Bug 2010921: Azure Stack: add trust bundle to cloud config #5248

patrickdillon · 2021-09-28T15:51:53Z

Adds CA for self-signed certs to the cloud provider config on Azure Stack Hub platform. Some environments, such as our internal dedicated Azure Stack environment, may use self-signed certs for the armEndpoint. This PR takes a bundle from installConfig.additionalTrustBundle and adds it to the cloud provider config with the key ca-bundle.pem.

$ head ash-ca-bundle/m/manifests/cloud-provider-config.yaml 
apiVersion: v1
data:
  ca-bundle.pem: |
    -----BEGIN CERTIFICATE-----
    MIIDgjCCAmqgAwIBAgIQdrn6bdq60qRPxujNuJEL0DANBgkqhkiG9w0BAQsFADBA
    MRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFjAUBgoJkiaJk/IsZAEZFgZ3d3RhdGMx
    DzANBgNVBAMTBkFUQy1DQTAeFw0xNTA5MDgxNTM2NThaFw0yNTA5MDgxNTQ2NTda
    MEAxFTATBgoJkiaJk/IsZAEZFgVsb2NhbDEWMBQGCgmSJomT8ixkARkWBnd3dGF0
    YzEPMA0GA1UEAxMGQVRDLUNBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
    AQEAxyGyv2thsIXb5sn3FucF1NnCLMSMPGCpGr8i6QOoCi1Ct22ooFpofLgf05w0

I will create a BZ soon.

Adds CA for self-signed certs to the cloud provider config on Azure Stack Hub platform.

staebler · 2021-09-29T13:44:13Z

@patrickdillon Since the e2e job for ASH is not working at the moment, can you show me with a local installation that the CA is making it into the configmap in the openshift-config and openshift-config-managed namespaces?

patrickdillon · 2021-10-01T15:11:23Z

@patrickdillon Since the e2e job for ASH is not working at the moment, can you show me with a local installation that the CA is making it into the configmap in the openshift-config and openshift-config-managed namespaces?

Will do. I'm assuming the managed config is created after bootstrap, so I can't test it right now due to our main ASH environment being down. Will get on it ASAP

patrickdillon · 2021-10-01T22:35:28Z

/test e2e-azurestack-upi

patrickdillon · 2021-10-01T23:40:03Z

/test e2e-azurestack

openshift-ci · 2021-10-05T16:02:40Z

@patrickdillon: This pull request references Bugzilla bug 2010921, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.10.0) matches configured target release for branch (4.10.0)
bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

No GitHub users were found matching the public email listed for the QA contact in Bugzilla (gpei@redhat.com), skipping review request.

Details

In response to this:

Bug 2010921: Azure Stack: add trust bundle to cloud config

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

patrickdillon · 2021-10-07T21:24:00Z

/test e2e-azurestack-upi

patrickdillon · 2021-10-12T15:27:59Z

/test e2e-azurestack-upi

openshift-ci · 2021-10-12T16:14:33Z

@patrickdillon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-workers-rhel7	`22c02bb`	link	false	`/test e2e-aws-workers-rhel7`
ci/prow/e2e-aws-workers-rhel8	`22c02bb`	link	false	`/test e2e-aws-workers-rhel8`
ci/prow/e2e-libvirt	`22c02bb`	link	false	`/test e2e-libvirt`
ci/prow/e2e-aws-fips	`22c02bb`	link	false	`/test e2e-aws-fips`
ci/prow/e2e-metal-ipi-ovn-ipv6	`22c02bb`	link	false	`/test e2e-metal-ipi-ovn-ipv6`
ci/prow/e2e-crc	`22c02bb`	link	false	`/test e2e-crc`
ci/prow/e2e-azurestack	`22c02bb`	link	false	`/test e2e-azurestack`
ci/prow/e2e-azurestack-upi	`22c02bb`	link	false	`/test e2e-azurestack-upi`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

patrickdillon · 2021-10-19T15:25:14Z

These changes are being carried through to the managed config:

$ oc describe cm kube-cloud-config -n openshift-config-managed | head
Name:         kube-cloud-config
Namespace:    openshift-config-managed
Labels:       <none>
Annotations:  <none>

Data
====
ca-bundle.pem:
----
-----BEGIN CERTIFICATE-----

and the installer-created config:

$ oc describe cm -n openshift-config cloud-provider-config | head
Name:         cloud-provider-config
Namespace:    openshift-config
Labels:       <none>
Annotations:  <none>

Data
====
ca-bundle.pem:
----
-----BEGIN CERTIFICATE-----

@staebler I think we are ready to merge this. I tested this in conjunction with openshift/cluster-cloud-controller-manager-operator#136 and was able to successfully run the CCMO

staebler

/lgtm
/approve

openshift-ci · 2021-10-20T00:52:35Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: staebler

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [staebler]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2021-10-20T00:52:52Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: staebler

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [staebler]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2021-10-20T02:13:47Z

/retest-required

Please review the full test history for this PR and help us cut down flakes.

openshift-ci · 2021-10-20T03:30:17Z

@patrickdillon: All pull requests linked via external trackers have merged:

openshift/installer#5248

Bugzilla bug 2010921 has been moved to the MODIFIED state.

Details

In response to this:

Bug 2010921: Azure Stack: add trust bundle to cloud config

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

patrickdillon · 2021-10-20T14:37:58Z

/cherry-pick release-4.9

openshift-cherrypick-robot · 2021-10-20T14:38:39Z

@patrickdillon: new pull request created: #5318

Details

In response to this:

/cherry-pick release-4.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

bottkars · 2021-11-04T10:21:52Z

@patrickdillon , for the initial bootstrap vm, you might consider changing the location information for the BOOTSTRAP_URL from https to http, e.g.
http://ocpcluster1sa.blob.local.azurestack.external/files/bootstrap.ign
that will work then for SelfSigned CA´s

Azure Stack: add trust bundle to cloud config

22c02bb

Adds CA for self-signed certs to the cloud provider config on Azure Stack Hub platform.

openshift-ci bot requested review from jstuever and rna-afk September 28, 2021 15:52

patrickdillon changed the title ~~Azure Stack: add trust bundle to cloud config~~ Bug 2010921: Azure Stack: add trust bundle to cloud config Oct 5, 2021

openshift-ci bot added the bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. label Oct 5, 2021

openshift-ci bot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label Oct 5, 2021

staebler approved these changes Oct 20, 2021

View reviewed changes

openshift-ci bot assigned staebler Oct 20, 2021

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 20, 2021

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 20, 2021

openshift-merge-robot merged commit 1a47710 into openshift:master Oct 20, 2021

openshift-cherrypick-robot mentioned this pull request Oct 20, 2021

[release-4.9] Bug 2012173: Azure Stack: add trust bundle to cloud config #5318

Closed

lobziik mentioned this pull request Oct 21, 2021

[release-4.9] Bug 2015503: User CA bundle sync controller openshift/cluster-cloud-controller-manager-operator#138

Merged

Bug 2010921: Azure Stack: add trust bundle to cloud config #5248

Bug 2010921: Azure Stack: add trust bundle to cloud config #5248

Uh oh!

Conversation

patrickdillon commented Sep 28, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

staebler commented Sep 29, 2021

Uh oh!

patrickdillon commented Oct 1, 2021

Uh oh!

patrickdillon commented Oct 1, 2021

Uh oh!

patrickdillon commented Oct 1, 2021

Uh oh!

openshift-ci bot commented Oct 5, 2021

Uh oh!

patrickdillon commented Oct 7, 2021

Uh oh!

patrickdillon commented Oct 12, 2021

Uh oh!

openshift-ci bot commented Oct 12, 2021

Uh oh!

patrickdillon commented Oct 19, 2021

Uh oh!

staebler left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Oct 20, 2021

Uh oh!

openshift-ci bot commented Oct 20, 2021

Uh oh!

openshift-bot commented Oct 20, 2021

Uh oh!

openshift-ci bot commented Oct 20, 2021

Uh oh!

patrickdillon commented Oct 20, 2021

Uh oh!

openshift-cherrypick-robot commented Oct 20, 2021

Uh oh!

bottkars commented Nov 4, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

patrickdillon commented Sep 28, 2021 •

edited

Loading