Support TLS certificate auto-generation using certmanager #17238

dungdm93 · 2021-08-25T11:22:16Z

This is fourth part of #16792 that add support tls autogen using cert-manager

cert-manager (under CNCF umbrella) has become de-facto way to create and manage certificates.
Compare to other methods that cilium chart currently supported, this has some advantages:

Support multiple issuers: CA, Vault, Let's encrypt, Google CAS,...
Auto-renew certificate when it pass 2/3 life time.
Manage cert via a CRD resource, which show much more easier than inspect the PEM file.

kaworu

Hello @dungdm93 and thank you for the PR!

I have some suggestions that were required for me to test the PR. Once fixed, here are some steps I did using a kind cluster.

install cert-manager

$ kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.3/cert-manager.yaml

Now here we have a "chicken and egg problem": Because the Nodes are in NotReady state waiting on the CNI, cert-manager Pods are in Pending state waiting on the Nodes:

$ kubectl describe -n cert-manager pod -l app.kubernetes.io/name=cert-manager
…
Events:
  Type     Reason            Age                 From               Message
  ----     ------            ----                ----               -------
  Warning  FailedScheduling  24s (x13 over 12m)  default-scheduler  0/3 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate, 2 node(s) had taint {node.kubernetes.io/not-ready: }, that the pod didn't tolerate.

Issuer

Configure a CA issuer named hubble-ca (inspired from #15443 (comment)):

$ cat <<EOF > hubble-ca-issuer.yaml
---
apiVersion: v1
kind: Secret
metadata:
  name: hubble-ca-keypair
  namespace: kube-system
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUMrVENDQWVHZ0F3SUJBZ0lKQUtQR3dLRGwvNUhuTUEwR0NTcUdTSWIzRFFFQkN3VUFNQk14RVRBUEJnTlYKQkFNTUNHcHZjMmgyWVc1c01CNFhEVEU1TURneU1qRTJNRFUxT0ZvWERUSTVNRGd4T1RFMk1EVTFPRm93RXpFUgpNQThHQTFVRUF3d0lhbTl6YUhaaGJtd3dnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCCkFRQ3doU0IvcVc2L2tMYjJ6cHUrRUp2RDl3SEZhcStRQS8wSkgvTGxseW83ekFGeCtISHErQ09BYmsrQzhCNHQKL0hVRXNuczVSTDA5Q1orWDRqNnBiSkZkS2R1UHhYdTVaVllua3hZcFVEVTd5ZzdPU0tTWnpUbklaNzIzc01zMApSNmpZbi9Ecmo0eFhNSkVmSFVEcVllU1dsWnIzcWkxRUZhMGM3ZlZEeEgrNHh0WnROTkZPakg3YzZEL3ZXa0lnCldRVXhpd3Vzc2U2S01PV2pEbnYvNFZyamVsMlFnVVlVYkhDeWVaSG1jdGkrSzBMV0Nmby9SZzZQdWx3cmJEa2gKam1PZ1l0MzBwZGhYME9aa0F1a2xmVURIZnA4YmpiQ29JMnRhWUFCQTZBS2pLc08zNUxBRVU3OUNMMW1MVkh1WgpBQ0k1VWppamEzVlBXVkhTd21KUEp5dXhBZ01CQUFHalVEQk9NQjBHQTFVZERnUVdCQlFtbDVkVEFaaXhGS2hqCjkzd3VjUldoYW8vdFFqQWZCZ05WSFNNRUdEQVdnQlFtbDVkVEFaaXhGS2hqOTN3dWNSV2hhby90UWpBTUJnTlYKSFJNRUJUQURBUUgvTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFCK2tsa1JOSlVLQkxYOHlZa3l1VTJSSGNCdgpHaG1tRGpKSXNPSkhac29ZWGRMbEcxcFpORmpqUGFPTDh2aDQ0Vmw5OFJoRVpCSHNMVDFLTWJwMXN1NkNxajByClVHMWtwUkJlZitJT01UNE1VN3ZSSUNpN1VPbFJMcDFXcDBGOGxhM2hQT2NSYjJ5T2ZGcVhYeVpXWGY0dDBCNDUKdEhpK1pDTkhCOUZ4alNSeWNiR1lWaytUS3B2aEphU1lOTUdKM2R4REthUDcrRHgzWGNLNnNBbklBa2h5SThhagpOVSttdzgvdG1Sa1A0SW4va1hBUitSaTBxVW1Iai92d3ZuazRLbTdaVXkxRllIOERNZVM1TmtzbisvdUhsUnhSClY3RG5uMDM5VFJtZ0tiQXFONzJnS05MbzVjWit5L1lxREFZSFlybjk4U1FUOUpEZ3RJL0svQVRwVzhkWAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBc0lVZ2Y2bHV2NUMyOXM2YnZoQ2J3L2NCeFdxdmtBUDlDUi95NVpjcU84d0JjZmh4CjZ2Z2pnRzVQZ3ZBZUxmeDFCTEo3T1VTOVBRbWZsK0krcVd5UlhTbmJqOFY3dVdWV0o1TVdLVkExTzhvT3praWsKbWMwNXlHZTl0N0RMTkVlbzJKL3c2NCtNVnpDUkh4MUE2bUhrbHBXYTk2b3RSQld0SE8zMVE4Ui91TWJXYlRUUgpUb3grM09nLzcxcENJRmtGTVlzTHJMSHVpakRsb3c1Ny8rRmE0M3Bka0lGR0ZHeHdzbm1SNW5MWXZpdEMxZ242ClAwWU9qN3BjSzJ3NUlZNWpvR0xkOUtYWVY5RG1aQUxwSlgxQXgzNmZHNDJ3cUNOcldtQUFRT2dDb3lyRHQrU3cKQkZPL1FpOVppMVI3bVFBaU9WSTRvMnQxVDFsUjBzSmlUeWNyc1FJREFRQUJBb0lCQUNFTkhET3JGdGg1a1RpUApJT3dxa2UvVVhSbUl5MHlNNHFFRndXWXBzcmUxa0FPMkFDWjl4YS96ZDZITnNlanNYMEM4NW9PbmtrTk9mUHBrClcxVS94Y3dLM1ZpRElwSnBIZ09VNzg1V2ZWRXZtU3dZdi9Fb1V3eHFHRVMvcnB5Z1drWU5WSC9XeGZGQlg3clMKc0dmeVltbXJvM09DQXEyLzNVVVFiUjcrT09md3kzSHdUdTBRdW5FSnBFbWU2RXdzdWIwZzhTTGp2cEpjSHZTbQpPQlNKSXJyL1RjcFRITjVPc1h1Vm5FTlVqV3BBUmRQT1NrRFZHbWtCbnkyaVZURElST3NGbmV1RUZ1NitXOWpqCmhlb1hNN2czbkE0NmlLenUzR0YwRWhLOFkzWjRmeE42NERkbWNBWnphaU1vMFJVaktWTFVqbVlQSEUxWWZVK3AKMkNYb3dNRUNnWUVBMTgyaU52UEkwVVlWaUh5blhKclNzd1YrcTlTRStvVi90U2ZSUUNGU2xsV0d3KzYyblRiVwpvNXpoL1RDQW9VTVNSbUFPZ0xKWU1LZUZ1SWdvTEoxN1pvWjN0U1czTlVtMmRpT0lPSHorcTQxQzM5MDRrUzM5CjkrYkFtVmtaSFA5VktLOEMraS9tek5mSkdHZEJadGIweWtTM2t3OUIxTHdnT3o3MDhFeXFSQ2tDZ1lFQTBXWlAKbzF2MThnV2tMK2FnUDFvOE13eDRPZlpTN3dKY3E0Z0xnUWhjYS9pSkttY0x0RFN4cUJHckJ4UVo0WTIyazlzdQpzTFVrNEJobGlVM29iUUJNaUdtMGtITHVBSEFRNmJvdWZBMUJwZjN2VFdHSkhSRjRMeFJsNzc2akw4UXI4VnpxClpURVBtY0R0T0hpYjdwb2I1Z2IzSDhiVGhYeUhmdGZxRW55alhFa0NnWUVBdk9DdDZZclZhTlQrWThjMmRFYk4Kd3dJOExBaUZtdjdkRjZFUjlCODJPWDRCeGR0WTJhRDFtNTNqN2NaVnpzNzFYOE1TN25FcDN1dkFqaElkbDI3KwpZbTJ1dUUyYVhIbDN5VTZ3RzBETFpUcnVIU0Z5TVI4ZithbHRTTXBDd0s1NXluSGpHVFp6dXpYaVBBbWpwRzdmCk1XbVRncE1IK3puc3UrNE9VNFBHUW9FQ2dZQWNqdUdKbS84YzlOd0JsR2lDZTJIK2JGTHhSTURteStHcm16QkcKZHNkMENqOWF3eGI3aXJ3MytjRGpoRUJMWExKcjA5YTRUdHdxbStrdElxenlRTG92V0l0QnNBcjVrRThlTVVBcAp0djBmRUZUVXJ0cXVWaldYNWlaSTNpMFBWS2ZSa1NSK2pJUmVLY3V3aWZKcVJpWkw1dU5KT0NxYzUvRHF3Yk93CnRjTHAwUUtCZ0VwdEw1SU10Sk5EQnBXbllmN0F5QVBhc0RWRE9aTEhNUGRpL2dvNitjSmdpUmtMYWt3eUpjV3IKU25QSG1TbFE0aEluNGMrNW1lbHBDWFdJaklLRCtjcTlxT2xmQmRtaWtYb2RVQ2pqWUJjNnVGQ1QrNWRkMWM4RwpiUkJQOUNtWk9GL0hOcHN0MEgxenhNd1crUHk5Q2VnR3hhZ0ZCekxzVW84N0xWR2h0VFFZCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: hubble-ca
  namespace: kube-system
spec:
  ca:
    secretName: hubble-ca-keypair
EOF
$ kubectl apply -f hubble-ca-issuer.yaml
secret/hubble-ca-keypair created
Error from server (InternalError): error when creating "hubble-ca-issuer.yaml": Internal error occurred: failed calling webhook "webhook.cert-manager.io": Post "https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s": dial tcp 10.31.2.53:443: connect: connection refused

Here the Secret is created, but the Issuer creation failed.

Install Cilium

Install using the certgen method:

$ helm install cilium ./install/kubernetes/cilium \
--namespace kube-system \
--set image.tag=stable \
--set hubble.relay.image.tag=stable \
--set hubble.ui.backend.image.tag=stable \
--set hubble.ui.frontend.image.tag=stable \
--set operator.image.tag=stable \
--set preflight.image.tag=stable \
--set clustermesh.apiserver.image.tag=latest \
--set nodeinit.enabled=true \
--set kubeProxyReplacement=partial \
--set hostServices.enabled=false \
--set externalIPs.enabled=true \
--set nodePort.enabled=true \
--set hostPort.enabled=true \
--set bpf.masquerade=false \
--set image.pullPolicy=IfNotPresent \
--set ipam.mode=kubernetes \
--set hubble.relay.enabled=true \
--set hubble.tls.auto.method=certmanager \
--set clustermesh.apiserver.tls.auto.method=certmanager \
--set hubble.tls.auto.certManagerIssuerRef.name=hubble-ca \
--set clustermesh.apiserver.tls.auto.certManagerIssuerRef.name=hubble-ca
Error: Internal error occurred: failed calling webhook "webhook.cert-manager.io": Post "https://cert-manager-webhook.cert-manager.svc:443/mutate?timeout=10s": dial tcp 10.31.2.53:443: connect: connection refused

Now at that point all Pods but the Relay Pod are eventually in a Running state, but the TLS Secrets couldn't be created:

$ kubectl logs -n kube-system ds/cilium  | grep subsys=hubble
Found 3 pods, using pod/cilium-4p7xv
level=info msg="Configuring Hubble server" eventQueueSize=8192 maxFlows=4095 subsys=hubble
level=info msg="Starting local Hubble server" address="unix:///var/run/cilium/hubble.sock" subsys=hubble
level=info msg="Waiting for Hubble server TLS certificate and key files to be created" subsys=hubble
$ kubectl describe pod -n kube-system -l k8s-app=hubble-relay
…
Events:
  Type     Reason            Age                    From               Message
  ----     ------            ----                   ----               -------
  Warning  FailedMount       3m49s (x2 over 8m18s)  kubelet            Unable to attach or mount volumes: unmounted volumes=[tls], unattached volumes=[tls hubble-sock-dir config]: timed out waiting for the condition
  Warning  FailedMount       95s (x2 over 6m4s)     kubelet            Unable to attach or mount volumes: unmounted volumes=[tls], unattached volumes=[hubble-sock-dir config tls]: timed out waiting for the condition
  Warning  FailedMount       5s (x13 over 10m)      kubelet            MountVolume.SetUp failed for volume "tls" : secret "hubble-relay-client-certs" not found

Fixing the TLS stuff

Re-creating the Issuer would now work:

$ kubectl apply -f hubble-ca-issuer.yaml
secret/hubble-ca-keypair unchanged
issuer.cert-manager.io/hubble-ca created

Forcing an upgrade would re-try to create the certificate requests:

$ helm upgrade cilium ./install/kubernetes/cilium \
--namespace kube-system \
--set image.tag=stable \
--set hubble.relay.image.tag=stable \
--set hubble.ui.backend.image.tag=stable \
--set hubble.ui.frontend.image.tag=stable \
--set operator.image.tag=stable \
--set preflight.image.tag=stable \
--set clustermesh.apiserver.image.tag=latest \
--set nodeinit.enabled=true \
--set kubeProxyReplacement=partial \
--set hostServices.enabled=false \
--set externalIPs.enabled=true \
--set nodePort.enabled=true \
--set hostPort.enabled=true \
--set bpf.masquerade=false \
--set image.pullPolicy=IfNotPresent \
--set ipam.mode=kubernetes \
--set hubble.relay.enabled=true \
--set hubble.tls.auto.method=certmanager \
--set clustermesh.apiserver.tls.auto.method=certmanager \
--set hubble.tls.auto.certManagerIssuerRef.name=hubble-ca \
--set clustermesh.apiserver.tls.auto.certManagerIssuerRef.name=hubble-ca
Release "cilium" has been upgraded. Happy Helming!
NAME: cilium
LAST DEPLOYED: Mon Aug 30 17:11:10 2021
NAMESPACE: kube-system
STATUS: deployed
REVISION: 2
TEST SUITE: None
NOTES:
You have successfully installed Cilium with Hubble Relay.

Your release version is 1.10.90.

For any further help, visit https://docs.cilium.io/en/v1.10/gettinghelp

Now eventually all TLS Secrets are created, and both Hubble and Relay are up.

tl;dr

I have no clue how to handle the fact that cert-manager needs the CNI to be initialized, but This PR invoke cert-manager's Certificate CRD creation (requiring cert-manager to be ready) when we install Cilium.

install/kubernetes/cilium/templates/clustermesh-apiserver/tls-certmanager/client-secret.yaml

install/kubernetes/cilium/templates/clustermesh-apiserver/tls-certmanager/remote-secret.yaml

install/kubernetes/cilium/templates/clustermesh-apiserver/tls-certmanager/server-secret.yaml

install/kubernetes/cilium/templates/hubble/tls-certmanager/relay-client-secret.yaml

install/kubernetes/cilium/templates/hubble/tls-certmanager/server-secret.yaml

install/kubernetes/cilium/templates/hubble/tls-certmanager/ui-client-certs.yaml

seanmwinn · 2021-08-30T16:06:04Z

To be sure the cilium containers can start prior to cert-manager deploying the certificates, its required that volume mounts that target those secrets are mounted as projected:

https://github.com/cilium/cilium/blob/master/install/kubernetes/cilium/templates/hubble-relay/deployment.yaml#L111-L121

kaworu · 2021-08-31T08:03:41Z

@dungdm93 thanks for addressing the suggestions. However, I think there is a fundamental problem here as we can't expect cert-manager to be functional without network, and thus the Certificate request will fail when we helm install Cilium. Additionally, cert-manager require to setup Issuer(s) as well, and in that sense it isn't an auto method.

Since there are many ways to setup cert-manager, I think the issue is primarily a documentation issue (we have #13590 to track it).

dungdm93 · 2021-08-31T08:08:25Z

Hello @kaworu, it's not exactly chicken-and-egg problem.
In cilium-agent, hubble-server-certs volume defined as optional.

cilium/install/kubernetes/cilium/templates/cilium-agent/daemonset.yaml

Lines 575 to 587 in 1695d9c

    
           - name: hubble-tls 
        
             projected: 
        
               sources: 
        
               - secret: 
        
                   name: hubble-server-certs 
        
                   optional: true 
        
                   items: 
        
                   - key: ca.crt 
        
                     path: client-ca.crt 
        
                   - key: tls.crt 
        
                     path: server.crt 
        
                   - key: tls.key 
        
                     path: server.key

So, cilium-agent can be start without TLS and the startup order will be following:

cilium-agent start
Nodes become Ready
cert-manager launch
certificates secret is created
secret automatically mount to cilium-agent without restart (may take a few minute delay)
other components like hubble, clustermesh start

Your above problem come from cert-manager webhook, not cilium or cert-manager it self.
There are several ways to overcome above issue:

Option 1: Install cert-manager without Validation Webhook (you should use pure k8s manifests, cert-manager helm don't have option to disable webhook). You can also enable it later.
Option 2: install cert-manager with webhook.hostNetwork=true
Option 3: Install cilium without TLS first:
1. helm install cilium without TLS
2. helm install cert-manager
3. waiting for node ready, and cert-manager available
4. helm upgrade cilium with TLS

In the CI/CD environment, I think option 2 is most suitable.

kaworu · 2021-08-31T08:34:56Z

@dungdm93 Thank you for the explanation!

I feel like we still need to address #13590, as there are multiple non-trivial options. Would you mind updating the documentation in this PR?

dungdm93 · 2021-08-31T08:50:21Z

Additionally, cert-manager require to setup Issuer(s) as well, and in that sense it isn't an auto method.

I don't think so, issuer is in cert-manager part, not cilium. And auto mean certificates is not create and manage, renew,... manually.

Would you mind updating the documentation in this PR?

Yes. Where should I update the document?

kaworu · 2021-08-31T10:22:46Z

Yes. Where should I update the document?

It is under the Documentation/ directory. You can make -C Documentation live-preview to see the changes you are making.

seanmwinn · 2021-09-03T17:26:23Z

Additionally, cert-manager require to setup Issuer(s) as well, and in that sense it isn't an auto method.

I don't think so, issuer is in cert-manager part, not cilium. And auto mean certificates is not create and manage, renew,... manually.

Would you mind updating the documentation in this PR?

Yes. Where should I update the document?

The user needs to create an issuer that can issue certificates with our cilium.io internal domain names along with the associated certificate requests. My clusters include the following:

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned
spec:
  selfSigned: {}

apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: cilium-ca
  namespace: kube-system
spec:
  ca:
    secretName: cilium-ca-cert

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: cilium-ca-cert
  namespace: kube-system
spec:
  secretName: cilium-ca-cert
  dnsNames:
    - '*.cilium.io'
    - cilium.io
  keyAlgorithm: ecdsa
  keySize: 384
  isCA: true
  issuerRef:
    name: selfsigned
    kind: ClusterIssuer

These are very specific to CIlium and not a part of cert-manager installation.

dungdm93 · 2021-09-06T06:46:08Z

Hello @kaworu, I just update docs on Documentation/concepts/observability/hubble-configuration.rst. Could you please take a look

dungdm93 · 2021-09-06T06:51:55Z

@seanmwinn actually, you don't need create a dedicated issuer for cilium.

For example in my org, we use a Vault issuer to manage all private certificates (not only for cilium) in multiple environments and clusters as well. And as I mention above, setup issuer should not be in scope of cilium.

kaworu

Thanks for updating the documentation @dungdm93! I have some comments but overall it's great.

Documentation/concepts/observability/hubble-configuration.rst

dungdm93 · 2021-09-06T10:35:40Z

@kaworu update as your suggestion

kaworu · 2021-09-07T09:22:46Z

Thank you @dungdm93! There is one missed but other than that LGTM.

Some warnings that need to be fixed from the deploy/netlify build:

12:34:33 PM: /opt/build/repo/Documentation/concepts/observability/hubble-configuration.rst:11: WARNING: Duplicate explicit target name: "cert-manager".
12:34:33 PM: /opt/build/repo/Documentation/concepts/observability/hubble-configuration.rst:114: WARNING: Enumerated list ends without a blank line; unexpected unindent.
12:34:33 PM: /opt/build/repo/Documentation/concepts/observability/hubble-configuration.rst:115: WARNING: Block quote ends without a blank line; unexpected unindent.

Documentation/concepts/observability/hubble-configuration.rst

gandro · 2021-09-20T07:43:38Z

test-me-please

Job 'Cilium-PR-K8s-1.16-net-next' hit: #17437 (97.22% similarity)

joestringer

Sorry, I missed a couple of other minor formatting issues and I have one question about issuer.yaml below.

Documentation/concepts/observability/hubble-configuration.rst

joestringer · 2021-09-20T18:00:11Z

Documentation/concepts/observability/hubble-configuration.rst

+.. code-block:: bash
+
+    # We assum cilium installed in kube-system namespace
+    kubectl label namespace kube-system cert-manager.io/disable-validation=true
+
+    helm install cert-manager ...
+    kubectl apply -f issuer.yaml
+    helm install cilium ...


For these ones, if you want to format them as a shell-session then you need to do:

Suggested change

.. code-block:: bash

# We assum cilium installed in kube-system namespace

kubectl label namespace kube-system cert-manager.io/disable-validation=true

helm install cert-manager ...

kubectl apply -f issuer.yaml

helm install cilium ...

.. code-block:: shell-session

$ # We assume cilium installed in kube-system namespace

$ kubectl label namespace kube-system cert-manager.io/disable-validation=true

$ helm install cert-manager ...

$ kubectl apply -f issuer.yaml

$ helm install cilium ...

Also, looking at these snippets, I see issuer.yaml mentioned but I'm not sure where that comes from. How does the user generate issuer.yaml?

@joestringer I also add a note that where issuer.yaml is come from.

joestringer

LGTM, thanks!

oblazek

small nits :)

Documentation/concepts/observability/hubble-configuration.rst

kaworu · 2021-09-24T08:37:59Z

test-me-please

Job 'Cilium-PR-K8s-1.19-kernel-5.4' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sDatapathConfig AutoDirectNodeRoutes Check connectivity with sockops and direct routing

Failure Output

FAIL: Error creating resource /home/jenkins/workspace/Cilium-PR-K8s-1.19-kernel-5.4/src/github.com/cilium/cilium/test/k8sT/manifests/l3-policy-demo.yaml: Cannot retrieve cilium pod cilium-mb6dk policy revision: cannot get revision from json output '': could not parse JSON from command "kubectl exec -n kube-system cilium-mb6dk -- cilium policy get -o json"

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.19-kernel-5.4 so I can create a new GitHub issue to track it.

Job 'Cilium-PR-K8s-1.16-net-next' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sChaosTest Connectivity demo application Endpoint can still connect while Cilium is not running

Failure Output

FAIL: DNS entry is not ready after timeout

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.16-net-next so I can create a new GitHub issue to track it.

Signed-off-by: Đặng Minh Dũng <dungdm93@live.com>

create CA issuer when certManagerIssuerRef is not specify Signed-off-by: Đặng Minh Dũng <dungdm93@live.com>

joestringer · 2021-09-24T17:47:59Z

/test

joestringer · 2021-09-27T22:51:19Z

test-1.16-net-next run hit #14598.
test-1.19-5.4 run hit #16852.
BPF checks don't like empty commit content and would prefer an explanation, but that's fine to ignore.

CI 3.0 runs didn't trigger for some reason, retriggering manually.

joestringer · 2021-09-27T22:51:41Z

/ci-gke

joestringer · 2021-09-27T22:52:32Z

/ci-eks

joestringer · 2021-09-27T22:52:40Z

/ci-aks

joestringer · 2021-09-27T22:52:49Z

/ci-awscni

joestringer · 2021-10-01T17:56:23Z

test-1.16-netnext job hit what looks like #17401, should be fixed recently in the master tree.
test-1.19-5.4 job hit #16852 .

Checkpatch warnings don't need to be addressed.

All reviews are in.

Ready to merge.

dungdm93 · 2021-10-02T02:32:02Z

Thanks @joestringer

It seems we forgot to update `helm-values.rst` in cilium#17238, yielding issues when building documentation locally with `make render-docs`. Signed-off-by: Nicolas Busseneau <nicolas@isovalent.com>

It seems we forgot to update `helm-values.rst` in #17238, yielding issues when building documentation locally with `make render-docs`. Signed-off-by: Nicolas Busseneau <nicolas@isovalent.com>

dungdm93 requested a review from a team as a code owner August 25, 2021 11:22

dungdm93 requested review from a team and errordeveloper August 25, 2021 11:22

maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Aug 25, 2021

maintainer-s-little-helper bot assigned errordeveloper Aug 25, 2021

gandro self-assigned this Aug 27, 2021

kaworu added the release-note/minor This PR changes functionality that users may find relevant to operating Cilium. label Aug 30, 2021

maintainer-s-little-helper bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Aug 30, 2021

kaworu requested a review from seanmwinn August 30, 2021 11:29

maintainer-s-little-helper bot assigned seanmwinn Aug 30, 2021

kaworu requested changes Aug 30, 2021

View reviewed changes

dungdm93 requested a review from kaworu August 31, 2021 08:18

maintainer-s-little-helper bot assigned kaworu Aug 31, 2021

dungdm93 requested a review from a team as a code owner September 6, 2021 06:43

dungdm93 requested a review from joestringer September 6, 2021 06:43

maintainer-s-little-helper bot assigned joestringer Sep 6, 2021

kaworu requested changes Sep 6, 2021

View reviewed changes

errordeveloper reviewed Sep 9, 2021

View reviewed changes

Documentation/concepts/observability/hubble-configuration.rst Outdated Show resolved Hide resolved

gandro approved these changes Sep 20, 2021

View reviewed changes

maintainer-s-little-helper bot unassigned gandro Sep 20, 2021

gandro added the area/helm Impacts helm charts and user deployment experience label Sep 20, 2021

maintainer-s-little-helper bot mentioned this pull request Sep 20, 2021

CI: K8sServicesTest Checks service across nodes Tests NodePort BPF Tests with direct routing Tests LoadBalancer Connectivity to endpoint via LB #17437

Closed

gandro requested a review from joestringer September 20, 2021 14:04

joestringer requested changes Sep 20, 2021

View reviewed changes

dungdm93 requested a review from joestringer September 23, 2021 09:48

joestringer approved these changes Sep 23, 2021

View reviewed changes

maintainer-s-little-helper bot unassigned joestringer Sep 23, 2021

oblazek reviewed Sep 24, 2021

View reviewed changes

dungdm93 added 2 commits September 24, 2021 16:19

docs: hubble install TLS config

6324980

Signed-off-by: Đặng Minh Dũng <dungdm93@live.com>

helm: ca issuer

e21d1b2

create CA issuer when certManagerIssuerRef is not specify Signed-off-by: Đặng Minh Dũng <dungdm93@live.com>

joestringer merged commit 082fa15 into cilium:master Oct 1, 2021

nbusseneau mentioned this pull request Oct 4, 2021

docs: fix docs following #17238 #17530

Merged

joestringer changed the title ~~support tls autogen using certmanager~~ Support TLS certificate auto-generation using certmanager Oct 4, 2021

joestringer mentioned this pull request Dec 3, 2021

Cilium upgrade with --reuse-values causes Helm to segfault #18115

Closed

2 tasks

Shunpoco mentioned this pull request Jan 4, 2023

Modify helm chart: delete validations for certManagerIssuerRef #22921

Merged

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support TLS certificate auto-generation using certmanager #17238

Support TLS certificate auto-generation using certmanager #17238

dungdm93 commented Aug 25, 2021

kaworu left a comment •

edited

seanmwinn commented Aug 30, 2021

kaworu commented Aug 31, 2021

dungdm93 commented Aug 31, 2021 •

edited

kaworu commented Aug 31, 2021

dungdm93 commented Aug 31, 2021

kaworu commented Aug 31, 2021

seanmwinn commented Sep 3, 2021 •

edited

dungdm93 commented Sep 6, 2021

dungdm93 commented Sep 6, 2021

kaworu left a comment •

edited

dungdm93 commented Sep 6, 2021

kaworu commented Sep 7, 2021 •

edited

gandro commented Sep 20, 2021 •

edited by maintainer-s-little-helper bot

joestringer left a comment

joestringer Sep 20, 2021

joestringer Sep 20, 2021

dungdm93 Sep 23, 2021

joestringer left a comment

oblazek left a comment

kaworu commented Sep 24, 2021 •

edited by maintainer-s-little-helper bot

Test Name

Failure Output

Test Name

Failure Output

joestringer commented Sep 24, 2021

joestringer commented Sep 27, 2021 •

edited

joestringer commented Sep 27, 2021

joestringer commented Sep 27, 2021

joestringer commented Sep 27, 2021

joestringer commented Sep 27, 2021

joestringer commented Oct 1, 2021

dungdm93 commented Oct 2, 2021

Support TLS certificate auto-generation using certmanager #17238

Support TLS certificate auto-generation using certmanager #17238

Conversation

dungdm93 commented Aug 25, 2021

kaworu left a comment • edited

Choose a reason for hiding this comment

install cert-manager

Issuer

Install Cilium

Fixing the TLS stuff

tl;dr

seanmwinn commented Aug 30, 2021

kaworu commented Aug 31, 2021

dungdm93 commented Aug 31, 2021 • edited

kaworu commented Aug 31, 2021

dungdm93 commented Aug 31, 2021

kaworu commented Aug 31, 2021

seanmwinn commented Sep 3, 2021 • edited

dungdm93 commented Sep 6, 2021

dungdm93 commented Sep 6, 2021

kaworu left a comment • edited

Choose a reason for hiding this comment

dungdm93 commented Sep 6, 2021

kaworu commented Sep 7, 2021 • edited

gandro commented Sep 20, 2021 • edited by maintainer-s-little-helper bot

joestringer left a comment

Choose a reason for hiding this comment

joestringer Sep 20, 2021

Choose a reason for hiding this comment

joestringer Sep 20, 2021

Choose a reason for hiding this comment

dungdm93 Sep 23, 2021

Choose a reason for hiding this comment

joestringer left a comment

Choose a reason for hiding this comment

oblazek left a comment

Choose a reason for hiding this comment

kaworu commented Sep 24, 2021 • edited by maintainer-s-little-helper bot

Test Name

Failure Output

Test Name

Failure Output

joestringer commented Sep 24, 2021

joestringer commented Sep 27, 2021 • edited

joestringer commented Sep 27, 2021

joestringer commented Sep 27, 2021

joestringer commented Sep 27, 2021

joestringer commented Sep 27, 2021

joestringer commented Oct 1, 2021

dungdm93 commented Oct 2, 2021

kaworu left a comment •

edited

dungdm93 commented Aug 31, 2021 •

edited

seanmwinn commented Sep 3, 2021 •

edited

kaworu left a comment •

edited

kaworu commented Sep 7, 2021 •

edited

gandro commented Sep 20, 2021 •

edited by maintainer-s-little-helper bot

kaworu commented Sep 24, 2021 •

edited by maintainer-s-little-helper bot

joestringer commented Sep 27, 2021 •

edited