[release-v1.38] CI-1933: enable OpenShift Ingress→Route for the manager#4791
Merged
rene-dekker merged 2 commits intoMay 8, 2026
Merged
Conversation
Two small render changes so customers can front the manager Service with a networking.k8s.io/v1 Ingress and let OpenShift's ingress-to-route controller auto-generate a reencrypt Route: - manager Service: name the 9443 port "https". The conversion needs a named target port. - when the Authentication CR uses the OpenShift IDP, render an Opaque Secret "tigera-ca-public" in calico-system holding tls.crt copied from the operator CA (tigera-ca-private). Customers reference it via route.openshift.io/destination-ca-certificate-secret on the Ingress. Cleaned up automatically when the IDP changes or the Authentication CR is removed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The original PR rendered the secret in calico-system. On v1.38 the manager Service is in tigera-manager, and OpenShift's ingress-to-route controller does a same-namespace lookup against the Ingress, so the secret has to live alongside the Service. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Brian-McM
approved these changes
May 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #4763 to release-v1.38.
Summary
https. OpenShift's ingress-to-route conversion needs a named target port.tigera-ca-publicincalico-systemcontainingtls.crtfrom the operator CA (tigera-ca-private). Cleaned up automatically when the IDP changes or the Authentication CR is removed.Conflict resolution
authentication_controller.go: keptinstallvariable name (master usedinstallationSpec); added newTigeraCAKeyPairfield; reformatted alignment.manager.go: kept v1.38'sTigeraComponentPolicyPrefixand lowercasemanagerPort(master usedCalicoComponentPolicyPrefixand exportedManagerPort); added the newManagerPortNameconstant andNameon the Service port.dex.go: keptTigeraComponentPolicyPrefix + "allow-tigera-dex"(master usedCalicoComponentPolicyPrefix + "dex"); added newTigeraCAPublicSecretNameconstant. Rest of the patch (config field, Objects() branch, helper method) applied cleanly.