Defining KnativeServing.spec.controller-custom-certs results in ConfigMap being overwritten

[kwkoo]

When I define a custom registry certificate in a ConfigMap and reference the ConfigMap in KnativeServing.spec.controller-custom-certs (decribed here), the contents of the ConfigMap gets overwritten with the certificates of other CAs.

This behavior is not present when using the upstream Knative operator.

This looks like it may be due to this line.

However, when the custom registry certificate is defined in a Secret, the contents of the Secret are not overwritten.

If the objective is to merge the service CAs and the trusted CAs with the contents of the ConfigMap, then shouldn't the original contents of the ConfigMap be copied into combinedContents?

[pierDipi]

cc @skonto @nak3 @ReToCode

[skonto]

Hi @kwkoo the current design is described here:

If a secret is not included in the KnativeServing CR, this setting defaults to using public key infrastructure (PKI). When using PKI, the cluster-wide certificates are automatically injected into the Knative Serving controller by using the config-service-sa config map.

For the OCP PKI stuff there is more here. Right now the way to manually set certs is done via a secret only. This needs more work to be aligned with the upstream.

[kwkoo]

Thank you for the link, Stavros. I see that the docs you linked to talk about putting the certificate in a Secret. However, it does not define what happens when you put the certificate in a ConfigMap. Should the docs include a paragraph warning users against using ConfigMaps for the certificate then?

This is especially important since the Knative docs use ConfigMaps as an example.

[skonto]

I will create an issue to track this internally thanks.