cert: use MeshRootCertificate on startup #4816
Conversation
keithmattix
changed the title
keithmattix
force-pushed
the
abstract-message-broker
branch
from
cf607ad to
821f517
Compare
keithmattix
requested review from
shashankram,
snehachhabria,
nojnhuh,
draychev and
trstringer
as code owners
Codecov Report
@@ Coverage Diff @@
## main #4816 +/- ##
==========================================
- Coverage 68.54% 68.49% -0.05%
==========================================
Files 224 225 +1
Lines 16170 16325 +155
==========================================
+ Hits 11083 11182 +99
- Misses 5035 5091 +56
Partials 52 52
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
|
| }, | ||
| var mrcClient certificate.MRCClient | ||
| if ic == nil || len(ic.List(informers.InformerKeyMeshRootCertificate)) == 0 { | ||
| // no MRCs detected; use the compat client |
There was a problem hiding this comment.
If osm-bootstrap always creates a MRC, will this branch ever be hit?
There was a problem hiding this comment.
@jaellio can correct me, but I think we're still allowing customers to NOT use MRCs and to keep using MeshConfigs for a couple of releases (configurable somehow through helm?). I'm totally down to remove the logic if that's not the case and we're making a hard cut in v1.2. I'm just trying to be mindful of backwards compatibility
There was a problem hiding this comment.
Right now a MRC is always created by osm-bootstrap. If we want to support the option of not using the MRC created on startup to configure the Manager, maybe it would be best to make using the MRC an opt in option on install?
There was a problem hiding this comment.
I don't have strong opinions either way. If we ARE making a hard cut though, we're likely going to want some documentation on the change and instructions on how to switch
keithmattix
force-pushed
the
abstract-message-broker
branch
2 times, most recently
from
0ef747d to
4626499
Compare
keithmattix
force-pushed
the
abstract-message-broker
branch
from
6589808 to
34030b7
Compare
By default, read MRCs from the cluster in order to build out the certificate manager. From there, allow the certificate manager to watch for changes to the MRCs in the cluster Signed-off-by: Keith Mattix II <[email protected]>
keithmattix
force-pushed
the
abstract-message-broker
branch
from
34030b7 to
c284106
Compare
Description:
Use MRC to initialize certificate manager on startup. Fixes #4713
Testing done:
Added unit test to verify that the MRC is used during startup
Affected area:
Please answer the following questions with yes/no.
Does this change contain code from or inspired by another project? no
Is this a breaking change? no
Has documentation corresponding to this change been updated in the osm-docs repo (if applicable)? no