openshift
OCPBUGS-15827: Use sigs.k8s.io certwatcher for console serving certs
@TheRealJon: This pull request references Jira Issue OCPBUGS-15827, which is invalid:
- expected the bug to target the "4.16.0" version, but no target version was set
Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.
The bug has been updated to refer to the pull request using the external bug tracker.
In response to this:
Use CertWatcher to update console serving certificates at runtime.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
@TheRealJon: This pull request references Jira Issue OCPBUGS-15827, which is valid.
3 validation(s) were run on this bug
- bug is open, matching expected state (open)
- bug target version (4.16.0) matches configured target version for branch (4.16.0)
- bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
Requesting review from QA contact: /cc @juzhao
In response to this:
/jira refresh
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
Please try to minimize any use of controller-runtime, they are known to do things the weird way which oftentimes results in weird bugs.
Have a look at how actual kubernetes does this for its binaries - in https://github.com/kubernetes/kubernetes/blob/246d363ea4bab2ac99a938d0cee73d72fc44de45/staging/src/k8s.io/apiserver/pkg/server/secure_serving.go#L107-L145
@stlaz https://github.com/openshift/console-operator/pull/822 includes a similar change. Should we create a follow-on story to move the console webhook server away from controller-runtime as well?
Also, we use controller-runtime Client in our OperandsListHandler. Client and CertWatcher are all we use from that package, and they both seem to be pretty stable in the current version we are using. Is it worth rolling a new solution to move away from this package? I'm okay with doing that if it's worthwhile but just wanted to push back a little since this does seem to work fine for us as it is.
For any new code such as this, I'd suggest checking the core Kube code first. Consider the Kube serving logic for the webhook too, to be consistent among your binaries. Note that this serving logic is already baked in to your operator for its metrics endpoint. It would be great if the whole console was capable of eventually moving towards the standard upstream options system that uses this automatically.
@jhadvig Should we close this PR and use the k8s.io/apiserver package instead? I can open a new story for this since technically this bug was fixed by https://github.com/openshift/console-operator/pull/822 and https://github.com/openshift/console-operator/pull/833
@jhadvig This PR has been rebased and comments have been addressed. PTAL!
/retest-required
Remaining retests: 0 against base HEAD d6e2e1eb612c4f841f5ed1b11d7a5fab2e584672 and 2 for PR HEAD 805b9a485ecdf7a4a6fb80c8bcf69a2140b36c13 in total
/retest-required
Remaining retests: 0 against base HEAD f968847514463e0e1eed2bc068d191c4be59462f and 1 for PR HEAD 805b9a485ecdf7a4a6fb80c8bcf69a2140b36c13 in total
/retest-required
Remaining retests: 0 against base HEAD b3a6cdc5c456655b7c158e665cf88e8f87e66f32 and 0 for PR HEAD 805b9a485ecdf7a4a6fb80c8bcf69a2140b36c13 in total
/hold
Revision 805b9a485ecdf7a4a6fb80c8bcf69a2140b36c13 was retested 3 times: holding
[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: jhadvig, TheRealJon
The full list of commands accepted by this bot can be found here.
The pull request process is described here
- ~~OWNERS~~ [TheRealJon,jhadvig]
Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment
![openshift-ci[bot] avatar](https://avatars.githubusercontent.com/in/91280?v=4 "Published by a pub.dev verified publisher"){kind=small}
/retest-required
Remaining retests: 0 against base HEAD 03d0d6dfac3eee51ddfee013bf8d02ef1cd463da and 2 for PR HEAD 2c11c1a0f8bb9a3dd9efd5f45694e9b1ce73e669 in total