Update deployment to use rotatable bootstrap config #2524
Labels
area/deployment
Issues or PRs related to deployment tooling or infrastructure.
lifecycle/accepted
Denotes an issue that has been triaged and determined to be valid.
release-note
Denotes a PR that will be considered when it comes time to generate release notes.
Comments
7 tasks
jpeach
added
release-note
jpeach
added a commit
to jpeach/contour
that referenced
this issue
May 27, 2020
Switch the certgen xDS certificate generation over to using certificates that are compatible with certificate-manager. This requires the certgen job to run again, which means we have to give is a unique name. Using a version-locked name will let it run on each upgrade, which will have the beneficial side-effect of rotating the xDS certificates. The envoy and contour pods will restart because the secrets mounts change, but they will restart at release time anyway because the container image will change. After this change, re-running certgen to rotate the xDS certificates will not require restarting and pods. This fixes projectcontour#2524. This updates projectcontour#2143. Signed-off-by: James Peach <[email protected]>
jpeach
added a commit
to jpeach/contour
that referenced
this issue
May 27, 2020
Switch the certgen xDS certificate generation over to using certificates that are compatible with certificate-manager. This requires the certgen job to run again, which means we have to give is a unique name. Using a version-locked name will let it run on each upgrade, which will have the beneficial side-effect of rotating the xDS certificates. The envoy and contour pods will restart because the secrets mounts change, but they will restart at release time anyway because the container image will change. After this change, re-running certgen to rotate the xDS certificates will not require restarting and pods. This fixes projectcontour#2524. This updates projectcontour#2143. Signed-off-by: James Peach <[email protected]>
jpeach
added a commit
to jpeach/contour
that referenced
this issue
May 28, 2020
Switch the certgen xDS certificate generation over to using certificates that are compatible with certificate-manager. This requires the certgen job to run again, which means we have to give is a unique name. Using a version-locked name will let it run on each upgrade, which will have the beneficial side-effect of rotating the xDS certificates. The envoy and contour pods will restart because the secrets mounts change, but they will restart at release time anyway because the container image will change. After this change, re-running certgen to rotate the xDS certificates will not require restarting and pods. This fixes projectcontour#2524. This updates projectcontour#2143. Signed-off-by: James Peach <[email protected]>
jpeach
added a commit
to jpeach/contour
that referenced
this issue
May 28, 2020
Switch the certgen xDS certificate generation over to using certificates that are compatible with certificate-manager. This requires the certgen job to run again, which means we have to give is a unique name. Using a version-locked name will let it run on each upgrade, which will have the beneficial side-effect of rotating the xDS certificates. The envoy and contour pods will restart because the secrets mounts change, but they will restart at release time anyway because the container image will change. After this change, re-running certgen to rotate the xDS certificates will not require restarting and pods. This fixes projectcontour#2524. This updates projectcontour#2143. Signed-off-by: James Peach <[email protected]>
jpeach
added a commit
to jpeach/contour
that referenced
this issue
May 28, 2020
Switch the certgen xDS certificate generation over to using certificates that are compatible with certificate-manager. This requires the certgen job to run again, which means we have to give it a unique name. Using a version-locked name will let it run on each upgrade, which will have the beneficial side-effect of rotating the xDS certificates. The envoy and contour pods will restart because the secrets mounts change, but they will restart at release time anyway because the container image will change. After this change, re-running certgen to rotate the xDS certificates will not require restarting and pods. This fixes projectcontour#2524. This updates projectcontour#2143. Signed-off-by: James Peach <[email protected]>
jpeach
added a commit
to jpeach/contour
that referenced
this issue
May 28, 2020
Switch the certgen xDS certificate generation over to using certificates that are compatible with certificate-manager. This requires the certgen job to run again, which means we have to give it a unique name. Using a version-locked name will let it run on each upgrade, which will have the beneficial side-effect of rotating the xDS certificates. The envoy and contour pods will restart because the secrets mounts change, but they will restart at release time anyway because the container image will change. After this change, re-running certgen to rotate the xDS certificates will not require restarting and pods. This fixes projectcontour#2524. This updates projectcontour#2143. Signed-off-by: James Peach <[email protected]>
jpeach
added a commit
that referenced
this issue
May 28, 2020
Switch the certgen xDS certificate generation over to using certificates that are compatible with certificate-manager. This requires the certgen job to run again, which means we have to give it a unique name. Using a version-locked name will let it run on each upgrade, which will have the beneficial side-effect of rotating the xDS certificates. The envoy and contour pods will restart because the secrets mounts change, but they will restart at release time anyway because the container image will change. After this change, re-running certgen to rotate the xDS certificates will not require restarting and pods. This fixes #2524. This updates #2143. Signed-off-by: James Peach <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Please describe the problem you have
Update the default deployment YAML to generate an Envoy bootstrap that is able to rotate xDS certificates (as per #2333)
The text was updated successfully, but these errors were encountered: