OCPBUGS-28614: Use OpenShift generated trust bundle by default #129

montaguethomas · 2024-01-26T10:09:45Z

Currently it is required to manually reconfigure the operator installation in order to have it use the OpenShift generated trusted cabundle.

Since this operator is solely for OpenShift [1], there is no reason to have this be a manual, non-default action.

[1]

openshift-ci · 2024-01-26T10:10:53Z

Hi @montaguethomas. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alebedev87 · 2024-01-30T15:04:19Z

/retitle OCPBUGS-28614: Use OpenShift generated trust bundle by default

openshift-ci-robot · 2024-01-30T15:04:36Z

@montaguethomas: This pull request references Jira Issue OCPBUGS-28614, which is invalid:

expected the bug to target the "4.16.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Currently it is required to manually reconfigure the operator installation in order to have it use the OpenShift generated trusted cabundle.

Since this operator is solely for OpenShift [1], there is no reason to have this be a manual, non-default action.

[1]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

alebedev87 · 2024-01-30T16:29:03Z

@montaguethomas : can you please update config directory and run make bundle? The volume and envvar can be updated in config/manager/manager.yaml while the configmap can be added to config/manager (+ kustomization.yaml). Also, the proxy.md should be updated with the new details.

alebedev87 · 2024-01-30T16:29:36Z

/jira refresh

openshift-ci-robot · 2024-01-30T16:29:43Z

@alebedev87: This pull request references Jira Issue OCPBUGS-28614, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.16.0) matches configured target version for branch (4.16.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @lihongan

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

montaguethomas · 2024-01-30T18:04:38Z

bundle/manifests/aws-load-balancer-operator.clusterserviceversion.yaml

+  relatedImages:
+  - image: quay.io/aws-load-balancer-operator/aws-load-balancer-controller@sha256:d8b5e9a91aca2a4a4de7f9bd2b614c5ba3d4cc62fa8967e94e9539fd7c1940a9
+    name: controller


I have no idea why make bundle updated this.

That's a related image discovery mechanism which was added in v1.20.0. Since you used the latest (v1.33.0) operator-sdk it filled the related images field of CSV. Overall I think it's a good thing however I'm wondering how you got into this situation as make bundle was supposed to download you the v1.17.0 version of operator-sdk.

I see 2 ways of how we can move on:

you can regenerate the bundle using the version from Makefile (mkae bundle should do all on its own)

you can update Makefile with the latest operator-sdk and put it as a separate commit in your PR

I generally work on a mac. The make target for operator-sdk wasn't going to work correctly as it downloads the linux_amd64 version. The target does a test if the bin exists in path, so I simply installed it via brew. Of note, this target will redownload the bin every time if it's not in your path.

aws-load-balancer-operator/Makefile

Line 224 in 1a2c320

ifeq (, $(shell which operator-sdk 2>/dev/null))

Happy to adjust however you'd like.

Makefile is not fully Mac friendly indeed. It would be nice if you could do the same as for opm target: code. That should cover both of your points: Mac downloads, avoid downloads when the binary is present in bin/.

Implemented and regenerated bundle using version specified in Makefile.

montaguethomas · 2024-01-30T18:06:06Z

@alebedev87 Updated as requested.

ShudiLi · 2024-01-31T07:11:46Z

/jira refresh

ShudiLi · 2024-01-31T10:08:06Z

Tested it with 4.15.0-0.ci.test-2024-01-31-072323-ci-ln-03nqdbb-latest

% oc get clusterversion
NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.15.0-0.ci.test-2024-01-31-072323-ci-ln-03nqdbb-latest True False 104m Cluster version is 4.15.0-0.ci.test-2024-01-31-072323-ci-ln-03nqdbb-latest

the operator pod was created automatically when the cluster was created, check the pods
% oc -n aws-load-balancer-operator get pods
NAME READY STATUS RESTARTS AGE
aws-load-balancer-controller-cluster-68768c94f5-nmhc4 1/1 Running 0 86m
aws-load-balancer-operator-controller-manager-77b46d7c59-vlfzr 2/2 Running 0 102m
cb17be5bb7de4c4e5cf940bdd58ef80ddd744ec08bd54c882c07a5eaa0vb2f9 0/1 Completed 0 102m
oo-db4fb-xj9qb 1/1 Running 0 103m

% oc -n aws-load-balancer-operator get cm aws-load-balancer-operator-trusted-cabundle -oyaml | grep -A1 "labels:"
labels:
config.openshift.io/inject-trusted-cabundle: "true"

checked the updates in csv in step 4 to 8
% oc get csv aws-load-balancer-operator.v1.1.0 -n aws-load-balancer-operator -oyaml | grep "operators.operatorframework.io/builder"
operators.operatorframework.io/builder: operator-sdk-v1.33.0

% oc get csv aws-load-balancer-operator.v1.1.0 -n aws-load-balancer-operator -oyaml | grep -A3 "deployments:"
deployments:
- label:
control-plane: controller-manager
name: aws-load-balancer-operator-controller-manager

% oc get csv aws-load-balancer-operator.v1.1.0 -n aws-load-balancer-operator -oyaml | grep -A1 " - name: TRUSTED_CA_CONFIGMAP_NAME"
- name: TRUSTED_CA_CONFIGMAP_NAME
value: aws-load-balancer-operator-trusted-cabundle

% oc get csv aws-load-balancer-operator.v1.1.0 -n aws-load-balancer-operator -oyaml | grep -A2 "mountPath: /etc/pki/tls/certs/albo-tls-ca-bundle.crt"
- mountPath: /etc/pki/tls/certs/albo-tls-ca-bundle.crt
name: trusted-cabundle
subPath: ca-bundle.crt

% oc get csv aws-load-balancer-operator.v1.1.0 -n aws-load-balancer-operator -oyaml | grep -A3 " - configMap:"
- configMap:
defaultMode: 420
name: aws-load-balancer-operator-trusted-cabundle
name: trusted-cabundle

checked the changes for manager in the flowing step 9 to 10
% oc -n aws-load-balancer-operator get deployment aws-load-balancer-operator-controller-manager -oyaml | grep -A2 " - mountPath: /etc/pki/tls/certs/albo-tls-ca-bundle.crt"
- mountPath: /etc/pki/tls/certs/albo-tls-ca-bundle.crt
name: trusted-cabundle
subPath: ca-bundle.crt

% oc -n aws-load-balancer-operator get deployment aws-load-balancer-operator-controller-manager -oyaml | grep -A3 " - configMap:"
- configMap:
defaultMode: 420
name: aws-load-balancer-operator-trusted-cabundle
name: trusted-cabundle

candita · 2024-01-31T16:35:48Z

/assign @alebedev87

alebedev87 · 2024-02-06T16:37:10Z

bundle/manifests/aws-load-balancer-operator.clusterserviceversion.yaml

+      - label:
+          control-plane: controller-manager


This label is new in CSV but it was there in manager.yaml since the beginning so I suppose it's just a fixed bug in the latest operator-sdk.

docs/proxy.md

alebedev87 · 2024-02-06T16:47:18Z

docs/proxy.md

-4. _Optional_: make sure the operator is restarted every time the configmap contents change:
-
-    ```bash
-    oc -n aws-load-balancer-operator rollout restart deployment/aws-load-balancer-operator-controller-manager
-    ```


This part still needs to be mentioned because the operator doesn't watch for the volume mount's contents changes.

Updated with this note. Lmk if it looks good.

alebedev87 · 2024-02-06T22:43:58Z

/ok-to-test

alebedev87 · 2024-02-07T08:37:26Z

/test e2e-aws-proxy-operator

Delete failed.

montaguethomas · 2024-02-08T00:16:39Z

/retest

alebedev87 · 2024-02-13T23:27:05Z

/retest

ShudiLi · 2024-02-26T10:21:53Z

tested it with 4.15.0-0.ci.test-2024-02-26-082703-ci-ln-lzcspnt-latest

% oc get clusterversion
NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.15.0-0.ci.test-2024-02-26-082703-ci-ln-lzcspnt-latest True False 60m Cluster version is 4.15.0-0.ci.test-2024-02-26-082703-ci-ln-lzcspnt-latest
%

%oc -n aws-load-balancer-operator get pods
NAME READY STATUS RESTARTS AGE
aws-load-balancer-controller-cluster-7d48c596c4-f2skj 1/1 Running 0 11m
aws-load-balancer-operator-controller-manager-6c794f4dcd-mjjth 2/2 Running 0 57m
ef53ff3b6a4b5de7f27b7a26a3905dfb2b52f982c16c0dc2381efe18d8s4lsm 0/1 Completed 0 58m
oo-wlhcw-w44kc 1/1 Running 0 58m
%

% oc -n aws-load-balancer-operator get cm aws-load-balancer-operator-trusted-cabundle -oyaml | grep -A1 "labels:"
labels:
config.openshift.io/inject-trusted-cabundle: "true"
%

% oc get csv aws-load-balancer-operator.v1.1.0 -n aws-load-balancer-operator -oyaml | grep "operators.operatorframework.io/builder"
operators.operatorframework.io/builder: operator-sdk-v1.16.0+git
%

% oc get csv aws-load-balancer-operator.v1.1.0 -n aws-load-balancer-operator -oyaml | grep -A6 "deployments:"
deployments:
- name: aws-load-balancer-operator-controller-manager
spec:
replicas: 1
selector:
matchLabels:
control-plane: controller-manager
%

% oc get csv aws-load-balancer-operator.v1.1.0 -n aws-load-balancer-operator -oyaml | grep -A1 " - name: TRUSTED_CA_CONFIGMAP_NAME"
- name: TRUSTED_CA_CONFIGMAP_NAME
value: aws-load-balancer-operator-trusted-cabundle
%

% oc get csv aws-load-balancer-operator.v1.1.0 -n aws-load-balancer-operator -oyaml | grep -A2 "mountPath: /etc/pki/tls/certs/albo-tls-ca-bundle.crt"
- mountPath: /etc/pki/tls/certs/albo-tls-ca-bundle.crt
name: trusted-cabundle
subPath: ca-bundle.crt
%

%
% oc get csv aws-load-balancer-operator.v1.1.0 -n aws-load-balancer-operator -oyaml | grep -A3 " - configMap:"
- configMap:
defaultMode: 420
name: aws-load-balancer-operator-trusted-cabundle
name: trusted-cabundle
%

%oc -n aws-load-balancer-operator get deployment aws-load-balancer-operator-controller-manager -oyaml | grep -A2 " - mountPath: /etc/pki/tls/certs/albo-tls-ca-bundle.crt"
- mountPath: /etc/pki/tls/certs/albo-tls-ca-bundle.crt
name: trusted-cabundle
subPath: ca-bundle.crt
%

% oc -n aws-load-balancer-operator get deployment aws-load-balancer-operator-controller-manager -oyaml | grep -A3 " - configMap:"
- configMap:
defaultMode: 420
name: aws-load-balancer-operator-trusted-cabundle
name: trusted-cabundle
%

alebedev87 · 2024-02-26T13:59:11Z

@montaguethomas : Can you please fix up commit to a single one? Also can you mention the bug in the commit message similar to what is done in the other commits?

alebedev87 · 2024-03-26T10:10:03Z

@montaguethomas : sorry about a conflict added. If you can fix the merge conflict and fix the commits up I think we can move on with the PR.

montaguethomas · 2024-04-24T13:26:52Z

@alebedev87 sorry for the delay. Merge conflict resolved. Are you able to use Github's Squash and Merge on the PR to deal witch squashing the commits into a single commit with an updated commit message as you desire (defaults to the PR's title)?

alebedev87 · 2024-04-24T17:41:23Z

@montaguethomas: I can use tide merge-method-* commands but they won't change the commit message.

Squashed commit of the following: commit 7190196 Merge: d88ccce 0baccef Author: Thomas Montague <montague.thomas@gmail.com> Date: Tue Apr 23 11:43:43 2024 -0500 Merge branch 'main' into patch-1 commit d88ccce Author: Thomas Montague <montague.thomas@lmbbox.com> Date: Tue Feb 6 10:13:27 2024 -0700 cr commit 0049ecf Author: Thomas Montague <montague.thomas@gmail.com> Date: Tue Feb 6 12:10:11 2024 -0500 Update docs/proxy.md Co-authored-by: Andrey Lebedev <alebedev87@gmail.com> commit e57a790 Author: Thomas Montague <montague.thomas@lmbbox.com> Date: Tue Feb 6 10:08:42 2024 -0700 Update generated bundle. commit bd2e253 Author: Thomas Montague <montague.thomas@lmbbox.com> Date: Tue Feb 6 10:05:16 2024 -0700 Add support for multiple distros/arch in Makefile. commit e2ea121 Author: Thomas Montague <montague.thomas@lmbbox.com> Date: Tue Feb 6 09:57:35 2024 -0700 Add ignores for MacOSX commit d87c76a Author: Thomas Montague <tmontague@palantir.com> Date: Tue Jan 30 11:04:07 2024 -0700 cleanup. commit 39c4fca Author: Thomas Montague <tmontague@palantir.com> Date: Tue Jan 30 11:01:21 2024 -0700 update docs. commit ad42ad0 Author: Thomas Montague <tmontague@palantir.com> Date: Tue Jan 30 10:57:19 2024 -0700 Add updates to config and generate bundle. commit 57b202d Author: Thomas Montague <tmontague@palantir.com> Date: Tue Jan 30 10:36:16 2024 -0700 Revert "Update aws-load-balancer-operator.clusterserviceversion.yaml" This reverts commit b2d11b8. commit b2d11b8 Author: Thomas Montague <montague.thomas@gmail.com> Date: Fri Jan 26 05:06:27 2024 -0500 Update aws-load-balancer-operator.clusterserviceversion.yaml commit 925ac58 Author: Thomas Montague <montague.thomas@gmail.com> Date: Fri Jan 26 05:00:24 2024 -0500 Create aws-load-balancer-operator-trusted-cabundle-config_v1_configmap.yaml

montaguethomas · 2024-04-24T19:39:40Z

@alebedev87 understood. I've rebased & squash merged changes.

alebedev87 · 2024-04-24T20:51:30Z

/lgtm
/approve

openshift-ci · 2024-04-24T20:52:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alebedev87

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [alebedev87]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2024-04-24T22:41:20Z

/retest-required

Remaining retests: 0 against base HEAD 0baccef and 2 for PR HEAD 3c03fb1 in total

alebedev87 · 2024-04-25T07:13:44Z

/retest

openshift-ci · 2024-04-25T09:22:02Z

@montaguethomas: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2024-04-25T09:25:45Z

@montaguethomas: Jira Issue OCPBUGS-28614: All pull requests linked via external trackers have merged:

openshift/aws-load-balancer-operator#129

Jira Issue OCPBUGS-28614 has been moved to the MODIFIED state.

In response to this:

Currently it is required to manually reconfigure the operator installation in order to have it use the OpenShift generated trusted cabundle.

Since this operator is solely for OpenShift [1], there is no reason to have this be a manual, non-default action.

[1]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci bot requested review from candita and Miciah January 26, 2024 10:10

openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jan 26, 2024

openshift-ci bot changed the title ~~Use OpenShift generated trust bundle by default~~ OCPBUGS-28614: Use OpenShift generated trust bundle by default Jan 30, 2024

openshift-ci-robot added jira/severity-moderate Referenced Jira bug's severity is moderate for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. labels Jan 30, 2024

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jan 30, 2024

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Jan 30, 2024

openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jan 30, 2024

openshift-ci bot requested a review from lihongan January 30, 2024 16:29

montaguethomas commented Jan 30, 2024

View reviewed changes

openshift-ci bot assigned alebedev87 Jan 31, 2024

alebedev87 reviewed Feb 6, 2024

View reviewed changes

openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Feb 6, 2024

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 26, 2024

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 23, 2024

montaguethomas force-pushed the patch-1 branch from 7190196 to 3c03fb1 Compare April 24, 2024 19:38

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 24, 2024

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 24, 2024

openshift-merge-bot bot merged commit a846cc2 into openshift:main Apr 25, 2024
8 checks passed

montaguethomas deleted the patch-1 branch April 25, 2024 13:47

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-28614: Use OpenShift generated trust bundle by default #129

OCPBUGS-28614: Use OpenShift generated trust bundle by default #129

montaguethomas commented Jan 26, 2024 •

edited

openshift-ci bot commented Jan 26, 2024

alebedev87 commented Jan 30, 2024

openshift-ci-robot commented Jan 30, 2024

alebedev87 commented Jan 30, 2024 •

edited

alebedev87 commented Jan 30, 2024

openshift-ci-robot commented Jan 30, 2024

montaguethomas Jan 30, 2024

alebedev87 Feb 6, 2024

montaguethomas Feb 6, 2024

alebedev87 Feb 6, 2024

montaguethomas Feb 6, 2024

montaguethomas commented Jan 30, 2024

ShudiLi commented Jan 31, 2024 •

edited

ShudiLi commented Jan 31, 2024

candita commented Jan 31, 2024

alebedev87 Feb 6, 2024

alebedev87 Feb 6, 2024

montaguethomas Feb 6, 2024

alebedev87 commented Feb 6, 2024

alebedev87 commented Feb 7, 2024

montaguethomas commented Feb 8, 2024

alebedev87 commented Feb 13, 2024

ShudiLi commented Feb 26, 2024

alebedev87 commented Feb 26, 2024

alebedev87 commented Mar 26, 2024

montaguethomas commented Apr 24, 2024 •

edited

alebedev87 commented Apr 24, 2024

montaguethomas commented Apr 24, 2024

alebedev87 commented Apr 24, 2024

openshift-ci bot commented Apr 24, 2024

openshift-ci-robot commented Apr 24, 2024

alebedev87 commented Apr 25, 2024

openshift-ci bot commented Apr 25, 2024

openshift-ci-robot commented Apr 25, 2024

OCPBUGS-28614: Use OpenShift generated trust bundle by default #129

OCPBUGS-28614: Use OpenShift generated trust bundle by default #129

Conversation

montaguethomas commented Jan 26, 2024 • edited

openshift-ci bot commented Jan 26, 2024

alebedev87 commented Jan 30, 2024

openshift-ci-robot commented Jan 30, 2024

alebedev87 commented Jan 30, 2024 • edited

alebedev87 commented Jan 30, 2024

openshift-ci-robot commented Jan 30, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

montaguethomas commented Jan 30, 2024

ShudiLi commented Jan 31, 2024 • edited

ShudiLi commented Jan 31, 2024

candita commented Jan 31, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alebedev87 commented Feb 6, 2024

alebedev87 commented Feb 7, 2024

montaguethomas commented Feb 8, 2024

alebedev87 commented Feb 13, 2024

ShudiLi commented Feb 26, 2024

alebedev87 commented Feb 26, 2024

alebedev87 commented Mar 26, 2024

montaguethomas commented Apr 24, 2024 • edited

alebedev87 commented Apr 24, 2024

montaguethomas commented Apr 24, 2024

alebedev87 commented Apr 24, 2024

openshift-ci bot commented Apr 24, 2024

openshift-ci-robot commented Apr 24, 2024

alebedev87 commented Apr 25, 2024

openshift-ci bot commented Apr 25, 2024

openshift-ci-robot commented Apr 25, 2024

montaguethomas commented Jan 26, 2024 •

edited

alebedev87 commented Jan 30, 2024 •

edited

ShudiLi commented Jan 31, 2024 •

edited

montaguethomas commented Apr 24, 2024 •

edited