CM-235: Support for istio-csr through integration with cert-manager-operator #1628

bharath-b-rh · 2024-05-16T05:14:13Z

This enhancement describes the proposal to extend cert-manager-operator to deploy and manage the istio-csr solution. OpenShift Service Mesh facilitates the security of both intra-cluster and external service communications through mTLS. And istio-csr acts as an agent to obtain and renew certificates that facilitate mTLS from the cert-manager.

openshift-ci-robot · 2024-05-16T05:14:16Z

@bharath-b-rh: This pull request references CM-235 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.16.0" version, but no target version was set.

In response to this:

This enhancement describes the proposal to extend cert-manager-operator to deploy and manage the istio-csr solution. OpenShift Service Mesh facilitates the security of both intra-cluster and external service communications through mTLS. And istio-csr acts as an agent to obtain and renew certificates that facilitate mTLS from the cert-manager.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

bharath-b-rh · 2024-05-16T05:14:23Z

/cc @TrilokGeer

…perator

jewertow

If we require to install istio-csr in the same namespace as istiod, we might always try to find istio-ca secret and mount ca.crt in /var/run/secrets/istio-csr/ to avoid "Trust on first use" (read this comment for more context). WDYT?

enhancements/cert-manager/istio-csr-controller.md

jewertow · 2024-05-20T20:57:24Z

enhancements/cert-manager/istio-csr-controller.md

+	// Namespace where the istio control-plane is running.
+	// Same namespace will be used for deploying istio-csr agent.
+	// +kubebuilder:default:="istio-system"
+	// +kubebuilder:validation:XValidation:rule="oldSelf == '' || self == oldSelf",message="namespace is immutable once set"
+	// +optional
+	Namespace string `json:"namespace,omitempty"`


This is not intuitive in my opinion. The namespace of IstioCSR resource should decide where istio-csr controller will be installed. Additionally, if you assume that istio-csr must be deployed in the same namespace as istiod, then we wouldn't need this field at all.

Suggested change

// Namespace where the istio control-plane is running.

// Same namespace will be used for deploying istio-csr agent.

// +kubebuilder:default:="istio-system"

// +kubebuilder:validation:XValidation:rule="oldSelf == '' || self == oldSelf",message="namespace is immutable once set"

// +optional

Namespace string `json:"namespace,omitempty"`

But Namespace is for installing the operand istio-csr, the controller is managing. And thought not assume the istiod namespace, made it as a config param. Please let me know WDYT.

I am not sure that I understand it correctly. If I create IstioCSR resource, will it result in deploying a controller that will manage istio-csr agent? And the controller will be created in IstioCSR.metadata.namespace and the agent in IstioCSR.spec.controllerConfig.namespace?

Yeah the field name ControllerConfig is misleading, I will update it.

the controller will be created in IstioCSR.metadata.namespace and the agent in IstioCSR.spec.controllerConfig.namespace

istio-csr manager is part of cert-manager-operator which will watch for istiocsr custom resource and install istio-csr agent in IstioCSR.spec.controllerConfig.namespace. In fact all the configs in controllerConfig is for setting up the agent. I will update the name and comments appropriately.
And I think it would be better to add a CEL validation for restricting the istiocsr custom resource in cert-manager-operator namespace. Please let me know WDYT.

If istio-csr agent must run in the same namespace as istiod, I would remove controllerConfig.namespace and rely only on the metadata.namespace.

Yeah, but the expectation is to create the new CR in operator namespace and namespace where istiod will be installed need not exist at the time, operator will create it.

namespace where istiod will be installed need not exist at the time

Why?

My understanding is based on this doc that, istio-csr can be and must be installed before istio. Please correct me if understanding is wrong.

@jewertow Is there a maximum tenancy limitation? For cases of mis-managed tenancies, cert-manager operators watching these deployments will be overwhelmed over time leading to performance issues.

jewertow · 2024-05-20T21:08:27Z

enhancements/cert-manager/istio-csr-controller.md

+      kind: ClusterRole
+      apiVersion: rbac.authorization.k8s.io/v1
+      metadata:
+        name: cert-manager-istio-csr


We may need a suffix for cluster role names to support multi-tenancy in the future.

enhancements/cert-manager/istio-csr-controller.md

Co-authored-by: Jacek Ewertowski <jacek.ewertowski1@gmail.com>

bharath-b-rh · 2024-05-21T13:15:27Z

@jewertow Thank you for reviewing the PR!!

bharath-b-rh · 2024-05-29T14:22:02Z

If we require to install istio-csr in the same namespace as istiod, we might always try to find istio-ca secret and mount ca.crt in /var/run/secrets/istio-csr/ to avoid "Trust on first use" (read this comment for more context). WDYT?

Thank you sharing! I agree, we can mount the secret with CA certificate while starting the istio-csr.

TrilokGeer · 2024-06-20T15:30:55Z

enhancements/cert-manager/istio-csr-controller.md

+
+### User Stories
+
+- As an OpenShift user, I want to have an option to dynamically enable `istio-csr`, so that it can be used only


A user story is required for installation, un-installation and upgrade usecases.

TrilokGeer · 2024-06-20T15:32:30Z

enhancements/cert-manager/istio-csr-controller.md

+## Summary
+
+This enhancement describes the proposal to extend cert-manager-operator to deploy and manage the `istio-csr`
+solution. `OpenShift Service Mesh` facilitates the security of both intra-cluster and external service


An elaboration about the istio-csr is required. Would istio-csr solution mean a controller or set of controllers?

openshift-bot · 2024-07-19T01:15:22Z

Inactive enhancement proposals go stale after 28d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle stale.
Stale proposals rot after an additional 7d of inactivity and eventually close.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle stale

openshift-bot · 2024-07-26T08:45:27Z

Stale enhancement proposals rot after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Rotten proposals close after an additional 7d of inactivity.
Exclude this proposal from closing by commenting /lifecycle frozen.

If this proposal is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

bharath-b-rh · 2024-07-31T04:36:21Z

/remove-lifecycle stale

openshift-bot · 2024-08-07T08:15:46Z

Rotten enhancement proposals close after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Reopen the proposal by commenting /reopen.
Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Exclude this proposal from closing again by commenting /lifecycle frozen.

/close

openshift-ci · 2024-08-07T08:16:08Z

@openshift-bot: Closed this PR.

In response to this:

Rotten enhancement proposals close after 7d of inactivity.

See https://github.com/openshift/enhancements#life-cycle for details.

Reopen the proposal by commenting /reopen.
Mark the proposal as fresh by commenting /remove-lifecycle rotten.
Exclude this proposal from closing again by commenting /lifecycle frozen.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

bharath-b-rh · 2024-08-07T08:18:36Z

/reopen

bharath-b-rh · 2024-08-07T08:19:08Z

/remove-lifecycle rotten

openshift-ci-robot · 2024-08-07T08:20:51Z

@bharath-b-rh: This pull request references CM-235 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "4.17.0" version, but no target version was set.

In response to this:

This enhancement describes the proposal to extend cert-manager-operator to deploy and manage the istio-csr solution. OpenShift Service Mesh facilitates the security of both intra-cluster and external service communications through mTLS. And istio-csr acts as an agent to obtain and renew certificates that facilitate mTLS from the cert-manager.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2024-08-07T08:20:51Z

@bharath-b-rh: Reopened this PR.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2024-08-07T08:21:49Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign runcom for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2024-08-07T08:36:29Z

@bharath-b-rh: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

TrilokGeer · 2024-08-19T06:07:20Z

enhancements/cert-manager/istio-csr-controller.md

+
+`istio-csr` controller will make use of static manifest templates for creating below resources to
+successfully deploy `istio-csr` agent.
+* `certificate.cert-manager.io`


The list has resources created by cert-manager operator as part for cert-manager installation. Are there any differences that needs to be considered for istio-csr?

TrilokGeer · 2024-08-19T06:23:17Z

enhancements/cert-manager/istio-csr-controller.md

+create the same for enabling the deployment. `istio-csr` should be deployed in the same namespace as that of
+the `OpenShift Service Mesh` control plane.
+
+When `istiocsr` custom resource is created but `issuerref` is not provided operator will create a


Can you take a relook at this paragraph? cert-manager Certficiate either uses a cluster scoped issuer (ClusterIssuer) or namespace scoped issuer (referred as only Issuer). There is missing context about the Issuer being created using ClusterIssuer.

TrilokGeer · 2024-08-19T06:41:35Z

enhancements/cert-manager/istio-csr-controller.md

+  functionality of `OpenShift Service Mesh` also deployed in the same namespace.
+- issuerRef:
+  IssuerRef is the reference to the certificate authority used for signing the certificates requested by
+  `OpenShift Service Mesh`. And allowing to change this config will create issues to renewing the existing


Elaborate the issues related to trust distribution in a separate paragraph.

TrilokGeer · 2024-08-19T06:42:23Z

enhancements/cert-manager/istio-csr-controller.md

+An OpenShift user could update any configurations in the spec section of the API, except for below
+configurations which are immutable and once set cannot be modified.
+- namespace:
+  Namespace where the `istio-csr` agent will be deployed, will also be used for creating other resources


How are the fields designed to be immutable?

TrilokGeer · 2024-08-19T06:44:23Z

enhancements/cert-manager/istio-csr-controller.md

+Configurations made available in the spec of `istio-csr` custom resource are passed as process arguments and
+updating these configurations would cause new rollout to happen.
+
+When an OpenShift user deletes istio-csr CR object `istio-csr` agent deployment will be deleted and all the


What is the remediation in case of deletion failure?

TrilokGeer · 2024-08-19T06:45:13Z

enhancements/cert-manager/istio-csr-controller.md

+
+### Workflow Description
+
+- An OpenShift user enables `istio-csr` by creating the new custom resource made available for configuring


Is it possible to add a sequence diagram to elaborate on the execution workflow

TrilokGeer · 2024-08-19T07:18:06Z

enhancements/cert-manager/istio-csr-controller.md

+	// Namespace where the istio control-plane is running.
+	// Same namespace will be used for deploying istio-csr agent.
+	// +kubebuilder:default:="istio-system"
+	// +kubebuilder:validation:XValidation:rule="oldSelf == '' || self == oldSelf",message="namespace is immutable once set"
+	// +optional
+	Namespace string `json:"namespace,omitempty"`


@jewertow Is there a maximum tenancy limitation? For cases of mis-managed tenancies, cert-manager operators watching these deployments will be overwhelmed over time leading to performance issues.

TrilokGeer · 2024-08-19T07:21:24Z

enhancements/cert-manager/istio-csr-controller.md

+
+## Version Skew Strategy
+
+Istio-csr will be supported for OpenShift Service Mesh Operator 2.4+, Istio v1.10+ and cert-manager v1.3+.


cert-manager operator version needs to be added to the list.

TrilokGeer · 2024-08-22T05:28:19Z

enhancements/cert-manager/istio-csr-controller.md

+}
+
+// IstioCSRStatus is the most recently observed status of the IstioCSR.
+type IstioCSRStatus struct {


A re-look at status fields of operator and controller will be needed as per new context.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label May 16, 2024

openshift-ci bot requested a review from TrilokGeer May 16, 2024 05:14

bharath-b-rh force-pushed the cm-235 branch 2 times, most recently from 8f3aa72 to bca36dd Compare May 16, 2024 05:47

CM-235: Support for istio-csr through integration with cert-manager-o…

35db38d

…perator

bharath-b-rh force-pushed the cm-235 branch from bca36dd to 35db38d Compare May 16, 2024 06:19

jewertow reviewed May 20, 2024

View reviewed changes

Apply suggestions from code review

13e71d2

Co-authored-by: Jacek Ewertowski <jacek.ewertowski1@gmail.com>

TrilokGeer reviewed Jun 20, 2024

View reviewed changes

openshift-ci bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jul 19, 2024

openshift-ci bot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Jul 26, 2024

openshift-ci bot closed this Aug 7, 2024

openshift-ci bot removed the lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. label Aug 7, 2024

openshift-ci bot reopened this Aug 7, 2024

TrilokGeer reviewed Aug 19, 2024

View reviewed changes

TrilokGeer reviewed Aug 22, 2024

View reviewed changes


		### User Stories

		- As an OpenShift user, I want to have an option to dynamically enable `istio-csr`, so that it can be used only


		### Workflow Description

		- An OpenShift user enables `istio-csr` by creating the new custom resource made available for configuring


		## Version Skew Strategy

		Istio-csr will be supported for OpenShift Service Mesh Operator 2.4+, Istio v1.10+ and cert-manager v1.3+.

CM-235: Support for istio-csr through integration with cert-manager-operator #1628

Are you sure you want to change the base?

CM-235: Support for istio-csr through integration with cert-manager-operator #1628

Conversation

bharath-b-rh commented May 16, 2024

openshift-ci-robot commented May 16, 2024 • edited by openshift-ci bot Loading

bharath-b-rh commented May 16, 2024

jewertow left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bharath-b-rh commented May 21, 2024

bharath-b-rh commented May 29, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-bot commented Jul 19, 2024

openshift-bot commented Jul 26, 2024

bharath-b-rh commented Jul 31, 2024

openshift-bot commented Aug 7, 2024

openshift-ci bot commented Aug 7, 2024

bharath-b-rh commented Aug 7, 2024

bharath-b-rh commented Aug 7, 2024

openshift-ci-robot commented Aug 7, 2024 • edited by openshift-ci bot Loading

openshift-ci bot commented Aug 7, 2024

openshift-ci bot commented Aug 7, 2024

openshift-ci bot commented Aug 7, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-ci-robot commented May 16, 2024 •

edited by openshift-ci bot

Loading

openshift-ci-robot commented Aug 7, 2024 •

edited by openshift-ci bot

Loading