WIP - Mount trusted CA to the registry operand#349
WIP - Mount trusted CA to the registry operand#349adambkaplan wants to merge 4 commits intoopenshift:masterfrom
Conversation
* Injects the cluster proxy CA into /etc/pki/ca-trust/source/ca-bundle.crt * Tell the CVO to only create the proxyca ConfigMap
Comment out volume mounts to unblock other work.
openshift-ci-robot
added
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: adambkaplan The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
the
approved
|
/assign @coreydaley |
| configapiv1 "github.com/openshift/api/config/v1" | ||
| configlisters "github.com/openshift/client-go/config/listers/config/v1" | ||
| "github.com/openshift/cluster-image-registry-operator/pkg/apis/imageregistry/v1" | ||
| v1 "github.com/openshift/cluster-image-registry-operator/pkg/apis/imageregistry/v1" |
There was a problem hiding this comment.
this seems redundant, your ide probably did it autonomously.
There was a problem hiding this comment.
yep. vscode's Golang extension seems to do this if multiple packages have the same name.
| // Registry runs update-ca-trust extract on startup, which merges the registry CAs with the cluster's trusted CAs | ||
| // into a single CA bundle. | ||
| vol = corev1.Volume{ | ||
| Name: "trusted-ca", |
There was a problem hiding this comment.
nit: I think you could use params.TrustedCA.Name here also, but this might be cleaner.
There was a problem hiding this comment.
will do once the ca controller lands
| value: "cluster-image-registry-operator" | ||
| - name: IMAGE | ||
| value: docker.io/openshift/origin-docker-registry:latest | ||
| # volumeMounts: |
There was a problem hiding this comment.
I assume you are going to remove these and just have them commented out for testing?
There was a problem hiding this comment.
@coreydaley Question on this one: the work being made on this PR is to mount the trusted-ca config map on the operand, not on the operator, right? If that is indeed the case then we gonna need these lines to be active in order to mount the config map also on operator during the deployment, right?
There was a problem hiding this comment.
@coreydaley yes once the CA controller lands
@ricardomaraschini this PR is built off of #340, which will mount trusted-ca to the operator. I did that because I also need to mount trusted-ca to the registry itself (operand)
|
Just as a reminder, I need this on to finish #342 |
adambkaplan
force-pushed
the
watch-trusted-ca
branch
from
81b5ecc to
f172b5c
Compare
openshift-ci-robot
added
size/L
|
@adambkaplan: The following tests failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
@adambkaplan: PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
the
needs-rebase
|
/close Moved to #360 |
|
@adambkaplan: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
4 participants
Building on top of #340 - mounting the cluster trusted CA to the "low-priority" trust source at
/usr/share/pki/ca-trust-source/within the registry.The registry calls
update-ca-trust extractto create the combined CA bundle, which includes the CA for the internal registry and other externally trusted registries.