New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CFE-987: Use RouterExternalCertificate feature gate for adding ROUTER_ENABLE_EXTERNAL_CERTIFICATE env var to the router pods #1017
Conversation
@arkadeepsen: This pull request references CFE-987 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
/retest |
} else { | ||
env = append(env, | ||
corev1.EnvVar{Name: "ROUTER_EXTERNAL_CERTIFICATE", Value: "false"}, | ||
) | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think it's better to only add the env variable, if routeExternalCertificateEnabled. If feature-gate is not enabled, then do nothing. At the router side we will check ROUTER_EXTERNAL_CERTIFICATE
exists or not, and take actions accordingly.
In that case, we can skip the else statement
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done
/assign @alebedev87 |
/retest |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
A couple of remarks which can be easily addressed and I'm good to LGTM.
// Add router external certificate environment variable. | ||
if routeExternalCertificateEnabled { | ||
env = append(env, | ||
corev1.EnvVar{Name: "ROUTER_EXTERNAL_CERTIFICATE", Value: "true"}, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The naming in ROUTER_EXTERNAL_CERTIFICATE
doesn't seem to reflect the meaning passed to the router. It looks like we try to pass the name or some sort of reference to an external certificate. While what we do is we try to enable the handling of the external certificate field.
corev1.EnvVar{Name: "ROUTER_EXTERNAL_CERTIFICATE", Value: "true"}, | |
corev1.EnvVar{Name: "ROUTER_EXTERNAL_CERTIFICATE_ENABLED", Value: "true"}, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This was mentioned in the EP here which I am following. I guess we'd need to change the EP as well if we make this change.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, it's hard to focus on the right name in the future code during the EP review. I think it's fine to tweak it in the EP if we find a better name down the implementation line.
I looked at the other variables from the router deployment and found ROUTER_ENABLE_COMPRESSION or ROUTER_DISABLE_HTTP2. I think we should follow the same pattern:
corev1.EnvVar{Name: "ROUTER_EXTERNAL_CERTIFICATE", Value: "true"}, | |
corev1.EnvVar{Name: "ROUTER_ENABLE_EXTERNAL_CERTIFICATE", Value: "true"}, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sure. @chiragkyal can you please take a note of this change in the EP? This would also need updating the Router implementation.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the heads-up. Noted in https://issues.redhat.com/browse/CFE-1038
…RNAL_CERTIFICATE env var to the router pod based on the feature gate.
fd22bec
to
4b56133
Compare
/retest |
1 similar comment
/retest |
@arkadeepsen: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
@arkadeepsen : can you please update the title and the description of the PR according to the latest changes? |
/lgtm |
@arkadeepsen: This pull request references CFE-987 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Done |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: alebedev87 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
a96d79f
into
openshift:master
[ART PR BUILD NOTIFIER] This PR has been included in build ose-cluster-ingress-operator-container-v4.16.0-202402271510.p0.ga96d79f.assembly.stream.el9 for distgit ose-cluster-ingress-operator. |
Use
RouterExternalCertificate
feature gate and addROUTER_ENABLE_EXTERNAL_CERTIFICATE
env var to the router pod based on the feature gate according to the EP openshift/enhancements#1307.