Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bug 2038934: Add custom CA bundle support #66

Merged
merged 3 commits into from Jan 20, 2022

Conversation

RomanBednar
Copy link
Contributor

In OCP, it's possible to set a cluster-wide proxy that operators can use to communicate with external APIs [1]. In addition to that, users can also define a custom CA bundle to be used together with the proxy setting.

Currently, we are not using that custom CA bundle and this patch fixes that. The main benefit of injecting the CA bundle using the CSI controllers, as opposed to statically mount it using the manifest file, is that we can watch for changes in the trusted CA bundle store and roll out a new Deployment with the new CA bundle injected.

[1] https://docs.openshift.com/container-platform/4.10/networking/enable-cluster-wide-proxy.html

CC @openshift/storage

@openshift-ci openshift-ci bot added bugzilla/severity-medium Referenced Bugzilla bug's severity is medium for the branch this PR is targeting. bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. labels Jan 12, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 12, 2022

@RomanBednar: This pull request references Bugzilla bug 2024804, which is invalid:

  • expected the bug to be in one of the following states: NEW, ASSIGNED, ON_DEV, POST, POST, but it is VERIFIED instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 2024804: Add custom CA bundle support

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@RomanBednar RomanBednar changed the title Bug 2024804: Add custom CA bundle support Bug 2038934: Add custom CA bundle support Jan 12, 2022
@openshift-ci openshift-ci bot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label Jan 12, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 12, 2022

@RomanBednar: This pull request references Bugzilla bug 2038934, which is valid. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.10.0) matches configured target release for branch (4.10.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

No GitHub users were found matching the public email listed for the QA contact in Bugzilla (wduan@redhat.com), skipping review request.

In response to this:

Bug 2038934: Add custom CA bundle support

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot removed the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label Jan 12, 2022
@RomanBednar
Copy link
Contributor Author

/bugzilla refresh

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 12, 2022

@RomanBednar: This pull request references Bugzilla bug 2038934, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.10.0) matches configured target release for branch (4.10.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

No GitHub users were found matching the public email listed for the QA contact in Bugzilla (wduan@redhat.com), skipping review request.

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@RomanBednar
Copy link
Contributor Author

/retest

@openshift-ci openshift-ci bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 19, 2022
In OCP, it's possible to set a cluster-wide proxy that operators can use
to communicate with external APIs. In addition to that, users can also
define a custom CA bundle to be used together with the proxy setting.

Currently, we are not using that custom CA bundle and this patch fixes
that. The main benefit of injecting the CA bundle using the
controllers, as opposed to statically mount it using the manifest file,
is that we can watch for changes in the trusted CA bundle store and roll
out a new Deployment with the new CA bundle.
@openshift-ci openshift-ci bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 19, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 19, 2022

@RomanBednar: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@jsafrane
Copy link
Contributor

/lgtm
/approve

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 20, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 20, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jsafrane, RomanBednar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 20, 2022
@openshift-merge-robot openshift-merge-robot merged commit fed4012 into openshift:master Jan 20, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 20, 2022

@RomanBednar: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

These pull request must merge or be unlinked from the Bugzilla bug in order for it to move to the next state. Once unlinked, request a bug refresh with /bugzilla refresh.

Bugzilla bug 2038934 has not been moved to the MODIFIED state.

In response to this:

Bug 2038934: Add custom CA bundle support

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/severity-medium Referenced Bugzilla bug's severity is medium for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants