NETOBSERV-1087: Added fields for ca certificate configuration #379

OlivierCazade · 2023-06-20T16:00:09Z

No description provided.

openshift-ci-robot · 2023-06-20T16:00:12Z

@OlivierCazade: This pull request references NETOBSERV-1087 which is a valid jira issue.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

codecov · 2023-06-21T14:35:50Z

Codecov Report

Patch coverage: 46.39% and project coverage change: +1.98% 🎉

Comparison is base (0d6ebe8) 53.67% compared to head (2824d27) 55.66%.
Report is 11 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #379      +/-   ##
==========================================
+ Coverage   53.67%   55.66%   +1.98%     
==========================================
  Files          44       46       +2     
  Lines        5559     5954     +395     
==========================================
+ Hits         2984     3314     +330     
- Misses       2359     2412      +53     
- Partials      216      228      +12

Flag	Coverage Δ
unittests	`55.66% <46.39%> (+1.98%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Changed	Coverage Δ
api/v1alpha1/flowcollector_webhook.go	`0.00% <0.00%> (ø)`
api/v1alpha1/zz_generated.conversion.go	`0.25% <0.00%> (-0.01%)`	⬇️
api/v1beta1/flowcollector_types.go	`100.00% <ø> (ø)`
controllers/flowlogspipeline/flp_common_objects.go	`80.66% <28.57%> (-1.11%)`	⬇️
api/v1beta1/zz_generated.deepcopy.go	`52.21% <64.51%> (-1.57%)`	⬇️
controllers/consoleplugin/consoleplugin_objects.go	`94.61% <100.00%> (-0.82%)`	⬇️
pkg/helper/helpers.go	`100.00% <100.00%> (ø)`
pkg/helper/monitoring.go	`100.00% <100.00%> (ø)`

... and 12 files with indirect coverage changes

☔ View full report in Codecov by Sentry.

📢 Have feedback on the report? Share it here.

jpinsonneau · 2023-06-22T07:42:42Z

controllers/flowlogspipeline/flp_common_objects.go

+		if b.desired.Processor.Metrics.Server.TLS.Provided.CaFile != "" {
+			if b.desired.Processor.Metrics.Server.TLS.Provided.Type == flowslatest.RefTypeConfigMap {
+				flpServiceMonitorObject.Spec.Endpoints[0].TLSConfig.SafeTLSConfig.CA = monitoringv1.SecretOrConfigMap{
+					ConfigMap: &corev1.ConfigMapKeySelector{
+						LocalObjectReference: corev1.LocalObjectReference{
+							Name: b.desired.Processor.Metrics.Server.TLS.Provided.Name,
+						},
+						Key: b.desired.Processor.Metrics.Server.TLS.Provided.CaFile,
+					},
+				}
+			} else if b.desired.Processor.Metrics.Server.TLS.Provided.Type == flowslatest.RefTypeSecret {
+				flpServiceMonitorObject.Spec.Endpoints[0].TLSConfig.SafeTLSConfig.CA = monitoringv1.SecretOrConfigMap{
+					Secret: &corev1.SecretKeySelector{
+						LocalObjectReference: corev1.LocalObjectReference{
+							Name: b.desired.Processor.Metrics.Server.TLS.Provided.Name,
+						},
+						Key: b.desired.Processor.Metrics.Server.TLS.Provided.CaFile,
+					},
+				}
+			}
+		}


Do we need to provide ConfigMap or Secret if InsecureSkipVerify is true ?

I would suggest to create an helper to check both b.desired.Processor.Metrics.Server.TLS.Provided.Type and b.desired.Processor.Metrics.Server.TLS.Provided.InsecureSkipVerify

Done, thanks!

jotak · 2023-07-11T12:59:30Z

api/v1beta1/flowcollector_types.go

@@ -678,6 +678,16 @@ type CertificateReference struct {
 	// certKey defines the path to the certificate private key file name within the config map or secret. Omit when the key is not necessary.
 	// +optional
 	CertKey string `json:"certKey,omitempty"`
+


These added fields are confusing when CertificateReference is used from ClientTLS, as it also contains a reference for caCert and insecureSkipVerify.

I think we need an intermediate struct between ServerTLS and CertificateReference, and move these fields in that new struct

I moved the field directly to the ServerTLS.

github-actions · 2023-07-31T07:49:02Z

New images:

quay.io/netobserv/network-observability-operator:0c381db
quay.io/netobserv/network-observability-operator-bundle:v0.0.0-0c381db
quay.io/netobserv/network-observability-operator-catalog:v0.0.0-0c381db

They will expire after two weeks.

To deploy this build:

# Direct deployment, from operator repo
IMAGE=quay.io/netobserv/network-observability-operator:0c381db make deploy

# Or using operator-sdk
operator-sdk run bundle quay.io/netobserv/network-observability-operator-bundle:v0.0.0-0c381db

Or as a Catalog Source:

apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: netobserv-dev
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/netobserv/network-observability-operator-catalog:v0.0.0-0c381db
  displayName: NetObserv development catalog
  publisher: Me
  updateStrategy:
    registryPoll:
      interval: 1m

github-actions · 2023-07-31T09:07:29Z

New images:

quay.io/netobserv/network-observability-operator:a7d07d9
quay.io/netobserv/network-observability-operator-bundle:v0.0.0-a7d07d9
quay.io/netobserv/network-observability-operator-catalog:v0.0.0-a7d07d9

They will expire after two weeks.

To deploy this build:

# Direct deployment, from operator repo
IMAGE=quay.io/netobserv/network-observability-operator:a7d07d9 make deploy

# Or using operator-sdk
operator-sdk run bundle quay.io/netobserv/network-observability-operator-bundle:v0.0.0-a7d07d9

Or as a Catalog Source:

apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: netobserv-dev
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/netobserv/network-observability-operator-catalog:v0.0.0-a7d07d9
  displayName: NetObserv development catalog
  publisher: Me
  updateStrategy:
    registryPoll:
      interval: 1m

jotak · 2023-09-08T08:32:40Z

api/v1alpha1/flowcollector_webhook.go

+// // This function need to be manually created because conversion-gen not able to create it intentionally because
+// // we have new defined fields in v1beta1 not in v1alpha1
+// // nolint:golint,stylecheck,revive
+// func Convert_v1beta1_CertificateReference_To_v1alpha1_CertificateReference(in *v1beta1.CertificateReference, out *CertificateReference, s apiconversion.Scope) error {


nit: looks like some garbage commented out?

Yes, removed, thank you!

jotak · 2023-09-08T09:30:06Z

/lgtm
thanks @OlivierCazade !
I will do a follow-up PR to remove the ConfigOrSecret api that was introduced with sasl (unsupported), since it overlaps with the new FileReference (which is actually better)

jotak · 2023-09-08T12:36:13Z

I'm merging for the branch cut, so this must be verified post-merge

jotak · 2023-09-08T12:36:18Z

/approve

openshift-ci · 2023-09-08T12:36:24Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jotak

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [jotak]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot added the jira/valid-reference label Jun 20, 2023

OlivierCazade force-pushed the 1087 branch 3 times, most recently from fc240a8 to e94358a Compare June 21, 2023 14:31

OlivierCazade requested review from jotak and jpinsonneau June 21, 2023 15:37

jpinsonneau reviewed Jun 22, 2023

View reviewed changes

jotak requested changes Jul 11, 2023

View reviewed changes

openshift-ci bot assigned jotak Jul 11, 2023

openshift-merge-robot added the needs-rebase label Jul 17, 2023

OlivierCazade force-pushed the 1087 branch 2 times, most recently from 1634e2f to 9c04347 Compare July 28, 2023 13:10

openshift-merge-robot removed the needs-rebase label Jul 28, 2023

OlivierCazade force-pushed the 1087 branch from 9c04347 to 41055f3 Compare July 28, 2023 16:37

jotak added the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Jul 31, 2023

Added fields for ca certificate configuration

c8f4ea9

OlivierCazade force-pushed the 1087 branch from 41055f3 to c8f4ea9 Compare July 31, 2023 08:24

github-actions bot removed the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Jul 31, 2023

jotak added the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Jul 31, 2023

jotak self-requested a review September 7, 2023 07:59

jotak reviewed Sep 8, 2023

View reviewed changes

Removing garbage comment

2824d27

github-actions bot removed the ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. label Sep 8, 2023

openshift-ci bot added the lgtm label Sep 8, 2023

jotak self-requested a review September 8, 2023 09:30

jotak approved these changes Sep 8, 2023

View reviewed changes

jotak mentioned this pull request Sep 8, 2023

Remove ConfigOrSecret API, replaced with the newer FileReference #411

Merged

openshift-ci bot added the approved label Sep 8, 2023

openshift-merge-robot merged commit 7aa9ff7 into netobserv:main Sep 8, 2023
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

NETOBSERV-1087: Added fields for ca certificate configuration #379

NETOBSERV-1087: Added fields for ca certificate configuration #379

OlivierCazade commented Jun 20, 2023

openshift-ci-robot commented Jun 20, 2023 •

edited by openshift-ci bot

codecov bot commented Jun 21, 2023 •

edited

jpinsonneau Jun 22, 2023

OlivierCazade Jul 28, 2023

jotak Jul 11, 2023

OlivierCazade Jul 28, 2023

github-actions bot commented Jul 31, 2023

github-actions bot commented Jul 31, 2023

jotak Sep 8, 2023

OlivierCazade Sep 8, 2023

jotak commented Sep 8, 2023

jotak commented Sep 8, 2023

jotak commented Sep 8, 2023

openshift-ci bot commented Sep 8, 2023

NETOBSERV-1087: Added fields for ca certificate configuration #379

NETOBSERV-1087: Added fields for ca certificate configuration #379

Conversation

OlivierCazade commented Jun 20, 2023

openshift-ci-robot commented Jun 20, 2023 • edited by openshift-ci bot

codecov bot commented Jun 21, 2023 • edited

Codecov Report

jpinsonneau Jun 22, 2023

Choose a reason for hiding this comment

OlivierCazade Jul 28, 2023

Choose a reason for hiding this comment

jotak Jul 11, 2023

Choose a reason for hiding this comment

OlivierCazade Jul 28, 2023

Choose a reason for hiding this comment

github-actions bot commented Jul 31, 2023

github-actions bot commented Jul 31, 2023

jotak Sep 8, 2023

Choose a reason for hiding this comment

OlivierCazade Sep 8, 2023

Choose a reason for hiding this comment

jotak commented Sep 8, 2023

jotak commented Sep 8, 2023

jotak commented Sep 8, 2023

openshift-ci bot commented Sep 8, 2023

openshift-ci-robot commented Jun 20, 2023 •

edited by openshift-ci bot

codecov bot commented Jun 21, 2023 •

edited