-
Notifications
You must be signed in to change notification settings - Fork 254
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
cert rotation #1091
cert rotation #1091
Conversation
2789020
to
bb42b35
Compare
/hold Still want to think on a couple things |
(I might be misreading the code...) Having the private and public keys files in the same directory and accessing it by mounting the directory probably means that the pods verifying keys can also impersonate that key. |
It would be nice to write more of the design somewhere, at least in the commit message keys are stored on the master node's filesystem in |
bb42b35
to
72fa1c0
Compare
@maya-r Not quite sure I understand your concern. But the paths we are protecting are as follows. And in no case does the client have direct access to the server key. In all cases, verification is done via the CA bundles which are stored in configmaps and separate from the keys/certs stored in secrets. upload proxy -> upload server: upload proxy has upload server CA bundle configmap mounted |
5a810a2
to
90bc52f
Compare
/test pull-containerized-data-importer-e2e-k8s-1.16.2-ceph |
1 similar comment
/test pull-containerized-data-importer-e2e-k8s-1.16.2-ceph |
90bc52f
to
558cef6
Compare
@@ -61,6 +64,7 @@ require ( | |||
replace ( | |||
github.com/openshift/api => github.com/openshift/api v0.0.0-20191219222812-2987a591a72c | |||
github.com/openshift/client-go => github.com/openshift/client-go v0.0.0-20191125132246-f6563a70e19a | |||
github.com/openshift/library-go => github.com/mhenriks/library-go v0.0.0-20200116194830-9fcc1a687a9d |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
using fork until this is merged: openshift/library-go#540
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If we merge this could you create a gh issue so we don't forget to back to the trunk?
feb4c94
to
9687298
Compare
/test pull-containerized-data-importer-e2e-k8s-1.16.2-upg |
/retest |
/hold cancel |
pkg/operator/controller/predicate.go
Outdated
"sigs.k8s.io/controller-runtime/pkg/predicate" | ||
) | ||
|
||
// LeaderAlectionAnnotation is the annotatation used on resources for leader election |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LeaderElectionAnnotation?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lol yup
Signed-off-by: Michael Henriksen <mhenriks@redhat.com>
9687298
to
d9d8d3c
Compare
/lgtm |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: awels The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/test pull-containerized-data-importer-e2e-k8s-1.15.1-ceph |
What this PR does / why we need it:
Currently certs expire after a year. This fixes that by having the operator create/refresh certs. The apiserver and uploadproxy mount certs as secrets and watch for updates to update TLSConfig appropriately.
The operator also creates/manages CA certs for upload server/client.
Which issue(s) this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)
format, will close the issue(s) when PR gets merged):Fixes #
Special notes for your reviewer:
The apiserver doesn't support non disruptive update of their CA certs. This would be a pretty easy add on, though. Have to watch CA bundles and reregister apiserver when it changes.
Release note: