[tlse] update TLS/CA config #693
Conversation
stuggi
requested review from
olliewalsh and
Deydra71
and removed request for
viroel
|
the tls custom config would now look like this on a ctlplane CR. duration, renewBefore are defaulted. |
config/samples/core_v1beta1_openstackcontrolplane_network_isolation_tlse.yaml
Outdated
Show resolved
Hide resolved
| CertSection `json:",inline"` | ||
| } | ||
|
|
||
| // TLSPodLevelConfig defines the desired state of the TLS configuration for TLS termination at the pod level |
There was a problem hiding this comment.
nit: technically libvirt isn't a pod.... but can't think of a better name
There was a problem hiding this comment.
right, I was thinking the same, but its also no longer a container. Service is also not a good name to mix it with k8s services. so podLevel was the only good name I came up ..
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/05182c760abb4ba4a43dda1bc6e1f87e ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 27m 56s |
|
recheck |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/040916088eaa4cc5b3ad632188bba33e ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 30m 48s |
|
/test openstack-operator-build-deploy-kuttl |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/a20efea60601473f91e98ff1e2fad4d3 ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 28m 13s |
|
rebased |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/ac6207f8155f4e8aa10dfbd4fe4b7169 ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 04m 55s |
|
/test openstack-operator-build-deploy-kuttl |
|
recheck |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/bb3af3462daf4b0593a533ddd14145a1 ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 06m 56s |
|
recheck |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/f75aa004e3cb4f5caba7414e06a042d9 ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 57m 53s |
|
Galera pod logs show abort erros for both instances cell1 |
they are probably not related we also see aborts in a successful run as in https://logserver.rdoproject.org/90/690/b0d0bda02ab5ae4f8fb39744e8cd606d829ffa04/github-check/cifmw-data-plane-adoption-osp-17-to-extracted-crc/e50ed17/controller/ci-framework-data/logs/openstack-k8s-operators-openstack-must-gather/namespaces/openstack/pods/openstack-cell1-galera-0/logs/galera.log |
|
ignore previous comments. the issue is that the conductors try to reach an external DB on |
|
try bumping nova and mariadb operator as the issue is not seen in #690 , but kuttl might fail as in that one |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/60c22e90656e49e29cf1ac78adc7a5f9 ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 44m 03s |
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/81278adce5444b11ac4673f771d61ebe ✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 22m 26s |
changes top level tls config section to reflect ingress and podlevel tls termination and allows to customize the duration and renewBefore for each of the CAs and Certs issued for a CA. Also: * creates CA for OVN * fixes an issue where service cert was not created when tls on ingress was disabled. Depends-On: openstack-k8s-operators/lib-common#471 Jira: OSPRH-5342
…ress used When also using LoadBalancer (MetalLB) for public endpoints this change allows to use the service configs tls.API.Public.SecretName to reference a secret holding a custom TLS cert. The secret must contain at least tls.key and tls.crt. The custom CA should be added to the bundle using the secret reference in the osctlplane crd.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: olliewalsh, stuggi The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
bot
merged commit 1e57116
into
openstack-k8s-operators:main
changes top level tls config section to reflect ingress and podlevel tls termination and allows to customize the duration and renewBefore for each of the CAs and Certs issued for a CA.
Also:
was disabled.
When also using LoadBalancer (MetalLB) for public endpoints this change allows to use the service configs tls.API.Public.SecretName to reference a secret holding a custom TLS cert. The secret must contain at least tls.key and tls.crt. The custom CA should be added to the bundle using the secret reference in the osctlplane crd.
Depends-On: openstack-k8s-operators/lib-common#471
Jira: OSPRH-5342