📖 Document changes to BYO certificates #9585

lentzi90 · 2023-10-20T05:59:06Z

What this PR does / why we need it:

This documents a change in requirements for user provided certificates

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #9568

k8s-ci-robot · 2023-10-20T05:59:09Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

lentzi90 · 2023-10-20T06:08:53Z

docs/book/src/developer/providers/migrations/v1.4-to-v1.5.md

 - Introduced function `CollectInfrastructureLogs` at the `ClusterLogCollector` interface in `test/framework/cluster_proxy.go` to allow collecting infrastructure related logs during tests.
 - A `GetTypedConfigOwner` function has been added to the `sigs.k8s.io./cluster-api/bootstrap/util` package. It is equivalent to `GetConfigOwner` except that it uses the cached typed client instead of the uncached unstructured client, so `GetTypedConfigOwner` is expected to be more performant.
 - `ClusterToObjectsMapper` in `sigs.k8s.io./cluster-api/util` has been deprecated, please use `ClusterToTypedObjectsMapper` instead.
 - The generated `kubeconfig` by the Control Plane providers must be labelled with the key-value pair `cluster.x-k8s.io/cluster-name=${CLUSTER_NAME}`.
-  This is required for the CAPI managers caches to store and retrieve them for the required operations.     
+  This is required for the CAPI managers caches to store and retrieve them for the required operations.
+- When using custom certificates, the certificates must be labeled with the key-value pair `cluster.x-k8s.io/cluster-name=${CLUSTER_NAME}`.


Note: The ${CLUSTER_NAME} is not really required. As long as the key exists, it will work, but perhaps it is better to be consistent throughout the docs with the name also?

lentzi90 · 2023-10-20T07:14:19Z

internal/test/envtest/environment.go

+		Cache: cache.Options{
+			// Namespaces: watchNamespaces,
+			SyncPeriod: &syncPeriod,
+			ByObject: map[client.Object]cache.ByObject{
+				// Note: Only Secrets with the cluster name label are cached.
+				// The default client of the manager won't use the cache for secrets at all (see Client.Cache.DisableFor).
+				// The cached secrets will only be used by the secretCachingClient we create below.
+				&corev1.Secret{}: {
+					Label: clusterSecretCacheSelector,
+				},
+			},
+		},


I copied this from ae9464d#diff-8bdee7925f4d1adc50383754391472636156a2a857a7c76290f6073c8d83f5cd
Not sure if it makes sense

seems ok, cc @sbueringer for a double check

killianmuldoon

/area documentation

lentzi90 · 2023-10-27T11:04:56Z

/test pull-cluster-api-verify-main

fabriziopandini · 2023-11-13T14:24:22Z

controlplane/kubeadm/internal/controllers/controller_test.go

+		g.Expect(kcp.Status.Replicas).To(BeEquivalentTo(1))
+		g.Expect(conditions.IsFalse(kcp, controlplanev1.AvailableCondition)).To(BeTrue())
+
+		k, err := kubeconfig.FromSecret(ctx, env, util.ObjectKey(cluster))


Q: Should we check if the KubeConfig is actually using the custom CA?

Sorry for the huge delay...
I think it would be a good addition to check the CA, but I'm not sure how to do it. Could you give me some hint?
Do we check the default CA in any place so I could replicate that?
@fabriziopandini

lentzi90 · 2024-02-28T06:17:13Z

I have removed the tests for now as I don't have time to work on them. Can we merge the documentation as is?

chrischdi

/lgtm

I guess this should get cherry-picked?

k8s-ci-robot · 2024-02-29T08:19:29Z

LGTM label has been added.

Git tree hash: 9dec8433547f9afe2ee7cb1a97a56552ca0abe98

lentzi90 · 2024-02-29T08:45:57Z

Yes please!

chrischdi · 2024-02-29T08:48:12Z

/cherry-pick release-1.6

k8s-infra-cherrypick-robot · 2024-02-29T08:48:14Z

@chrischdi: once the present PR merges, I will cherry-pick it on top of release-1.6 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

fabriziopandini

Thanks for documenting this!

/lgtm
/approve

k8s-ci-robot · 2024-03-06T20:24:29Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fabriziopandini

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~docs/OWNERS~~ [fabriziopandini]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

fabriziopandini · 2024-03-06T20:24:44Z

/cherry-pick release-1-6

k8s-infra-cherrypick-robot · 2024-03-06T20:24:45Z

@fabriziopandini: once the present PR merges, I will cherry-pick it on top of release-1-6 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1-6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

fabriziopandini · 2024-03-06T20:24:49Z

/cherry-pick release-1-5

k8s-infra-cherrypick-robot · 2024-03-06T20:24:51Z

@fabriziopandini: once the present PR merges, I will cherry-pick it on top of release-1-5 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1-5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-infra-cherrypick-robot · 2024-03-06T20:43:58Z

@chrischdi: new pull request created: #10230

In response to this:

/cherry-pick release-1.6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-infra-cherrypick-robot · 2024-03-06T20:44:31Z

@fabriziopandini: cannot checkout release-1-6: error checking out "release-1-6": exit status 1 error: pathspec 'release-1-6' did not match any file(s) known to git

In response to this:

/cherry-pick release-1-6

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-infra-cherrypick-robot · 2024-03-06T20:45:04Z

@fabriziopandini: cannot checkout release-1-5: error checking out "release-1-5": exit status 1 error: pathspec 'release-1-5' did not match any file(s) known to git

In response to this:

/cherry-pick release-1-5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

fabriziopandini · 2024-03-07T09:53:45Z

/cherry-pick release-1.5

k8s-infra-cherrypick-robot · 2024-03-07T09:54:23Z

@fabriziopandini: new pull request created: #10234

In response to this:

/cherry-pick release-1.5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 20, 2023

k8s-ci-robot requested a review from chrischdi October 20, 2023 05:59

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 20, 2023

k8s-ci-robot requested a review from JoelSpeed October 20, 2023 05:59

k8s-ci-robot added do-not-merge/needs-area PR is missing an area label size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Oct 20, 2023

lentzi90 commented Oct 20, 2023

View reviewed changes

killianmuldoon reviewed Oct 20, 2023

View reviewed changes

k8s-ci-robot added area/documentation Issues or PRs related to documentation and removed do-not-merge/needs-area PR is missing an area label labels Oct 20, 2023

lentzi90 force-pushed the lentzi90/byo-cert-labels branch from 65a4050 to 2609cd2 Compare October 27, 2023 10:31

lentzi90 changed the title ~~WIP: 📖 Document changes to BYO certificates and add tests~~ 📖 Document changes to BYO certificates and add tests Nov 3, 2023

lentzi90 marked this pull request as ready for review November 3, 2023 10:30

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 3, 2023

k8s-ci-robot requested a review from CecileRobertMichon November 3, 2023 10:30

fabriziopandini reviewed Nov 13, 2023

View reviewed changes

Document changes to BYO certificates

422a4cd

lentzi90 force-pushed the lentzi90/byo-cert-labels branch from 2609cd2 to 422a4cd Compare February 28, 2024 06:15

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Feb 28, 2024

lentzi90 changed the title ~~📖 Document changes to BYO certificates and add tests~~ 📖 Document changes to BYO certificates Feb 28, 2024

lentzi90 requested review from killianmuldoon and fabriziopandini February 28, 2024 06:17

chrischdi reviewed Feb 29, 2024

View reviewed changes

k8s-ci-robot assigned chrischdi Feb 29, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 29, 2024

fabriziopandini reviewed Mar 6, 2024

View reviewed changes

k8s-ci-robot assigned fabriziopandini Mar 6, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 6, 2024

k8s-ci-robot merged commit 5e3d813 into kubernetes-sigs:main Mar 6, 2024
31 checks passed

k8s-ci-robot added this to the v1.7 milestone Mar 6, 2024

k8s-infra-cherrypick-robot mentioned this pull request Mar 6, 2024

[release-1.6] 📖 Document changes to BYO certificates #10230

Merged

k8s-infra-cherrypick-robot mentioned this pull request Mar 7, 2024

[release-1.5] 📖 Document changes to BYO certificates #10234

Merged

lentzi90 deleted the lentzi90/byo-cert-labels branch March 7, 2024 10:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

📖 Document changes to BYO certificates #9585

📖 Document changes to BYO certificates #9585

lentzi90 commented Oct 20, 2023 •

edited

Loading

k8s-ci-robot commented Oct 20, 2023

lentzi90 Oct 20, 2023

lentzi90 Oct 20, 2023

fabriziopandini Nov 13, 2023

killianmuldoon left a comment

lentzi90 commented Oct 27, 2023

fabriziopandini Nov 13, 2023

lentzi90 Jan 31, 2024

lentzi90 commented Feb 28, 2024

chrischdi left a comment

k8s-ci-robot commented Feb 29, 2024

lentzi90 commented Feb 29, 2024

chrischdi commented Feb 29, 2024

k8s-infra-cherrypick-robot commented Feb 29, 2024

fabriziopandini left a comment

k8s-ci-robot commented Mar 6, 2024

fabriziopandini commented Mar 6, 2024

k8s-infra-cherrypick-robot commented Mar 6, 2024

fabriziopandini commented Mar 6, 2024

k8s-infra-cherrypick-robot commented Mar 6, 2024

k8s-infra-cherrypick-robot commented Mar 6, 2024

k8s-infra-cherrypick-robot commented Mar 6, 2024

k8s-infra-cherrypick-robot commented Mar 6, 2024

fabriziopandini commented Mar 7, 2024

k8s-infra-cherrypick-robot commented Mar 7, 2024

📖 Document changes to BYO certificates #9585

📖 Document changes to BYO certificates #9585

Conversation

lentzi90 commented Oct 20, 2023 • edited Loading

k8s-ci-robot commented Oct 20, 2023

lentzi90 Oct 20, 2023

Choose a reason for hiding this comment

lentzi90 Oct 20, 2023

Choose a reason for hiding this comment

fabriziopandini Nov 13, 2023

Choose a reason for hiding this comment

killianmuldoon left a comment

Choose a reason for hiding this comment

lentzi90 commented Oct 27, 2023

fabriziopandini Nov 13, 2023

Choose a reason for hiding this comment

lentzi90 Jan 31, 2024

Choose a reason for hiding this comment

lentzi90 commented Feb 28, 2024

chrischdi left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Feb 29, 2024

lentzi90 commented Feb 29, 2024

chrischdi commented Feb 29, 2024

k8s-infra-cherrypick-robot commented Feb 29, 2024

fabriziopandini left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Mar 6, 2024

fabriziopandini commented Mar 6, 2024

k8s-infra-cherrypick-robot commented Mar 6, 2024

fabriziopandini commented Mar 6, 2024

k8s-infra-cherrypick-robot commented Mar 6, 2024

k8s-infra-cherrypick-robot commented Mar 6, 2024

k8s-infra-cherrypick-robot commented Mar 6, 2024

k8s-infra-cherrypick-robot commented Mar 6, 2024

fabriziopandini commented Mar 7, 2024

k8s-infra-cherrypick-robot commented Mar 7, 2024

lentzi90 commented Oct 20, 2023 •

edited

Loading