Skip to content

STOR-2954: feat: have CVO inject the centralized TLS configuration into the operator's config #703

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Jun 21, 2026
+50 −8
Merged

STOR-2954: feat: have CVO inject the centralized TLS configuration into the operator's config #703

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions manifests/04_configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
apiVersion: v1
kind: ConfigMap
metadata:
namespace: openshift-cluster-storage-operator
name: cluster-storage-operator-config
annotations:
include.release.openshift.io/ibm-cloud-managed: "true"
include.release.openshift.io/self-managed-high-availability: "true"
include.release.openshift.io/single-node-developer: "true"
capability.openshift.io/name: Storage
config.openshift.io/inject-tls: "true"
data:
config.yaml: |
apiVersion: operator.openshift.io/v1alpha1
kind: GenericOperatorConfig
12 changes: 12 additions & 0 deletions manifests/10_deployment-hypershift.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@ spec:
- args:
- start
- -v=2
- --config=/var/run/configmaps/config/config.yaml
- --terminate-on-files=/var/run/configmaps/config/config.yaml
Comment on lines +27 to +28

@jsafrane jsafrane Jun 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Who creates the ConfigMap in a hosted control plane? I think it will need something like openshift/hypershift#8011 to create it there.

We can merge this PR + then someone must copy 10_deployment-hypershift.yaml‎ to hypershift here and add ConfigMap creation in the same hypershift PR to make sure nothing breaks.

@ingvagabund ingvagabund Jun 7, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gotcha. I can do it.

- --terminate-on-files=/var/run/secrets/serving-cert/tls.crt
- --terminate-on-files=/var/run/secrets/serving-cert/tls.key
- --guest-kubeconfig=/etc/guest-kubeconfig/kubeconfig
Expand Down Expand Up @@ -131,6 +133,10 @@ spec:
readOnlyRootFilesystem: true
terminationMessagePolicy: FallbackToLogsOnError
volumeMounts:
- mountPath: /var/run/secrets/serving-cert
name: cluster-storage-operator-serving-cert
- mountPath: /var/run/configmaps/config
name: config
- mountPath: /etc/guest-kubeconfig
name: guest-kubeconfig
securityContext:
Expand All @@ -139,6 +145,12 @@ spec:
type: RuntimeDefault
serviceAccountName: cluster-storage-operator
volumes:
- name: cluster-storage-operator-serving-cert
secret:
secretName: cluster-storage-operator-serving-cert
- configMap:
name: cluster-storage-operator-config
name: config
- name: guest-kubeconfig
secret:
secretName: service-network-admin-kubeconfig
7 changes: 7 additions & 0 deletions manifests/10_deployment-ibm-cloud-managed.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,8 @@ spec:
- args:
- start
- -v=2
- --config=/var/run/configmaps/config/config.yaml
- --terminate-on-files=/var/run/configmaps/config/config.yaml
- --terminate-on-files=/var/run/secrets/serving-cert/tls.crt
- --terminate-on-files=/var/run/secrets/serving-cert/tls.key
command:
Expand Down Expand Up @@ -121,6 +123,8 @@ spec:
volumeMounts:
- mountPath: /var/run/secrets/serving-cert
name: cluster-storage-operator-serving-cert
- mountPath: /var/run/configmaps/config
name: config
priorityClassName: system-cluster-critical
securityContext:
runAsNonRoot: true
Expand All @@ -144,3 +148,6 @@ spec:
- name: cluster-storage-operator-serving-cert
secret:
secretName: cluster-storage-operator-serving-cert
- configMap:
name: cluster-storage-operator-config
name: config
7 changes: 7 additions & 0 deletions manifests/10_deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,8 @@ spec:
args:
- start
- -v=2
- --config=/var/run/configmaps/config/config.yaml
- --terminate-on-files=/var/run/configmaps/config/config.yaml
- --terminate-on-files=/var/run/secrets/serving-cert/tls.crt
- --terminate-on-files=/var/run/secrets/serving-cert/tls.key
ports:
Expand Down Expand Up @@ -143,7 +145,12 @@ spec:
volumeMounts:
- mountPath: /var/run/secrets/serving-cert
name: cluster-storage-operator-serving-cert
- mountPath: /var/run/configmaps/config
name: config
volumes:
- name: cluster-storage-operator-serving-cert
secret:
secretName: cluster-storage-operator-serving-cert
- name: config
configMap:
name: cluster-storage-operator-config
17 changes: 9 additions & 8 deletions profile-patches/hypershift/10_deployment.yaml-patch
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,18 +19,19 @@
- op: remove
path: /spec/template/spec/priorityClassName

# Add guest-kubeconfig volume
# Add guest-kubeconfig volume (append to existing volumes)
- op: add
path: /spec/template/spec/volumes
path: /spec/template/spec/volumes/-
value:
- name: guest-kubeconfig
secret:
secretName: service-network-admin-kubeconfig
name: guest-kubeconfig
secret:
secretName: service-network-admin-kubeconfig
# Add guest-kubeconfig volumeMount (append to existing volumeMounts)
- op: add
path: /spec/template/spec/containers/0/volumeMounts
path: /spec/template/spec/containers/0/volumeMounts/-
value:
- name: guest-kubeconfig
mountPath: /etc/guest-kubeconfig
name: guest-kubeconfig
mountPath: /etc/guest-kubeconfig

- op: add
path: /spec/template/spec/containers/0/env/33
Expand Down