-
Notifications
You must be signed in to change notification settings - Fork 1.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
🌱 Prepare envtest certs for aggregation layer #1449
Conversation
Hi @timebertt. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: timebertt The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
@alvaroaleman @DirectXMan12 can one of you check this PR? |
@DirectXMan12 is currently working on adding TLS support to envtest, maybe we should wait for that? |
Hmm, probably makes sense. |
/assign @DirectXMan12 |
friendly ping to @DirectXMan12 |
@alvaroaleman @DirectXMan12 how do we proceed here? |
hey, I'm sorry for dropping this one, I'll figure out what to do with this shortly -- lost track of some PRs. Btw, if this happens again, please do ping me on slack -- I occasionally lose track of github notifications. |
@DirectXMan12 Ok, will ping you on slack next time :) |
@timebertt: PR needs rebase. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
Currently working on upgrading to controller-runtime@v0.9.0 (gardener/gardener#4174). Will figure out what to do with this PR during that. |
- Make use of the new Users concept in envtest to provision a dedicated user for gardener-apiserver and a valid kubeconfig - Make use of the new way to configure API server args to easily configure kube-aggregator flags - Also generate certs for aggregation layer on our own instead of reusing the API server ca/certs (which is semantically correct), which allows us to drop our fork including kubernetes-sigs/controller-runtime#1449
* Upgrade to k/*@v0.21.1 in go.mod * [automated] make revendor for k/* dependencies This deletes pkg/mock/client-go/kubernetes/mocks.go to resolve the following deadlock: make revendor fails because of some dependencies of the file and make generate fails because of missing revendoring. File will be generated again in the next commit. * [automated] make generate for k/* dependencies * Upgrade to c-r@v0.9.0 in go.mod * [automated] make revendor for c-r dependency `make revendor` results in `hack/setup-envtest.sh` being broken, so reset the file after running `make revendor`. Adaption to breaking changes in the upstream file will be done in a later commit. * manager.NewClientBuilder was removed in favor of cluster.DefaultNewClient ref kubernetes-sigs/controller-runtime#1409 * client.*MergeFrom* now take client.Object instead of runtime.Object ref kubernetes-sigs/controller-runtime#1395 * [automated] make generate for c-r dependency * Adapt to changes in labels.NewRequirement ref kubernetes/kubernetes#97538 * Adapt to new setup-envtest tool Makes use of the new setup-envtest tool (kubernetes-sigs/controller-runtime#1488) in hack/setup-envtest.sh instead of vendoring hack/setup-envtest.sh and fetching binaries with that. * [automated] make revendor for setup-envtest tool * Adapt pkg/envtest to upstream changes - Make use of the new Users concept in envtest to provision a dedicated user for gardener-apiserver and a valid kubeconfig - Make use of the new way to configure API server args to easily configure kube-aggregator flags - Also generate certs for aggregation layer on our own instead of reusing the API server ca/certs (which is semantically correct), which allows us to drop our fork including kubernetes-sigs/controller-runtime#1449 * Styling nits
After upgrading to controller-runtime@v0.9.0, I adapted our configuration of the aggregation layer to #1541 and decided to not reuse the client/serving certs and generate dedicated front-proxy CA/cert/key instead (which is also cleaner) – reusing the client/serving certs was more a quick and dirty solution actually. With that, this PR is not required anymore, so You can find the updated example for how to configure the aggregation layer in envtest here. |
@timebertt: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
* Upgrade to k/*@v0.21.1 in go.mod * [automated] make revendor for k/* dependencies This deletes pkg/mock/client-go/kubernetes/mocks.go to resolve the following deadlock: make revendor fails because of some dependencies of the file and make generate fails because of missing revendoring. File will be generated again in the next commit. * [automated] make generate for k/* dependencies * Upgrade to c-r@v0.9.0 in go.mod * [automated] make revendor for c-r dependency `make revendor` results in `hack/setup-envtest.sh` being broken, so reset the file after running `make revendor`. Adaption to breaking changes in the upstream file will be done in a later commit. * manager.NewClientBuilder was removed in favor of cluster.DefaultNewClient ref kubernetes-sigs/controller-runtime#1409 * client.*MergeFrom* now take client.Object instead of runtime.Object ref kubernetes-sigs/controller-runtime#1395 * [automated] make generate for c-r dependency * Adapt to changes in labels.NewRequirement ref kubernetes/kubernetes#97538 * Adapt to new setup-envtest tool Makes use of the new setup-envtest tool (kubernetes-sigs/controller-runtime#1488) in hack/setup-envtest.sh instead of vendoring hack/setup-envtest.sh and fetching binaries with that. * [automated] make revendor for setup-envtest tool * Adapt pkg/envtest to upstream changes - Make use of the new Users concept in envtest to provision a dedicated user for gardener-apiserver and a valid kubeconfig - Make use of the new way to configure API server args to easily configure kube-aggregator flags - Also generate certs for aggregation layer on our own instead of reusing the API server ca/certs (which is semantically correct), which allows us to drop our fork including kubernetes-sigs/controller-runtime#1449 * Styling nits
* Upgrade to k/*@v0.21.1 in go.mod * [automated] make revendor for k/* dependencies This deletes pkg/mock/client-go/kubernetes/mocks.go to resolve the following deadlock: make revendor fails because of some dependencies of the file and make generate fails because of missing revendoring. File will be generated again in the next commit. * [automated] make generate for k/* dependencies * Upgrade to c-r@v0.9.0 in go.mod * [automated] make revendor for c-r dependency `make revendor` results in `hack/setup-envtest.sh` being broken, so reset the file after running `make revendor`. Adaption to breaking changes in the upstream file will be done in a later commit. * manager.NewClientBuilder was removed in favor of cluster.DefaultNewClient ref kubernetes-sigs/controller-runtime#1409 * client.*MergeFrom* now take client.Object instead of runtime.Object ref kubernetes-sigs/controller-runtime#1395 * [automated] make generate for c-r dependency * Adapt to changes in labels.NewRequirement ref kubernetes/kubernetes#97538 * Adapt to new setup-envtest tool Makes use of the new setup-envtest tool (kubernetes-sigs/controller-runtime#1488) in hack/setup-envtest.sh instead of vendoring hack/setup-envtest.sh and fetching binaries with that. * [automated] make revendor for setup-envtest tool * Adapt pkg/envtest to upstream changes - Make use of the new Users concept in envtest to provision a dedicated user for gardener-apiserver and a valid kubeconfig - Make use of the new way to configure API server args to easily configure kube-aggregator flags - Also generate certs for aggregation layer on our own instead of reusing the API server ca/certs (which is semantically correct), which allows us to drop our fork including kubernetes-sigs/controller-runtime#1449 * Styling nits
Prepare API server certs in envtest for usage with the aggregation layer:
--requestheader-client-ca-file
and--client-ca-file
ClientAuth
key usage to API server cert, so it can be used by the API server to authenticate against an extension API serverWith this change, tests are able to setup the API server's aggregation layer for registering
APIService
s in their test environment.For example:
These are the minimum required changes to make this scenario work.
Ref #1448