Mount cert and add permissions to IDS controller to access managed cluster #1265
Conversation
| if managementClusterConnection == nil { | ||
| if esLicenseType, err = utils.GetElasticLicenseType(ctx, r.client, reqLogger); err != nil { | ||
| r.status.SetDegraded("Failed to get Elasticsearch license", err.Error()) | ||
| return reconcile.Result{}, err | ||
| } | ||
|
|
||
| managerInternalTLSSecret, err = utils.ValidateCertPair(r.client, |
There was a problem hiding this comment.
Depending on which pull is merged first, you may wanna change the key to "", such that it is not checked.
#1260
| }, | ||
| }, | ||
| } | ||
| if !c.managedCluster { |
There was a problem hiding this comment.
Just out of curiosity, do we still need this role at all in managed clusters?
There was a problem hiding this comment.
Right, IDS controller in managed cluster need permission to access licensekeys, globalthreatfeeds and globalnetworksets.
I'll remove the permissions for globalalerts, they are not needed in managed cluster anymore.
There was a problem hiding this comment.
I tested by removing globalalerts permission for IDS controller in managed cluster, if we do that then IDS in management doesn't have access to globalalerts in managed cluster. So we need to retain those permissions.
Suraiya-Hameed
force-pushed
the
es-watcher-replacement
branch
3 times, most recently
from
acd2d93
to
92b2f5d
Compare
Suraiya-Hameed
force-pushed
the
es-watcher-replacement
branch
from
92b2f5d
to
c7cb5f6
Compare
tmjd
added
enterprise
in management cluster to access GlobalAlert in managed cluster.
Suraiya-Hameed
force-pushed
the
es-watcher-replacement
branch
from
c7cb5f6
to
0288582
Compare
Suraiya-Hameed
added
merge-when-ready
and removed
docs-pr-required
release-note-required
labels
Description
As part of replacing Elastic watchers, IDS controller in management will watch for GlobalAlert in managed cluster and handle them. This PR is to mount tls-manager certificate and adds role needed to access managed cluster from management cluster and also disable GlobalAlert handling in managed cluster's IDS controller.
For PR author
make gen-filesmake gen-versionsFor PR reviewers
A note for code reviewers - all pull requests must have the following:
kind/bugif this is a bugfix.kind/enhancementif this is a a new feature.enterpriseif this PR applies to Calico Enterprise only.