Create singleton recipe for Cert Manager #2328

YCShen1010 · 2024-12-06T21:39:13Z

What this PR does:

Create a new template for Cert Manager and resources cert manager configs including set of Application, Assignment, PolicyAssignment and new streamlined Recipe

Issue: https://github.ibm.com/IBMPrivateCloud/roadmap/issues/64751

Condition check

Before backup: if there is no IBM cert manager subscription, then it failed (checking by selectorlabel).
Before restore: if there is already a cert manager webhook exists on the cluster, then failed and error out.

Test steps:

Install IBM Cert Manager
Create new cert manager templates
Run backup and restore on fusion

Test result

Positive case:

Negative case (if there is a cert manager present in the restore cluster, then error out):

ibm-ci-bot · 2024-12-06T21:39:16Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: YCShen1010

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [YCShen1010]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

bluzarraga

Let's talk about how we want cert manager to work in these recipes during our sync up tomorrow. It sits in a weird spot since it is mandatory compared to the licensing singletons and I think that requires a little more discussion

velero/spectrum-fusion/cert-manager/backup-restore-workflow.yaml

Signed-off-by: YuChen <[email protected]>

bluzarraga · 2024-12-12T20:22:30Z

velero/spectrum-fusion/cert-manager/backup-restore-workflow.yaml

+  recipe:
+    apiVersion: spp-data-protection.isf.ibm.com/v1alpha1
+    name: cert-manager-recipe
+    namespace: ibm-spectrum-fusion-ns


I like the backup-restore-workflow.yaml idea, good job

Signed-off-by: YuChen <[email protected]>

bluzarraga · 2024-12-12T20:23:33Z

velero/spectrum-fusion/recipes/4.0-4.5-example-recipe-multi-ns.yaml

@@ -32,7 +32,7 @@ spec:
      includeClusterResources: true
      includedResourceTypes:
        - customresourcedefinitions.apiextensions.k8s.io
-      name: cert-manager-crd
+      name: cert-manager-config-crd


we can probably generalize this and make sure to BR all cert manager crds

I have changed the this name to cert-manager-crds, which will include all CRDs of certificate, issuer, and cert-manager configurations with the label foundationservices.cloudpak.ibm.com=cert-manager.

I am not using the cert-manager-operator label for these CRDs and resources because this aligns with the label used in label-cert-manager.sh, which is still in use.

bluzarraga · 2024-12-12T20:24:11Z

velero/backup/common-service/label-common-service.sh

@@ -323,7 +326,7 @@ function label_subscription() {

    ${OC} label subscriptions.operators.coreos.com $cs_pm foundationservices.cloudpak.ibm.com=subscription -n $OPERATOR_NS --overwrite=true 2>/dev/null
    if [[ $ENABLE_CERT_MANAGER -eq 1 ]]; then
-        ${OC} label subscriptions.operators.coreos.com $cm_pm foundationservices.cloudpak.ibm.com=singleton-subscription -n $CERT_MANAGER_NAMESPACE --overwrite=true 2>/dev/null
+        ${OC} label subscriptions.operators.coreos.com $cm_pm foundationservices.cloudpak.ibm.com=cert-manager -n $CERT_MANAGER_NAMESPACE --overwrite=true 2>/dev/null


I have a couple thoughts on changing the label name:

we will need to update the instructions for OADP/Velero to make sure these are properly reflected

we need to include the cert manager crds (like certificate and issuer) because they are currently not included so when we restore cert-manager, we will fail to restore certs and issuers labeled cert-manager from the label-cert-manager.sh script

Its possible to lump all cert manager resources (including the subscription) together (I think) but we need to make sure CRDs are there and I don't seem them labeled in any of our existing scripts.

These thoughts mostly apply to how the script changes affect OADP/Velero. In Fusion, we can always create the subscription first and then the resources after and its not a big deal but if we are running the restore-cert-manager.yaml file for OADP/Velero, it may not be able to create the certificates and issuers because the crds are not present yet

I think to address the above comments, we either label the cert manager crds or we continue with the singleton-subscription label. I am leaning towards labeling cert manager CRDs (certs, issuers, etc.)

For the labelling subscription of cert manager, I have updated the label in both label-singleton-cert-manager.sh and label-common-services.sh scripts to foundationservices.cloudpak.ibm.com=cert-manager-operator as we discussed this could be diff from the one in label-cert-manager.sh

bluzarraga · 2024-12-12T20:25:38Z

velero/spectrum-fusion/recipes/4.0-4.5-example-recipe-multi-ns.yaml

+        - hook: cert-manager-webhook-exists-check/webhookExists
+        - group: cert-manager-config-crd
+        - group: cert-manager-workload-resources
+        - group: cert-manager-subscription


Does the subscription need to be restored first? At least before the webhook check?

In this PR, the recipe includes a group named cert-manager-subscription, which works specifically for the cert-manager subscription.
However, I have kept the singleton-subscriptions group in this PR because I have not yet opened a PR for the license operator. This group could still be used for the license subscription BR.

When I handle the license BR, I will use the specific license label for its subscription at that time

bluzarraga · 2024-12-12T20:28:01Z

velero/spectrum-fusion/recipes/4.0-4.5-example-recipe-single-ns.yaml

+        - hook: cert-manager-webhook-exists-check/webhookExists
+        - group: cert-manager-config-crd
+        - group: cert-manager-workload-resources
+        - group: cert-manager-subscription


same here, subscription restored first?

Is there a possibility that, after the operator is installed successfully, it could bring up its own resources, causing conflicts and blocking the restoration of resources later?
If it is safe, I could move the subscription before the CRD

bluzarraga · 2024-12-12T20:28:41Z

velero/spectrum-fusion/recipes/4.7-example-recipe-multi-ns-multi-zen.yaml

+        - hook: cert-manager-webhook-exists-check/webhookExists
+        - group: cert-manager-config-crd
+        - group: cert-manager-config-cr
+        - group: cert-manager-subscription


bluzarraga · 2025-01-23T15:24:21Z

velero/spectrum-fusion/cert-manager/backup-restore-workflow.yaml

+      timeout: 600
+      type: check
+    - chks:
+        - condition: '{$.metadata.name} != null'


I'm getting a syntax error for this condition and I am not sure "!= null" is a supported comparison. So I have two questions:

What is this check trying to accomplish?

Can we accomplish this goal with a different check?

To me, it seems like a very similar check as the cert-manager-webhook-check/podReady. Can we reuse this check instead? Or, could we change the comparison to equal the string we expect it to be (since it should be static if using IBM cert manager)? If the name value is ever null, then the resource would not exist so would we really be able to check that it is null?

bluzarraga · 2025-01-23T15:24:40Z

velero/spectrum-fusion/recipes/4.0-4.5-example-recipe-multi-ns.yaml

@@ -237,6 +242,18 @@ spec:
      selectResource: deployment
      timeout: 600
      type: check
+    - chks:
+        - condition: '{$.metadata.name} != null'


same as in individual recipe

bluzarraga · 2025-01-23T15:25:01Z

velero/spectrum-fusion/recipes/4.7-example-recipe-multi-ns-multi-zen.yaml

+      timeout: 600
+      type: check
+    - chks:
+        - condition: '{$.metadata.name} != null'


same as in individual

bluzarraga · 2025-01-23T15:25:17Z

velero/spectrum-fusion/recipes/4.7-example-recipe-multi-ns.yaml

+      timeout: 600
+      type: check
+    - chks:
+        - condition: '{$.metadata.name} != null'


same as in individual recipe

bluzarraga · 2025-01-23T15:25:32Z

velero/spectrum-fusion/recipes/4.7-example-recipe-single-ns.yaml

+      timeout: 600
+      type: check
+    - chks:
+        - condition: '{$.metadata.name} != null'


same as individual recipe

Signed-off-by: YuChen <[email protected]>

YCShen1010 added the do-not-merge/hold label Dec 6, 2024

ibm-ci-bot requested review from bitscuit and Daniel-Fan December 6, 2024 21:39

ibm-ci-bot added approved size/L labels Dec 6, 2024

YCShen1010 force-pushed the cm-recipe branch from 97ad6f1 to cfd517f Compare December 6, 2024 22:03

YCShen1010 requested a review from bluzarraga December 6, 2024 22:03

YCShen1010 force-pushed the cm-recipe branch 2 times, most recently from 44db113 to d298b6f Compare December 7, 2024 21:34

YCShen1010 removed the do-not-merge/hold label Dec 9, 2024

YCShen1010 force-pushed the cm-recipe branch 2 times, most recently from 6abe20e to 22759b5 Compare December 9, 2024 20:22

bluzarraga reviewed Dec 9, 2024

View reviewed changes

velero/spectrum-fusion/cert-manager/backup-restore-workflow.yaml Outdated Show resolved Hide resolved

ibm-ci-bot added size/XL and removed size/L labels Dec 11, 2024

YCShen1010 force-pushed the cm-recipe branch 2 times, most recently from ce5d3d5 to b5e7bf6 Compare December 12, 2024 03:48

YCShen1010 added 4 commits December 11, 2024 19:53

create cert manager BR workflows

62383e5

Signed-off-by: YuChen <[email protected]>

update label script with adding cert manager config

21ca89b

Signed-off-by: YuChen <[email protected]>

add condition check before backup and restore

e7d702a

Signed-off-by: YuChen <[email protected]>

update full recipe for cert maanger changes

79c5997

Signed-off-by: YuChen <[email protected]>

YCShen1010 force-pushed the cm-recipe branch 2 times, most recently from cf6bdf0 to 3e964d6 Compare December 12, 2024 04:11

bluzarraga reviewed Dec 12, 2024

View reviewed changes

YCShen1010 force-pushed the cm-recipe branch from 3e964d6 to 79c5997 Compare December 12, 2024 22:19

ibm-ci-bot added size/L and removed size/XL labels Dec 12, 2024

create label cert manager script

dae3324

Signed-off-by: YuChen <[email protected]>

ibm-ci-bot removed the size/L label Dec 12, 2024

ibm-ci-bot added the size/XL label Dec 12, 2024

create job for labeling singleton cert manager

8ab8be5

Signed-off-by: YuChen <[email protected]>

bluzarraga requested changes Jan 23, 2025

View reviewed changes

YCShen1010 force-pushed the cm-recipe branch 3 times, most recently from 77e38eb to 9a05c4f Compare January 24, 2025 18:48

add cluste role and rb for catalog

cb39d2e

Signed-off-by: YuChen <[email protected]>

YCShen1010 force-pushed the cm-recipe branch from 9a05c4f to cb39d2e Compare January 24, 2025 19:00

YCShen1010 added 2 commits January 24, 2025 11:42

including cert and issuer crd in label scripts

241c7a7

Signed-off-by: YuChen <[email protected]>

bring back cert manager workload resources for 4.7 recipe

82ba6be

Signed-off-by: YuChen <[email protected]>

YCShen1010 requested a review from bluzarraga February 24, 2025 15:22

remove webhook deployment check

d4b2dca

Signed-off-by: YuChen <[email protected]>

YCShen1010 force-pushed the cm-recipe branch from fdc854d to d4b2dca Compare February 24, 2025 15:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create singleton recipe for Cert Manager #2328

Create singleton recipe for Cert Manager #2328

YCShen1010 commented Dec 6, 2024 •

edited

Loading

ibm-ci-bot commented Dec 6, 2024

bluzarraga left a comment

bluzarraga Dec 12, 2024

bluzarraga Dec 12, 2024

YCShen1010 Jan 24, 2025

bluzarraga Dec 12, 2024

bluzarraga Dec 12, 2024

bluzarraga Jan 22, 2025

YCShen1010 Jan 24, 2025

bluzarraga Dec 12, 2024

YCShen1010 Jan 24, 2025

bluzarraga Dec 12, 2024

YCShen1010 Jan 24, 2025

bluzarraga Dec 12, 2024

bluzarraga Jan 23, 2025 •

edited

Loading

bluzarraga Jan 23, 2025

bluzarraga Jan 23, 2025

bluzarraga Jan 23, 2025

bluzarraga Jan 23, 2025

Create singleton recipe for Cert Manager #2328

Are you sure you want to change the base?

Create singleton recipe for Cert Manager #2328

Conversation

YCShen1010 commented Dec 6, 2024 • edited Loading

What this PR does:

Condition check

Test steps:

Test result

ibm-ci-bot commented Dec 6, 2024

bluzarraga left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bluzarraga Jan 23, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

YCShen1010 commented Dec 6, 2024 •

edited

Loading

bluzarraga Jan 23, 2025 •

edited

Loading