Add self-healing for CA bundle configmaps in user namespaces#3247
Conversation
tekton-robot
added
the
release-note
tekton-robot
added
the
size/L
|
Tested the upgrade scenario and it's working as expected |
| needsCABundle = true | ||
| } else { | ||
| // Self-healing: verify configmaps exist even when label matches | ||
| _, err1 := r.kubeClientSet.CoreV1().ConfigMaps(ns.Name).Get(ctx, trustedCABundleConfigMap, metav1.GetOptions{}) |
There was a problem hiding this comment.
I think you can reuse the r.kubeClientSet.CoreV1().ConfigMaps(ns.Name) part.
ab-ghosh
force-pushed
the
self-healing-ca-bundle-configmaps
branch
from
ccaa779 to
16ef4a8
Compare
|
/lgtm |
|
/lgtm |
|
@mathur07: changing LGTM is restricted to collaborators DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/cc @jkhelil |
| } | ||
|
|
||
| // Check if namespace needs CA bundle reconciliation | ||
| needsCABundle := false |
There was a problem hiding this comment.
@ab-ghosh can you extract cabundle process in its own function for readbility
same for rbac
We wold have
for _, ns := range ... {
if shouldIgnore(ns) {
continue
}
if r.needsRBAC(ns) {
result.RBACNamespaces = append(...)
}
if r.needsCABundle(ns) {
result.CANamespaces = append(...)
}
}
ab-ghosh
force-pushed
the
self-healing-ca-bundle-configmaps
branch
from
16ef4a8 to
c0a2a1d
Compare
Previously, the operator used the namespace label namespace-trusted-configmaps-version to determine if CA bundle configmaps were reconciled. Once the label matched the current version, the namespace was permanently skipped even if the configmaps were deleted externally. This adds a self-healing check in getNamespacesToBeReconciled(), matching the existing RBAC self-healing pattern that verifies RoleBinding existence. When the label matches but either config-trusted-cabundle or config-service-cabundle configmap is missing, the namespace is marked for re-reconciliation and a warning is logged. Signed-off-by: ab-ghosh <abghosh@redhat.com>
ab-ghosh
force-pushed
the
self-healing-ca-bundle-configmaps
branch
from
c0a2a1d to
305ba62
Compare
|
@ab-ghosh have you done a test on openshift ? (please create a couple of namespaces) |
|
@jkhelil I have already tested on openshift, including the upgrade test, before the code refactor. |
|
re-tested the changes on openshift and upgrade test, works as expected |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jkhelil The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
tekton-robot
added
the
approved
|
/lgtm |
6 participants
Changes
getNamespacesToBeReconciled()to verify CA bundle configmaps (config-trusted-cabundle,config-service-cabundle) exist even when the namespace label indicates reconciliation is completeSubmitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
make test lintbefore submitting a PRSee the contribution guide for more details.
Release Notes