CFE-755: Support cluster-wide egress proxy injection

[thejasn]

Description

This PR adds egress proxy injection support to the operator. Proxy environment variables will now be propagated to the operand from the operator deployment. This PR also provides an option to provide custom trusted CA certificates.

• pkg/controller/deployment/cert_manager_cainjector_deployment.go, pkg/controller/deployment/cert_manager_controller_set.go, pkg/controller/deployment/cert_manager_controller_deployment.go and pkg/controller/deployment/cert_manager_webhook_deployment.go : Fix informers arg names and pass trusted CA configmap at runtime.
• pkg/controller/deployment/deployment_overrides.go : Add 2 new deployment hooks to inject proxy env variables and inject trusted CA configmap as a volume.
• pkg/controller/deployment/generic_deployment_controller.go : Add configmap informers to re-sync deployments (watch configmaps in the operand namespace).

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@thejasn: This pull request references CFE-755 which is a valid jira issue.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@thejasn: This pull request references CFE-755 which is a valid jira issue.

In response to this:

Description

This PR adds egress proxy injection support to the operator. Proxy environment variables will now be propagated to the operand from the operator deployment. This PR also provides an option to provide custom trusted CA certificates.

• pkg/controller/deployment/cert_manager_cainjector_deployment.go, pkg/controller/deployment/cert_manager_controller_set.go, pkg/controller/deployment/cert_manager_controller_deployment.go and pkg/controller/deployment/cert_manager_webhook_deployment.go : Fix informers arg names and pass trusted CA configmap at runtime.
• pkg/controller/deployment/deployment_overrides.go : Add 2 new deployment hooks to inject proxy env variables and inject trusted CA configmap as a volume.
• pkg/controller/deployment/generic_deployment_controller.go : Add configmap informers to re-sync deployments (watch configmaps in the operand namespace).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

@thejasn: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[thejasn]

/cc @xingxingxia

[xingxingxia]

I'm executing below to try pre-merge testing:

launch openshift/cert-manager-operator#103 aws,proxy

If stuck due to whatever, will label directly to unblock merge, and test after merge.
@thejasn , one suggestion: it is better to always have Dev peer's /lgtm label first, as openshift other components repos' PRs do, before qe test starts involved, in case later Dev peer review will introduce new code updates : )

[xingxingxia]

launch openshift/cert-manager-operator#103 aws,proxy failed due to unknown readon.
Then used this approach to pre-merge test: executed launch openshift/cert-manager-operator#103, got the env, pulled down the catalog image, pushed to my quay.io repo, then used QE's Jenkins Flexy-install job to install a disconnected env with https_proxy, and installed this catalog from my quay.io repo, then installed cert-manager-operator from it. Done pre-merge testing with this https_proxy env:

[xxia@2023-02-16 20:36:57 CST my]$ oc get po -n cert-manager-operator
NAME                                                        READY   STATUS    RESTARTS   AGE
cert-manager-operator-controller-manager-76cf859cb7-qwvr7   2/2     Running   0          111s
[xxia@2023-02-16 20:37:10 CST my]$ oc get po -n cert-manager-operator cert-manager-operator-controller-manager-76cf859cb7-qwvr7 -o yaml 
...
    env:
    - name: HTTP_PROXY
      value: http://<user>:<password>@10.0.152.122:3128
    - name: HTTPS_PROXY
      value: https://<user>:<password>@10.0.152.122:3130
    - name: NO_PROXY
      value: .cluster.local,.svc,10.0.0.0/16,10.128.0.0/14,127.0.0.1,172.30.0.0/16,api-int.<cluster-domain>,localhost,test.no-proxy.com

They are same as oc get proxy -o yaml.

[xxia@2023-02-16 20:35:04 CST my]$ oc get po -n cert-manager
NAME                                      READY   STATUS    RESTARTS   AGE
cert-manager-6f96c79f9b-mzn4v             1/1     Running   0          31s
cert-manager-cainjector-674cfc967-8qwdw   1/1     Running   0          67s
cert-manager-webhook-5fd545966f-2q6f6     1/1     Running   0          69s

[xxia@2023-02-16 20:40:35 CST my]$ for i in cert-manager-6f96c79f9b-mzn4v cert-manager-cainjector-674cfc967-8qwdw cert-manager-webhook-5fd545966f-2q6f6 ; do oc get po $i -n cert-manager -o yaml > pod-cluster-bot-pr103-$i.yaml ; done
[xxia@2023-02-16 20:40:43 CST my]$ vi -p pod-cluster-bot-pr103-cert-manager-*.yaml
...
    env:
    - name: HTTPS_PROXY
      value: https://<user>:<password>@10.0.152.122:3130
    - name: HTTP_PROXY
      value: http://<user>:<password>@10.0.152.122:3128
    - name: NO_PROXY
      value: .cluster.local,.svc,10.0.0.0/16,10.128.0.0/14,127.0.0.1,172.30.0.0/16,api-int.<cluster-domain>,localhost,test.no-proxy.com
...
    - name: http_proxy
      value: http://<user>:<password>@10.0.152.122:3128
    - name: https_proxy
      value: https://<user>:<password>@10.0.152.122:3130
    - name: no_proxy
      value: .cluster.local,.svc,10.0.0.0/16,10.128.0.0/14,127.0.0.1,172.30.0.0/16,api-int.<cluster-domain>,localhost,test.no-proxy.com

In all 3 pods, there are both upper case and lower case proxy env vars ^^

[xxia@2023-02-16 20:42:15 CST my]$ oc -n cert-manager-operator patch subscription cert-manager-operator --type='merge' -p '{"spec":{"config":{"env":[{"name":"TRUSTED_CA_CONFIGMAP_NAME","value":"trusted-ca"}]}}}'
[xxia@2023-02-16 20:42:58 CST my]$ oc get po -n cert-manager-operator
NAME                                                       READY   STATUS    RESTARTS   AGE
cert-manager-operator-controller-manager-7b4bc96d9-wmtft   2/2     Running   0          68s
[xxia@2023-02-16 20:44:19 CST my]$ oc get po -n cert-manager
NAME                                       READY   STATUS    RESTARTS   AGE
cert-manager-85b7988d98-8mqpx              1/1     Running   0          30s
cert-manager-cainjector-744c47c447-fhntr   1/1     Running   0          30s
cert-manager-webhook-54bbfd9797-z8k29      1/1     Running   0          30s
[xxia@2023-02-16 20:44:33 CST my]$ for i in cert-manager-85b7988d98-8mqpx cert-manager-cainjector-744c47c447-fhntr cert-manager-webhook-54bbfd9797-z8k29 ; do oc get po $i -n cert-manager -o yaml > pod-cluster-bot-pr103-after-ce-injection-$i.yaml ; done
[xxia@2023-02-16 20:45:22 CST my]$ vi -p pod-cluster-bot-pr103-after-ce-injection-cert-manager-*
  volumes:
  - configMap:
      defaultMode: 420
      name: trusted-ca
    name: trusted-ca
...
    volumeMounts:
    - mountPath: /etc/pki/tls/certs/cert-manager-tls-ca-bundle.crt
      name: trusted-ca
      subPath: ca-bundle.crt

In all 3 pods, there is proxy ca injected ^^

Then test functions of self-signed issuer, CA issuer, ACME http01 solver issuer with external server https://acme-v02.api.letsencrypt.org/directory which can't be accessed by cert-manager if the proxy stuff is not injected, and certificates, they work well.

So adding qe label:
/label qe-approved

[TrilokGeer]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: thejasn, TrilokGeer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [TrilokGeer,thejasn]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[thejasn]

Fixes CM-37

[thejasn]

/label docs-approved

[thejasn]

/cc @davemulford

[davemulford]

/label px-approved