Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Include dex secrets only when oidc is non tigera or nil #3670

Merged
merged 2 commits into from
Dec 20, 2024
Merged

Include dex secrets only when oidc is non tigera or nil #3670

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c23c073
Include dex secrets when oidc is non tigera or nil
vara2504 Dec 20, 2024
6e2b71f
Fix dirty check
vara2504 Dec 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions pkg/crds/calico/crd.projectcalico.org_felixconfigurations.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -298,6 +298,14 @@ spec:
BPFPolicyDebugEnabled when true, Felix records detailed information
about the BPF policy programs, which can be examined with the calico-bpf command-line tool.
type: boolean
bpfProfiling:
description: |-
BPFProfiling controls profiling of BPF programs. At the monent, it can be
Disabled or Enabled. [Default: Disabled]
enum:
- Enabled
- Disabled
type: string
bpfRedirectToPeer:
description: |-
BPFRedirectToPeer controls which whether it is allowed to forward straight to the
Expand Down
7 changes: 4 additions & 3 deletions pkg/render/dex.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,10 +138,11 @@ func (c *dexComponent) Objects() ([]client.Object, []client.Object) {
// TODO the RequiredSecrets in the dex condig to not pass back secrets of this type.
if !c.cfg.DeleteDex {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rene-dekker DeleteDex is set to true only when (authentication.Spec.OIDC != nil && authentication.Spec.OIDC.Type == operatorv1.OIDCTypeTiger) here, which is logically equivalent to !(authentication.Spec.OIDC == nil || authentication.Spec.OIDC.Type != operatorv1.OIDCTypeTiger). Therefore, it should be ok to included under the same if condition.

objs = append(objs, secret.ToRuntimeObjects(c.cfg.DexConfig.RequiredSecrets(common.OperatorNamespace())...)...)
}

objs = append(objs, secret.ToRuntimeObjects(c.cfg.DexConfig.RequiredSecrets(DexNamespace)...)...)
objs = append(objs, secret.ToRuntimeObjects(secret.CopyToNamespace(DexNamespace, c.cfg.PullSecrets...)...)...)
// The Dex namespace exists only for non-Tigera OIDC types to create secrets within the namespace.
objs = append(objs, secret.ToRuntimeObjects(c.cfg.DexConfig.RequiredSecrets(DexNamespace)...)...)
objs = append(objs, secret.ToRuntimeObjects(secret.CopyToNamespace(DexNamespace, c.cfg.PullSecrets...)...)...)
}

if c.cfg.Installation.CertificateManagement != nil {
objs = append(objs, certificatemanagement.CSRClusterRoleBinding(DexObjectName, DexNamespace))
Expand Down
Loading