mig-controller: inherit TLS options from MigController#47
mig-controller: inherit TLS options from MigController#47Acedus wants to merge 3 commits intokubevirt:mainfrom
Conversation
Needed for the kubevirt-migration-controller to watch the MigrationController CR and infer its TLS configuration from. Signed-off-by: Adi Aloni <aaloni@redhat.com>
kubevirt-bot
added
release-note
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Acedus
force-pushed
the
inherit-tls-options-from-mig-controller
branch
from
e278157 to
5ce78a1
Compare
|
/test pull-kubevirt-migration-controller-e2e |
ManagedTLSWatcher watches the MigController CR's tlsSecurityProfile to dynamically update the TLS configuration for incoming connections on exposed endpoints. Signed-off-by: Adi Aloni <aaloni@redhat.com>
Acedus
force-pushed
the
inherit-tls-options-from-mig-controller
branch
from
5ce78a1 to
ec1c0e3
Compare
| list := &migrationsv1alpha1.MigControllerList{} | ||
| if err := c.List(ctx, list); err != nil { | ||
| log.Info("MigController CRD not available, using default TLS configuration", "error", err) | ||
| <-ctx.Done() |
There was a problem hiding this comment.
this is not a part of the operator tls watcher impl. are we sure we need this?
There was a problem hiding this comment.
The reason for this is because we're unaware of whether the MigController CR even exists to begin with so we fallback if it's unavailable and let controller-runtime dynamically create the informer from default cache on first use.
There was a problem hiding this comment.
ctx.Done() would just kill it, no?
There was a problem hiding this comment.
It won't be dynamic that's for sure... but I think it's worth arguing that we won't ever hit the dynamic TLS usecase without a MigController CRD installed, so we could probably get away with conditionally setting the TLSWatcher to ready.
Previously the metrics-server and webhook would be initiated with default TLS configuration. This change makes it so the TLS configuration is updated during runtime for every request according to the MigController TLSSecurityProfile. Signed-off-by: Adi Aloni <aaloni@redhat.com>
Acedus
force-pushed
the
inherit-tls-options-from-mig-controller
branch
from
ec1c0e3 to
381c3c2
Compare
4 participants
What this PR does / why we need it:
Previously the metrics-server and webhook would be initiated with
default TLS configuration. This change makes it so the TLS configuration
is updated during runtime for every request according to the
MigController TLSSecurityProfile.
Which issue(s) this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close the issue(s) when PR gets merged):Fixes #
Special notes for your reviewer:
Checklist
This checklist is not enforcing, but it's a reminder of items that could be relevant to every PR.
Approvers are expected to review this list.
Release note: