Skip to content

Bug 1797107: config/v1/types_proxy: Clarify trustedCA semantics #582

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-robot merged 1 commit into from
Jan 31, 2020
Merged

Bug 1797107: config/v1/types_proxy: Clarify trustedCA semantics #582

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 13 additions & 11 deletions config/v1/0000_03_config-operator_01_proxy.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,17 +62,19 @@ spec:
type: string
trustedCA:
description: "trustedCA is a reference to a ConfigMap containing a CA
certificate bundle used for client egress HTTPS connections. The certificate
bundle must be from the CA that signed the proxy's certificate and
be signed for everything. The trustedCA field should only be consumed
by a proxy validator. The validator is responsible for reading the
certificate bundle from required key \"ca-bundle.crt\" and copying
it to a ConfigMap named \"trusted-ca-bundle\" in the \"openshift-config-managed\"
namespace. The namespace for the ConfigMap referenced by trustedCA
is \"openshift-config\". Here is an example ConfigMap (in yaml): \n
apiVersion: v1 kind: ConfigMap metadata: name: user-ca-bundle namespace:
openshift-config data: ca-bundle.crt: | -----BEGIN CERTIFICATE-----
\ Custom CA certificate bundle. -----END CERTIFICATE-----"
certificate bundle. The trustedCA field should only be consumed by
a proxy validator. The validator is responsible for reading the certificate
bundle from the required key \"ca-bundle.crt\", merging it with the
system default trust bundle, and writing the merged trust bundle to
a ConfigMap named \"trusted-ca-bundle\" in the \"openshift-config-managed\"
namespace. Clients that expect to make proxy connections must use
the trusted-ca-bundle for all HTTPS requests to the proxy, and may
use the trusted-ca-bundle for non-proxy HTTPS requests as well. \n
The namespace for the ConfigMap referenced by trustedCA is \"openshift-config\".
Here is an example ConfigMap (in yaml): \n apiVersion: v1 kind: ConfigMap
metadata: name: user-ca-bundle namespace: openshift-config data:
\ ca-bundle.crt: | -----BEGIN CERTIFICATE----- Custom
CA certificate bundle. -----END CERTIFICATE-----"
type: object
required:
- name
Expand Down
56 changes: 30 additions & 26 deletions config/v1/0000_10_config-operator_01_build.crd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,19 +89,21 @@ spec:
type: string
trustedCA:
description: "trustedCA is a reference to a ConfigMap containing
a CA certificate bundle used for client egress HTTPS connections.
The certificate bundle must be from the CA that signed the
proxy's certificate and be signed for everything. The trustedCA
field should only be consumed by a proxy validator. The validator
is responsible for reading the certificate bundle from required
key \"ca-bundle.crt\" and copying it to a ConfigMap named
\"trusted-ca-bundle\" in the \"openshift-config-managed\"
namespace. The namespace for the ConfigMap referenced by trustedCA
is \"openshift-config\". Here is an example ConfigMap (in
yaml): \n apiVersion: v1 kind: ConfigMap metadata: name:
user-ca-bundle namespace: openshift-config data: ca-bundle.crt:
| -----BEGIN CERTIFICATE----- Custom CA certificate
bundle. -----END CERTIFICATE-----"
a CA certificate bundle. The trustedCA field should only be
consumed by a proxy validator. The validator is responsible
for reading the certificate bundle from the required key \"ca-bundle.crt\",
merging it with the system default trust bundle, and writing
the merged trust bundle to a ConfigMap named \"trusted-ca-bundle\"
in the \"openshift-config-managed\" namespace. Clients that
expect to make proxy connections must use the trusted-ca-bundle
for all HTTPS requests to the proxy, and may use the trusted-ca-bundle
for non-proxy HTTPS requests as well. \n The namespace for
the ConfigMap referenced by trustedCA is \"openshift-config\".
Here is an example ConfigMap (in yaml): \n apiVersion: v1
kind: ConfigMap metadata: name: user-ca-bundle namespace:
openshift-config data: ca-bundle.crt: | -----BEGIN
CERTIFICATE----- Custom CA certificate bundle. -----END
CERTIFICATE-----"
type: object
required:
- name
Expand Down Expand Up @@ -242,19 +244,21 @@ spec:
type: string
trustedCA:
description: "trustedCA is a reference to a ConfigMap containing
a CA certificate bundle used for client egress HTTPS connections.
The certificate bundle must be from the CA that signed the
proxy's certificate and be signed for everything. The trustedCA
field should only be consumed by a proxy validator. The validator
is responsible for reading the certificate bundle from required
key \"ca-bundle.crt\" and copying it to a ConfigMap named
\"trusted-ca-bundle\" in the \"openshift-config-managed\"
namespace. The namespace for the ConfigMap referenced by trustedCA
is \"openshift-config\". Here is an example ConfigMap (in
yaml): \n apiVersion: v1 kind: ConfigMap metadata: name:
user-ca-bundle namespace: openshift-config data: ca-bundle.crt:
| -----BEGIN CERTIFICATE----- Custom CA certificate
bundle. -----END CERTIFICATE-----"
a CA certificate bundle. The trustedCA field should only be
consumed by a proxy validator. The validator is responsible
for reading the certificate bundle from the required key \"ca-bundle.crt\",
merging it with the system default trust bundle, and writing
the merged trust bundle to a ConfigMap named \"trusted-ca-bundle\"
in the \"openshift-config-managed\" namespace. Clients that
expect to make proxy connections must use the trusted-ca-bundle
for all HTTPS requests to the proxy, and may use the trusted-ca-bundle
for non-proxy HTTPS requests as well. \n The namespace for
the ConfigMap referenced by trustedCA is \"openshift-config\".
Here is an example ConfigMap (in yaml): \n apiVersion: v1
kind: ConfigMap metadata: name: user-ca-bundle namespace:
openshift-config data: ca-bundle.crt: | -----BEGIN
CERTIFICATE----- Custom CA certificate bundle. -----END
CERTIFICATE-----"
type: object
required:
- name
Expand Down
18 changes: 11 additions & 7 deletions config/v1/types_proxy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,13 +41,17 @@ type ProxySpec struct {
// +optional
ReadinessEndpoints []string `json:"readinessEndpoints,omitempty"`

// trustedCA is a reference to a ConfigMap containing a CA certificate bundle used
// for client egress HTTPS connections. The certificate bundle must be from the CA
// that signed the proxy's certificate and be signed for everything. The trustedCA
// field should only be consumed by a proxy validator. The validator is responsible
// for reading the certificate bundle from required key "ca-bundle.crt" and copying
// it to a ConfigMap named "trusted-ca-bundle" in the "openshift-config-managed"
// namespace. The namespace for the ConfigMap referenced by trustedCA is
// trustedCA is a reference to a ConfigMap containing a CA certificate bundle.
// The trustedCA field should only be consumed by a proxy validator. The
// validator is responsible for reading the certificate bundle from the required
// key "ca-bundle.crt", merging it with the system default trust bundle,
// and writing the merged trust bundle to a ConfigMap named "trusted-ca-bundle"
// in the "openshift-config-managed" namespace. Clients that expect to make
// proxy connections must use the trusted-ca-bundle for all HTTPS requests to
// the proxy, and may use the trusted-ca-bundle for non-proxy HTTPS requests as
// well.
//
// The namespace for the ConfigMap referenced by trustedCA is
// "openshift-config". Here is an example ConfigMap (in yaml):
//
// apiVersion: v1
Expand Down
2 changes: 1 addition & 1 deletion config/v1/zz_generated.swagger_doc_generated.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.