Skip to content
This repository has been archived by the owner on Aug 12, 2024. It is now read-only.

Update certificate support #920

Merged
merged 1 commit into from
Jun 18, 2024
Merged

Conversation

tmshort
Copy link
Contributor

@tmshort tmshort commented Jun 14, 2024

Remove rootCAs from the NewDefaultUnpacker API, the argument is no longer used for HTTP transport.

Add CertificateData to the ImageSource struct. This is PEM-encoded data (straight from a Secret[tls.crt]) to be used to validate the certificate used to access an image regidstry (works along side the InsecureSkipTLSVerify option).

@tmshort tmshort requested a review from a team as a code owner June 14, 2024 17:09
@tmshort
Copy link
Contributor Author

tmshort commented Jun 14, 2024

This is necessary to get certs work on a per-ClusterExtension basis for an image registry. The CertifcateData is PEM to avoid rukpak having to look up secrets, etc. The creator of the BundleDeployment needs to do the lookup, etc. The default is to use system provided CAs, and those are included even if CertificateData is specified.

Copy link

codecov bot commented Jun 14, 2024

Codecov Report

Attention: Patch coverage is 0% with 17 lines in your changes missing coverage. Please review.

Project coverage is 14.42%. Comparing base (352d42f) to head (c8117d8).
Report is 4 commits behind head on main.

Files Patch % Lines
pkg/source/image_registry.go 0.00% 14 Missing ⚠️
cmd/core/main.go 0.00% 1 Missing ⚠️
cmd/helm/main.go 0.00% 1 Missing ⚠️
pkg/source/unpacker.go 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #920      +/-   ##
==========================================
- Coverage   14.44%   14.42%   -0.03%     
==========================================
  Files          41       41              
  Lines        2554     2558       +4     
==========================================
  Hits          369      369              
- Misses       2128     2132       +4     
  Partials       57       57              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Remove `rootCAs` from the `NewDefaultUnpacker` API, the argument is no
longer used for HTTP transport.

Add `CertificateData` to the ImageSource struct. This is PEM-encoded
data (straight from a Secret[tls.crt]) to be used to validate the
certificate used to access an image regidstry (works along side the
`InsecureSkipTLSVerify` option).

Signed-off-by: Todd Short <todd.short@me.com>
@tmshort
Copy link
Contributor Author

tmshort commented Jun 14, 2024

The code is tested in the e2e, but that doesn't count toward code coverage.

Copy link
Member

@varshaprasad96 varshaprasad96 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jun 18, 2024
@tmshort tmshort added this pull request to the merge queue Jun 18, 2024
Merged via the queue into operator-framework:main with commit e1d8b0e Jun 18, 2024
7 of 10 checks passed
@tmshort tmshort deleted the cert-updates branch June 18, 2024 13:48
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants