Make caBundle available to kubermatic-api when it is configured but n…

[erdii]

What this PR does / why we need it: Make caBundle available to kubermatic-api when it is configured but no OIDCKubeCfgEndpoint feature-flag is set.

This enables users to use a custom root CA for dex.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Documentation:

Does this PR introduce a user-facing change?:

Always mount CABundle for Dex into the kubermatic-api, even when `OIDCKubeCfgEndpoint` is disabled.

[xrstf]

Please ensure that the kubermatic Helm chart behaves the same way.

[erdii]

/retest

[erdii]

git diff HEAD~

diff --git a/charts/kubermatic/Chart.yaml b/charts/kubermatic/Chart.yaml
index 2f1e7ee5f..7c97a8aeb 100644
--- a/charts/kubermatic/Chart.yaml
+++ b/charts/kubermatic/Chart.yaml
@@ -14,7 +14,7 @@
 
 apiVersion: v1
 name: kubermatic
-version: 1.1.15
+version: 1.1.16
 appVersion: '__KUBERMATIC_TAG__'
 description: Kubermatic chart for master and/or seed clusters.
 keywords:
diff --git a/charts/kubermatic/templates/kubermatic-api-dep.yaml b/charts/kubermatic/templates/kubermatic-api-dep.yaml
index 0061a3525..11a3f110a 100644
--- a/charts/kubermatic/templates/kubermatic-api-dep.yaml
+++ b/charts/kubermatic/templates/kubermatic-api-dep.yaml
@@ -71,11 +71,11 @@ spec:
         - -accessible-addons={{- (.Files.Get "static/master/accessible-addons.yaml" | fromYaml).addons | join "," }}
         {{- end }}
         - -feature-gates={{ .Values.kubermatic.api.featureGates }}
-        # the following flags enable oidc kubeconfig feature/endpoint
-        {{- if regexMatch ".*OIDCKubeCfgEndpoint=true.*" (default "" .Values.kubermatic.api.featureGates) }}
         {{- if .Values.kubermatic.auth.caBundle }}
         - -oidc-ca-file=/opt/dex-ca/caBundle.pem
         {{- end }}
+        # the following flags enable oidc kubeconfig feature/endpoint
+        {{- if regexMatch ".*OIDCKubeCfgEndpoint=true.*" (default "" .Values.kubermatic.api.featureGates) }}
         - -oidc-issuer-redirect-uri={{ .Values.kubermatic.auth.issuerRedirectURL }}
         - -oidc-issuer-client-id={{ .Values.kubermatic.auth.issuerClientID }}
         - -oidc-issuer-client-secret={{ .Values.kubermatic.auth.issuerClientSecret }}

[2020-09-30T15:24:04+0000] Chart kubermatic was modified but its version (1.1.16) was not changed. Please adjust charts/kubermatic/Chart.yaml.

I am confused...

[xrstf]

[2020-09-30T15:24:04+0000] Chart kubermatic was modified but its version (1.1.16) was not changed. Please adjust charts/kubermatic/Chart.yaml.
I am confused...

@erdii Since you opened your PR, another PR got merged that bumped the version in master branch to 1.1.16 already. So you have to bump even harder.

[xrstf]

/approve

[kubermatic-bot]

LGTM label has been added.

Git tree hash: c5a6e03842eef100b55f3c2793c15cf37994193e

[kubermatic-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: erdii, xrstf

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [xrstf]
• pkg/controller/OWNERS [xrstf]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[xrstf]

/cherrypick release/v2.15

[kubermatic-bot]

@xrstf: new pull request created: #6010

In response to this:

/cherrypick release/v2.15

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.