Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Configure TLS communication between registry cache and containerd #245

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

Configure TLS communication between registry cache and containerd #245

wants to merge 2 commits into from

Conversation

dimitar-kostadinov
Copy link
Contributor

How to categorize this PR?

/area security
/kind enhancement

What this PR does / why we need it:
Configure TLS communication between registry cache and containerd.

Which issue(s) this PR fixes:
Fixes #203

Special notes for your reviewer:

Release note:

TBD

@gardener-prow Gardener Prow
Copy link
Contributor

gardener-prow bot commented Aug 27, 2024

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@gardener-prow gardener-prow bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. area/security Security related kind/enhancement Enhancement, improvement, extension labels Aug 27, 2024
@gardener-prow Gardener Prow
Copy link
Contributor

gardener-prow bot commented Aug 27, 2024

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from dimitar-kostadinov. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@gardener-prow gardener-prow bot added the cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. label Aug 27, 2024
@gardener-prow gardener-prow bot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Aug 27, 2024
@ialidzhikov
Copy link
Member

/assign

@ialidzhikov ialidzhikov added area/ipcei IPCEI (Important Project of Common European Interest) ipcei/registry-cache-extension Registry Cache Extension labels Sep 11, 2024
@gardener-prow gardener-prow bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 17, 2024
@gardener-ci-robot
Copy link

The Gardener project currently lacks enough active contributors to adequately respond to all PRs.
This bot triages PRs according to the following rules:

  • After 15d of inactivity, lifecycle/stale is applied
  • After 15d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 7d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

  • Mark this PR as fresh with /remove-lifecycle stale
  • Mark this PR as rotten with /lifecycle rotten
  • Close this PR with /close

/lifecycle stale

@gardener-prow gardener-prow bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 2, 2024
@ialidzhikov
Copy link
Member

/remove-lifecycle stale

@gardener-prow gardener-prow bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 2, 2024
ialidzhikov
ialidzhikov reviewed Oct 4, 2024
View reviewed changes
Copy link
Member

@ialidzhikov ialidzhikov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR, @dimitar-kostadinov!

Sorry for the long delay! I am posting some very minor preliminary comments for now! I will do a more detailed review in CW42.

Can you meanwhile also rebase?

pkg/apis/registry/v1alpha3/types.go Outdated Show resolved Hide resolved
pkg/secrets/config.go Show resolved Hide resolved
pkg/apis/registry/v1alpha3/types.go Outdated Show resolved Hide resolved
pkg/component/registrycaches/templates/config.yml.tpl Outdated Show resolved Hide resolved
pkg/controller/cache/actuator.go Outdated Show resolved Hide resolved
pkg/webhook/cache/ensurer.go Outdated Show resolved Hide resolved
pkg/apis/registry/types.go Outdated Show resolved Hide resolved
pkg/apis/registry/v1alpha3/types.go Outdated Show resolved Hide resolved
charts/gardener-extension-registry-cache/templates/clusterrole.yaml Outdated Show resolved Hide resolved
ialidzhikov
ialidzhikov reviewed Oct 17, 2024
View reviewed changes
pkg/component/registrycaches/templates/config.yml.tpl
@@ -22,6 +22,9 @@ http:
enabled: true
path: /metrics
draintimeout: 25s
tls:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You could add e2e tests for CA rotation to make sure that we don't regress the scenario in future.

pkg/component/registrycaches/registry_caches.go Outdated Show resolved Hide resolved
pkg/component/registrycaches/registry_caches.go Outdated Show resolved Hide resolved
pkg/component/registrycaches/registry_caches.go Outdated Show resolved Hide resolved
pkg/component/registrycaches/registry_caches.go Show resolved Hide resolved
@gardener-prow gardener-prow bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ialidzhikov ialidzhikov ialidzhikov left review comments

Assignees

@ialidzhikov ialidzhikov

Labels
area/ipcei IPCEI (Important Project of Common European Interest) area/security Security related cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. ipcei/registry-cache-extension Registry Cache Extension kind/enhancement Enhancement, improvement, extension size/XL Denotes a PR that changes 500-999 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

TLS for the containerd and registry cache communication
3 participants
@dimitar-kostadinov @ialidzhikov @gardener-ci-robot