Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[release-4.12] Misc changes for cert approval and validating #633

Merged
merged 2 commits into from
Dec 21, 2022
Merged

[release-4.12] Misc changes for cert approval and validating #633

merged 2 commits into from
Dec 21, 2022

Conversation

openshift-cherrypick-robot
Copy link

This is an automated cherry-pick of #631

/assign praveenkumar

@praveenkumar
Approve pending cert as part of cert validation retry loop
687156f 
As of now we first approve the first pending csr for
kube-apiserver-client-kubelet and then approve kubelet-serving one.
On the CI it is observed that as soon as we approve kube-apiserver-client-kubelet
csr (csr-qc8c7), another one is create with same signer name (csr-c28jv) and kubelet-serving not
created until this one is also approved.
```
$ oc get csr
NAME                                             AGE     SIGNERNAME                                    REQUESTOR                                                                         REQUESTEDDURATION   CONDITION
csr-b4gb2                                        24h     kubernetes.io/kube-apiserver-client-kubelet   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper         <none>              Approved,Issued
csr-c28jv                                        3m19s   kubernetes.io/kube-apiserver-client-kubelet   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper         <none>              Pending
csr-f9f7d                                        24h     kubernetes.io/kube-apiserver-client-kubelet   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper         <none>              Approved,Issued
csr-mrdqg                                        24h     kubernetes.io/kubelet-serving                 system:node:crc-zcb9n-master-0                                                    <none>              Approved,Issued
csr-qc8c7                                        8m1s    kubernetes.io/kube-apiserver-client-kubelet   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper         <none>              Approved
system:openshift:openshift-authenticator-k58qx   24h     kubernetes.io/kube-apiserver-client           system:serviceaccount:openshift-authentication-operator:authentication-operator   <none>              Approved,Issued
```

Using this PR we change the logic of iterating to csr request and
approve them to just approve all the csr request until the kubelet
client/server certs are vaild for a month. At the cluster
provision time approving csr request bindly doesn't have any security
implications.
@praveenkumar
Reverse the sleep time and retry loop
9f7fec6 
In previous commit we added the cert approve logic to retry loop. This
pr uses 10sec as sleep time and 60 retry so that we can approve the cert
before another one generated due to not approved in time.
@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request Dec 21, 2022
Merged
@openshift-ci openshift-ci bot requested review from cfergeau and gbraad December 21, 2022 06:09
@openshift-ci
Copy link

openshift-ci bot commented Dec 21, 2022

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign praveenkumar for approval by writing /assign @praveenkumar in a comment. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci
Copy link

openshift-ci bot commented Dec 21, 2022

Hi @openshift-cherrypick-robot. Thanks for your PR.

I'm waiting for a crc-org member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@praveenkumar praveenkumar merged commit b53735e into crc-org:release-4.12 Dec 21, 2022
@praveenkumar praveenkumar mentioned this pull request Mar 9, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@cfergeau cfergeau Awaiting requested review from cfergeau

@gbraad gbraad Awaiting requested review from gbraad

Assignees

@praveenkumar praveenkumar

Labels
needs-ok-to-test
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@openshift-cherrypick-robot @praveenkumar