Bug 1813894: Stop using service ca from service account token

[marun]

/cc @sttts @mfojtik @deads2k

[openshift-ci-robot]

@marun: This pull request references Bugzilla bug 1813894, which is valid. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target release (4.5.0) matches configured target release for branch (4.5.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1813894: Stop using service ca from service account token

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mfojtik]

/lgtm

[Miciah]

/lgtm
/hold
Before we merge this PR, we need to fix the operator to configure the service CA bundle from the proper location.

[marun]

@miabbott @Miciah Should the default be cleared as proposed and the flag/env var be set by the operator to the configmap-sourced file, or should the default be the configmap-sourced file?

I'll leave you to coordinate landing updates to the router and operator, but I'll leave this PR up as a placeholder until your PRs are proposed.

[Miciah]

@marun, I think you mean to @ me (Miciah, not Micah). We should clear the default so that the router can be started without creating the configmap or specifying the environment variable or command-line option. Some Origin tests do this (deploy a router pod with some special configuration, without using the operator), and I could imagine developers or community users doing the same.

[Miciah]

I manually tested a cluster built with #130 and openshift/origin#24956 and did not have any test failures.
/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: marun, mfojtik, Miciah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/cmd/infra/router/OWNERS [Miciah]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Miciah]

/hold cancel

[Miciah]

And, for the record, openshift/cluster-ingress-operator#399 (merged) addresses #130 (comment).

[Miciah]

ci-operator failure:

could not initialize namespace: could not create role binding for: rolebindings.rbac.authorization.k8s.io is forbidden: User "system:serviceaccount:ci:ci-operator" cannot create resource "rolebindings" in API group "rbac.authorization.k8s.io" in the namespace "ci-op-zfqqgl57"

/test unit

[marun]

/retest

[openshift-bot]

/retest

Please review the full test history for this PR and help us cut down flakes.

[openshift-ci-robot]

@marun: Some pull requests linked via external trackers have merged: . The following pull requests linked via external trackers have not merged:

• openshift/api#606 is closed
  Bugzilla bug 1813894 has been moved to the MODIFIED state.

In response to this:

Bug 1813894: Stop using service ca from service account token

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.