Bug 1813894: Disable the addition of service ca to token secrets #24956
Conversation
…oken secrets Previously the serving service CA was added to token secrets by default. This commit changes the addition to be disabled by default and optionally enabled by setting ADD_SERVICE_SERVING_CA_TO_TOKEN_SECRETS=true in the environment.
openshift-ci-robot
added
bugzilla/severity-high
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
requested review from
deads2k,
sttts,
smarterclayton and
tbielawa
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/retest |
|
/hold This PR should not be merged until library-go's staticpod controller no longer depends on the service ca being supplied via service account token (openshift/library-go#792), and all operators that are shipped in an ocp release have been bumped to pick up that library-go change. |
openshift-ci-robot
added
the
do-not-merge/hold
marun
changed the title
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
2 similar comments
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Remind me why we need service ca in the token secrets?
|
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
9 similar comments
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
removed
the
bugzilla/valid-bug
|
@marun: This pull request references Bugzilla bug 1813894, which is invalid:
Comment In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
added
the
bugzilla/invalid-bug
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: marun, sttts The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci-robot
added
approved
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
openshift-ci-robot
removed
the
bugzilla/invalid-bug
|
@marun: This pull request references Bugzilla bug 1813894, which is valid. 3 validation(s) were run on this bug
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/retest Still waiting on the fix for cluster-samples-operator. If for some reason that change doesn't land by Friday, it probably makes sense to land this PR and only have to backport the operator fix. |
|
/hold cancel Want to get this in before master switches to 4.6 development on Monday June 1 to avoid having to backport. I have confirmation from @gabemontero that it is ok for cluster-samples-operator to be temporarily impacted, since code freeze is still 3 weeks away and the required fixes are likely to be in place in days rather than weeks. |
openshift-ci-robot
removed
the
do-not-merge/hold
|
@marun: Some pull requests linked via external trackers have merged: openshift/telemeter#334, openshift/router#130, openshift/origin#24956, openshift/library-go#792, openshift/insights-operator#102, openshift/cluster-kube-scheduler-operator#248. The following pull requests linked via external trackers have not merged:
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Previously the serving service CA was added to token secrets by default. This commit changes the addition to be disabled by default and optionally enabled by setting
ADD_SERVICE_SERVING_CA_TO_TOKEN_SECRETS=truein the environment.PRs that need to merge before this one: