Skip to content

Add automatic rolling deployment & option to re-create admission webhook certs #242

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open

Add automatic rolling deployment & option to re-create admission webhook certs #242

wants to merge 7 commits into from

Conversation

duhminick
Copy link
Contributor

@duhminick duhminick commented Sep 18, 2025 •
edited
Loading

Issue #, if available: NA

Description of changes:

Certificate Management Enhancement:

  • Added a recreate flag for auto-generated certificates in the admission webhooks configuration
  • This flag allows users to control whether existing certificates should be recreated during deployments
  • Updated the helper templates and operator webhook configuration to support this new functionality
    • Will first check to see if autoGenerateCert is enabled, then check to see if there is an already existing cert with the recreate option set to false. If so, then it will retrieve the cert info. The ca.crt is not in the secret so we retrieve that from the caBundle from the admission webhooks to be re-used. Otherwise it will create new certs - the logic is taken from the operator-webhook.yaml file (copy & paste).
    • The operator-webhook.yaml file is updated to use the cert values from the helper
  • Default value is set to true to maintain backward compatibility

Operator Deployment Rolling:

Testing

Recreate is enabled

With these values:

clusterName: dscia-helm
region: us-east-1
admissionWebhooks:
  autoGenerateCert:
    recreate: true
$ kubectl get secret amazon-cloudwatch-observability-controller-manager-service-cert -n amazon-cloudwatch -o=jsonpath='{.data}' | md5sum
29f979c3cda1ae60969baec1073a7538  -
$ helm upgrade \
    --wait \
    --create-namespace \
    --namespace amazon-cloudwatch \
    amazon-cloudwatch-observability \
    ./charts/amazon-cloudwatch-observability \
    -f custom-values.yaml
Release "amazon-cloudwatch-observability" has been upgraded. Happy Helming!
NAME: amazon-cloudwatch-observability
LAST DEPLOYED: Wed Oct  1 20:11:16 2025
NAMESPACE: amazon-cloudwatch
STATUS: deployed
REVISION: 38
TEST SUITE: None
$ kubectl get secret amazon-cloudwatch-observability-controller-manager-service-cert -n amazon-cloudwatch -o=jsonpath='{.data}' | md5sum
11d37c192b475e522cbaae15a6dfb0d8  -

Recreate is disabled

With these values:

clusterName: dscia-helm
region: us-east-1
admissionWebhooks:
  autoGenerateCert:
    recreate: false
$ kubectl get secret amazon-cloudwatch-observability-controller-manager-service-cert -n amazon-cloudwatch -o=jsonpath='{.data}' | md5sum
11d37c192b475e522cbaae15a6dfb0d8  -
$ helm upgrade \
    --wait \
    --create-namespace \
    --namespace amazon-cloudwatch \
    amazon-cloudwatch-observability \
    ./charts/amazon-cloudwatch-observability \
    -f custom-values.yaml
Release "amazon-cloudwatch-observability" has been upgraded. Happy Helming!
NAME: amazon-cloudwatch-observability
LAST DEPLOYED: Wed Oct  1 20:12:20 2025
NAMESPACE: amazon-cloudwatch
STATUS: deployed
REVISION: 39
TEST SUITE: None
$ kubectl get secret amazon-cloudwatch-observability-controller-manager-service-cert -n amazon-cloudwatch -o=jsonpath='{.data}' | md5sum
11d37c192b475e522cbaae15a6dfb0d8  -

Rolling is enabled

With these values:

clusterName: dscia-helm
region: us-east-1
manager:
  rolling: true
$ kubectl get deployments amazon-cloudwatch-observability-controller-manager -n amazon-cloudwatch -o jsonpath='{.spec.template.metadata.annotations.rollme}'
Pvx1s%
$ helm upgrade \                                                                            --wait \
    --create-namespace \
    --namespace amazon-cloudwatch \
    amazon-cloudwatch-observability \
    ./charts/amazon-cloudwatch-observability \
    -f custom-values.yaml
Release "amazon-cloudwatch-observability" has been upgraded. Happy Helming!
NAME: amazon-cloudwatch-observability
LAST DEPLOYED: Wed Oct  1 20:26:33 2025
NAMESPACE: amazon-cloudwatch
STATUS: deployed
REVISION: 41
TEST SUITE: None
$ kubectl get deployments amazon-cloudwatch-observability-controller-manager -n amazon-cloudwatch -o jsonpath='{.spec.template.metadata.annotations.rollme}'
5g3lK%

Rolling is disabled

With these values:

clusterName: dscia-helm
region: us-east-1
manager:
  rolling: false
$ kubectl get deployments amazon-cloudwatch-observability-controller-manager -n amazon-cloudwatch -o jsonpath='{.spec.template.metadata.annotations.rollme}'
< empty >

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@duhminick
Copy link
Contributor Author

Reference PRs:

  1. add option to reuse previously auto-generated cert open-telemetry/opentelemetry-helm-charts#936
  2. Fix operator tls error when cert file update open-telemetry/opentelemetry-helm-charts#720

@duhminick duhminick force-pushed the dominic-tls branch 5 times, most recently from d749534 to 6d4b9f4 Compare September 26, 2025 05:17
sky333999
sky333999 previously approved these changes Oct 7, 2025
View reviewed changes
movence
movence reviewed Oct 15, 2025
View reviewed changes
...loudwatch-observability/validations/minikube/scenarios/certificate_recreate_disabled_test.go
@@ -0,0 +1,59 @@
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this is out of scope with this PR, but should we consider a way to organize minukube test scenarios? I can only imagine these cases will grow, so a folder structures will be nice

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@movence movence movence approved these changes

@sky333999 sky333999 sky333999 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@duhminick @movence @sky333999