Adds Trust Bundle Publishing to Proxy Controller by danehans · Pull Request #271 · openshift/cluster-network-operator

danehans · 2019-08-02T03:36:25Z

Depends on #245

Reconcile "openshift-config-managed/trusted-ca-bundle" ConfigMap object.
Validate Data of "openshift-config-managed/user-ca-bundle" ConfigMap object.
Validate cluster-network-operator's system trust bundle as valid certificate(s).
Merge user/system trust bundles.
Create/update "openshift-config-managed/trusted-ca-bundle" ConfigMap object.
Godocs

PTAL @squeed @danwinship @dcbw @bparees @JacobTanenbaum

squeed · 2019-08-05T13:24:36Z

+// encoded certificates, embeds the merged byte slice into a configmap
+// named "proxy-ca-bundle" in namespace "openshift-config-managed" and
+// returns the configmap.
+func (r *ConfigMapReconciler) ensureMergedConfigMap(additionalData, systemData []byte) (*corev1.ConfigMap, error) {


Is it a problem if the additional CA is already present in the system trust? Will that break expectations?

it's just going to result in 2 copies of that cert in the bundle, right?

Yup. The question is: does that break anything? Does the bundle need to be unique? (I have no idea)

i'd be surprised but it would definitely be a good thing to test.

bparees · 2019-08-08T19:41:57Z

+
+// Reconcile expects request to refer to a proxy object named "cluster"
+// in the default namespace or to a configmap object named
+// "user-ca-bundle" in namespace "openshift-config-managed", and will


this comment is wrong... i'd expect this controller to be watching 3 things:

the trust-bundle configmap in openshift-config-managed (this CM has a fixed name), because you need to stomp it back to the correct value if it gets updated by something else

the additional CA bundle configmap in the openshift-config namespace (this configmap name can change, so you need to detect if it changes, by watching the proxy config resource), because if the bundle changes, you need to re-merge the values w/ the system values and publish it to the CM in (1).

the proxyconfig resource (so you can determine the name of the configmap in (2) and perform the merge action on it)

@bparees see #271 (comment)

bparees · 2019-08-14T19:53:16Z

/lgtm

danehans · 2019-08-14T22:33:53Z

/test e2e-aws-upgrade

danehans · 2019-08-15T04:39:22Z

/test e2e-aws-upgrade

bparees · 2019-08-15T19:49:40Z

/lgtm

knobunc · 2019-08-15T20:00:29Z

/approve

danehans · 2019-08-15T23:35:35Z

aws-e2e-upgrade job failure due to:
Aug 15 20:45:11.316 E clusterversion/version changed Failing to True: ClusterOperatorDegraded: Cluster operator network is reporting a failure: failed to generate system trust bundle configmap ’openshift-config-managed/trusted-ca-bundle (failed to validate trust bundle /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem: certificate is not a CA certificate: <nil>).

I found that /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem contains a certificate with serial # 9b:7e:06:49:a3:3e:62:b9:d5:ee:90:48:71:29:ef:57 that does not contain CA: True. This is because the CA field was introduced in v3 of x509 and the offending cert is v1.

I am removing the following from CertificateData in validation/trustbundle.go:

if !cert.IsCA {
    return nil, nil, fmt.Errorf("certificate is not a CA certificate: %v", err)
}

bparees · 2019-08-16T12:26:47Z

/lgtm

openshift-ci-robot · 2019-08-16T12:26:58Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bparees, danehans, knobunc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [knobunc]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot requested review from JacobTanenbaum and squeed August 2, 2019 03:36

danehans force-pushed the ca_bundle_controller branch 2 times, most recently from 1cddc5c to d333e71 Compare August 2, 2019 17:23

openshift-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 2, 2019

danehans force-pushed the ca_bundle_controller branch from d333e71 to d5f3e80 Compare August 2, 2019 20:01

danehans changed the title ~~WIP: Adds Trust Bundle Publisher Controller~~ Adds Trust Bundle Publisher Controller Aug 2, 2019

openshift-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 2, 2019

bparees reviewed Aug 2, 2019

View reviewed changes

Comment thread pkg/controller/trustbundle-publisher/controller.go Outdated

squeed reviewed Aug 5, 2019

View reviewed changes

danehans force-pushed the ca_bundle_controller branch from d5f3e80 to 59f1bcc Compare August 5, 2019 23:15

openshift-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 5, 2019

danehans force-pushed the ca_bundle_controller branch from 59f1bcc to 2590627 Compare August 5, 2019 23:20

danehans mentioned this pull request Aug 6, 2019

Adds Proxy Controller #245

Merged

3 tasks

danehans force-pushed the ca_bundle_controller branch from 2590627 to 9cf327d Compare August 6, 2019 19:45

JacobTanenbaum added a commit to JacobTanenbaum/cluster-network-operator that referenced this pull request Aug 6, 2019

added names from openshift#271

4597336

JacobTanenbaum added a commit to JacobTanenbaum/cluster-network-operator that referenced this pull request Aug 6, 2019

added validation from openshift#271

1780b39

danehans mentioned this pull request Aug 7, 2019

Adds readinessEndpoint validation for Proxy API type. #277

Merged

3 tasks

JacobTanenbaum added a commit to JacobTanenbaum/cluster-network-operator that referenced this pull request Aug 8, 2019

added names from openshift#271

0a0947c

JacobTanenbaum added a commit to JacobTanenbaum/cluster-network-operator that referenced this pull request Aug 8, 2019

added validation from openshift#271

fcadcdc

openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 8, 2019

bparees reviewed Aug 8, 2019

View reviewed changes

Comment thread pkg/controller/proxyconfig/controller.go

bparees reviewed Aug 8, 2019

View reviewed changes

danehans force-pushed the ca_bundle_controller branch from 9cf327d to 5a0adf0 Compare August 8, 2019 19:55

openshift-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 8, 2019

danehans force-pushed the ca_bundle_controller branch from 5a0adf0 to d68c724 Compare August 8, 2019 20:06

danehans force-pushed the ca_bundle_controller branch 2 times, most recently from 2960d45 to 2a0c159 Compare August 14, 2019 17:24

bparees requested changes Aug 14, 2019

View reviewed changes

Comment thread pkg/controller/proxyconfig/controller.go

Comment thread pkg/names/names.go Outdated

Comment thread pkg/names/names.go Outdated

danehans force-pushed the ca_bundle_controller branch from 2a0c159 to b0e2c1c Compare August 14, 2019 19:03

openshift-ci-robot assigned bparees Aug 14, 2019

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Aug 14, 2019

danehans mentioned this pull request Aug 14, 2019

Adds proxy https readinessEndpoints support #289

Merged

awgreene mentioned this pull request Aug 15, 2019

[CA] Use Certificate Authority bundle operator-framework/operator-marketplace#242

Merged

jmrodri mentioned this pull request Aug 15, 2019

Add Proxy CA support openshift/cluster-svcat-controller-manager-operator#49

Merged

danehans force-pushed the ca_bundle_controller branch from b0e2c1c to 46e0ac1 Compare August 15, 2019 19:08

openshift-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed lgtm Indicates that a PR is ready to be merged. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Aug 15, 2019

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Aug 15, 2019

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 15, 2019

Adds Trust Bundle Publishing to Proxy Controller

6de48c6

danehans force-pushed the ca_bundle_controller branch from 46e0ac1 to 6de48c6 Compare August 15, 2019 23:46

openshift-ci-robot removed the lgtm Indicates that a PR is ready to be merged. label Aug 15, 2019

danehans mentioned this pull request Aug 16, 2019

DEVEXP-403: Mount cluster trusted CA to image registry operator openshift/cluster-image-registry-operator#340

Merged

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Aug 16, 2019

openshift-merge-robot merged commit 273dbd7 into openshift:master Aug 16, 2019

danehans mentioned this pull request Aug 16, 2019

Inject payload's system store with proxy CA when specified openshift/cluster-authentication-operator#172

Merged

Conversation

danehans commented Aug 2, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

squeed Aug 5, 2019

Choose a reason for hiding this comment

Uh oh!

bparees Aug 5, 2019

Choose a reason for hiding this comment

Uh oh!

squeed Aug 6, 2019

Choose a reason for hiding this comment

Uh oh!

bparees Aug 6, 2019

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bparees Aug 8, 2019

Choose a reason for hiding this comment

Uh oh!

danehans Aug 14, 2019

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bparees commented Aug 14, 2019

Uh oh!

danehans commented Aug 14, 2019

Uh oh!

danehans commented Aug 15, 2019

Uh oh!

bparees commented Aug 15, 2019

Uh oh!

knobunc commented Aug 15, 2019

Uh oh!

danehans commented Aug 15, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bparees commented Aug 16, 2019

Uh oh!

openshift-ci-robot commented Aug 16, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

danehans commented Aug 2, 2019 •

edited

Loading

danehans commented Aug 15, 2019 •

edited

Loading