Skip to content
This repository has been archived by the owner on Jul 11, 2023. It is now read-only.

Webhook/certificate generation split from XDS control plane #1939

Closed
eduser25 opened this issue Oct 27, 2020 · 2 comments
Closed

Webhook/certificate generation split from XDS control plane #1939

eduser25 opened this issue Oct 27, 2020 · 2 comments
Assignees
@shashankram
Labels
priority/P1 P1 priority size/L 14 days (~2.5 weeks)
Milestone
v0.8.0

Comments

@eduser25
Copy link
Contributor

Some discussions suggested we could separate the XDS control plane to the webhook and certificate generation for envoy onboarding.

This would ease up and decouple the system into finer responsibilities, potentially simplifying the later scalability, possible sharding and fine tuning the individual components at scale.

This issue tracks potential conversation over this matter.

  • New Functionality [X]
  • Envoy Control Plane [X]
  • Certificate Management [X]
  • Sidecar Injection [X]
@draychev
Copy link
Contributor

draychev commented Dec 8, 2020

Could be positively impacted by #1974

@draychev draychev mentioned this issue Jan 26, 2021
Closed
@draychev draychev added size/M 7 days (~1.5 week) and removed size/XXL 40 days (2 months) labels Jan 26, 2021
@shashankram shashankram self-assigned this Feb 4, 2021
@shashankram shashankram added this to the v0.8.0 milestone Feb 4, 2021
shashankram added a commit to shashankram/osm that referenced this issue Feb 5, 2021
@shashankram
osm-controller: move certificate provider bootstrap code into utility…
0d3622c 
… pkg

Moves code related to bootstrapping the certificate manager/provider
into a separate utility pkg. This utility pkg will be reused across
osm-controller and the sidecar injector app. The sidecar injector
component will be moved out of osm-controller as a part of openservicemesh#1939,
and this change is required to reuse code across the two apps.

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 5, 2021
@shashankram
osm-controller: add utility certificate provider utility pkg
787eb14 
Moves code related to bootstrapping the certificate manager/provider
into a separate utility pkg. This utility pkg will be reused across
osm-controller and the sidecar injector app. The sidecar injector
component will be moved out of osm-controller as a part of openservicemesh#1939,
and this change is required to reuse code across the two apps.

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 5, 2021
@shashankram
osm-controller: add utility certificate provider utility pkg
da989ab 
Moves code related to bootstrapping the certificate manager/provider
into a separate utility pkg. This utility pkg will be reused across
osm-controller and the sidecar injector app. The sidecar injector
component will be moved out of osm-controller as a part of openservicemesh#1939,
and this change is required to reuse code across the two apps.

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
@shashankram shashankram mentioned this issue Feb 5, 2021
Merged
shashankram added a commit to shashankram/osm that referenced this issue Feb 5, 2021
@shashankram
certificate: consolidate provider related config and helpers
01196ae 
Moves code related to bootstrapping the certificate manager/provider
into to `pkg/certificate/providers`. This code will be reused across
osm-controller and the sidecar injector app. The sidecar injector
component will be moved out of osm-controller as a part of openservicemesh#1939,
and this change is required to reuse code across the two apps.

The change does the following:

- Moves certificate provider related code that needs
  to be reused into `pkg/certificate/providers`.

- Creates structs for the different cert provider
  options and validation methods for those options.

- A `Config` struct to leverage to retrieve CA bundle
  secret information (currently used by tests). Thi
  will be leveraged by the osm-injector component
  to retrieve the CA bundle secret created by osm-controller.

- Refactors existing cert provider initialization code
  for code reusability.

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 5, 2021
@shashankram
certificate: consolidate provider related config and helpers
5a17fea 
Moves code related to bootstrapping the certificate manager/provider
into to `pkg/certificate/providers`. This code will be reused across
osm-controller and the sidecar injector app. The sidecar injector
component will be moved out of osm-controller as a part of openservicemesh#1939,
and this change is required to reuse code across the two apps.

The change does the following:

- Moves certificate provider related code that needs
  to be reused into `pkg/certificate/providers`.

- Creates structs for the different cert provider
  options and validation methods for those options.

- A `Config` struct to leverage to retrieve CA bundle
  secret information (currently used by tests). Thi
  will be leveraged by the osm-injector component
  to retrieve the CA bundle secret created by osm-controller.

- Refactors existing cert provider initialization code
  for code reusability.

- Makes `--ca-bundle-secret-name` mandatory. The Helm charts
  always pass this option and this is required for issue openservicemesh#1939.

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 5, 2021
@shashankram
certificate: consolidate provider related config and helpers
a31a1db 
Moves code related to bootstrapping the certificate manager/provider
into to `pkg/certificate/providers`. This code will be reused across
osm-controller and the sidecar injector app. The sidecar injector
component will be moved out of osm-controller as a part of openservicemesh#1939,
and this change is required to reuse code across the two apps.

The change does the following:

- Moves certificate provider related code that needs
  to be reused into `pkg/certificate/providers`.

- Creates structs for the different cert provider
  options and validation methods for those options.

- A `Config` struct to leverage to retrieve CA bundle
  secret information (currently used by tests). Thi
  will be leveraged by the osm-injector component
  to retrieve the CA bundle secret created by osm-controller.

- Refactors existing cert provider initialization code
  for code reusability.

- Makes `--ca-bundle-secret-name` mandatory. The Helm charts
  always pass this option and this is required for issue openservicemesh#1939.

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
@shashankram shashankram added size/L 14 days (~2.5 weeks) and removed size/M 7 days (~1.5 week) labels Feb 8, 2021
@shashankram shashankram mentioned this issue Feb 8, 2021
Closed
shashankram added a commit to shashankram/osm that referenced this issue Feb 8, 2021
@shashankram
debugger: disable printing expected proxy list
a7bbeee 
This change is a temporary workaround till issue openservicemesh#2481 is
addressed. As a part of openservicemesh#1939, injector will be taken
out of `osm-controller`, after which we will no longer
get the list of expected proxies.

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
@shashankram shashankram mentioned this issue Feb 8, 2021
Merged
shalier pushed a commit to shalier/osm that referenced this issue Feb 8, 2021
@shashankram @shalier
certificate: consolidate provider related config and helpers
9bccd54 
Moves code related to bootstrapping the certificate manager/provider
into to `pkg/certificate/providers`. This code will be reused across
osm-controller and the sidecar injector app. The sidecar injector
component will be moved out of osm-controller as a part of openservicemesh#1939,
and this change is required to reuse code across the two apps.

The change does the following:

- Moves certificate provider related code that needs
  to be reused into `pkg/certificate/providers`.

- Creates structs for the different cert provider
  options and validation methods for those options.

- A `Config` struct to leverage to retrieve CA bundle
  secret information (currently used by tests). Thi
  will be leveraged by the osm-injector component
  to retrieve the CA bundle secret created by osm-controller.

- Refactors existing cert provider initialization code
  for code reusability.

- Makes `--ca-bundle-secret-name` mandatory. The Helm charts
  always pass this option and this is required for issue openservicemesh#1939.

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 8, 2021
@shashankram
injector: split sidecar-injector from osm-controller
d802199 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- clanup of unused options for mutating webhook's reconciler

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 8, 2021
@shashankram
injector: split sidecar-injector from osm-controller
bdbf822 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- clanup of unused options for mutating webhook's reconciler

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 9, 2021
@shashankram
injector: split sidecar-injector from osm-controller
a93f247 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 9, 2021
@shashankram
injector: split sidecar-injector from osm-controller
17c6e25 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 10, 2021
@shashankram
injector: split sidecar-injector from osm-controller
a14e4ef 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 10, 2021
@shashankram
injector: split sidecar-injector from osm-controller
c3641bf 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
@shashankram shashankram mentioned this issue Feb 10, 2021
Merged
shashankram added a commit to shashankram/osm that referenced this issue Feb 10, 2021
@shashankram
injector: split sidecar-injector from osm-controller
80b6e99 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 10, 2021
@shashankram
injector: split sidecar-injector from osm-controller
b1b518e 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 11, 2021
@shashankram
injector: split sidecar-injector from osm-controller
dcff3da 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 11, 2021
@shashankram
injector: split sidecar-injector from osm-controller
a78d2d4 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 11, 2021
@shashankram
injector: split sidecar-injector from osm-controller
0b17de6 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 11, 2021
@shashankram
injector: split sidecar-injector from osm-controller
d2479b0 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
@snehachhabria snehachhabria added the priority/P1 P1 priority label Feb 11, 2021
shashankram added a commit to shashankram/osm that referenced this issue Feb 11, 2021
@shashankram
injector: split sidecar-injector from osm-controller
d28fe21 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
shashankram added a commit to shashankram/osm that referenced this issue Feb 12, 2021
@shashankram
injector: split sidecar-injector from osm-controller
664ddae 
This change splits the sidecar injector component from
osm-controller for scalability purpose as a part of openservicemesh#1939.

Summary of changes:
- injector is moved to a separate osm-injector app
- Helm chart changes to deploy osm-injector
- osm-controller changes to remove injector initialization
- utility method on `providers.Config` to watch CA bundle secret
- Makefile, dockerfile changes to build osm-injector
- cleanup of unused options for mutating webhook's reconciler
- update e2e tests to wait on osm-injector pod

Signed-off-by: Shashank Ram <shashr2204@gmail.com>
@shashankram
Copy link
Member

Resolved by #2505

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@shashankram shashankram

Labels
priority/P1 P1 priority size/L 14 days (~2.5 weeks)
Projects
None yet
Milestone
v0.8.0
Development

No branches or pull requests
4 participants
@eduser25 @shashankram @draychev @snehachhabria