Api service certificates are created for each api group

[lulf]

I have a CSV with apiservice definitions with different groups hosted by an API server. I'm using the latest OCP 4 installer on AWS.

When I install the operator, 2 certificate secrets gets created:

v1beta1.enmasse.io-cert                                           kubernetes.io/tls                     2         12m                                                                                             
v1beta1.user.enmasse.io-cert                                      kubernetes.io/tls                     2         12m                                                                                             

Moreover, it seems the last one created is the one that gets injected to the api server. I would expect only 1 certificate to be created for an api server.

Following is the api services that are defined in my CSV. 2 resources use the group enmasse.io and 1 resource use the group user.enmasse.io.

apiservicedefinitions:
    owned:
    - group: enmasse.io
      version: v1beta1
      kind: AddressSpace 
      name: addressspaces.enmasse.io
      displayName: Address Space
      description: A group of messaging addresses that can be accessed via the same endpoint
      deploymentName: api-server
      containerPort: 8443
    - group: enmasse.io
      version: v1beta1
      kind: Address
      name: addresses.enmasse.io
      displayName: Address
      description: A messaging address that can be used to send/receive messages to/from
      deploymentName: api-server
      containerPort: 8443
    - group: user.enmasse.io
      version: v1beta1
      kind: MessagingUser
      name: messagingusers.user.enmasse.io
      displayName: Messaging User
      description: A messaging user that can connect to an Address Space
      deploymentName: api-server
      containerPort: 8443

[ecordell]

Thanks for the report - we currently assume 1 APIService per deployment, which is why you're seeing this issue.

We will work on a fix and update here. In the mean time, you can work around it by splitting across two deployments (not sure how simple this would be for your current deployment)

[lulf]

The workaround of creating 2 api server deployments fixes the issue for us, thanks!

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[dmesser]

Given the adoption of APIServices in general, I think we are going to stay with the guideline of 1 APIServer per deployment for now, as a suitable workaround exists.