OCPBUGS-84652: Include RootCA in the temporal CC#5896
OCPBUGS-84652: Include RootCA in the temporal CC#5896openshift-merge-bot[bot] merged 1 commit intoopenshift:mainfrom
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
@pablintino: No Jira issue with key OCBPUGS-84652 exists in the tracker at https://redhat.atlassian.net. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (2)
WalkthroughCentralizes retrieval of the Machine Config Server (MCS) Root CA into a new Changes
Sequence Diagram(s)sequenceDiagram
participant Caller as "syncRenderConfig / OSImageStream\n(caller)"
participant Operator as "Operator.getMCSCABundle()"
participant ManagedCM as "Managed MCO ConfigMap\n(namespace: managed)"
participant UnmanagedCM as "Unmanaged root CA ConfigMap\n(namespace: kube-system)"
rect rgba(0,128,255,0.5)
Caller->>Operator: request MCSC CA bundle
end
rect rgba(0,255,128,0.5)
Operator->>ManagedCM: GET managed configmap
ManagedCM-->>Operator: 200 + CA bundle / 404 / error
end
alt Managed CM returned CA
Operator-->>Caller: CA bundle
else Managed CM 404
rect rgba(255,128,0,0.5)
Operator->>UnmanagedCM: GET kube-system root CA configmap
UnmanagedCM-->>Operator: 200 + CA bundle / error
end
alt Unmanaged CM returned CA
Operator-->>Caller: CA bundle
else Error
Operator-->>Caller: error (wrapped "could not get MCSC CA bundle: %w")
end
else Managed CM error
Operator-->>Caller: error (wrapped "could not get MCSC CA bundle: %w")
end
rect rgba(128,0,255,0.5)
Caller->>Caller: integrate CA bundle into ControllerConfig / render config
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Review rate limit: 9/10 reviews remaining, refill in 6 minutes. Comment |
openshift-ci
Bot
added
the
approved
|
This patch should also fix https://redhat.atlassian.net/browse/OCPBUGS-84652, thanks a lot @pablintino ! |
|
@pablintino: No Jira issue with key OCBPUGS-84652 exists in the tracker at https://redhat.atlassian.net. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pkg/operator/sync.go`:
- Around line 658-667: The getMCSCABundle function currently swallows
non-NotFound errors from getCAsFromConfigMap which can lead to returning nil,
nil; change the error handling in getMCSCABundle so that after calling
optr.getCAsFromConfigMap(ctrlcommon.MCONamespace,
ctrlcommon.MachineConfigServerCAName, "ca-bundle.crt") any error that is not
apierrors.IsNotFound(err) is returned immediately (return nil, err), and only
when IsNotFound should you call and return the result of
optr.getCAsFromConfigMap("kube-system", ctrlcommon.RootCAConfigMapName,
"ca.crt"); otherwise return the successfully read machineConfigServerCABundle
and nil.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 1e4ffb29-9bc4-4ff1-99e5-88ec253d3b74
📒 Files selected for processing (2)
pkg/operator/osimagestream_ocp.gopkg/operator/sync.go
|
/retitle OCPBUGS-84652: Include RootCA in the temporal CC |
openshift-ci
Bot
changed the title
openshift-ci-robot
added
jira/valid-reference
|
@pablintino: This pull request references Jira Issue OCPBUGS-84652, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
This change includes the MCS CA bundle as part of the OS Image Stream temporal CC to allow the logic to pull images from the temporal IRI registry that uses a certificate signed with the MCS CA cert. Signed-off-by: Pablo Rodriguez Nava <git@amail.pablintino.eu>
pablintino
force-pushed
the
ocpbugs-84652
branch
from
0366f6a to
5b83dbd
Compare
|
@pablintino: This pull request references Jira Issue OCPBUGS-84652, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/lgtm I tested this fix with TechPreview/ISONoRegistryInstall and it works well. |
|
Scheduling tests matching the |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bfournie, pablintino The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
note: once landed, we'll need to backport it to 4.22 |
|
Adding verified label as tested with Agent-based installer using |
openshift-ci-robot
added
the
verified
|
@bfournie: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest-required |
|
/test e2e-aws-ovn-upgrade |
|
/retest-required |
|
/retest-required |
|
@pablintino: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
@pablintino: Jira Issue Verification Checks: Jira Issue OCPBUGS-84652 Jira Issue OCPBUGS-84652 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/cherry-pick release-4.22 |
|
@andfasano: new pull request created: #5904 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/payload-job periodic-ci-openshift-release-main-nightly-5.0-e2e-agent-iso-no-registry-conformance-techpreview |
|
@sadasu: trigger 0 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command |
|
Fix included in release 5.0.0-0.nightly-2026-05-01-010944 |
7 participants
Closes: #OCPBUGS-84652
- What I did
This change includes the MCS CA bundle as part of the OS Image Stream temporal CC to allow the logic to pull images from the temporal IRI registry that uses a certificate signed with the MCS CA cert.
- How to verify it
TBD
- Description for the changelog
Include the MCS CA bundle in the OS Image Stream temporal CC.
Summary by CodeRabbit