Skip to content

OLS-1998: Add option to proxyConfig's ca certificates to specify configmap key#1201

Open
sriroopar wants to merge 1 commit intoopenshift:mainfrom
sriroopar:proxy-ca-config
Open

OLS-1998: Add option to proxyConfig's ca certificates to specify configmap key#1201
sriroopar wants to merge 1 commit intoopenshift:mainfrom
sriroopar:proxy-ca-config

Conversation

@sriroopar
Copy link
Contributor

@sriroopar sriroopar commented Dec 23, 2025

Description

Type of change

  • Refactor
  • New feature
  • Bug fix
  • CVE fix
  • Optimization
  • Documentation Update
  • Configuration Update
  • Bump-up dependent library

Related Tickets & Documents

  • Related Issue #
  • Closes #

Checklist before requesting a review

  • I have performed a self-review of my code.
  • PR has passed all pre-merge test jobs.
  • If it is a core feature, I have added thorough tests.

Testing

  • Please provide detailed steps to perform tests related to this code change.
  • How were the fix/results from this change verified? Please provide relevant screenshots or results.

@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 23, 2025
@sriroopar sriroopar marked this pull request as draft December 23, 2025 16:53
@openshift-ci
Copy link

openshift-ci bot commented Dec 23, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign raptorsun for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@sriroopar
Copy link
Contributor Author

sriroopar commented Dec 23, 2025

/retest

@sriroopar sriroopar marked this pull request as ready for review December 23, 2025 16:55
@openshift-ci openshift-ci bot requested review from blublinsky and bparees December 23, 2025 16:55
@sriroopar
Copy link
Contributor Author

sriroopar commented Dec 23, 2025

/retest

@sriroopar sriroopar changed the title [WIP] Add option to proxyConfig's ca certificates to specify configmap key Add option to proxyConfig's ca certificates to specify configmap key Jan 2, 2026
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jan 2, 2026
@sriroopar sriroopar force-pushed the proxy-ca-config branch 2 times, most recently from 8999506 to 4928197 Compare January 3, 2026 04:56
@sriroopar
Copy link
Contributor Author

sriroopar commented Jan 3, 2026

/retest

2 similar comments
@sriroopar
Copy link
Contributor Author

sriroopar commented Jan 3, 2026

/retest

@sriroopar
Copy link
Contributor Author

sriroopar commented Jan 5, 2026

/retest

@sriroopar sriroopar force-pushed the proxy-ca-config branch 3 times, most recently from f8574c5 to 5b53113 Compare January 12, 2026 14:12
@blublinsky
Copy link
Contributor

blublinsky commented Jan 12, 2026

Unless I am missing something, this is already done (slightly differently) in main. What is the related issue?

@sriroopar
Copy link
Contributor Author

sriroopar commented Jan 12, 2026 •
edited
Loading

@blublinsky This is the issue : OLS-1998 (https://issues.redhat.com/browse/OLS-1998).

JoaoFula
JoaoFula reviewed Jan 13, 2026
View reviewed changes
config/crd/bases/ols.openshift.io_olsconfigs.yaml
description: The configmap holding proxy CA certificate
description: The configmap and key holding proxy CA certificate
properties:
key:
Copy link
Contributor

@JoaoFula JoaoFula Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There definitely should be a default value for the key matching the value we currently expect. We should not require clients who have gotten this to work to now have to specify the key

@sriroopar sriroopar force-pushed the proxy-ca-config branch 2 times, most recently from 1d135c9 to d57678d Compare January 14, 2026 13:54
@JoaoFula
Copy link
Contributor

JoaoFula commented Jan 14, 2026

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 14, 2026
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Jan 15, 2026
syedriko
syedriko reviewed Mar 4, 2026
View reviewed changes
internal/controller/utils/constants.go Outdated
// AdditionalCAHashKey is the key of the hash value of the additional CA certificates in the deployment annotations
AdditionalCAHashKey = "hash/additionalca"
// ProxyCACertHashKey is the key of the hash value of the proxy CA certificate in the deployment annotations
ProxyCACertHashKey = "hash/proxycacert"
Copy link
Contributor

@syedriko syedriko Mar 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only the lcore Deployment has this annotation, does the appserver Deployment not need it?

@sriroopar sriroopar changed the title Add option to proxyConfig's ca certificates to specify configmap key OLS-1998: Add option to proxyConfig's ca certificates to specify configmap key Mar 4, 2026
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 4, 2026
@openshift-ci-robot
Copy link

openshift-ci-robot commented Mar 4, 2026 •
edited by openshift-ci bot
Loading

@sriroopar: This pull request references OLS-1998 which is a valid jira issue.

Details

In response to this:

Description

Type of change

  • Refactor
  • New feature
  • Bug fix
  • CVE fix
  • Optimization
  • Documentation Update
  • Configuration Update
  • Bump-up dependent library

Related Tickets & Documents

  • Related Issue #
  • Closes #

Checklist before requesting a review

  • I have performed a self-review of my code.
  • PR has passed all pre-merge test jobs.
  • If it is a core feature, I have added thorough tests.

Testing

  • Please provide detailed steps to perform tests related to this code change.
  • How were the fix/results from this change verified? Please provide relevant screenshots or results.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@JoaoFula
Copy link
Contributor

JoaoFula commented Mar 4, 2026

/lgtm

@sriroopar
Copy link
Contributor Author

sriroopar commented Mar 4, 2026

/retest

4 similar comments
@sriroopar
Copy link
Contributor Author

sriroopar commented Mar 4, 2026

/retest

@sriroopar
Copy link
Contributor Author

sriroopar commented Mar 6, 2026

/retest

@sriroopar
Copy link
Contributor Author

sriroopar commented Mar 10, 2026

/retest

@sriroopar
Copy link
Contributor Author

sriroopar commented Mar 10, 2026

/retest

@sriroopar sriroopar force-pushed the proxy-ca-config branch 2 times, most recently from 22cc49e to 4555ca6 Compare March 11, 2026 17:20
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 11, 2026
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 11, 2026
@sriroopar
Copy link
Contributor Author

sriroopar commented Mar 11, 2026

/retest

1 similar comment
@sriroopar
Copy link
Contributor Author

sriroopar commented Mar 11, 2026

/retest

@sriroopar sriroopar force-pushed the proxy-ca-config branch 2 times, most recently from 55f345b to 8299409 Compare March 12, 2026 12:46
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 12, 2026
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 12, 2026
JoaoFula
JoaoFula reviewed Mar 12, 2026
View reviewed changes
test/e2e/proxy_test.go Outdated
Copy link
Contributor

@JoaoFula JoaoFula Mar 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if we're able to specify the configmap key, we no longer have to copy the contents of the openshift-service-ca.crt to the proxy-ca and instead can just use the openshift-service-ca.crt and specify the correct key. This was the point that triggered the creation of this ticket btw.

@openshift-ci
Copy link

openshift-ci bot commented Mar 13, 2026 •
edited
Loading

@sriroopar: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/lint 3a268f6 link true /test lint
ci/prow/bundle-e2e-4-22 497aec3 link true /test bundle-e2e-4-22

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 13, 2026
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@joshuawilson joshuawilson Awaiting requested review from joshuawilson

@xrajesh xrajesh Awaiting requested review from xrajesh

@blublinsky blublinsky Awaiting requested review from blublinsky

@bparees bparees Awaiting requested review from bparees

2 more reviewers

@JoaoFula JoaoFula JoaoFula left review comments

@syedriko syedriko syedriko left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@JoaoFula JoaoFula

Labels

do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@sriroopar @blublinsky @JoaoFula @xrajesh @openshift-ci-robot @syedriko @openshift-merge-robot