Refactor compliance check to respect overrides - #40
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: richardsonnick The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
Adds a system for configuring component-specific TLS profile overrides. This system applies the apiserver profile by default. This can be overridden for components that have overrides available to them. Adds a yaml file for setting component-specific TLS profile overrides. Adds policy_test.go for testing the policy system.
| return nil, fmt.Errorf("failed to list KubeletConfigs: %v", err) | ||
| } | ||
|
|
||
| for _, kc := range kubeletConfigs.Items { |
There was a problem hiding this comment.
might be a convention of openshift - just thinking that MachineConfigPools can apply to the workers or the control plane or worker pools. This might mismatch if we do a ip/port look and just get the first we find.
|
/lgtm |
|
@richardsonnick: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
The most recent Enhancement Proposal for TLS compliance specifies that all components should respect only the apiserver CRD unless:
I check the "component" type by process name for the ingress controller and by port for kubelet (10250 and 10255).
Unit tests have been added/updated to verify this behavior.