OSASINFRA-3731: openstack: Consume CA cert from CCO secret #359
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@stephenfin: This pull request references OSASINFRA-3731 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
the
do-not-merge/hold
|
@stephenfin: This pull request references OSASINFRA-3731 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
stephenfin
force-pushed
the
OSASINFRA-3731
branch
3 times, most recently
from
e11d83d to
7aa9bc9
Compare
|
/retest |
|
/unhold openshift/cloud-credential-operator#780 is merged |
openshift-ci
bot
removed
the
do-not-merge/hold
|
@stephenfin: This pull request references OSASINFRA-3731 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest openshift/cluster-storage-operator#557 has merged |
|
I will investigate these failures tomorrow. Hopefully just a case of the payload not pulling in the CSO change yet 🤞 |
stephenfin
force-pushed
the
OSASINFRA-3731
branch
from
7aa9bc9 to
2ab019e
Compare
|
This is failing because the |
stephenfin
force-pushed
the
OSASINFRA-3731
branch
from
2ab019e to
4cb9b04
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: stephenfin The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
/retest-required |
This at least tells you what the secret is for. Signed-off-by: Stephen Finucane <[email protected]>
Signed-off-by: Stephen Finucane <[email protected]>
Put it in a more usual place. Signed-off-by: Stephen Finucane <[email protected]>
This is going to be superseded in a coming change. Rename it in preparation. Signed-off-by: Stephen Finucane <[email protected]>
In this change, we modify the assets to start (optionally) mounting the CA cert from the secret in the containers. We leave a fallback in place for the old config map source to allow time for the cloud-credential-operator to update things in an upgrade scenario. This fallback can be removed in 4.20, as noted by the copious TODOs. Signed-off-by: Stephen Finucane <[email protected]>
cloud-credential-operator and hypershift-operator now support deploying the CA cert to the credentials secrets they generate, which means we can start consuming them from there rather than from configuration. In this change, we modify the controller to start (optionally) consuming the CA cert from the secret. We leave a fallback in place for the old config map source to allow time for the cloud-credential-operator to update things in an upgrade scenario. This fallback can be removed in 4.22, as noted by the copious TODOs. Signed-off-by: Stephen Finucane <[email protected]>
This is going to be superseded in a coming change. Rename it in preparation. Signed-off-by: Stephen Finucane <[email protected]>
Again, do what we already did for openstack-cinder but for openstack-manila. Like the openstack-cinder change, we continue to allow consuming from the old location to ease upgrades. It's worth highlighting that this is a nice little step towards having the Manila CSI driver and controller source their credentials from a 'clouds.yaml' rather than a 'cloud.conf' file, which would let us remove a lot of logic currently found in the operator. Completing that effort is a job best left to another day though so a TODO is included for now. Signed-off-by: Stephen Finucane <[email protected]>
Do what we previously did for the openstack-cinder controller but for the openstack-manila controller. In effect, we're really just reflecting the changes made in cluster-storage-operator in [1]. However, we do need to add some logic to detect where we are consuming our CA cert from so that we can match forthcoming changes to our assets. While here, we also replace use of the deprecated `ioutil.ReadFile` function in favour of its suggested replacement, `os.ReadFile` [2]. We also replace use of `os.IsNotExist` in favour of its suggested replacement, `errors.Is(err, fs.ErrNotExist)` [3]. [1] github.com/openshift/cluster-storage-operator/pull/557 [2] https://pkg.go.dev/io/ioutil#ReadFile [3] https://pkg.go.dev/os#IsNotExist Signed-off-by: Stephen Finucane <[email protected]>
stephenfin
force-pushed
the
OSASINFRA-3731
branch
from
4cb9b04 to
0b2d16a
Compare
|
/hold I am investigating the failures |
openshift-ci
bot
added
the
do-not-merge/hold
|
@stephenfin: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
In openshift/cloud-credential-operator/pull/780, we have added the ability for
cloud-credential-operatorto consume a CA cert from the root credentials secret and to include in the credentials secrets it provisions.In openshift/installer/pull/9194, we have modified the Installer to start setting this field where necessary.
In openshift/cluster-storage-operator/pull/557, we modified cluster-storage-operator to pass this CA cert through to the
csi-operatorwhen present.Adapt the assets and controllers for both the openstack-cinder and openstack-manila CSI drivers to start consuming this field, where present. We maintain fallbacks for the previous locations of the cert for now, but these can be removed in the next release.
This needs to wait for the CCO change to be approved before we merge this. It also needs the CSO change to merge first.
Dependencies:
/hold