OSASINFRA-3731: openstack: Consume CA cert from CCO secret #557
Conversation
|
@stephenfin: This pull request references OSASINFRA-3731 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
openshift-ci
bot
added
the
do-not-merge/hold
|
@stephenfin: This pull request references OSASINFRA-3731 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Do what we previously did for the openstack-cinder controller but for the openstack-manila controller. In effect, we're really just reflecting the changes made in cluster-storage-operator in [1]. However, we do need to add some logic to detect where we are consuming our CA cert from so that we can match forthcoming changes to our assets. While here, we also replace use of the deprecated `ioutil.ReadFile` function in favour of its suggested replacement, `os.ReadFile` [2]. We also replace use of `os.IsNotExist` in favour of its suggested replacement, `errors.Is(err, fs.ErrNotExist)` [3]. [1] github.com/openshift/cluster-storage-operator/pull/557 [2] https://pkg.go.dev/io/ioutil#ReadFile [3] https://pkg.go.dev/os#IsNotExist Signed-off-by: Stephen Finucane <[email protected]>
|
/lgtm |
|
@stephenfin: This pull request references OSASINFRA-3731 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
stephenfin
force-pushed
the
OSASINFRA-3731
branch
from
771f829 to
44edf4c
Compare
Do what we previously did for the openstack-cinder controller but for the openstack-manila controller. In effect, we're really just reflecting the changes made in cluster-storage-operator in [1]. However, we do need to add some logic to detect where we are consuming our CA cert from so that we can match forthcoming changes to our assets. While here, we also replace use of the deprecated `ioutil.ReadFile` function in favour of its suggested replacement, `os.ReadFile` [2]. We also replace use of `os.IsNotExist` in favour of its suggested replacement, `errors.Is(err, fs.ErrNotExist)` [3]. [1] github.com/openshift/cluster-storage-operator/pull/557 [2] https://pkg.go.dev/io/ioutil#ReadFile [3] https://pkg.go.dev/os#IsNotExist Signed-off-by: Stephen Finucane <[email protected]>
Do what we previously did for the openstack-cinder controller but for the openstack-manila controller. In effect, we're really just reflecting the changes made in cluster-storage-operator in [1]. However, we do need to add some logic to detect where we are consuming our CA cert from so that we can match forthcoming changes to our assets. While here, we also replace use of the deprecated `ioutil.ReadFile` function in favour of its suggested replacement, `os.ReadFile` [2]. We also replace use of `os.IsNotExist` in favour of its suggested replacement, `errors.Is(err, fs.ErrNotExist)` [3]. [1] github.com/openshift/cluster-storage-operator/pull/557 [2] https://pkg.go.dev/io/ioutil#ReadFile [3] https://pkg.go.dev/os#IsNotExist Signed-off-by: Stephen Finucane <[email protected]>
stephenfin
force-pushed
the
OSASINFRA-3731
branch
from
44edf4c to
22ca446
Compare
Do what we previously did for the openstack-cinder controller but for the openstack-manila controller. In effect, we're really just reflecting the changes made in cluster-storage-operator in [1]. However, we do need to add some logic to detect where we are consuming our CA cert from so that we can match forthcoming changes to our assets. While here, we also replace use of the deprecated `ioutil.ReadFile` function in favour of its suggested replacement, `os.ReadFile` [2]. We also replace use of `os.IsNotExist` in favour of its suggested replacement, `errors.Is(err, fs.ErrNotExist)` [3]. [1] github.com/openshift/cluster-storage-operator/pull/557 [2] https://pkg.go.dev/io/ioutil#ReadFile [3] https://pkg.go.dev/os#IsNotExist Signed-off-by: Stephen Finucane <[email protected]>
stephenfin
force-pushed
the
OSASINFRA-3731
branch
from
22ca446 to
31c1820
Compare
|
/retest |
|
/lgtm |
|
/test hypershift-e2e-openstack-csi-manila |
|
@MaysaMacedo: The specified target(s) for The following commands are available to trigger optional jobs: Use In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/test hypershift-e2e-openstack-aws-csi-manila hypershift-e2e-openstack-aws-csi-cinder |
|
@MaysaMacedo: No presubmit jobs available for openshift/cluster-storage-operator@main In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/unhold openshift/cloud-credential-operator#780 is merged |
openshift-ci
bot
removed
the
do-not-merge/hold
openshift-merge-robot
removed
the
needs-rebase
As noted inline, the definition in the base asset was only used in the generated standalone asset, so it actually belongs in the standalone patch. This has no impact on the generated assets. Signed-off-by: Stephen Finucane <[email protected]>
Signed-off-by: Stephen Finucane <[email protected]>
This at least tells you what the secret is for. Signed-off-by: Stephen Finucane <[email protected]>
This is going to be superseded in a coming change. Rename it in preparation. Signed-off-by: Stephen Finucane <[email protected]>
cloud-credential-operator now supports deploying the CA cert to the secrets it generates, which means we can start consuming it from there rather than from configuration. Signed-off-by: Stephen Finucane <[email protected]>
Signed-off-by: Stephen Finucane <[email protected]>
It's easier to understand and consistent with openstack-cinder. The only changes to the generated assets are to do with ordering (i.e. irrelevant). Signed-off-by: Stephen Finucane <[email protected]>
This is going to be superseded in a coming change. Rename it in preparation. Signed-off-by: Stephen Finucane <[email protected]>
As we did for openstack-cinder before, now do for openstack-manila. We also strip some trailing slashes from volumes mounts: they're unnecessary. Signed-off-by: Stephen Finucane <[email protected]>
|
More conflicts due to #564. Here is the diff this time. Again, nothing unexpected: |
stephenfin
force-pushed
the
OSASINFRA-3731
branch
from
2c50b22 to
b8ee279
Compare
|
/retest Not related to these changes, but might as well while we wait. |
|
The The Clearly neither are anything to do with this PR. |
|
@stephenfin: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: gnufied, stephenfin The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
/label qe-approved |
openshift-ci
bot
added
the
qe-approved
|
@stephenfin: This pull request references OSASINFRA-3731 which is a valid jira issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-merge-bot
bot
merged commit 678bf4a
into
openshift:main
|
[ART PR BUILD NOTIFIER] Distgit: cluster-storage-operator |
Do what we previously did for the openstack-cinder controller but for the openstack-manila controller. In effect, we're really just reflecting the changes made in cluster-storage-operator in [1]. However, we do need to add some logic to detect where we are consuming our CA cert from so that we can match forthcoming changes to our assets. While here, we also replace use of the deprecated `ioutil.ReadFile` function in favour of its suggested replacement, `os.ReadFile` [2]. We also replace use of `os.IsNotExist` in favour of its suggested replacement, `errors.Is(err, fs.ErrNotExist)` [3]. [1] github.com/openshift/cluster-storage-operator/pull/557 [2] https://pkg.go.dev/io/ioutil#ReadFile [3] https://pkg.go.dev/os#IsNotExist Signed-off-by: Stephen Finucane <[email protected]>
Do what we previously did for the openstack-cinder controller but for the openstack-manila controller. In effect, we're really just reflecting the changes made in cluster-storage-operator in [1]. However, we do need to add some logic to detect where we are consuming our CA cert from so that we can match forthcoming changes to our assets. While here, we also replace use of the deprecated `ioutil.ReadFile` function in favour of its suggested replacement, `os.ReadFile` [2]. We also replace use of `os.IsNotExist` in favour of its suggested replacement, `errors.Is(err, fs.ErrNotExist)` [3]. [1] github.com/openshift/cluster-storage-operator/pull/557 [2] https://pkg.go.dev/io/ioutil#ReadFile [3] https://pkg.go.dev/os#IsNotExist Signed-off-by: Stephen Finucane <[email protected]>
Do what we previously did for the openstack-cinder controller but for the openstack-manila controller. In effect, we're really just reflecting the changes made in cluster-storage-operator in [1]. However, we do need to add some logic to detect where we are consuming our CA cert from so that we can match forthcoming changes to our assets. While here, we also replace use of the deprecated `ioutil.ReadFile` function in favour of its suggested replacement, `os.ReadFile` [2]. We also replace use of `os.IsNotExist` in favour of its suggested replacement, `errors.Is(err, fs.ErrNotExist)` [3]. [1] github.com/openshift/cluster-storage-operator/pull/557 [2] https://pkg.go.dev/io/ioutil#ReadFile [3] https://pkg.go.dev/os#IsNotExist Signed-off-by: Stephen Finucane <[email protected]>
Do what we previously did for the openstack-cinder controller but for the openstack-manila controller. In effect, we're really just reflecting the changes made in cluster-storage-operator in [1]. However, we do need to add some logic to detect where we are consuming our CA cert from so that we can match forthcoming changes to our assets. While here, we also replace use of the deprecated `ioutil.ReadFile` function in favour of its suggested replacement, `os.ReadFile` [2]. We also replace use of `os.IsNotExist` in favour of its suggested replacement, `errors.Is(err, fs.ErrNotExist)` [3]. [1] github.com/openshift/cluster-storage-operator/pull/557 [2] https://pkg.go.dev/io/ioutil#ReadFile [3] https://pkg.go.dev/os#IsNotExist Signed-off-by: Stephen Finucane <[email protected]>
8 participants
In openshift/cloud-credential-operator/pull/780, we have added the ability for
cloud-credential-operatorto consume a CA cert from the root credentials secret and to include in the credentials secrets it provisions.In openshift/installer/pull/9194, we have modified the Installer to start setting this field where necessary.
Adapt the assets for both the openstack-cinder and openstack-manila CSI drivers to start consuming this field, where present. We maintain fallbacks for the previous locations of the cert for now, but these can be removed in the next release.
This needs wait for the CCO change to be approved before we merge this.
/hold