MON-3814: Follow-up #2293 #2315

slashpai · 2024-04-11T04:51:47Z

Follow-up from #2293

I added CHANGELOG entry for this change.
No user facing changes, so no entry in CHANGELOG was needed.

openshift-bot · 2024-04-11T04:51:50Z

@slashpai: This pull request references MON-3814 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.16.0" version, but no target version was set.

In response to this:

Follow-up from #2293

I added CHANGELOG entry for this change.

No user facing changes, so no entry in CHANGELOG was needed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2024-04-11T04:52:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: slashpai

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [slashpai]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

slashpai · 2024-04-18T09:48:48Z

/assign @machine424

machine424 · 2024-04-19T07:18:14Z

pkg/manifests/manifests.go

@@ -2106,6 +2106,8 @@ func (f *Factory) MetricsServerDeployment(apiAuthSecretName string, kubeletCABun
 		"--requestheader-extra-headers-prefix="+requestheaderExtraHeadersPrefix,
 		"--requestheader-group-headers="+requestheaderGroupHeaders,
 		"--requestheader-username-headers="+requestheaderUsernameHeaders,
+		"--tls-cert-file=/etc/client-ca-bundle/tls.crt",


No test was failing when using /etc/tls/private/xxx, do they have the same content? Is testing this difficult?

Thinking about it again. I think what we need here is cleanup as we are using it in volume mount
https://github.com/openshift/cluster-monitoring-operator/pull/2293/files#r1557090512

cluster-monitoring-operator/jsonnet/components/metrics-server.libsonnet

Line 120 in 889bb2c

'service.beta.openshift.io/serving-cert-secret-name': 'metrics-server-tls',

(metrics-server-tls) is been mounted at /etc/tls/private (

cluster-monitoring-operator/jsonnet/components/metrics-server.libsonnet

Line 248 in 889bb2c

name: 'secret-metrics-server-tls',

)

In the updated approach as well it uses the same secret https://github.com/openshift/cluster-monitoring-operator/pull/2293/files#diff-0bbbc0b6e7ee4c4efe218030b64c2ef604fda58d92e51e52c206b6c5c0a4a5a3R158

I updated the PR to remove unused in volume mounts https://github.com/openshift/cluster-monitoring-operator/pull/2293/files#r1557090512

Signed-off-by: Jayapriya Pai <janantha@redhat.com>

slashpai · 2024-04-19T09:38:59Z

pkg/manifests/manifests.go

@@ -2162,16 +2162,14 @@ func (f *Factory) MetricsServerSecret(tlsSecret *v1.Secret, apiAuthConfigmap *v1
 	var (
 		clientCA              = r.value("client-ca-file")
 		requestheaderClientCA = r.value("requestheader-client-ca-file")
-		tlsCA                 = r.value("tls.crt")
-		tlsKey                = r.value("tls.key")
 	)


removing these as it not used and we mount this in assets already

cluster-monitoring-operator/jsonnet/components/metrics-server.libsonnet

Lines 199 to 200 in 889bb2c

'--tls-cert-file=/etc/tls/private/tls.crt',

'--tls-private-key-file=/etc/tls/private/tls.key',

Follow-up https://github.com/openshift/cluster-monitoring-operator/pull/2293/files#r1557090512

True, and I believe the tlsSecret can be dropped now.

(i just realized we didin't need that wait. as we already waited for that secret here

cluster-monitoring-operator/pkg/tasks/metricsserver.go

Lines 122 to 128 in 65ee646

scas, err := t.client.WaitForSecretByNsName(

ctx,

types.NamespacedName{

Namespace: s.Namespace,

Name: s.Annotations["service.beta.openshift.io/serving-cert-secret-name"],

},

)

)

slashpai · 2024-04-24T07:35:37Z

Closing in favour of #2329

slashpai · 2024-04-24T07:35:43Z

/close

openshift-ci · 2024-04-24T07:36:01Z

@slashpai: Closed this PR.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

machine424 · 2024-05-07T10:01:43Z

Because we put #2329 on hold for now, we can revive this PR if you want.

machine424 · 2024-06-05T11:59:37Z

I'll
/reopen
this, it'll be nice to have this cleaning in 4.17

openshift-ci · 2024-06-05T11:59:56Z

@machine424: Reopened this PR.

In response to this:

I'll
/reopen
this, it'll be nice to have this cleaning in 4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2024-06-05T11:59:58Z

@slashpai: This pull request references MON-3814 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.17.0" version, but no target version was set.

In response to this:

Follow-up from #2293

I added CHANGELOG entry for this change.

No user facing changes, so no entry in CHANGELOG was needed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

machine424 · 2024-06-05T14:43:58Z

I think we can merge this once tlsSecret is dropped as an argument to MetricsServerSecret.

machine424 · 2024-06-05T14:44:02Z

/hold

openshift-ci · 2024-07-01T20:29:03Z

@slashpai: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-bot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Apr 11, 2024

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 11, 2024

openshift-ci bot requested review from danielmellado and rexagod April 11, 2024 04:52

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 11, 2024

slashpai changed the title ~~WIP: MON-3814: update request-header flags in metrics-server~~ MON-3814: update request-header flags in metrics-server Apr 18, 2024

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 18, 2024

openshift-ci bot assigned machine424 Apr 18, 2024

machine424 reviewed Apr 19, 2024

View reviewed changes

MON-3814: Follow-up openshift#2293

0c71e7c

Signed-off-by: Jayapriya Pai <janantha@redhat.com>

slashpai force-pushed the metrics-server branch from 6ad247b to 0c71e7c Compare April 19, 2024 09:23

slashpai changed the title ~~MON-3814: update request-header flags in metrics-server~~ MON-3814: Follow-up #2293 Apr 19, 2024

slashpai commented Apr 19, 2024

View reviewed changes

slashpai mentioned this pull request Apr 23, 2024

MON-3866: create separate metrics client cert for metrics server #2329

Open

2 tasks

openshift-ci bot closed this Apr 24, 2024

openshift-ci bot reopened this Jun 5, 2024

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 5, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

MON-3814: Follow-up #2293 #2315

MON-3814: Follow-up #2293 #2315

slashpai commented Apr 11, 2024

openshift-bot commented Apr 11, 2024 •

edited by openshift-ci bot

Loading

openshift-ci bot commented Apr 11, 2024

slashpai commented Apr 18, 2024

machine424 Apr 19, 2024

slashpai Apr 19, 2024

slashpai Apr 19, 2024

slashpai Apr 19, 2024

slashpai Apr 19, 2024

rexagod Apr 19, 2024 •

edited

Loading

machine424 Apr 19, 2024

slashpai commented Apr 24, 2024

slashpai commented Apr 24, 2024

openshift-ci bot commented Apr 24, 2024

machine424 commented May 7, 2024

machine424 commented Jun 5, 2024

openshift-ci bot commented Jun 5, 2024

openshift-ci-robot commented Jun 5, 2024 •

edited by openshift-ci bot

Loading

machine424 commented Jun 5, 2024

machine424 commented Jun 5, 2024

openshift-ci bot commented Jul 1, 2024

	'--tls-cert-file=/etc/tls/private/tls.crt',
	'--tls-private-key-file=/etc/tls/private/tls.key',

	scas, err := t.client.WaitForSecretByNsName(
	ctx,
	types.NamespacedName{
	Namespace: s.Namespace,
	Name: s.Annotations["service.beta.openshift.io/serving-cert-secret-name"],
	},
	)

MON-3814: Follow-up #2293 #2315

Are you sure you want to change the base?

MON-3814: Follow-up #2293 #2315

Conversation

slashpai commented Apr 11, 2024

openshift-bot commented Apr 11, 2024 • edited by openshift-ci bot Loading

openshift-ci bot commented Apr 11, 2024

slashpai commented Apr 18, 2024

machine424 Apr 19, 2024

Choose a reason for hiding this comment

slashpai Apr 19, 2024

Choose a reason for hiding this comment

slashpai Apr 19, 2024

Choose a reason for hiding this comment

slashpai Apr 19, 2024

Choose a reason for hiding this comment

slashpai Apr 19, 2024

Choose a reason for hiding this comment

rexagod Apr 19, 2024 • edited Loading

Choose a reason for hiding this comment

machine424 Apr 19, 2024

Choose a reason for hiding this comment

slashpai commented Apr 24, 2024

slashpai commented Apr 24, 2024

openshift-ci bot commented Apr 24, 2024

machine424 commented May 7, 2024

machine424 commented Jun 5, 2024

openshift-ci bot commented Jun 5, 2024

openshift-ci-robot commented Jun 5, 2024 • edited by openshift-ci bot Loading

machine424 commented Jun 5, 2024

machine424 commented Jun 5, 2024

openshift-ci bot commented Jul 1, 2024

openshift-bot commented Apr 11, 2024 •

edited by openshift-ci bot

Loading

rexagod Apr 19, 2024 •

edited

Loading

openshift-ci-robot commented Jun 5, 2024 •

edited by openshift-ci bot

Loading