Try to find and verify existing OIDC providers before we try to create a new one #2901

codablock · 2021-11-01T16:38:37Z

What type of PR is this?
/kind bug

What this PR does / why we need it:
When moving clusters between management clusters, ControlPlane.Status.OIDCProvider.ARN
is lost. The new management cluster must then pickup the already existing
cluster, as otherwise it tries to create the same provider again and then
fails.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

Checklist:

squashed commits
includes documentation
adds unit tests
adds or updates e2e tests

Release note:

Try to find and verify existing OIDC providers before we try to create a new one

k8s-ci-robot · 2021-11-01T16:38:44Z

@codablock: This issue is currently awaiting triage.

If CAPA/CAPI contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot · 2021-11-01T16:38:46Z

Hi @codablock. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

randomvariable · 2021-11-02T17:56:10Z

/ok-to-test

richardcase · 2021-11-03T06:36:23Z

Shame we stored this in the status in the original implementation.

@codablock - do you see any potential issues (i.e. edge cases) with trying to to automatically find the oidc provider?

codablock · 2021-11-03T06:53:28Z

@richardcase I can't imagine any. I was first thinking that I could also try to update an existing OIDC provider's thumbprint ind client IDs, but then decided that I should not touch them as we can't know for sure WHY they would differ from the expected values...if they do, there is probably a good reason (e.g. manually created provider, for whatever reason).

codablock · 2021-12-14T08:40:08Z

@richardcase Any update on how to proceed with this PR?

k8s-triage-robot · 2022-03-14T09:06:25Z

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle stale
Mark this issue or PR as rotten with /lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

richardcase · 2022-03-15T14:48:34Z

/lifecycle frozen

This looks good to me. I can't imagine any issues with this myself. @sedefsavas - what do you think?

k8s-ci-robot · 2022-03-15T14:48:35Z

@richardcase: The lifecycle/frozen label cannot be applied to Pull Requests.

In response to this:

/lifecycle frozen

This looks good to me. I can't imagine any issues with this myself. @sedefsavas - what do you think?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

richardcase · 2022-04-11T11:44:09Z

@codablock - this looks good to me. Do you think there is anyway we can add a test around this functionality?

k8s-triage-robot · 2022-05-11T11:50:47Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue or PR as fresh with /remove-lifecycle rotten
Close this issue or PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

codablock · 2022-05-11T12:06:53Z

Unfortunately I'm a bit overloaded atm and won't find time to add tests.

richardcase · 2022-06-08T11:08:52Z

/help

Skarlso · 2022-09-29T20:13:38Z

This is a nightmare to test. :D

After I finally managed to get the HTTPS test server working with proper certs, now I'm in trouble with PatchObject... :D

Skarlso · 2022-09-29T20:20:38Z

Yesss!! Almost there. :D now trying to reconcile the LAST HURDLE. :D This part:

	if err := s.reconcileTrustPolicy(); err != nil {
		return errors.Wrap(err, "failed to reconcile trust policy in workload cluster")
	}

:D

Skarlso · 2022-09-29T20:29:55Z

OH. MY. GODS.

I0929 22:29:41.349199   66964 oidc.go:54] "Reconciling EKS OIDC Provider" cluster-name=0xc000200960
--- PASS: TestOIDCReconcile (0.05s)
    --- PASS: TestOIDCReconcile/cluster_create_with_no_OIDC_provider_present_yet_should_create_one (0.05s)
PASS

Edit: NOPE. My Kind test cluster was running and it connected to that. :(

Skarlso · 2022-09-29T21:19:04Z

Hah! I found a bug! :D :D Testing++++++

Skarlso · 2022-09-29T21:22:56Z

@richardcase @codablock This was DIFFICULT not gonna lie. :D But I added a test. :) And I found a bug where this was being done:

		if fmt.Sprintf("https://%s", *provider.Url) != issuerURL.String() {
			continue
		}

But the provider url MUST contain https already anyways so this errored. Now, was there a reason for this being there?
I can add a thing like, check if https is there and if not, append it. But the specification is telling me there should be https on the retrieved provider always. 🤷

Skarlso · 2022-09-30T04:58:57Z

TLS handshake error from 127.0.0.1:36514: remote error: tls: bad certificate

Sh*t. I was afraid of that. :/ The certificate is not installed/recognised by the local environment. So it doesn't like it.

…f another bug in Go

Skarlso · 2022-09-30T05:45:39Z

Dang it. This won't work. :( I have to find a different approach and mock the http client completely.

Skarlso · 2022-09-30T08:12:01Z

pkg/cloud/services/eks/service.go

+type ServiceOpts func(s *Service)
+
+// WithIAMClient creates an access spec with a custom http client.
+func WithIAMClient(client *http.Client) ServiceOpts {


Sadly, I can't create a legit https service because the certificate is not trusted. So I had to fall back to making the client mockable.

If anyone has a better idea, I'm all ears.

Also, I made this an option to minimise the impact on changing NewService.

Skarlso · 2022-09-30T08:19:42Z

pkg/cloud/services/eks/iam/iam.go

+}
+
+func fetchRootCAThumbprint(issuerURL string, client *http.Client) (string, error) {
+	// needed to appease noctx.


"Funny" how noctx never noticed "http.Get" but noticed client.Get immediately. Tsk, tsk, tsk.

Skarlso · 2022-10-01T08:16:06Z

This is now ready for review. :)

Skarlso · 2022-10-03T16:18:22Z

ping @Ankitasw as Richard is OOO. :))

Skarlso · 2022-10-12T06:38:27Z

/test ?

k8s-ci-robot · 2022-10-12T06:38:28Z

@Skarlso: The following commands are available to trigger required jobs:

/test pull-cluster-api-provider-aws-build
/test pull-cluster-api-provider-aws-test
/test pull-cluster-api-provider-aws-verify

The following commands are available to trigger optional jobs:

/test pull-cluster-api-provider-aws-apidiff-main
/test pull-cluster-api-provider-aws-e2e
/test pull-cluster-api-provider-aws-e2e-blocking
/test pull-cluster-api-provider-aws-e2e-clusterclass
/test pull-cluster-api-provider-aws-e2e-conformance
/test pull-cluster-api-provider-aws-e2e-conformance-with-ci-artifacts
/test pull-cluster-api-provider-aws-e2e-eks

Use /test all to run the following jobs that were automatically triggered:

pull-cluster-api-provider-aws-apidiff-main
pull-cluster-api-provider-aws-build
pull-cluster-api-provider-aws-test
pull-cluster-api-provider-aws-verify

In response to this:

/test ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Skarlso · 2022-10-12T06:39:09Z

/test pull-cluster-api-provider-aws-e2e-eks

Hmm, hmm, unsure if this passes oidc part. Probably not. But at least it will test that EKS didn't break. :)

Skarlso · 2022-10-19T09:51:10Z

/lgtm
/approve

k8s-ci-robot · 2022-10-19T09:51:26Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Skarlso

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Skarlso]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added kind/bug Categorizes issue or PR as related to a bug. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-priority labels Nov 1, 2021

k8s-ci-robot added needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 1, 2021

k8s-ci-robot requested review from Ankitasw and dlipovetsky November 1, 2021 16:38

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 2, 2021

codablock force-pushed the fix-oidc-reconcile branch from 5ba0dfb to 24d7c42 Compare November 3, 2021 00:16

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 14, 2022

k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels May 11, 2022

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Sep 29, 2022

Skarlso force-pushed the fix-oidc-reconcile branch from 959c82d to adfe1b9 Compare September 30, 2022 04:45

Add unit test to find and create oidc provider

e870085

Skarlso force-pushed the fix-oidc-reconcile branch from adfe1b9 to e870085 Compare September 30, 2022 04:51

Let's try if this cert works on Linux... on Darwin it fails because o…

480200c

…f another bug in Go

Skarlso reviewed Sep 30, 2022

View reviewed changes

Skarlso force-pushed the fix-oidc-reconcile branch from d03bea6 to 019a51a Compare September 30, 2022 08:19

Skarlso reviewed Sep 30, 2022

View reviewed changes

Switching to mocking the http client used to get the OIDC issuer

f2381df

Skarlso force-pushed the fix-oidc-reconcile branch from 019a51a to f2381df Compare September 30, 2022 08:30

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 19, 2022

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 19, 2022

k8s-ci-robot merged commit 95e8972 into kubernetes-sigs:main Oct 19, 2022

k8s-ci-robot modified the milestones: v1.6.0, v1.x Oct 19, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Try to find and verify existing OIDC providers before we try to create a new one #2901

Try to find and verify existing OIDC providers before we try to create a new one #2901

codablock commented Nov 1, 2021 •

edited

k8s-ci-robot commented Nov 1, 2021

k8s-ci-robot commented Nov 1, 2021

randomvariable commented Nov 2, 2021

richardcase commented Nov 3, 2021

codablock commented Nov 3, 2021

codablock commented Dec 14, 2021

k8s-triage-robot commented Mar 14, 2022

richardcase commented Mar 15, 2022

k8s-ci-robot commented Mar 15, 2022

richardcase commented Apr 11, 2022

k8s-triage-robot commented May 11, 2022

codablock commented May 11, 2022

richardcase commented Jun 8, 2022

Skarlso commented Sep 29, 2022 •

edited

Skarlso commented Sep 29, 2022

Skarlso commented Sep 29, 2022 •

edited

Skarlso commented Sep 29, 2022

Skarlso commented Sep 29, 2022

Skarlso commented Sep 30, 2022 •

edited

Skarlso commented Sep 30, 2022

Skarlso Sep 30, 2022

Skarlso Sep 30, 2022

Skarlso commented Oct 1, 2022

Skarlso commented Oct 3, 2022

Skarlso commented Oct 12, 2022

k8s-ci-robot commented Oct 12, 2022

Skarlso commented Oct 12, 2022

Skarlso commented Oct 19, 2022

k8s-ci-robot commented Oct 19, 2022

Try to find and verify existing OIDC providers before we try to create a new one #2901

Try to find and verify existing OIDC providers before we try to create a new one #2901

Conversation

codablock commented Nov 1, 2021 • edited

k8s-ci-robot commented Nov 1, 2021

k8s-ci-robot commented Nov 1, 2021

randomvariable commented Nov 2, 2021

richardcase commented Nov 3, 2021

codablock commented Nov 3, 2021

codablock commented Dec 14, 2021

k8s-triage-robot commented Mar 14, 2022

richardcase commented Mar 15, 2022

k8s-ci-robot commented Mar 15, 2022

richardcase commented Apr 11, 2022

k8s-triage-robot commented May 11, 2022

codablock commented May 11, 2022

richardcase commented Jun 8, 2022

Skarlso commented Sep 29, 2022 • edited

Skarlso commented Sep 29, 2022

Skarlso commented Sep 29, 2022 • edited

Skarlso commented Sep 29, 2022

Skarlso commented Sep 29, 2022

Skarlso commented Sep 30, 2022 • edited

Skarlso commented Sep 30, 2022

Skarlso Sep 30, 2022

Choose a reason for hiding this comment

Skarlso Sep 30, 2022

Choose a reason for hiding this comment

Skarlso commented Oct 1, 2022

Skarlso commented Oct 3, 2022

Skarlso commented Oct 12, 2022

k8s-ci-robot commented Oct 12, 2022

Skarlso commented Oct 12, 2022

Skarlso commented Oct 19, 2022

k8s-ci-robot commented Oct 19, 2022

codablock commented Nov 1, 2021 •

edited

Skarlso commented Sep 29, 2022 •

edited

Skarlso commented Sep 29, 2022 •

edited

Skarlso commented Sep 30, 2022 •

edited