Configure TLS communication between registry cache and containerd #245

dimitar-kostadinov · 2024-08-27T15:03:51Z

How to categorize this PR?

/area security
/kind enhancement

What this PR does / why we need it:
Configure TLS communication between registry cache and containerd.

Which issue(s) this PR fixes:
Part of #203

Special notes for your reviewer:

Release note:

The communication between containerd and the registry cache is no longer over plain HTTP. The communication is now encrypted with TLS. The pull through cache is now served over HTTPS.

gardener-prow · 2024-08-27T15:03:56Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

ialidzhikov · 2024-08-30T07:06:07Z

/assign

gardener-ci-robot · 2024-10-02T12:44:05Z

The Gardener project currently lacks enough active contributors to adequately respond to all PRs.
This bot triages PRs according to the following rules:

After 15d of inactivity, lifecycle/stale is applied
After 15d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 7d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Mark this PR as rotten with /lifecycle rotten
Close this PR with /close

/lifecycle stale

ialidzhikov · 2024-10-02T12:46:59Z

/remove-lifecycle stale

ialidzhikov

Thanks for the PR, @dimitar-kostadinov!

Sorry for the long delay! I am posting some very minor preliminary comments for now! I will do a more detailed review in CW42.

Can you meanwhile also rebase?

pkg/apis/registry/v1alpha3/types.go

pkg/secrets/config.go

pkg/apis/registry/v1alpha3/types.go

pkg/component/registrycaches/templates/config.yml.tpl

pkg/controller/cache/actuator.go

pkg/webhook/cache/ensurer.go

pkg/apis/registry/types.go

pkg/apis/registry/v1alpha3/types.go

charts/gardener-extension-registry-cache/templates/clusterrole.yaml

pkg/component/registrycaches/templates/config.yml.tpl

pkg/component/registrycaches/registry_caches.go

ialidzhikov · 2024-11-15T14:14:22Z

/hold
until v0.12 is released

ialidzhikov · 2024-11-27T10:41:50Z

/hold cancel
v0.12.0 is released

pkg/controller/cache/actuator.go

charts/gardener-extension-registry-cache/templates/clusterrole.yaml

pkg/webhook/cache/ensurer.go

pkg/utils/registry/registry.go

ialidzhikov · 2024-11-29T15:56:23Z

I will have a final look in CW51. I am again sorry for the delays in the reviews. But overall, PR looks great already!

pkg/webhook/cache/ensurer.go

pkg/controller/cache/actuator.go

pkg/component/registrycaches/registry_caches.go

pkg/component/registrycacheservices/registry_cache_services_test.go

pkg/component/registrycaches/registry_caches.go

pkg/controller/cache/actuator.go

dimitar-kostadinov

CA rotation TM test is OK:

Ran 1 of 3 Specs in 1110.913 seconds
SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 2 Skipped
--- PASS: TestShoot (1110.91s)
PASS
ok

/lgtm

gardener-prow · 2024-12-12T14:56:06Z

@dimitar-kostadinov: you cannot LGTM your own PR.

In response to this:

CA rotation TM test is OK:

Ran 1 of 3 Specs in 1110.913 seconds
SUCCESS! -- 1 Passed | 0 Failed | 0 Pending | 2 Skipped
--- PASS: TestShoot (1110.91s)
PASS
ok

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

ialidzhikov

/lgtm

gardener-prow · 2024-12-12T15:22:17Z

LGTM label has been added.

Git tree hash: 513886569c641150fd64bf9e7420571bb9d1c96f

gardener-prow · 2024-12-12T15:22:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ialidzhikov

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [ialidzhikov]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

gardener-prow bot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. area/security Security related kind/enhancement Enhancement, improvement, extension cla: yes Indicates the PR's author has signed the cla-assistant.io CLA. labels Aug 27, 2024

gardener-prow bot requested a review from ialidzhikov August 27, 2024 15:04

gardener-prow bot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Aug 27, 2024

gardener-prow bot assigned ialidzhikov Aug 30, 2024

ialidzhikov added area/ipcei IPCEI (Important Project of Common European Interest) ipcei/registry-cache-extension Registry Cache Extension labels Sep 11, 2024

gardener-prow bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 17, 2024

gardener-prow bot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 2, 2024

gardener-prow bot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Oct 2, 2024

ialidzhikov reviewed Oct 4, 2024

View reviewed changes

ialidzhikov reviewed Oct 17, 2024

View reviewed changes

dimitar-kostadinov force-pushed the enh/enable_tls_communication branch from 724c96c to 594e1b5 Compare October 22, 2024 08:12

gardener-prow bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 22, 2024

dimitar-kostadinov force-pushed the enh/enable_tls_communication branch 2 times, most recently from 5432210 to f5d18df Compare October 22, 2024 08:23

gardener-prow bot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Oct 29, 2024

dimitar-kostadinov force-pushed the enh/enable_tls_communication branch 2 times, most recently from 7807643 to 550cea1 Compare October 29, 2024 12:18

ialidzhikov mentioned this pull request Oct 30, 2024

TLS for the containerd and registry cache communication #203

Closed

2 tasks

dimitar-kostadinov marked this pull request as ready for review October 30, 2024 12:55

gardener-prow bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 30, 2024

gardener-prow bot requested a review from ialidzhikov October 30, 2024 12:55

gardener-prow bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 25, 2024

gardener-prow bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 27, 2024

dimitar-kostadinov force-pushed the enh/enable_tls_communication branch from 2c3f06e to 6d99ce3 Compare November 27, 2024 15:13

gardener-prow bot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Nov 27, 2024

dimitar-kostadinov force-pushed the enh/enable_tls_communication branch from 6d99ce3 to 2d0cdb3 Compare November 29, 2024 14:28

gardener-prow bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 29, 2024

ialidzhikov reviewed Nov 29, 2024

View reviewed changes

ialidzhikov requested changes Dec 9, 2024

View reviewed changes

pkg/controller/cache/actuator.go Outdated Show resolved Hide resolved

gardener-prow bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 10, 2024

dimitar-kostadinov and others added 6 commits December 11, 2024 17:10

Configure tls communication between registry cache and containerd

8edcc7b

Address PR review feedback

d1e335e

Adaptation to PoC with two component and two MRs

bec651f

Fix tls Secret creation when upstream contains a port (contains :)

52491a0

Address PR review feedback (2)

a145d4e

Address PR review feedback (3)

128b87d

ialidzhikov force-pushed the enh/enable_tls_communication branch from a41e2b7 to 128b87d Compare December 11, 2024 15:45

gardener-prow bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 11, 2024

dimitar-kostadinov commented Dec 12, 2024

View reviewed changes

ialidzhikov approved these changes Dec 12, 2024

View reviewed changes

gardener-prow bot added the lgtm Indicates that a PR is ready to be merged. label Dec 12, 2024

gardener-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 12, 2024

gardener-prow bot merged commit f614b47 into gardener:main Dec 12, 2024
6 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Configure TLS communication between registry cache and containerd #245

Configure TLS communication between registry cache and containerd #245

dimitar-kostadinov commented Aug 27, 2024 •

edited by ialidzhikov

Loading

gardener-prow bot commented Aug 27, 2024

ialidzhikov commented Aug 30, 2024

gardener-ci-robot commented Oct 2, 2024

ialidzhikov commented Oct 2, 2024

ialidzhikov left a comment

ialidzhikov commented Nov 15, 2024

ialidzhikov commented Nov 27, 2024

ialidzhikov commented Nov 29, 2024

dimitar-kostadinov left a comment

gardener-prow bot commented Dec 12, 2024

ialidzhikov left a comment

gardener-prow bot commented Dec 12, 2024

gardener-prow bot commented Dec 12, 2024

Configure TLS communication between registry cache and containerd #245

Configure TLS communication between registry cache and containerd #245

Conversation

dimitar-kostadinov commented Aug 27, 2024 • edited by ialidzhikov Loading

gardener-prow bot commented Aug 27, 2024

ialidzhikov commented Aug 30, 2024

gardener-ci-robot commented Oct 2, 2024

ialidzhikov commented Oct 2, 2024

ialidzhikov left a comment

Choose a reason for hiding this comment

ialidzhikov commented Nov 15, 2024

ialidzhikov commented Nov 27, 2024

ialidzhikov commented Nov 29, 2024

dimitar-kostadinov left a comment

Choose a reason for hiding this comment

gardener-prow bot commented Dec 12, 2024

ialidzhikov left a comment

Choose a reason for hiding this comment

gardener-prow bot commented Dec 12, 2024

gardener-prow bot commented Dec 12, 2024

dimitar-kostadinov commented Aug 27, 2024 •

edited by ialidzhikov

Loading