WIP: Integration of certmanager for IntegrationSink

[matzew]

NOTE: this is not yet ready, and adds a raw support for cert-manager / TLS

Fixes #

Proposed Changes

Pre-review Checklist

• At least 80% unit test coverage
• E2E tests for any new behavior
• Docs PR for any user-facing impact
• Spec PR for any new API feature
• Conformance test for any change to the spec

Release Note

Docs

[knative-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: matzew

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [matzew]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

Attention: Patch coverage is 18.09524% with 86 lines in your changes missing coverage. Please review.

Project coverage is 64.03%. Comparing base (4087c3a) to head (1232c65).

Files with missing lines	Patch %	Lines
...conciler/integration/sink/resources/certificate.go	0.00%	44 Missing ⚠️
pkg/reconciler/integration/sink/integrationsink.go	6.25%	29 Missing and 1 partial ⚠️
pkg/reconciler/integration/sink/controller.go	0.00%	8 Missing ⚠️
cmd/controller/main.go	0.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8385      +/-   ##
==========================================
- Coverage   64.22%   64.03%   -0.19%     
==========================================
  Files         388      389       +1     
  Lines       23324    23413      +89     
==========================================
+ Hits        14979    14993      +14     
- Misses       7550     7624      +74     
- Partials      795      796       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[matzew]

I think this does not work, when changing the feature cfg afterwards. In the controller.go of the integrationsink I am getting a nil pointer... when accessing the cmCertificateLister there.

[pierDipi]

Yes, it doesn't, we could start / stop the informer manually without injection based on the value

[matzew]

we could start / stop the informer manually without injection based on the value

you mean the "cert manager" informers, right? start / stop based on cfg change of the config-feature CM?

Any pointer to similar code for this?

[pierDipi]

here we start a "custom" configmap informer using the factory

eventing/pkg/adapter/v2/main.go

Lines 227 to 250 in b00da59

	// Manually create a ConfigMap informer for the env.GetNamespace() namespace to have it
	// optionally created when needed.
	infFactory := informers.NewSharedInformerFactoryWithOptions(
	kubeclient.Get(ctx),
	controller.GetResyncPeriod(ctx),
	informers.WithNamespace(env.GetNamespace()),
	informers.WithTweakListOptions(func(options *metav1.ListOptions) {
	options.LabelSelector = eventingtls.TrustBundleLabelSelector
	}),
	)
	go func() {
	<-ctx.Done()
	infFactory.Shutdown()
	}()
	inf := infFactory.Core().V1().ConfigMaps()
	_ = inf.Informer() // Actually create informer
	trustBundleConfigMapLister = inf.Lister().ConfigMaps(env.GetNamespace())
	infFactory.Start(ctx.Done())
	_ = infFactory.WaitForCacheSync(ctx.Done())

the "stop" is based on the passed context and there we can use the usual "context / cancel" pair

[matzew]

Thanks

[skonto]

A bit of background info. We discussed a more dynamic approach in the past here. Serving requires for the controller pod to be restarted. In general making it dynamic here makes more sense as it reacts on some cm change and you can freely define your main stuff as in the adapter's main. For Serving once you disable encryption there will be downtime afaik and we wanted minimal changes back then to move with the internal encryption feature. cc @ReToCode if he has anything to add/correct me.

[knative-prow]

@matzew: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
unit-tests_eventing_main	ee95167	link	true	/test unit-tests
reconciler-tests_eventing_main	ee95167	link	true	/test reconciler-tests

Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.