Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

IR-369,IR-370: support Azure workload identity #857

Merged
merged 8 commits into from Jun 27, 2023
Merged

IR-369,IR-370: support Azure workload identity #857

merged 8 commits into from Jun 27, 2023

Conversation

flavianmissi
Copy link
Member

@flavianmissi flavianmissi commented Jun 9, 2023 •
edited

No description provided.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jun 9, 2023
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jun 9, 2023 •
edited by openshift-ci bot

@flavianmissi: This pull request references IR-369 which is a valid jira issue.

In response to this:

This will not configure the necessary environment variables in the registry (the work implement this is covered by a different jira, IR-370).
It configures the operator so that it uses a CCO provided workload identity. I still have to figure out how test this.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

1 similar comment
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jun 9, 2023 •
edited by openshift-ci bot

@flavianmissi: This pull request references IR-369 which is a valid jira issue.

In response to this:

This will not configure the necessary environment variables in the registry (the work implement this is covered by a different jira, IR-370).
It configures the operator so that it uses a CCO provided workload identity. I still have to figure out how test this.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot requested review from bparees and dmage June 9, 2023 10:06
@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 9, 2023
@flavianmissi
Copy link
Member Author

/retest

@flavianmissi flavianmissi changed the title IR-369: add support for Azure workload identity in the operator IR-369,IR-370: support Azure workload identity Jun 14, 2023
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jun 14, 2023 •
edited by openshift-ci bot

@flavianmissi: This pull request references IR-369 which is a valid jira issue.

This pull request references IR-370 which is a valid jira issue.

In response to this:

This will not configure the necessary environment variables in the registry (the work implement this is covered by a different jira, IR-370).
It configures the operator so that it uses a CCO provided workload identity. I still have to figure out how test this.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@flavianmissi
Copy link
Member Author

/retest

1 similar comment
@flavianmissi
Copy link
Member Author

/retest

@flavianmissi
Copy link
Member Author

I have now configured a cluster with workload identity and can confirm that this works 🎉

/assign @dmage

@flavianmissi
Copy link
Member Author

/retest

@flavianmissi
Copy link
Member Author

failure seems unrelated
/retest

@flavianmissi
Copy link
Member Author

/test e2e-hypershift

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jun 19, 2023

@flavianmissi: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

  • /test e2e-aws-operator
  • /test e2e-aws-ovn
  • /test e2e-aws-ovn-image-registry
  • /test e2e-aws-ovn-upgrade
  • /test e2e-vsphere-operator
  • /test images
  • /test unit
  • /test verify

The following commands are available to trigger optional jobs:

  • /test e2e-azure-operator
  • /test e2e-azure-ovn
  • /test e2e-gcp-operator
  • /test e2e-gcp-ovn
  • /test e2e-openstack
  • /test e2e-ovirt-sdn
  • /test e2e-vsphere

Use /test all to run the following jobs that were automatically triggered:

  • pull-ci-openshift-cluster-image-registry-operator-master-e2e-aws-operator
  • pull-ci-openshift-cluster-image-registry-operator-master-e2e-aws-ovn
  • pull-ci-openshift-cluster-image-registry-operator-master-e2e-aws-ovn-image-registry
  • pull-ci-openshift-cluster-image-registry-operator-master-e2e-aws-ovn-upgrade
  • pull-ci-openshift-cluster-image-registry-operator-master-e2e-azure-operator
  • pull-ci-openshift-cluster-image-registry-operator-master-e2e-azure-ovn
  • pull-ci-openshift-cluster-image-registry-operator-master-e2e-gcp-operator
  • pull-ci-openshift-cluster-image-registry-operator-master-e2e-gcp-ovn
  • pull-ci-openshift-cluster-image-registry-operator-master-e2e-openstack
  • pull-ci-openshift-cluster-image-registry-operator-master-e2e-ovirt-sdn
  • pull-ci-openshift-cluster-image-registry-operator-master-images
  • pull-ci-openshift-cluster-image-registry-operator-master-unit
  • pull-ci-openshift-cluster-image-registry-operator-master-verify

In response to this:

/test e2e-hypershift

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@flavianmissi
Copy link
Member Author

/retest

@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jun 20, 2023 •
edited by openshift-ci bot

@flavianmissi: This pull request references IR-369 which is a valid jira issue.

This pull request references IR-370 which is a valid jira issue.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@flavianmissi
manifests: specify service account names on azure cred request
f18db5b 
also add "Storage Blob Data Contributor" role, otherwise the registry
does not have permission to do anything in the container.
@flavianmissi
pkg/storage/azure: inject infra lister into GetConfig
15cdaf6
@flavianmissi
pkg/storage/azure: refactor authentication
28370b7 
we'll need to add an identation level, so get rid of an unnecessary one
before doing that.
@flavianmissi
pkg/storage/azure: add support for auth with workload identity
c209320
@flavianmissi
pkg/storage/azure: configure registry with workload identity
8bb474a
@flavianmissi
Copy link
Member Author

putting this on hold so we can merge it together with openshift/image-registry#372
/hold

@openshift-ci openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 21, 2023
@flavianmissi flavianmissi mentioned this pull request Jun 21, 2023
Merged
@flavianmissi
Copy link
Member Author

/retest

@flavianmissi
Copy link
Member Author

test failures seems unrelated
/retest

@flavianmissi
Copy link
Member Author

/test e2e-aws-ovn-image-registry

@jstuever
Copy link
Contributor

/cc

@openshift-ci openshift-ci bot requested a review from jstuever June 23, 2023 16:50
@flavianmissi
Copy link
Member Author

/test e2e-ovirt-sdn

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jun 26, 2023

@flavianmissi: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-ovirt-sdn 8bb474a link false /test e2e-ovirt-sdn

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@jstuever
Copy link
Contributor

This looks pretty solid. I am wondering if it should also be placed behind a featureGate like we did with the other operators.

@jstuever
Copy link
Contributor

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jun 26, 2023
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jun 26, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: flavianmissi, jstuever

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@jstuever jstuever removed their assignment Jun 26, 2023
@flavianmissi
Copy link
Member Author

Changes in this PR are for interfacing with the CCO, they don't affect how end-users interact with the operator or the registry.

/label docs-approved
/label px-approved

@openshift-ci openshift-ci bot added docs-approved Signifies that Docs has signed off on this PR px-approved Signifies that Product Support has signed off on this PR labels Jun 27, 2023
@xiuwang
Copy link

xiuwang commented Jun 27, 2023

/label qe-approved

@openshift-ci openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Jun 27, 2023
@flavianmissi
Copy link
Member Author

/unhold

@openshift-ci openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 27, 2023
@xiuwang
Copy link

xiuwang commented Jun 27, 2023

Test with openshift/image-registry#372 and cco 523 pr.
Could set registry to use the workload identity token manually and aws sts/ hypershift installation succeed.

@openshift-merge-robot openshift-merge-robot merged commit ee650f3 into openshift:master Jun 27, 2023
14 of 15 checks passed
@flavianmissi flavianmissi deleted the IR-369 branch June 27, 2023 09:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@bparees bparees Awaiting requested review from bparees

@dmage dmage Awaiting requested review from dmage

@jstuever jstuever Awaiting requested review from jstuever

Assignees

@dmage dmage

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. docs-approved Signifies that Docs has signed off on this PR jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged. px-approved Signifies that Product Support has signed off on this PR qe-approved Signifies that QE has signed off on this PR
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@flavianmissi @openshift-ci-robot @jstuever @xiuwang @dmage @openshift-merge-robot