[release-3.11] Correct service serving secret name in the annotation

[bysnupy]

• Fix: "redeploy-router-certificates.yml" makes changes to wrong "service serving certificate secrets" annotation

• Version: v3.11, and I've verified other version is also affected this, such as v3.3 ~ v3.10.

• Description:
  When redeploy-router-certificates.yml playbooks run for redeploy router certificates, both router-certs and router-metrics-tls certificates secret should be redeploy, and the router-certs should be also regenerated as wildcard certificates, it's not service serving certificates. router-metrics-tls secret has been managed as service serving certificates secret. If router-certs created as service serving certificates, it's affected the services to access using wildcard certificates

router-certs will be created again from included openshift_hosted/tasks/router.yml tasks in the roles.

[openshift-ci-robot]

Hi @bysnupy. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@bysnupy: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

• Fix: "redeploy-router-certificates.yml" makes changes to wrong "service serving certificate secrets" annotation

• Version: v3.11, and I've verified other version is also affected this, such as v3.3 ~ v3.10.

• Description:
  When redeploy-router-certificates.yml playbooks run for redeploy router certificates, both router-certs and router-metrics-tls certificates secret should be redeploy, and the router-certs should be also regenerated as wildcard certificates, it's not service serving certificates. router-metrics-tls secret has been managed as service serving certificates secret. If router-certs created as service serving certificates, it's affected the services to access using wildcard certificates

router-certs will be created again from included openshift_hosted/tasks/router.yml tasks in the roles.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[papr-bot]

Can one of the admins verify this patch?
I understand the following commands:

• bot, add author to whitelist
• bot, test pull request
• bot, test pull request once

[bysnupy]

Could you PTAL @sdodson @vrutkovs ?

[openshift-ci-robot]

@bysnupy: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

Could you PTAL @sdodson @vrutkovs ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@bysnupy: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@bysnupy: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

The initial installation would set up as "router-metrics-tls", it changed to "router-certs" after running the redeploy playbooks, so I just change it back. And router should be providing wildcard certificates against external access, service serving secret is generated internal service certificates for internal communication, it's not correct for router certificates secret.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@bysnupy: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@bysnupy: Cannot trigger testing until a trusted user reviews the PR and leaves an /ok-to-test message.

In response to this:

"router-metrics-tls" secret is provided by the serving cert signer component, it does not depend on "openshift_hosted_router_certificate" which provides custom wildcard API certificate and this block is required to delete "router-metrics-tls", so the checking condition about "router-certs" secret is not matched this block.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[vrutkovs]

/ok-to-test

[bysnupy]

Could you PTAL @sdodson ? Or Could you assign other reviewer for this PR @vrutkovs ? Thanks :)

[vrutkovs]

/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bysnupy, vrutkovs

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [vrutkovs]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment