Use ServerCA from GameServerAllocationPolicy instead of client secret ca.crt #1545

pooneh-m · 2020-05-14T06:10:42Z

What type of PR is this?
/kind feature

What this PR does / Why we need it:
This is adding ServerCA field to GameServerAllocationPolicy to be used instead of client ca.crt field. This unblocks cert manager adaptation for multi-cluster allocation client certs.

Which issue(s) this PR fixes:
Closes #1517

Special notes for your reviewer:

agones-bot · 2020-05-14T06:26:07Z

Build Failed 😱

Build Id: 302468ce-30c3-447f-b7d5-e8c847863feb

To get permission to view the Cloud Build view, join the agones-discuss Google Group.

markmandel

I only found one small documentation issue, but outside of that, this look good to go 👍

markmandel · 2020-05-14T22:07:14Z

site/content/en/docs/Advanced/multi-cluster-allocation.md

  priority: 1
  weight: 100
 EOF
 ```

 To define the local cluster priority, similarly, an allocation rule should be defined, while leaving allocationEndpoints unset. If the local cluster priority is not defined, the allocation from the local cluster happens only if allocation from other clusters with the existing allocation rules is unsuccessful.

+`sercerCA` is the server TLS CA public certificate, set only if the remote server certificate is not signed by a public CA (e.g. self-signed).


Can we please wrap the references to serverCA, with a feature shortcode?

Done. Thanks!

markmandel · 2020-05-14T22:07:43Z

site/content/en/docs/Advanced/multi-cluster-allocation.md

@@ -67,7 +71,7 @@ EOF

 The certificates are base 64 string of the certificate file e.g. `cat ${CERT_FILE} | base64 -w 0`

-`ca.crt` is the server TLS public certificate if it is self-signed. For simplicity, it is recommended to use one client secret per cluster and make `ca.crt` bundle of server certificates.
+Agones recommends using [cert-manager.io](https://cert-manager.io/) solution for generating client certificates. 


Not for this PR, but do we want to provide some docs on this in some way down the line?

There are already documentation on allocator-service.md for cert-manager.io. I'll try to provide snippets in this doc as well, but in a different PR.

agones-bot · 2020-05-15T06:36:20Z

Build Succeeded 👏

Build Id: 64c1cbc0-8c6e-47f4-a68a-9171a1170886

The following development artifacts have been built, and will exist for the next 30 days:

image: gcr.io/agones-images/agones-controller:1.6.0-cec2f2b
image: gcr.io/agones-images/agones-sdk:1.6.0-cec2f2b
image: gcr.io/agones-images/agones-ping:1.6.0-cec2f2b
Linux C++ SDK (build): agonessdk-1.6.0-cec2f2b-linux-arch_64.tar.gz
SDK Server: agonessdk-server-1.6.0-cec2f2b.zip

A preview of the website (the last 30 builds are retained):

https://cec2f2b-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/GoogleCloudPlatform/agones.git pull/1545/head:pr_1545 && git checkout pr_1545
helm install ./install/helm/agones --namespace agones-system --name agones --set agones.image.tag=1.6.0-cec2f2b

markmandel

Done!

google-oss-robot · 2020-05-15T18:12:32Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: markmandel, pooneh-m

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [markmandel,pooneh-m]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

google-oss-robot · 2020-05-15T18:15:12Z

New changes are detected. LGTM label has been removed.

agones-bot · 2020-05-15T18:33:27Z

Build Succeeded 👏

Build Id: 5548fe0d-51d4-4382-8deb-ccb3ca3374bc

The following development artifacts have been built, and will exist for the next 30 days:

image: gcr.io/agones-images/agones-controller:1.6.0-8962e5a
image: gcr.io/agones-images/agones-sdk:1.6.0-8962e5a
image: gcr.io/agones-images/agones-ping:1.6.0-8962e5a
Linux C++ SDK (build): agonessdk-1.6.0-8962e5a-linux-arch_64.tar.gz
SDK Server: agonessdk-server-1.6.0-8962e5a.zip

A preview of the website (the last 30 builds are retained):

https://8962e5a-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/GoogleCloudPlatform/agones.git pull/1545/head:pr_1545 && git checkout pr_1545
helm install ./install/helm/agones --namespace agones-system --name agones --set agones.image.tag=1.6.0-8962e5a

agones-bot · 2020-05-15T18:54:03Z

Build Succeeded 👏

Build Id: e63d7d74-bfa6-4e0b-b8eb-e021cfa4b6fc

The following development artifacts have been built, and will exist for the next 30 days:

image: gcr.io/agones-images/agones-controller:1.6.0-3dced26
image: gcr.io/agones-images/agones-sdk:1.6.0-3dced26
image: gcr.io/agones-images/agones-ping:1.6.0-3dced26
Linux C++ SDK (build): agonessdk-1.6.0-3dced26-linux-arch_64.tar.gz
SDK Server: agonessdk-server-1.6.0-3dced26.zip

A preview of the website (the last 30 builds are retained):

https://3dced26-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/GoogleCloudPlatform/agones.git pull/1545/head:pr_1545 && git checkout pr_1545
helm install ./install/helm/agones --namespace agones-system --name agones --set agones.image.tag=1.6.0-3dced26

agones-bot · 2020-05-15T19:13:14Z

Build Succeeded 👏

Build Id: 6bfabc8a-bc14-4ac4-8404-c4724a9eef3c

The following development artifacts have been built, and will exist for the next 30 days:

image: gcr.io/agones-images/agones-controller:1.6.0-3482de5
image: gcr.io/agones-images/agones-sdk:1.6.0-3482de5
image: gcr.io/agones-images/agones-ping:1.6.0-3482de5
Linux C++ SDK (build): agonessdk-1.6.0-3482de5-linux-arch_64.tar.gz
SDK Server: agonessdk-server-1.6.0-3482de5.zip

A preview of the website (the last 30 builds are retained):

https://3482de5-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/GoogleCloudPlatform/agones.git pull/1545/head:pr_1545 && git checkout pr_1545
helm install ./install/helm/agones --namespace agones-system --name agones --set agones.image.tag=1.6.0-3482de5

agones-bot · 2020-05-15T20:01:14Z

Build Succeeded 👏

Build Id: 2f381365-9556-4bf6-879d-54651e979dd6

The following development artifacts have been built, and will exist for the next 30 days:

image: gcr.io/agones-images/agones-controller:1.6.0-7a7b478
image: gcr.io/agones-images/agones-sdk:1.6.0-7a7b478
image: gcr.io/agones-images/agones-ping:1.6.0-7a7b478
Linux C++ SDK (build): agonessdk-1.6.0-7a7b478-linux-arch_64.tar.gz
SDK Server: agonessdk-server-1.6.0-7a7b478.zip

A preview of the website (the last 30 builds are retained):

https://7a7b478-dot-preview-dot-agones-images.appspot.com/

To install this version:

git fetch https://github.com/GoogleCloudPlatform/agones.git pull/1545/head:pr_1545 && git checkout pr_1545
helm install ./install/helm/agones --namespace agones-system --name agones --set agones.image.tag=1.6.0-7a7b478

Co-authored-by: Mark Mandel <markmandel@google.com>

google-oss-robot requested review from markmandel and roberthbailey May 14, 2020 06:10

google-oss-robot added approved size/L labels May 14, 2020

markmandel reviewed May 14, 2020

View reviewed changes

Use ServerCA instead of client secret ca.crt

cec2f2b

pooneh-m force-pushed the random branch from bc5f4df to cec2f2b Compare May 15, 2020 06:18

pooneh-m requested a review from markmandel May 15, 2020 16:14

markmandel approved these changes May 15, 2020

View reviewed changes

google-oss-robot assigned markmandel May 15, 2020

google-oss-robot added the lgtm label May 15, 2020

Merge branch 'master' into random

8962e5a

google-oss-robot removed the lgtm label May 15, 2020

Merge branch 'master' into random

3dced26

Merge branch 'master' into random

3482de5

Merge branch 'master' into random

7a7b478

pooneh-m merged commit 3a01161 into googleforgames:master May 15, 2020

markmandel added this to the 1.6.0 milestone May 19, 2020

markmandel added area/operations Installation, updating, metrics etc kind/feature New features for Agones labels May 19, 2020

ilkercelikyilmaz pushed a commit to ilkercelikyilmaz/agones that referenced this pull request Oct 23, 2020

Use ServerCA instead of client secret ca.crt (googleforgames#1545)

5f6254f

Co-authored-by: Mark Mandel <markmandel@google.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use ServerCA from GameServerAllocationPolicy instead of client secret ca.crt #1545

Use ServerCA from GameServerAllocationPolicy instead of client secret ca.crt #1545

pooneh-m commented May 14, 2020

agones-bot commented May 14, 2020

markmandel left a comment

markmandel May 14, 2020

pooneh-m May 15, 2020 •

edited

Loading

markmandel May 14, 2020

pooneh-m May 15, 2020

agones-bot commented May 15, 2020

markmandel left a comment

google-oss-robot commented May 15, 2020

google-oss-robot commented May 15, 2020

agones-bot commented May 15, 2020

agones-bot commented May 15, 2020

agones-bot commented May 15, 2020

agones-bot commented May 15, 2020

Use ServerCA from GameServerAllocationPolicy instead of client secret ca.crt #1545

Use ServerCA from GameServerAllocationPolicy instead of client secret ca.crt #1545

Conversation

pooneh-m commented May 14, 2020

agones-bot commented May 14, 2020

markmandel left a comment

Choose a reason for hiding this comment

markmandel May 14, 2020

Choose a reason for hiding this comment

pooneh-m May 15, 2020 • edited Loading

Choose a reason for hiding this comment

markmandel May 14, 2020

Choose a reason for hiding this comment

pooneh-m May 15, 2020

Choose a reason for hiding this comment

agones-bot commented May 15, 2020

markmandel left a comment

Choose a reason for hiding this comment

google-oss-robot commented May 15, 2020

google-oss-robot commented May 15, 2020

agones-bot commented May 15, 2020

agones-bot commented May 15, 2020

agones-bot commented May 15, 2020

agones-bot commented May 15, 2020

pooneh-m May 15, 2020 •

edited

Loading