Skip to content

[release-4.13] OCPBUGS-13967, OCPBUGS-13964: Handle mTLS CRLs, and fix accidental CRL duplication #485

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
openshift-merge-robot merged 3 commits into from
Jun 6, 2023
Merged

[release-4.13] OCPBUGS-13967, OCPBUGS-13964: Handle mTLS CRLs, and fix accidental CRL duplication #485

openshift-merge-robot merged 3 commits into from
Jun 6, 2023

Conversation

@openshift-cherrypick-robot
Copy link

@openshift-cherrypick-robot openshift-cherrypick-robot commented May 23, 2023

This is an automated cherry-pick of #472

/assign rfredette

rfredette added 3 commits May 23, 2023 15:10
@rfredette
Download and manage CRLs in openshift-router
876f51a
@rfredette
Cache current CRLs in memory instead of re-parsing from disk
971e612 
The CRLs on disk don't include enough information to accurately
determine which CA certificate they were downloaded for. Instead of
re-parsing the CRLs on disk, keep them in a map indexed by the CA's
subject key, so we can avoid unnecessary downloads and incorrect
attribution.
@rfredette
Revert to pkix.CertificateList instead of x509.RevocationList
9af59fc 
Allows easier backporting to releases reliant on go 1.18 or older
@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request May 23, 2023
Merged
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented May 23, 2023

@openshift-cherrypick-robot: Jira Issue OCPBUGS-9464 has been cloned as Jira Issue OCPBUGS-13964. Will retitle bug to link to clone.
/retitle [release-4.13] OCPBUGS-6661, OCPBUGS-13964: Handle mTLS CRLs, and fix accidental CRL duplication

Details

In response to this:

This is an automated cherry-pick of #472

/assign rfredette

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot changed the title [release-4.13] OCPBUGS-6661, OCPBUGS-9464: Handle mTLS CRLs, and fix accidental CRL duplication [release-4.13] OCPBUGS-6661, OCPBUGS-13964: Handle mTLS CRLs, and fix accidental CRL duplication May 23, 2023
@openshift-ci-robot openshift-ci-robot added jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels May 23, 2023
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented May 23, 2023

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-13964, which is invalid:

  • expected dependent Jira Issue OCPBUGS-9464 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This is an automated cherry-pick of #472

/assign rfredette

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci openshift-ci bot requested review from candita and knobunc May 23, 2023 15:17
@rfredette
Copy link
Contributor

rfredette commented May 23, 2023

/retitle [release-4.13] OCPBUGS-13967, OCPBUGS-13964: Handle mTLS CRLs, and fix accidental CRL duplication

@openshift-ci openshift-ci bot changed the title [release-4.13] OCPBUGS-6661, OCPBUGS-13964: Handle mTLS CRLs, and fix accidental CRL duplication [release-4.13] OCPBUGS-13967, OCPBUGS-13964: Handle mTLS CRLs, and fix accidental CRL duplication May 23, 2023
@rfredette
Copy link
Contributor

rfredette commented May 23, 2023

/assign @Miciah
/assign @frobware

Assuming the same reviewers as the parent PR

@frobware
Copy link
Contributor

frobware commented May 23, 2023

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label May 23, 2023
@rfredette
Copy link
Contributor

rfredette commented May 23, 2023

/retest

@rfredette rfredette mentioned this pull request May 23, 2023
Merged
@openshift-ci
Copy link
Contributor

openshift-ci bot commented May 23, 2023

@openshift-cherrypick-robot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@frobware
Copy link
Contributor

frobware commented Jun 2, 2023

/approve

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 2, 2023
@lihongan
Copy link
Contributor

lihongan commented Jun 3, 2023

/jira refresh

@openshift-ci-robot openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Jun 3, 2023
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jun 3, 2023

@lihongan: This pull request references Jira Issue OCPBUGS-13964, which is valid.

6 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target version (4.13.z) matches configured target version for branch (4.13.z)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
  • dependent bug Jira Issue OCPBUGS-9464 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE))
  • dependent Jira Issue OCPBUGS-9464 targets the "4.14.0" version, which is one of the valid target versions: 4.14.0
  • bug has dependents

Requesting review from QA contact:
/cc @lihongan

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot openshift-ci-robot removed the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Jun 3, 2023
@openshift-ci openshift-ci bot requested a review from lihongan June 3, 2023 09:56
@Miciah
Copy link
Contributor

Miciah commented Jun 5, 2023

/approve

The purpose of this PR is to move logic to the router that is being removed from cluster-ingress-operator with openshift/cluster-ingress-operator#935. This logic is covered by E2E tests in cluster-ingress-operator. We have discussed and addressed implications for upgrades (operator as well as operand) and for the cluster-wide egress proxy (which the operator now configures the router to use, if applicable, to download CRLs). Engineering and QE have tested these changes extensively and have not found any other issues.

/label backport-risk-assessed

@openshift-ci openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Jun 5, 2023
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jun 5, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: frobware, Miciah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@lihongan
Copy link
Contributor

lihongan commented Jun 6, 2023

/label cherry-pick-approved

@openshift-ci openshift-ci bot added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Jun 6, 2023
@openshift-merge-robot openshift-merge-robot merged commit 065deab into openshift:release-4.13 Jun 6, 2023
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jun 6, 2023

@openshift-cherrypick-robot: Jira Issue OCPBUGS-13964: Some pull requests linked via external trackers have merged:

The following pull requests linked via external trackers have not merged:

These pull request must merge or be unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-13964 has not been moved to the MODIFIED state.

Details

In response to this:

This is an automated cherry-pick of #472

/assign rfredette

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@mffiedler
Copy link

mffiedler commented Jun 6, 2023

/label qe-approved

@openshift-ci openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Jun 6, 2023
@mffiedler
Copy link

mffiedler commented Jun 6, 2023

/remove-label qe-approved

removing label. incorrectly thought this was pre-merge tested

@openshift-ci openshift-ci bot removed the qe-approved Signifies that QE has signed off on this PR label Jun 6, 2023
@openshift-merge-robot
Copy link
Contributor

openshift-merge-robot commented Jun 6, 2023

Fix included in accepted release 4.13.0-0.nightly-2023-06-06-122318

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@candita candita Awaiting requested review from candita

@knobunc knobunc Awaiting requested review from knobunc

@lihongan lihongan Awaiting requested review from lihongan

Assignees

@rfredette rfredette

@frobware frobware

@Miciah Miciah

@lihongan lihongan

@melvinjoseph86 melvinjoseph86

@ShudiLi ShudiLi

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

10 participants

@openshift-cherrypick-robot @openshift-ci-robot @rfredette @frobware @lihongan @Miciah @mffiedler @openshift-merge-robot @melvinjoseph86 @ShudiLi