WIP WIP WIP OCPBUGS-78941: Respect tlsprofiles on sail-library#1394
WIP WIP WIP OCPBUGS-78941: Respect tlsprofiles on sail-library#1394rikatz wants to merge 1 commit into
Conversation
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
openshift-ci-robot
added
the
jira/severity-critical
|
Skipping CI for Draft Pull Request. |
openshift-ci-robot
added
jira/valid-reference
|
@rikatz: This pull request references Jira Issue OCPBUGS-78941, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Important Review skippedAuto reviews are limited based on label configuration. 🚫 Review skipped — only excluded labels are configured. (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
| apiConfig := &configv1.APIServer{} | ||
| if err := r.client.Get(ctx, types.NamespacedName{Name: "cluster"}, apiConfig); err != nil { | ||
| if errors.IsNotFound(err) { | ||
| log.Info("APIServer 'cluster' not found; falling back to intermediate TLS profile") | ||
| } else { | ||
| return fmt.Errorf("failed to get APIServer 'cluster': %w", err) | ||
| } | ||
| } | ||
|
|
||
| tlsProfile, err := openshifttls.GetTLSProfileSpec(apiConfig.Spec.TLSSecurityProfile) | ||
| if err != nil { | ||
| return fmt.Errorf("failed to get APIServer 'cluster': %w", err) | ||
| } |
There was a problem hiding this comment.
We will need the openshiftcrypto.ShouldHonorClusterTLSProfile(apiServer.Spec.TLSAdherence) check from istio-ecosystem/sail-operator#1513 to make sure we don't cause any potentially breaking surprise TLS configuration changes on upgrade.
openshift-ci
Bot
added
the
needs-rebase
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
This is a wip to support tlsprofile on Istio deployment when using sail library
This cannot be merged yet, we need istio-ecosystem/sail-operator#1513 to be available on upstream and on the fork we are using.
Things are broken here, please do not try to merge or review yet!