Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OCPBUGS-31384: use RotatedSigningCASecret controller in update only mode #1659

Merged
merged 3 commits into from
Apr 4, 2024
Merged

OCPBUGS-31384: use RotatedSigningCASecret controller in update only mode #1659

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
48d231a
bump(library-go)
tkashem Apr 2, 2024
b07a384
use RotatedSigningCASecret in update only mode
tkashem Apr 2, 2024
6c448ef
fix secret type to SecretTypeTLS for TestCertRotationStompOnBadType
tkashem Apr 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 1 addition & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ require (
github.com/openshift/api v0.0.0-20231219140051-ddc590a81acb
github.com/openshift/build-machinery-go v0.0.0-20230228230858-4cd708338479
github.com/openshift/client-go v0.0.0-20231218155125-ff7d9f9bf415
github.com/openshift/library-go v0.0.0-20240305144041-18ee8279b4e3
github.com/openshift/library-go v0.0.0-20240402180049-f5bf38712dca
github.com/pkg/profile v1.5.0 // indirect
github.com/prometheus/client_golang v1.16.0
github.com/spf13/cobra v1.7.0
Expand All @@ -40,7 +40,6 @@ require (
github.com/antlr/antlr4/runtime/Go/antlr/v4 v4.0.0-20230305170008-8188dc5388df // indirect
github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/blang/semver v3.5.1+incompatible // indirect
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/coreos/go-semver v0.3.1 // indirect
Expand Down
6 changes: 2 additions & 4 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,6 @@ github.com/benbjohnson/clock v1.1.0 h1:Q92kusRqC1XV2MjkWETPvjJVqKetz1OzxZB7mHJLj
github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
Expand Down Expand Up @@ -163,8 +161,8 @@ github.com/openshift/build-machinery-go v0.0.0-20230228230858-4cd708338479 h1:IU
github.com/openshift/build-machinery-go v0.0.0-20230228230858-4cd708338479/go.mod h1:b1BuldmJlbA/xYtdZvKi+7j5YGB44qJUJDZ9zwiNCfE=
github.com/openshift/client-go v0.0.0-20231218155125-ff7d9f9bf415 h1:wfnn3E0Z62bB3wYM5eO1AZ9EYZpFd7M1p4PclcIyVv0=
github.com/openshift/client-go v0.0.0-20231218155125-ff7d9f9bf415/go.mod h1:5W+xoimHjRdZ0dI/yeQR0ANRNLK9mPmXMzUWPAIPADo=
github.com/openshift/library-go v0.0.0-20240305144041-18ee8279b4e3 h1:9ReQNVTyhFwcMfLROKhpmry74ge+urWixmR/EMQajhY=
github.com/openshift/library-go v0.0.0-20240305144041-18ee8279b4e3/go.mod h1:ePlaOqUiPplRc++6aYdMe+2FmXb2xTNS9Nz5laG2YmI=
github.com/openshift/library-go v0.0.0-20240402180049-f5bf38712dca h1:hbTGB9yPZj+cBTYQtRzGDh7NlzeuWk+9cYMFv5TRcPc=
github.com/openshift/library-go v0.0.0-20240402180049-f5bf38712dca/go.mod h1:sb0m3u8GuEtCmkVWsosk/XBAzvnJjaOKcZ4m+oYsOa0=
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
Expand Down
96 changes: 96 additions & 0 deletions pkg/operator/certrotationcontroller/certrotationcontroller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we should also apply it to the RotatedSelfSignedCertKeySecret controller, right ?

},
certrotation.CABundleConfigMap{
Namespace: operatorclient.GlobalMachineSpecifiedConfigNamespace,
Expand Down Expand Up @@ -174,6 +178,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand All @@ -198,6 +206,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
certrotation.CABundleConfigMap{
Namespace: operatorclient.OperatorNamespace,
Expand Down Expand Up @@ -228,6 +240,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand All @@ -253,6 +269,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
certrotation.CABundleConfigMap{
Namespace: operatorclient.OperatorNamespace,
Expand Down Expand Up @@ -282,6 +302,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand All @@ -307,6 +331,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
certrotation.CABundleConfigMap{
Namespace: operatorclient.OperatorNamespace,
Expand Down Expand Up @@ -337,6 +365,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand All @@ -362,6 +394,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
certrotation.CABundleConfigMap{
Namespace: operatorclient.OperatorNamespace,
Expand Down Expand Up @@ -392,6 +428,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand All @@ -417,6 +457,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
certrotation.CABundleConfigMap{
Namespace: operatorclient.OperatorNamespace,
Expand Down Expand Up @@ -447,6 +491,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand All @@ -471,6 +519,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
certrotation.CABundleConfigMap{
Namespace: operatorclient.OperatorNamespace,
Expand Down Expand Up @@ -502,6 +554,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand All @@ -524,6 +580,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
certrotation.CABundleConfigMap{
Namespace: operatorclient.OperatorNamespace,
Expand Down Expand Up @@ -554,6 +614,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.GlobalMachineSpecifiedConfigNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand All @@ -576,6 +640,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
certrotation.CABundleConfigMap{
Namespace: operatorclient.OperatorNamespace,
Expand Down Expand Up @@ -606,6 +674,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.GlobalMachineSpecifiedConfigNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand All @@ -628,6 +700,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
certrotation.CABundleConfigMap{
Namespace: operatorclient.OperatorNamespace,
Expand Down Expand Up @@ -658,6 +734,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand All @@ -680,6 +760,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
certrotation.CABundleConfigMap{
Namespace: operatorclient.OperatorNamespace,
Expand Down Expand Up @@ -710,6 +794,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.TargetNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand All @@ -734,6 +822,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
certrotation.CABundleConfigMap{
Namespace: operatorclient.OperatorNamespace,
Expand Down Expand Up @@ -771,6 +863,10 @@ func newCertRotationController(
Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(),
Client: kubeClient.CoreV1(),
EventRecorder: eventRecorder,

// we will remove this when we migrate all of the affected secret
// objects to their intended type: https://issues.redhat.com/browse/API-1800
UseSecretUpdateOnly: true,
},
eventRecorder,
&certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},
Expand Down
2 changes: 1 addition & 1 deletion test/e2e/certrotation_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ func TestCertRotationStompOnBadType(t *testing.T) {
}
if _, err := kubeClient.CoreV1().Secrets(operatorclient.OperatorNamespace).Create(context.TODO(), &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{Namespace: operatorclient.OperatorNamespace, Name: "aggregator-client-signer"},
Type: "Opaque",
Type: "SecretTypeTLS",
}, metav1.CreateOptions{}); err != nil {
return false, nil
}
Expand Down
21 changes: 0 additions & 21 deletions vendor/github.com/blang/semver/.travis.yml
View file
Open in desktop

This file was deleted.

22 changes: 0 additions & 22 deletions vendor/github.com/blang/semver/LICENSE
View file
Open in desktop

This file was deleted.