ESO-186: Make the operator HTTP(s) proxy aware #62
+864
−22
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| labels: | ||
| app.kubernetes.io/managed-by: kustomize | ||
| app.kubernetes.io/name: external-secrets-operator | ||
| config.openshift.io/inject-trusted-cabundle: "true" | ||
| control-plane: controller-manager | ||
| name: external-secrets-operator-trusted-ca-bundle |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| apiVersion: apps/v1 | ||
| kind: Deployment | ||
| metadata: | ||
| name: controller-manager | ||
| namespace: system | ||
| spec: | ||
| template: | ||
| spec: | ||
| containers: | ||
| - name: manager | ||
| volumeMounts: | ||
| - name: trusted-ca-bundle | ||
| mountPath: /etc/pki/tls/certs | ||
| readOnly: true | ||
| volumes: | ||
chiragkyal marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| - name: trusted-ca-bundle | ||
| configMap: | ||
| name: trusted-ca-bundle | ||
|
There was a problem hiding this comment. 🧩 Analysis chainConfigMap name likely mismatched with the injected bundle manifest. This references ConfigMap "trusted-ca-bundle", while the PR context mentions creating "external-secrets-operator-trusted-ca-bundle". If the names differ, the volume will mount an empty/non‑existent CM at runtime. Apply this diff to align with the injected bundle name: configMap:
- name: trusted-ca-bundle
+ name: external-secrets-operator-trusted-ca-bundleRun this script to verify CM names across the repo and ensure consistency: 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== kustomization in config/manager =="
fd -t f kustomization.yaml | rg -n '^config/manager/.*' -n
rg -n -C2 'configMapGenerator|name:\s*trusted-ca-bundle|external-secrets-operator-trusted-ca-bundle' config/manager/kustomization.yaml || true
echo "== CM manifests mentioning trusted CA bundle =="
fd -H -t f '.*(trusted|ca-bundle).*\.ya?ml' | rg -n -C2 'external-secrets-operator-trusted-ca-bundle|trusted-ca-bundle' || trueLength of output: 375 Align ConfigMap name to the injected bundle
🤖 Prompt for AI Agents |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,86 @@ | ||
| package external_secrets | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| corev1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
|
|
||
| operatorv1alpha1 "github.com/openshift/external-secrets-operator/api/v1alpha1" | ||
| ) | ||
|
|
||
| // ensureTrustedCABundleConfigMap creates or ensures the trusted CA bundle ConfigMap exists | ||
| // in the operand namespace when proxy configuration is present. The ConfigMap is labeled | ||
| // with the injection label required by the Cluster Network Operator (CNO), which watches | ||
| // for this label and injects the cluster's trusted CA bundle into the ConfigMap's data. | ||
| // This function ensures the correct labels are present so that CNO can manage the CA bundle | ||
| // content as expected. | ||
| func (r *Reconciler) ensureTrustedCABundleConfigMap(esc *operatorv1alpha1.ExternalSecretsConfig, resourceLabels map[string]string) error { | ||
| proxyConfig := r.getProxyConfiguration(esc) | ||
|
|
||
| // Only create ConfigMap if proxy is configured | ||
| if proxyConfig == nil { | ||
| return nil | ||
| } | ||
|
|
||
| namespace := getNamespace(esc) | ||
| expectedLabels := getTrustedCABundleLabels(resourceLabels) | ||
|
|
||
| configMap := &corev1.ConfigMap{ | ||
| ObjectMeta: metav1.ObjectMeta{ | ||
| Name: trustedCABundleConfigMapName, | ||
| Namespace: namespace, | ||
| Labels: expectedLabels, | ||
| }, | ||
| } | ||
|
|
||
| // Check if the ConfigMap already exists | ||
| existingConfigMap := &corev1.ConfigMap{} | ||
| exist, err := r.Exists(r.ctx, client.ObjectKeyFromObject(configMap), existingConfigMap) | ||
| if err != nil { | ||
| return fmt.Errorf("failed to check if trusted CA bundle ConfigMap exists: %w", err) | ||
| } | ||
|
|
||
| if !exist { | ||
| // Create the ConfigMap | ||
| if err := r.Create(r.ctx, configMap); err != nil { | ||
| return fmt.Errorf("failed to create trusted CA bundle ConfigMap: %w", err) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // ConfigMap exists, ensure it has the correct labels | ||
| // Do not update the data of the ConfigMap since it is managed by CNO | ||
| if existingConfigMap.Labels == nil { | ||
| existingConfigMap.Labels = make(map[string]string) | ||
| } | ||
|
|
||
| expectedLabels = getTrustedCABundleLabels(resourceLabels) | ||
| needsUpdate := false | ||
| for k, expectedValue := range expectedLabels { | ||
| if existingValue, exists := existingConfigMap.Labels[k]; !exists || existingValue != expectedValue { | ||
| existingConfigMap.Labels[k] = expectedValue | ||
| needsUpdate = true | ||
| } | ||
| } | ||
|
|
||
| // Update the ConfigMap if any labels changed | ||
| if needsUpdate { | ||
| if err := r.Update(r.ctx, existingConfigMap); err != nil { | ||
| return fmt.Errorf("failed to update trusted CA bundle ConfigMap labels: %w", err) | ||
| } | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| // getTrustedCABundleLabels merges resource labels with the injection label | ||
| func getTrustedCABundleLabels(resourceLabels map[string]string) map[string]string { | ||
| labels := make(map[string]string) | ||
| for k, v := range resourceLabels { | ||
| labels[k] = v | ||
| } | ||
| labels[trustedCABundleInjectLabel] = "true" | ||
| return labels | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.