Conversation
Previously we used a custom Authorino operator image (`quay.io/innabox/authorino-operator:latest`) to work around a conflict when mounting trusted CA certificates into the Authorino container. The upstream operator mounts TLS cert files via `subPath` at `/etc/ssl/certs/tls.crt`, and mounting the CA bundle ConfigMap as a directory volume at the same path caused container startup failures. The fix is to mount the CA bundle at `/etc/pki/ca-trust/extracted/pem` instead. On the Authorino container image (Red Hat-based), `/etc/ssl/certs` is a symlink to `/etc/pki/tls/certs`, and the file `ca-bundle.crt` there is a symlink to `/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem`. By mounting the CA bundle at this final target directory with the `items` field to rename `bundle.pem` to `tls-ca-bundle.pem`, Go's `crypto/x509` picks up the custom CA through the existing symlink chain when scanning `/etc/ssl/certs` for certificates. This avoids the conflict with the operator's `subPath` TLS mounts because the two mount points are in entirely separate directory trees. This change also simplifies `installAuthorino` in `kind.go` to apply the upstream operator manifests directly via URL, removing the download-replace-apply workaround. Related: Kuadrant/authorino-operator#282 Signed-off-by: Juan Hernandez <juan.hernandez@redhat.com>
jhernand
changed the title
|
@jhernand: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughThis PR simplifies the Authorino operator installation process by removing manual manifest download, image substitution via Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
internal/testing/kind.go (1)
863-874: Pin Authorino manifests to an immutable ref for reproducibility.The code uses mutable branch references (
refs/heads/release-v0.23.1) in three locations:
internal/testing/kind.golines 1168-1169: constant definitionmanifests/README.mdline 218: installation instructionscharts/README.mdline 220+: installation instructionsMutable branch refs introduce supply-chain drift risk—the manifest content can change between test runs. Switch to immutable tags (
refs/tags/v0.23.1) to ensure reproducible test execution across all three locations.♻️ Proposed fix
-const ( - authorinoManifests = "https://raw.githubusercontent.com/Kuadrant/authorino-operator/refs/heads/release-" + - authorinoVersion + "/config/deploy/manifests.yaml" -) +const ( + authorinoManifests = "https://raw.githubusercontent.com/Kuadrant/authorino-operator/refs/tags/" + + authorinoVersion + "/config/deploy/manifests.yaml" +)Update documentation references similarly.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@internal/testing/kind.go` around lines 863 - 874, Update the mutable branch refs for Authorino to immutable tag refs: replace any occurrences of "refs/heads/release-v0.23.1" (used where authorino manifests are defined/used—e.g., the constant that supplies authorinoManifests used in the Apply block in internal/testing/kind.go and the constant/variable that NewCommand() SetArgs("--filename", authorinoManifests) consumes) with "refs/tags/v0.23.1"; also update the corresponding installation instructions in manifests/README.md and charts/README.md to use the tag ref so the manifests are pinned to an immutable ref for reproducible tests. Ensure you change all three places (the constant in the code and the two README entries) consistently.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@internal/testing/kind.go`:
- Around line 863-874: Update the mutable branch refs for Authorino to immutable
tag refs: replace any occurrences of "refs/heads/release-v0.23.1" (used where
authorino manifests are defined/used—e.g., the constant that supplies
authorinoManifests used in the Apply block in internal/testing/kind.go and the
constant/variable that NewCommand() SetArgs("--filename", authorinoManifests)
consumes) with "refs/tags/v0.23.1"; also update the corresponding installation
instructions in manifests/README.md and charts/README.md to use the tag ref so
the manifests are pinned to an immutable ref for reproducible tests. Ensure you
change all three places (the constant in the code and the two README entries)
consistently.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 44b68800-8e40-4949-867e-f4fc342e62ff
📒 Files selected for processing (5)
charts/README.mdcharts/service/templates/authorino/authorino.yamlinternal/testing/kind.gomanifests/README.mdmanifests/base/authorino/authorino.yaml
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: adriengentil, jhernand The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
3 participants
Summary
/etc/pki/ca-trust/extracted/peminstead of/etc/ssl/certstoavoid a conflict with the Authorino operator's
subPathTLS cert mounts. On the RedHat-based Authorino image,
/etc/ssl/certsis a symlink to/etc/pki/tls/certs, andca-bundle.crtthere points through to/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem.By mounting at this final target directory, Go's
crypto/x509picks up the custom CAthrough the existing symlink chain without interfering with the operator.
with
quay.io/innabox/authorino-operator:latest. The upstream operator is now applieddirectly.
Related: Kuadrant/authorino-operator#282
Test plan
CrashLoopBackOffor mount errorsSummary by CodeRabbit
Release Notes
Documentation
Chores