Bug 1797123: pkg/cvo: Fetch proxy CA certs from openshift-config-managed/trusted-ca-bundle #311

wking · 2020-01-31T23:58:43Z

The API docs recommend avoiding trustedCA (unless you happen to be the "proxy validator") and instead pulling the trust bundle from this managed namespace. The docs also explain that the trusted-ca-bundle ConfigMap has already been merged with the system certificates, so we don't need to inject those locally. If trusted-ca-bundle doesn't exist, we'll fall back to our local system store.

Our logic was touched most recently in 5968cdf (#231), which resolved the "looking in the wrong place" issue by looking at the trustedCA source (which feeds the proxy validator). With this commit we switch that around and look at the proxy validator's output.

openshift-ci-robot · 2020-01-31T23:58:46Z

@wking: This pull request references Bugzilla bug 1797123, which is invalid:

expected the bug to target the "4.4.0" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 1797123: pkg/cvo: Fetch proxy CA certs from openshift-config-managed/trusted-ca-bundle

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wking · 2020-01-31T23:59:10Z

/bugzilla refresh

openshift-ci-robot · 2020-01-31T23:59:15Z

@wking: This pull request references Bugzilla bug 1797123, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

abhinavdahiya · 2020-02-01T01:48:50Z

If the operator that creates the config map in that managed namespace is created by CVO, there is a cycle of dependencies..

wking · 2020-02-01T03:38:36Z

If the operator that creates the config map in that managed namespace is created by CVO, there is a cycle of dependencies.

Is that a problem? We shouldn't need either Cincy graph fetches or signature pulls until the network operator comes up.

abhinavdahiya · 2020-02-05T20:46:10Z

If the operator that creates the config map in that managed namespace is created by CVO, there is a cycle of dependencies.

Is that a problem? We shouldn't need either Cincy graph fetches or signature pulls until the network operator comes up.

Yeah, i don't think we should add this cycle.
We only use the proxy for Cincinnati requests today but I don't think we should add this cycle that would make it difficult if it was necessary for anything important later on.

wking · 2020-02-18T18:12:54Z

We only use the proxy for Cincinnati requests today but I don't think we should add this cycle that would make it difficult if it was necessary for anything important later on.

I can't imagine a case where the CVO would need to make external HTTP(S) requests before the network operator comes up. And I like having the CVO continue to be able to make HTTP(S) requests via a proxy even in the event that a cluster-admin borks the ConfigMap they control (because the network operator will refuse to copy the broken CAs into the openshift-config-managed ConfigMap that it controls). But whatever, I don't care enough to push this through ;). I'm happy to reopen and rebase if there's a consensus to pick this approach back up later, just let me know. Until then.

/close

openshift-ci-robot · 2020-02-18T18:12:56Z

@wking: Closed this PR.

In response to this:

We only use the proxy for Cincinnati requests today but I don't think we should add this cycle that would make it difficult if it was necessary for anything important later on.

I can't imagine a case where the CVO would need to make external HTTP(S) requests before the network operator comes up. And I like having the CVO continue to be able to make HTTP(S) requests via a proxy even in the event that a cluster-admin borks the ConfigMap they control (because the network operator will refuse to copy the broken CAs into the openshift-config-managed ConfigMap that it controls). But whatever, I don't care enough to push this through ;). I'm happy to reopen and rebase if there's a consensus to pick this approach back up later, just let me know. Until then.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2020-06-29T23:02:23Z

@wking: This pull request references Bugzilla bug 1797123, which is invalid:

expected the bug to be open, but it isn't
expected the bug to target the "4.6.0" release, but it targets "4.5.0" instead
expected the bug to be in one of the following states: NEW, ASSIGNED, ON_DEV, POST, POST, but it is CLOSED (DEFERRED) instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 1797123: pkg/cvo: Fetch proxy CA certs from openshift-config-managed/trusted-ca-bundle

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wking · 2020-06-29T23:03:42Z

/bugzilla refresh

openshift-ci-robot · 2020-06-29T23:03:46Z

@wking: This pull request references Bugzilla bug 1797123, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.6.0) matches configured target release for branch (4.6.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

wking · 2020-06-29T23:07:16Z

Rebased onto master (around a trivial context conflict with #319) with 02fd56f -> f2c34cf.

LalatenduMohanty · 2020-07-20T12:52:56Z

pkg/cvo/egress.go

-	cm, err := optr.cmConfigLister.Get(cmNameRef)
-
+func (optr *Operator) getTLSConfig() (*tls.Config, error) {
+	cm, err := optr.cmConfigManagedLister.Get("trusted-ca-bundle")


We are hard coding the name here i.e. "trusted-ca-bundle". Is there any way we can avoid it?

It is part of the adopted enhancement. I only use it in this one place, so it doesn't seem useful to create a local const for it. But I can if you want one.

…a-bundle The API docs [1] recommend avoiding trustedCA (unless you happen to be the "proxy validator") and instead pulling the trust bundle from this managed namespace. The docs also explain that the trusted-ca-bundle ConfigMap has already been merged with the system certificates, so we don't need to inject those locally. If trusted-ca-bundle doesn't exist, we'll fall back to our local system store. Our logic was touched most recently in 5968cdf (pkg: switch to openshift-config for proxy CA, 2019-08-07, openshift#231), which resolved the "looking in the wrong place" issue by looking at the trustedCA source (which feeds the proxy validator). With this commit we switch that around and look at the proxy validator's output. [1]: https://github.com/openshift/api/blob/f2a771e1a90ceb4e65f1ca2c8b11fc1ac6a66da8/config/v1/types_proxy.go#L44-L52

wking · 2020-07-27T19:44:45Z

Rebased around #411 with 1b3ae21 -> c9fab43.

wking · 2020-07-31T02:01:47Z

e2e-upgrade died on Application behind service load balancer with PDB is not disrupted, which is not us.

/retest

vrutkovs

/lgtm

vrutkovs · 2020-07-31T09:24:14Z

/retest

LalatenduMohanty · 2020-07-31T10:53:32Z

/hold
Going through some conversation we had with @bparees on this approach to make sure we are doing what we agreed upon.

LalatenduMohanty · 2020-07-31T10:58:59Z

/hold cancel

LalatenduMohanty

/lgtm

openshift-ci-robot · 2020-07-31T11:00:13Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: abhinavdahiya, LalatenduMohanty, vrutkovs, wking

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [LalatenduMohanty,abhinavdahiya,vrutkovs,wking]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2020-07-31T13:49:57Z

@wking: The following tests failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-aws-upgrade	`1b3ae21`	link	`/test e2e-aws-upgrade`
ci/prow/e2e-aws	`1b3ae21`	link	`/test e2e-aws`
ci/prow/e2e-gcp	`1b3ae21`	link	`/test e2e-gcp`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

wking · 2020-07-31T13:53:03Z

/retest

openshift-ci-robot · 2020-07-31T19:03:43Z

@wking: All pull requests linked via external trackers have merged: openshift/cluster-version-operator#311. Bugzilla bug 1797123 has been moved to the MODIFIED state.

In response to this:

Bug 1797123: pkg/cvo: Fetch proxy CA certs from openshift-config-managed/trusted-ca-bundle

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

With c9fab43 (pkg/cvo: Fetch proxy CA certs from openshift-config-managed/trusted-ca-bundle, 2020-01-31, openshift#311), I attempted to pivot to loading the TLS configration from the openshift-config-managed namespace. But I hadn't realized that cmConfigInformer was scoped to the openshift-config namespace, so attempts to retrieve trusted-ca-bundle failed via the "not found" no-op path regardless of whether the ConfigMap actually existed. With this commit, I create a new informer for the openshift-config-managed namespace, so we can successfully retrieve the ConfigMap when it exists. An alternative approach would be to drop the informers.WithNamespace filter. My impression is that having two namespace-filtered informers will be more efficient than a single unfiltered informer, but I'm not really sure.

Since 4.2's ea5e3bc (Add http transport for cincinnati to enable proxy, 2019-07-16, openshift#219), the CVO has been loading proxy config from the spec property. We should be loading from status instead, so we benefit from the network operator's validation. Risk is small, because unlike some other in-cluster components, the CVO is unlikely to break things if it is temporarily consuming a broken proxy configuration. This is similar to c9fab43 (pkg/cvo: Fetch proxy CA certs from openshift-config-managed/trusted-ca-bundle, 2020-01-31, openshift#311), where we moved our trusted CA source from the user-configured ConfigMap to the network-operator-validated ConfigMap.

openshift-ci-robot added bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Jan 31, 2020

openshift-ci-robot requested review from abhinavdahiya and smarterclayton January 31, 2020 23:58

openshift-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jan 31, 2020

openshift-ci-robot added the bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. label Jan 31, 2020

openshift-ci-robot removed the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label Jan 31, 2020

wking mentioned this pull request Feb 1, 2020

enhancements/x509-trust: Propose a new enhancement openshift/enhancements#115

Closed

openshift-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 13, 2020

openshift-ci-robot closed this Feb 18, 2020

wking reopened this Jun 29, 2020

openshift-ci-robot added bugzilla/severity-unspecified Referenced Bugzilla bug's severity is unspecified for the PR. and removed bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. labels Jun 29, 2020

openshift-ci-robot added the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label Jun 29, 2020

openshift-ci-robot added bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. and removed bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. labels Jun 29, 2020

wking force-pushed the load-proxy-certs-from-trusted-ca-bundle branch from 02fd56f to f2c34cf Compare June 29, 2020 23:06

openshift-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 29, 2020

LalatenduMohanty suggested changes Jul 20, 2020

View reviewed changes

wking force-pushed the load-proxy-certs-from-trusted-ca-bundle branch from 1b3ae21 to c9fab43 Compare July 27, 2020 19:44

vrutkovs approved these changes Jul 31, 2020

View reviewed changes

openshift-ci-robot assigned vrutkovs Jul 31, 2020

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 31, 2020

openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 31, 2020

openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jul 31, 2020

LalatenduMohanty approved these changes Jul 31, 2020

View reviewed changes

openshift-ci-robot assigned LalatenduMohanty Jul 31, 2020

openshift-merge-robot merged commit 2b421c0 into openshift:master Jul 31, 2020

wking deleted the load-proxy-certs-from-trusted-ca-bundle branch August 1, 2020 04:26

wking mentioned this pull request Aug 22, 2020

Bug 1797123: pkg/cvo: Separate ConfigMap informer for openshift-config-managed #441

Merged

wking mentioned this pull request Jul 2, 2021

Bug 1978774: pkg/cvo/egress: Load HTTPS proxy from Proxy status #621

Merged

palonsoro mentioned this pull request Jul 8, 2021

Bug 1980411: [release-4.8] pkg/cvo/egress: Load HTTPS proxy from Proxy status #627

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bug 1797123: pkg/cvo: Fetch proxy CA certs from openshift-config-managed/trusted-ca-bundle #311

Bug 1797123: pkg/cvo: Fetch proxy CA certs from openshift-config-managed/trusted-ca-bundle #311

wking commented Jan 31, 2020

openshift-ci-robot commented Jan 31, 2020

wking commented Jan 31, 2020

openshift-ci-robot commented Jan 31, 2020

abhinavdahiya commented Feb 1, 2020

wking commented Feb 1, 2020

abhinavdahiya commented Feb 5, 2020

wking commented Feb 18, 2020

openshift-ci-robot commented Feb 18, 2020

openshift-ci-robot commented Jun 29, 2020

wking commented Jun 29, 2020

openshift-ci-robot commented Jun 29, 2020

wking commented Jun 29, 2020

LalatenduMohanty Jul 20, 2020

wking Jul 22, 2020

wking commented Jul 27, 2020

wking commented Jul 31, 2020

vrutkovs left a comment

vrutkovs commented Jul 31, 2020

LalatenduMohanty commented Jul 31, 2020

LalatenduMohanty commented Jul 31, 2020

LalatenduMohanty left a comment

openshift-ci-robot commented Jul 31, 2020

openshift-ci-robot commented Jul 31, 2020 •

edited

Loading

wking commented Jul 31, 2020

openshift-ci-robot commented Jul 31, 2020

Bug 1797123: pkg/cvo: Fetch proxy CA certs from openshift-config-managed/trusted-ca-bundle #311

Bug 1797123: pkg/cvo: Fetch proxy CA certs from openshift-config-managed/trusted-ca-bundle #311

Conversation

wking commented Jan 31, 2020

openshift-ci-robot commented Jan 31, 2020

wking commented Jan 31, 2020

openshift-ci-robot commented Jan 31, 2020

abhinavdahiya commented Feb 1, 2020

wking commented Feb 1, 2020

abhinavdahiya commented Feb 5, 2020

wking commented Feb 18, 2020

openshift-ci-robot commented Feb 18, 2020

openshift-ci-robot commented Jun 29, 2020

wking commented Jun 29, 2020

openshift-ci-robot commented Jun 29, 2020

wking commented Jun 29, 2020

LalatenduMohanty Jul 20, 2020

Choose a reason for hiding this comment

wking Jul 22, 2020

Choose a reason for hiding this comment

wking commented Jul 27, 2020

wking commented Jul 31, 2020

vrutkovs left a comment

Choose a reason for hiding this comment

vrutkovs commented Jul 31, 2020

LalatenduMohanty commented Jul 31, 2020

LalatenduMohanty commented Jul 31, 2020

LalatenduMohanty left a comment

Choose a reason for hiding this comment

openshift-ci-robot commented Jul 31, 2020

openshift-ci-robot commented Jul 31, 2020 • edited Loading

wking commented Jul 31, 2020

openshift-ci-robot commented Jul 31, 2020

openshift-ci-robot commented Jul 31, 2020 •

edited

Loading