[release-4.13] OCPBUGS-13967, OCPBUGS-13964: Handle mTLS CRLs, and fix accidental CRL duplication #935

rfredette · 2023-05-23T15:33:17Z

Manual cherry pick of #930

Leave a stub of the CRL controller to clean up any existing configmaps. The stub controller will need to be removed in a future release Use cluster-wide proxy for CRL downloads when available Add a test with several test cases to test CRL management

openshift-ci-robot · 2023-05-23T15:33:25Z

@rfredette: This pull request references Jira Issue OCPBUGS-13964, which is invalid:

expected dependent Jira Issue OCPBUGS-9464 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Manual cherry pick of #930

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rfredette · 2023-05-23T15:42:09Z

/assign @Miciah
/assign @frobware

Assuming the same reviewers as the parent PR

rfredette · 2023-05-23T19:37:58Z

e2e-aws-operator won't pass until openshift/router#485 merges, but the other test failures should be unrelated.
/test e2e-azure-ovn
/test e2e-aws-ovn-single-node

sjenning · 2023-05-23T22:04:18Z

/hold

see #930 (comment)

sferich888 · 2023-05-25T13:08:20Z

@sjenning does this still need to be on hold? or are we replacing this with openshift/router#485
cc: @rfredette

… the ingress operator's environment

rfredette · 2023-06-01T21:53:23Z

@sferich888 This PR is needed in addition to openshift/router#485.
As far as the hold goes, it should remain on hold until #939 merges, although that should be happening as soon as it makes it through CI.

frobware · 2023-06-02T15:36:32Z

    client_tls_test.go:1322: stdout:
    client_tls_test.go:1322: stderr:
        cat: /var/lib/haproxy/mtls/latest/crls.pem: No such file or directory

This will continue to fail until openshift/router#485 is merged.

frobware · 2023-06-02T15:36:50Z

/lgtm
/hold waiting for openshift/router#485

lihongan · 2023-06-03T09:55:47Z

/jira refresh

openshift-ci-robot · 2023-06-03T09:55:54Z

@lihongan: This pull request references Jira Issue OCPBUGS-13964, which is valid. The bug has been moved to the POST state.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.13.z) matches configured target version for branch (4.13.z)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
dependent bug Jira Issue OCPBUGS-9464 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE))
dependent Jira Issue OCPBUGS-9464 targets the "4.14.0" version, which is one of the valid target versions: 4.14.0
bug has dependents

Requesting review from QA contact:
/cc @lihongan

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Miciah · 2023-06-05T20:58:29Z

/approve

The purpose of this PR is to remove logic from cluster-ingress-operator that is being moved to the router with openshift/router#485. This logic is covered by E2E tests in cluster-ingress-operator. We have discussed and addressed implications for upgrades (operator as well as operand) and for the cluster-wide egress proxy (which the operator now configures the router to use, if applicable, to download CRLs). Engineering and QE have tested these changes extensively and have not found any other issues.

/label backport-risk-assessed

openshift-ci · 2023-06-05T20:59:16Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Miciah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [Miciah]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

lihongan · 2023-06-06T02:36:37Z

/label cherry-pick-approved

Miciah · 2023-06-06T02:52:42Z

/hold cancel
per #935 (comment) since openshift/router#485 merged.

openshift-ci-robot · 2023-06-06T03:08:50Z

/retest-required

Remaining retests: 0 against base HEAD 502e351 and 2 for PR HEAD 73a446d in total

rfredette · 2023-06-06T04:54:47Z

Failed TestAWSELBConnectionIdleTimeout.
/retest

frobware · 2023-06-06T06:37:16Z

e2e-aws-operator - FAIL: TestAll/parallel/TestAWSELBConnectionIdleTimeout, which is bug https://issues.redhat.com/browse/OCPBUGS-13810.

Investigation for 13810 happening in: #940.

frobware · 2023-06-06T06:38:31Z

/retest-required

frobware · 2023-06-06T11:34:09Z

TestAWSELBConnectionIdleTimeout failed again.

/retest

rfredette · 2023-06-06T15:03:32Z

Looking at the test history, all of the runs after the router PR merged only failed TestAWSELBConnectionIdleTimeout in the test suite. There were some must-gather failures as well, but they seem to be flakes.

Miciah · 2023-06-06T15:03:50Z

/override ci/prow/e2e-aws-operator
based on #935 (comment).

openshift-ci · 2023-06-06T15:14:23Z

@Miciah: Overrode contexts on behalf of Miciah: ci/prow/e2e-aws-operator

Details

In response to this:

/override ci/prow/e2e-aws-operator
based on #935 (comment).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-06-06T15:14:40Z

@rfredette: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-operator	`73a446d`	link	true	`/test e2e-aws-operator`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2023-06-06T15:19:41Z

@rfredette: Jira Issue OCPBUGS-13964: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-13964 has been moved to the MODIFIED state.

Details

In response to this:

Manual cherry pick of #930

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

mffiedler · 2023-06-06T15:32:47Z

/label qe-approved

mffiedler · 2023-06-06T15:51:58Z

/remove-label qe-approved

removing label. incorrectly thought this was pre-merge tested

openshift-merge-robot · 2023-06-06T19:43:58Z

Fix included in accepted release 4.13.0-0.nightly-2023-06-06-122318

rfredette added 2 commits May 23, 2023 11:30

Add test case to test CRL updates

31894ef

openshift-ci bot requested review from knobunc and miheer May 23, 2023 15:33

openshift-ci bot assigned frobware and Miciah May 23, 2023

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 23, 2023

rfredette added 2 commits June 1, 2023 16:14

Pull operand proxy variables from the cluster proxy config instead of…

0ac4585

… the ingress operator's environment

Revert bump to library-go

73a446d

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jun 2, 2023

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Jun 3, 2023

openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jun 3, 2023

openshift-ci bot requested a review from lihongan June 3, 2023 09:55

openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Jun 5, 2023

openshift-ci bot assigned lihongan and melvinjoseph86 Jun 5, 2023

openshift-ci bot assigned ShudiLi Jun 5, 2023

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 5, 2023

Miciah mentioned this pull request Jun 5, 2023

[release-4.13] OCPBUGS-13967, OCPBUGS-13964: Handle mTLS CRLs, and fix accidental CRL duplication openshift/router#485

Merged

openshift-ci bot added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Jun 6, 2023

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 6, 2023

openshift-merge-robot merged commit 052f416 into openshift:release-4.13 Jun 6, 2023

openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Jun 6, 2023

openshift-ci bot removed the qe-approved Signifies that QE has signed off on this PR label Jun 6, 2023

[release-4.13] OCPBUGS-13967, OCPBUGS-13964: Handle mTLS CRLs, and fix accidental CRL duplication #935

[release-4.13] OCPBUGS-13967, OCPBUGS-13964: Handle mTLS CRLs, and fix accidental CRL duplication #935

Uh oh!

Conversation

rfredette commented May 23, 2023

Uh oh!

openshift-ci-robot commented May 23, 2023

Uh oh!

rfredette commented May 23, 2023

Uh oh!

rfredette commented May 23, 2023

Uh oh!

sjenning commented May 23, 2023

Uh oh!

sferich888 commented May 25, 2023

Uh oh!

rfredette commented Jun 1, 2023

Uh oh!

frobware commented Jun 2, 2023

Uh oh!

frobware commented Jun 2, 2023

Uh oh!

lihongan commented Jun 3, 2023

Uh oh!

openshift-ci-robot commented Jun 3, 2023

Uh oh!

Miciah commented Jun 5, 2023

Uh oh!

openshift-ci bot commented Jun 5, 2023

Uh oh!

lihongan commented Jun 6, 2023

Uh oh!

Miciah commented Jun 6, 2023

Uh oh!

openshift-ci-robot commented Jun 6, 2023

Uh oh!

rfredette commented Jun 6, 2023

Uh oh!

frobware commented Jun 6, 2023

Uh oh!

frobware commented Jun 6, 2023

Uh oh!

frobware commented Jun 6, 2023

Uh oh!

rfredette commented Jun 6, 2023

Uh oh!

Miciah commented Jun 6, 2023

Uh oh!

openshift-ci bot commented Jun 6, 2023

Uh oh!

openshift-ci bot commented Jun 6, 2023

Uh oh!

openshift-ci-robot commented Jun 6, 2023

Uh oh!

mffiedler commented Jun 6, 2023

Uh oh!

mffiedler commented Jun 6, 2023

Uh oh!

openshift-merge-robot commented Jun 6, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants