IR-390: Make a configmap for MCO to consume CAs #880

cdoern · 2023-07-13T18:48:28Z

Took Flavian's work on the current PR, and fixed the configmap already exists bug. This should be good to go in tandem with: openshift/machine-config-operator#3770

this certificate contains the storage ca and the service ca, making it nearly identical to the image-registry-certificates, except that it does not contains the additionalTrustedCA from images.config.openshift.io/cluster.

openshift-ci-robot · 2023-07-13T18:49:21Z

@cdoern: This pull request references IR-390 which is a valid jira issue.

In response to this:

Took Flavian's work on the current PR, and fixed the configmap already exists bug. This should be good to go in tandem with: openshift/machine-config-operator#3770

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

cdoern · 2023-07-13T20:35:52Z

it seems like the generator thinks the configmap both exists and doesn't exist....

cdoern · 2023-07-14T15:08:25Z

hope this works! 🤞

pkg/resource/imageregistryca.go

cdoern · 2023-07-14T18:46:40Z

/retest-required

cdoern · 2023-07-14T20:43:59Z

/retest e2e-aws-ovn-image-registry

openshift-ci · 2023-07-14T20:44:13Z

@cdoern: The /retest command does not accept any targets.
The following commands are available to trigger required jobs:

/test e2e-aws-operator
/test e2e-aws-ovn
/test e2e-aws-ovn-image-registry
/test e2e-aws-ovn-upgrade
/test e2e-hypershift
/test e2e-vsphere-operator
/test images
/test unit
/test verify

The following commands are available to trigger optional jobs:

/test e2e-azure-operator
/test e2e-azure-ovn
/test e2e-gcp-operator
/test e2e-gcp-ovn
/test e2e-openstack
/test e2e-ovirt-sdn
/test e2e-vsphere

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-cluster-image-registry-operator-master-e2e-aws-operator
pull-ci-openshift-cluster-image-registry-operator-master-e2e-aws-ovn
pull-ci-openshift-cluster-image-registry-operator-master-e2e-aws-ovn-image-registry
pull-ci-openshift-cluster-image-registry-operator-master-e2e-aws-ovn-upgrade
pull-ci-openshift-cluster-image-registry-operator-master-e2e-hypershift
pull-ci-openshift-cluster-image-registry-operator-master-e2e-ovirt-sdn
pull-ci-openshift-cluster-image-registry-operator-master-images
pull-ci-openshift-cluster-image-registry-operator-master-unit
pull-ci-openshift-cluster-image-registry-operator-master-verify

In response to this:

/retest e2e-aws-ovn-image-registry

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

cdoern · 2023-07-14T20:45:07Z

/test e2e-aws-ovn-image-registry

dmage · 2023-07-15T18:03:14Z

/retest

dmage · 2023-07-17T10:21:52Z

/retest

dmage · 2023-07-17T10:22:16Z

/lgtm

openshift-ci-robot · 2023-07-17T12:03:18Z

/retest-required

Remaining retests: 0 against base HEAD ea479d1 and 2 for PR HEAD bc624ce in total

cdoern · 2023-07-17T13:01:42Z

/retest-required

cdoern · 2023-07-17T13:31:58Z

/assign @sferich888 @xiuwang @stevsmit

sferich888 · 2023-07-17T13:42:58Z

/lgtm for 4.15 provided we align the paperwork in Jira

cdoern · 2023-07-17T13:44:54Z

/lgtm for 4.15 provided we align the paperwork in Jira

@sferich888 this is a high priority for 4.14, is that possible?

cdoern · 2023-07-17T20:04:46Z

/retest-required

Signed-off-by: Charlie Doern <cdoern@redhat.com>

xiuwang · 2023-07-19T10:05:48Z

image-registry-ca cm in openshift-config-managed keeps same content with image-registry-certificates cm of openshift-image-registry namespace.
Will check hypershift situation, and update here

cdoern · 2023-07-19T13:14:45Z

/test e2e-aws-operator

xiuwang · 2023-07-20T09:28:06Z

Hypershift hosted cluster install failed with such error, will try more times

07-20 16:49:17.842  + aws s3api delete-public-access-block --bucket aos-hypershift-ci-oidc-5811
07-20 16:49:18.399  /usr/local/lib/python3.6/site-packages/OpenSSL/_util.py:6: CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography. The next release of cryptography will remove support for Python 3.6.
07-20 16:49:18.399    from cryptography.hazmat.bindings.openssl.binding import Binding
07-20 16:49:18.399  
07-20 16:49:18.399  An error occurred (NoSuchBucket) when calling the DeletePublicAccessBlock operation: The specified bucket does not exist
07-20 16:49:18.399  + export hypershift_bucket_name=aos-hypershift-ci-oidc-5811
07-20 16:49:18.399  + hypershift_bucket_name=aos-hypershift-ci-oidc-5811
07-20 16:49:18.399  + echo '{
07-20 16:49:18.399              "Version": "2012-10-17",
07-20 16:49:18.399              "Statement": [
07-20 16:49:18.399                  {
07-20 16:49:18.399                  "Effect": "Allow",
07-20 16:49:18.399                  "Principal": "*",
07-20 16:49:18.399                  "Action": "s3:GetObject",
07-20 16:49:18.399                  "Resource": "arn:aws:s3:::${hypershift_bucket_name}/*"
07-20 16:49:18.399                  }
07-20 16:49:18.399              ]
07-20 16:49:18.399          }'
07-20 16:49:18.399  + envsubst
07-20 16:49:18.399  + cat policy.json
07-20 16:49:18.399  {
07-20 16:49:18.399              "Version": "2012-10-17",
07-20 16:49:18.399              "Statement": [
07-20 16:49:18.399                  {
07-20 16:49:18.399                  "Effect": "Allow",
07-20 16:49:18.399                  "Principal": "*",
07-20 16:49:18.399                  "Action": "s3:GetObject",
07-20 16:49:18.399                  "Resource": "arn:aws:s3:::aos-hypershift-ci-oidc-5811/*"
07-20 16:49:18.399                  }
07-20 16:49:18.399              ]
07-20 16:49:18.399          }
07-20 16:49:18.399  + aws s3api put-bucket-policy --bucket aos-hypershift-ci-oidc-5811 --policy file://policy.json/
07-20 16:49:18.958  /usr/local/lib/python3.6/site-packages/OpenSSL/_util.py:6: CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography. The next release of cryptography will remove support for Python 3.6.
07-20 16:49:18.958    from cryptography.hazmat.bindings.openssl.binding import Binding
07-20 16:49:18.958  
07-20 16:49:18.958  An error occurred (NoSuchBucket) when calling the PutBucketPolicy operation: The specified bucket does not exist
07-20 16:49:18.958  + return 255
07-20 16:49:18.958  + '[' 255 -eq 0 ']'
07-20 16:49:18.958  + echo 'try 1 time to create s3 bucket aos-hypershift-ci-oidc-5811'
07-20 16:49:18.958  try 1 time to create s3 bucket aos-hypershift-ci-oidc-5811
07-20 16:49:18.958  + n=2
07-20 16:49:18.958  + sleep 5
07-20 16:49:24.185  + '[' 2 -ge 3 ']'
07-20 16:49:24.185  + hypershift_create_s3_bucket aos-hypershift-ci-oidc-5811 us-east-1
07-20 16:49:24.185  + local bucket_name=aos-hypershift-ci-oidc-5811
07-20 16:49:24.185  + local bucket_region=us-east-1
07-20 16:49:24.185  + aws s3api head-bucket --bucket aos-hypershift-ci-oidc-5811
07-20 16:49:24.743  /usr/local/lib/python3.6/site-packages/OpenSSL/_util.py:6: CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography. The next release of cryptography will remove support for Python 3.6.
07-20 16:49:24.743    from cryptography.hazmat.bindings.openssl.binding import Binding
07-20 16:49:24.743  
07-20 16:49:24.743  An error occurred (404) when calling the HeadBucket operation: Not Found
07-20 16:49:24.743  + '[' 255 -ne 0 ']'
07-20 16:49:24.743  + aws s3api create-bucket --create-bucket-configuration LocationConstraint=us-east-1 --region us-east-1 --bucket aos-hypershift-ci-oidc-5811
07-20 16:49:25.301  /usr/local/lib/python3.6/site-packages/OpenSSL/_util.py:6: CryptographyDeprecationWarning: Python 3.6 is no longer supported by the Python core team. Therefore, support for it is deprecated in cryptography. The next release of cryptography will remove support for Python 3.6.
07-20 16:49:25.301    from cryptography.hazmat.bindings.openssl.binding import Binding
07-20 16:49:25.301  
07-20 16:49:25.301  An error occurred (InvalidLocationConstraint) when calling the CreateBucket operation: The specified location-constraint is not valid

cdoern · 2023-07-20T13:08:12Z

@xiuwang I don't think that should relate to my work, might have been a general failure / flake

xiuwang · 2023-07-21T06:35:09Z

@cdoern You are right, I can launch the hypershift hosted cluster.
image-registry-ca cm in openshift-config-managed keeps same content with image-registry-certificates cm in openshift-image-registry except the additionalTrustedCA

xiuwang · 2023-07-21T06:35:20Z

/label qe-approved

xiuwang · 2023-07-21T06:35:35Z

/retest

openshift-ci · 2023-07-21T06:45:40Z

@cdoern: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-ovirt-sdn	`9404a02`	link	false	`/test e2e-ovirt-sdn`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

dmage · 2023-07-21T09:19:58Z

/lgtm

openshift-ci · 2023-07-21T09:20:45Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cdoern, dmage, sferich888

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [dmage]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

pkg: add registry certificate to openshift-config-managed ns

bd169ca

this certificate contains the storage ca and the service ca, making it nearly identical to the image-registry-certificates, except that it does not contains the additionalTrustedCA from images.config.openshift.io/cluster.

openshift-ci bot requested review from dmage and flavianmissi July 13, 2023 18:48

cdoern changed the title ~~IR-390~~ IR-390: Make a configmap for MCO to consume CAs Jul 13, 2023

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 13, 2023

cdoern force-pushed the f-IR-390 branch from e75c8c7 to d5ee7cf Compare July 14, 2023 15:05

dmage reviewed Jul 14, 2023

View reviewed changes

pkg/resource/imageregistryca.go Outdated Show resolved Hide resolved

cdoern force-pushed the f-IR-390 branch from d5ee7cf to bc624ce Compare July 14, 2023 15:44

openshift-ci bot assigned dmage Jul 17, 2023

openshift-ci bot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Jul 17, 2023

openshift-ci bot assigned sferich888, stevsmit and xiuwang Jul 17, 2023

cdoern force-pushed the f-IR-390 branch from bc624ce to fde087c Compare July 18, 2023 17:58

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jul 18, 2023

if the configmap already exists, do not error out but continue

9404a02

Signed-off-by: Charlie Doern <cdoern@redhat.com>

cdoern force-pushed the f-IR-390 branch from fde087c to 9404a02 Compare July 18, 2023 19:23

openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Jul 21, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jul 21, 2023

openshift-merge-robot merged commit 09e6457 into openshift:master Jul 21, 2023
9 of 10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

IR-390: Make a configmap for MCO to consume CAs #880

IR-390: Make a configmap for MCO to consume CAs #880

cdoern commented Jul 13, 2023

openshift-ci-robot commented Jul 13, 2023 •

edited by openshift-ci bot

cdoern commented Jul 13, 2023

cdoern commented Jul 14, 2023 •

edited

cdoern commented Jul 14, 2023

cdoern commented Jul 14, 2023

openshift-ci bot commented Jul 14, 2023

cdoern commented Jul 14, 2023

dmage commented Jul 15, 2023

dmage commented Jul 17, 2023

dmage commented Jul 17, 2023

openshift-ci-robot commented Jul 17, 2023

cdoern commented Jul 17, 2023

cdoern commented Jul 17, 2023

sferich888 commented Jul 17, 2023

cdoern commented Jul 17, 2023

cdoern commented Jul 17, 2023

xiuwang commented Jul 19, 2023

cdoern commented Jul 19, 2023

xiuwang commented Jul 20, 2023

cdoern commented Jul 20, 2023

xiuwang commented Jul 21, 2023

xiuwang commented Jul 21, 2023

xiuwang commented Jul 21, 2023

openshift-ci bot commented Jul 21, 2023

dmage commented Jul 21, 2023

openshift-ci bot commented Jul 21, 2023

IR-390: Make a configmap for MCO to consume CAs #880

IR-390: Make a configmap for MCO to consume CAs #880

Conversation

cdoern commented Jul 13, 2023

openshift-ci-robot commented Jul 13, 2023 • edited by openshift-ci bot

cdoern commented Jul 13, 2023

cdoern commented Jul 14, 2023 • edited

cdoern commented Jul 14, 2023

cdoern commented Jul 14, 2023

openshift-ci bot commented Jul 14, 2023

cdoern commented Jul 14, 2023

dmage commented Jul 15, 2023

dmage commented Jul 17, 2023

dmage commented Jul 17, 2023

openshift-ci-robot commented Jul 17, 2023

cdoern commented Jul 17, 2023

cdoern commented Jul 17, 2023

sferich888 commented Jul 17, 2023

cdoern commented Jul 17, 2023

cdoern commented Jul 17, 2023

xiuwang commented Jul 19, 2023

cdoern commented Jul 19, 2023

xiuwang commented Jul 20, 2023

cdoern commented Jul 20, 2023

xiuwang commented Jul 21, 2023

xiuwang commented Jul 21, 2023

xiuwang commented Jul 21, 2023

openshift-ci bot commented Jul 21, 2023

dmage commented Jul 21, 2023

openshift-ci bot commented Jul 21, 2023

openshift-ci-robot commented Jul 13, 2023 •

edited by openshift-ci bot

cdoern commented Jul 14, 2023 •

edited