Bug 1866818: Set proxy.config/cluster spec.trustedCA if have CA #4082
Conversation
An install config may specify an additional trusted bundle without specifying any proxy configuration. Before this commit, such an install config would produce a "user-ca-bundle" configmap but would not configure anything to use it. After this commit, such an install config produces the "user-ca-bundle" configmap and also adds a reference to the configmap in the spec.trustedCA field of the proxy.config/cluster object. As a result, cluster-network-operator will read "user-ca-bundle" and inject the additional trusted bundle into the "trusted-ca-bundle" configmap, which other operators, such as the authentication operator, use. This commit is related to bug 1866818. https://bugzilla.redhat.com/show_bug.cgi?id=1866818 * pkg/asset/manifests/proxy.go (Generate): Set spec.trustedCA if the install config specifies an additional trusted bundle, irrespective of whether proxy configuration is specified.
openshift-ci-robot
added
the
bugzilla/severity-urgent
|
@Miciah: This pull request references Bugzilla bug 1866818, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
the
bugzilla/valid-bug
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Dup of #2658 (which includes some of the backstory around its rejection)? |
|
@Miciah: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
Ah, you're right. This means https://docs.openshift.com/container-platform/4.5/networking/configuring-a-custom-pki.html is completely wrong, doesn't it? |
|
@Miciah: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@Miciah: This pull request references Bugzilla bug 1866818. The bug has been updated to no longer refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
3 participants
An install config may specify an additional trusted bundle without specifying any proxy configuration. Before this change, such an install config would produce a
user-ca-bundleconfigmap but would not configure anything to use it. After this change, such an install config produces theuser-ca-bundleconfigmap and also adds a reference to the configmap in thespec.trustedCAfield of theproxy.config/clusterobject. As a result, cluster-network-operator will readuser-ca-bundleand inject the additional trusted bundle into thetrusted-ca-bundleconfigmap, which other operators, such as the authentication operator, use.pkg/asset/manifests/proxy.go(Generate): Setspec.trustedCAif the install config specifies an additional trusted bundle, irrespective of whether proxy configuration is specified.