Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug 1868801: check-endpoints should use minimal credentials #931

Merged
merged 2 commits into from Sep 8, 2020
Merged

Bug 1868801: check-endpoints should use minimal credentials #931

merged 2 commits into from Sep 8, 2020

Conversation

sanchezl
Copy link
Contributor

@sanchezl sanchezl commented Aug 12, 2020 •
edited

  • create a kubeconfig for use by the check-endpoints tool when running in the kube-apiserver pod.
  • use the kubeconfig.

@openshift-ci-robot openshift-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 12, 2020
@openshift-ci-robot
Copy link

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@sanchezl
Copy link
Contributor Author

/test all

@sanchezl sanchezl marked this pull request as ready for review August 13, 2020 20:15
@openshift-ci-robot openshift-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 13, 2020
@sanchezl sanchezl changed the title add check-endpoints-kubeconfig Bug 1868801: check-endpoints should use minimal credentials Aug 13, 2020
@openshift-ci-robot
Copy link

@sanchezl: This pull request references Bugzilla bug 1868801, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.6.0) matches configured target release for branch (4.6.0)
  • bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1868801: check-endpoints should use minimal credentials

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot openshift-ci-robot added bugzilla/severity-unspecified Referenced Bugzilla bug's severity is unspecified for the PR. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. labels Aug 13, 2020
@sanchezl
Copy link
Contributor Author

/bugzilla refresh

@openshift-ci-robot openshift-ci-robot removed the bugzilla/severity-unspecified Referenced Bugzilla bug's severity is unspecified for the PR. label Aug 13, 2020
@openshift-ci-robot
Copy link

@sanchezl: This pull request references Bugzilla bug 1868801, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.6.0) matches configured target release for branch (4.6.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot openshift-ci-robot added the bugzilla/severity-medium Referenced Bugzilla bug's severity is medium for the branch this PR is targeting. label Aug 13, 2020
@sanchezl sanchezl force-pushed the check-endpoints-kubeconfig branch 2 times, most recently from 2500092 to 05845b6 Compare August 14, 2020 04:14
@sanchezl
Copy link
Contributor Author

/retest

@sanchezl
Copy link
Contributor Author

/test e2e-aws-operator

deads2k
deads2k reviewed Aug 25, 2020
View reviewed changes
bindata/v4.1.0/kube-apiserver/check-endpoints-clusterrolebinding.yaml Outdated
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: check-endpoints
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

system:openshift:operator?:kube-apiserver-check-endpoints

Looks to see what fits best in operator.

deads2k
deads2k reviewed Aug 25, 2020
View reviewed changes
bindata/v4.1.0/kube-apiserver/check-endpoints-role.yaml Outdated
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: check-endpoints
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this part can be a clusterrole so you can re-use it.

Also, the name system:openshift:operator?:check-endpoints

deads2k
deads2k reviewed Aug 25, 2020
View reviewed changes
bindata/v4.1.0/kube-apiserver/check-endpoints-rolebinding-kube-system.yaml Outdated
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: check-endpoints
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

better name, you get the idea now.

@sanchezl
Copy link
Contributor Author

/test e2e-aws-serial
/test e2e-aws-operator

1 similar comment
@sanchezl
Copy link
Contributor Author

/test e2e-aws-serial
/test e2e-aws-operator

@sanchezl
Copy link
Contributor Author

/test e2e-aws-serial

1 similar comment
@sanchezl
Copy link
Contributor Author

/test e2e-aws-serial

deads2k
deads2k reviewed Sep 1, 2020
View reviewed changes
bindata/v4.1.0/kube-apiserver/check-endpoints-rolebinding-kube-system.yaml Outdated
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: system:openshift:controller:check-endpoints
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

needs to be named with kube-apiserver in teh name to avoid conflicts, right?

deads2k
deads2k reviewed Sep 1, 2020
View reviewed changes
bindata/v4.1.0/kube-apiserver/check-endpoints-clusterrolebinding.yaml Outdated
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: system:openshift:controller:check-endpoints
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

needs kube-apiserver in name to avoid conflict

deads2k
deads2k reviewed Sep 1, 2020
View reviewed changes
pkg/operator/certrotationcontroller/certrotationcontroller.go Outdated
Refresh: 15 * rotationDay,
RefreshOnlyWhenExpired: refreshOnlyWhenExpired,
CertCreator: &certrotation.ClientRotation{
UserInfo: &user.DefaultInfo{Name: "system:check-endpoints"},
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

name it like a service account (double check this): system:serviceaccount:namespace:name

@sanchezl
Copy link
Contributor Author

sanchezl commented Sep 6, 2020

/test e2e-aws-upgrade
/test k8s-e2e-gcp

@deads2k
Copy link
Contributor

deads2k commented Sep 8, 2020

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Sep 8, 2020
@openshift-ci-robot
Copy link

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, sanchezl

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 8, 2020
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

3 similar comments
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot openshift-merge-robot merged commit 0a69c78 into openshift:master Sep 8, 2020
@openshift-ci-robot
Copy link

@sanchezl: All pull requests linked via external trackers have merged:

Bugzilla bug 1868801 has been moved to the MODIFIED state.

In response to this:

Bug 1868801: check-endpoints should use minimal credentials

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@deads2k deads2k deads2k left review comments

@soltysh soltysh Awaiting requested review from soltysh

@sttts sttts Awaiting requested review from sttts

Assignees

@deads2k deads2k

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/severity-medium Referenced Bugzilla bug's severity is medium for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@sanchezl @openshift-ci-robot @deads2k @openshift-bot @openshift-merge-robot