Restore "copy build certificates to /etc/docker/certs.d" #31

adambkaplan · 2018-12-07T02:24:44Z

Restores functionality in #29
Reverts #30

Restores functionality in openshift#29 Reverts openshift#30

adambkaplan · 2018-12-07T02:25:42Z

/assign @bparees

adambkaplan · 2018-12-07T02:26:05Z

/hold

Not merging until e2e-aws is enabled for this repo.

adambkaplan · 2018-12-07T21:45:47Z

/hold cancel

bparees · 2018-12-07T21:50:17Z

/hold Ben Parees | OpenShift

…

On Fri, Dec 7, 2018, 16:45 Adam Kaplan ***@***.*** wrote: /hold cancel — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#31 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AEvl3joxlZMimdAmCC87bERZBWFINphvks5u2uGLgaJpZM4ZHrBy> .

adambkaplan · 2018-12-11T14:14:30Z

/test e2e-aws

bparees · 2018-12-12T21:08:54Z

cmd/main.go

 	clusterCASrc := fmt.Sprintf("%s/ca.crt", builder.SecretCertsMountPath)
 	clusterCADst := fmt.Sprintf("%s/cluster.crt", tlsCertRoot)
-	err := CopyIfExists(clusterCASrc, clusterCADst)
+	err := CopyFileIfExists(clusterCASrc, clusterCADst)


looking at a cluster today, this location exists:

ls -l /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
lrwxrwxrwx. 1 root root 13 Dec 12 20:58 /var/run/secrets/kubernetes.io/serviceaccount/ca.crt -> ..data/ca.crt

perhaps that is not the service-ca though? i'm not sure what it is....

I guess we want this for cases where the registry is signed by the cluster ca, which was the case in 3.11.

bparees · 2018-12-12T21:09:14Z

cmd/main.go

 	oldServiceCASrc := fmt.Sprintf("%s/service-ca.crt", builder.SecretCertsMountPath)
 	oldServiceCADst := fmt.Sprintf("%s/service.crt", tlsCertRoot)
-	err = CopyIfExists(oldServiceCASrc, oldServiceCADst)
+	err = CopyFileIfExists(oldServiceCASrc, oldServiceCADst)


this location does not exist:
ls -l /var/run/secrets/kubernetes.io/serviceaccount
total 0
lrwxrwxrwx. 1 root root 13 Dec 12 20:58 ca.crt -> ..data/ca.crt
lrwxrwxrwx. 1 root root 16 Dec 12 20:58 namespace -> ..data/namespace
lrwxrwxrwx. 1 root root 12 Dec 12 20:58 token -> ..data/token

so this no longer serves any purpose except confusion i guess.

(and i guess gets used on ansible installs?)

bparees · 2018-12-12T21:10:26Z

cmd/main.go

 	newServiceCASrc := fmt.Sprintf("%s/service-ca.crt", builder.ConfigMapCertsMountPath)
 	newServiceCADst := fmt.Sprintf("%s/openshift-service.crt", tlsCertRoot)
-	err = CopyIfExists(newServiceCASrc, newServiceCADst)
+	err = CopyFileIfExists(newServiceCASrc, newServiceCADst)


and this, presumably, "might" exist depending on the raciness of the creation/population of the configmap that was created by the build controller.

and this is only working for us because the configmap is getting populated fast enough

bparees · 2018-12-12T21:14:06Z

cmd/main.go

-	additionalCADst := fmt.Sprintf("%s/additional-ca.crt", tlsCertRoot)
-	err = CopyIfExists(additionalCASrc, additionalCADst)
+	runtimeCASrc := fmt.Sprintf("%s/certs.d", builder.ConfigMapCertsMountPath)
+	err = CopyDirIfExists(runtimeCASrc, runtimeCertRoot)


similarly "might" exist depending on raciness and the level of code in the origin build controller that dictates where this gets mounted i guess.

bparees · 2018-12-12T21:48:39Z

/hold cancel
/lgtm

openshift-ci-robot · 2018-12-12T21:48:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: adambkaplan, bparees

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [bparees]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

bparees · 2018-12-12T22:14:01Z

/retest

openshift-bot · 2018-12-13T02:03:03Z

/retest