OSSM-10865: set trustBundleName in Istio global values #1288

skriss · 2025-10-02T13:17:20Z

Sets trustBundleName in order to customize the
name of the configmap containing the CA cert so
it doesn't clash with a standalone OSSM instance.

Follow-up to #1243.

Sets trustBundleName in order to customize the name of the configmap containing the CA cert so it doesn't clash with a standalone OSSM instance. Follow-up to openshift#1243. Signed-off-by: Steve Kriss <[email protected]>

openshift-ci-robot · 2025-10-02T13:17:24Z

@skriss: This pull request references OSSM-10865 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "4.21.0" version, but no target version was set.

In response to this:

Sets trustBundleName in order to customize the
name of the configmap containing the CA cert so
it doesn't clash with a standalone OSSM instance.

Follow-up to #1243.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

skriss · 2025-10-02T13:17:33Z

cc @aslakknutsen

openshift-ci · 2025-10-02T13:17:43Z

Hi @skriss. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

rikatz · 2025-10-20T16:06:27Z

pkg/operator/controller/gatewayclass/controller_test.go

 						},
 						IstioNamespace:    ptr.To("openshift-ingress"),
 						PriorityClassName: ptr.To("system-cluster-critical"),
+						TrustBundleName:   ptr.To(controller.OpenShiftGatewayCARootCertName),


as a suggestion for the unit test, instead of relying on the variable value, rely on the real expected value (like line 70 where you explicit set "openshift-ingress") so in case something change on this controller.OpenShiftGatewayCARootCertName we know it will also break on the expected behavior.

As a side question: does setting this on an existing environment breaks something? Do we need to test any kind of upgrade? If this TrustBundleName is set on an existing environment, will it trigger a new reconciliation on the Istio resource that we need to be careful off?

As a side question: does setting this on an existing environment breaks something? Do we need to test any kind of upgrade? If this TrustBundleName is set on an existing environment, will it trigger a new reconciliation on the Istio resource that we need to be careful off?

It's not expected to break anything; it will just configure istiod to write out the root cert in a new ConfigMap with the custom name (only within namespaces with Gateways). This will help avoid conflicts with any standalone OSSM installations that would be using the default name for the root cert ConfigMap.

cc @aslakknutsen - any hidden upgrade risks we're not thinking of?

Sorry missed this.

I believe as @skriss states that we'll just get a new ConfigMap. I suppose it's an open question if we should try to clean up the old one or not as it'll be left in place. We don't really support Mesh in the same namespace as a Gateway at the moment so I believe it's relatively safe to delete them. Even if someone have configured mesh and gateway for the same namespace it wouldn't technically work as it would be flipping between the certs of the two control planes.

@aslakknutsen, if we merge this PR now, do we make the problem of cleaning up the old configmaps more difficult?

I think we have discussed the problem of cleaning up old configmaps, and we might have decided that it is too risky, and that we should tell the user to do the cleanup manually, if desired. However, I am not sure where that decision was recorded, if my memory is even correct. Maybe @dgn remembers?

@Miciah Noting comes to mind. But I think we managed to set the PILOT_ENABLE_GATEWAY_API_CA_CERT_ONLY flag(41d7add#diff-a2d0fb9a1cce5ecf91b0fd80716edfb3b48bad924cc6f365dbb93d72d82f8956R100-R105) which would imply that the CM in question actually has a special label just for this case ;)

https://github.com/openshift-service-mesh/istio/blob/release-1.27/pilot/pkg/config/kube/gateway/gateway_ca_controller.go#L51C2-L51C16

The "openshift.io/mesh": "true" only exist on our created CMs.

Yes that is what I remember as well-- let's not attempt an automatic cleanup.

Signed-off-by: Steve Kriss <[email protected]>

rikatz · 2025-10-23T14:07:35Z

/ok-to-test

skriss · 2025-10-24T13:40:18Z

/retest

Miciah · 2025-10-30T14:47:34Z

/assign

Miciah · 2025-11-21T19:45:07Z

Thanks!

/lgtm

Miciah · 2025-11-21T19:58:26Z

/approve

openshift-ci · 2025-11-21T19:58:38Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Miciah

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Miciah]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

skriss · 2025-11-24T14:11:21Z

/retest

rikatz · 2025-11-24T17:28:03Z

The test failure on e2e-aws-pre-release-ossm is being verified at https://issues.redhat.com/browse/OCPBUGS-65939

rikatz · 2025-11-24T19:34:16Z

/cc @rhamini3 @lihongan @ShudiLi @melvinjoseph86

for QE

lihongan · 2025-11-25T11:07:34Z

Hi @skriss I run pre-merge test with the PR and seems the configmap is still there after gateway is delete, is that expected ?

$ oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.21.0-0-2025-11-25-074233-test-ci-ln-8xrmrj2-latest   True        False         68m     Cluster version is 4.21.0-0-2025-11-25-074233-test-ci-ln-8xrmrj2-latest

// after creating gatewayclass
$ oc get istio openshift-gateway -oyaml
<......>
spec:
  namespace: openshift-ingress
  updateStrategy:
    type: InPlace
  values:
    global:
      defaultPodDisruptionBudget:
        enabled: false
      istioNamespace: openshift-ingress
      priorityClassName: system-cluster-critical
      trustBundleName: openshift-gw-ca-root-cert                         <--------------

// after creating gateway
$ oc -n openshift-ingress get configmap openshift-gw-ca-root-cert
NAME                        DATA   AGE
openshift-gw-ca-root-cert   1      10m

//note: the configmap is still there after all gateway are deleted

skriss · 2025-11-25T18:29:43Z

Hi @skriss I run pre-merge test with the PR and seems the configmap is still there after gateway is delete, is that expected ?

Yeah, AFAIK this is expected, there's no code to delete the configmaps on Gateway deletion.

lihongan · 2025-11-26T01:17:24Z

Thank you for your confirming @skriss

/verified by @lihongan

openshift-ci-robot · 2025-11-26T01:17:36Z

@lihongan: This PR has been marked as verified by @lihongan.

In response to this:

Thank you for your confirming @skriss

/verified by @lihongan

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

lihongan · 2025-11-26T01:17:57Z

/retest

openshift-ci-robot · 2025-11-26T04:29:41Z

/retest-required

Remaining retests: 0 against base HEAD b62dd27 and 2 for PR HEAD 056f80f in total

lihongan · 2025-11-26T07:53:22Z

/retest-required

openshift-ci · 2025-11-26T10:32:58Z

@skriss: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-serial-1of2	`056f80f`	link	true	`/test e2e-aws-ovn-serial-1of2`
ci/prow/e2e-aws-pre-release-ossm	`056f80f`	link	false	`/test e2e-aws-pre-release-ossm`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

set trustBundleName in Istio global values

85b6fc9

Sets trustBundleName in order to customize the name of the configmap containing the CA cert so it doesn't clash with a standalone OSSM instance. Follow-up to openshift#1243. Signed-off-by: Steve Kriss <[email protected]>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Oct 2, 2025

openshift-ci bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Oct 2, 2025

openshift-ci bot requested review from frobware and rikatz October 2, 2025 13:17

rikatz reviewed Oct 20, 2025

View reviewed changes

don't use constant in unit test

056f80f

Signed-off-by: Steve Kriss <[email protected]>

openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 23, 2025

openshift-ci bot assigned Miciah Oct 30, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 21, 2025

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 21, 2025

openshift-ci bot requested review from ShudiLi, lihongan, melvinjoseph86 and rhamini3 November 24, 2025 19:34

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Nov 26, 2025

OSSM-10865: set trustBundleName in Istio global values #1288

Are you sure you want to change the base?

OSSM-10865: set trustBundleName in Istio global values #1288

Uh oh!

Conversation

skriss commented Oct 2, 2025

Uh oh!

openshift-ci-robot commented Oct 2, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

skriss commented Oct 2, 2025

Uh oh!

openshift-ci bot commented Oct 2, 2025

Uh oh!

rikatz Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

skriss Oct 23, 2025

Choose a reason for hiding this comment

Uh oh!

aslakknutsen Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

Miciah Nov 19, 2025

Choose a reason for hiding this comment

Uh oh!

aslakknutsen Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dgn Nov 21, 2025

Choose a reason for hiding this comment

Uh oh!

rikatz commented Oct 23, 2025

Uh oh!

skriss commented Oct 24, 2025

Uh oh!

Miciah commented Oct 30, 2025

Uh oh!

Miciah commented Nov 21, 2025

Uh oh!

Miciah commented Nov 21, 2025

Uh oh!

openshift-ci bot commented Nov 21, 2025

Uh oh!

skriss commented Nov 24, 2025

Uh oh!

rikatz commented Nov 24, 2025

Uh oh!

rikatz commented Nov 24, 2025

Uh oh!

lihongan commented Nov 25, 2025

Uh oh!

skriss commented Nov 25, 2025

Uh oh!

lihongan commented Nov 26, 2025

Uh oh!

openshift-ci-robot commented Nov 26, 2025

Uh oh!

lihongan commented Nov 26, 2025

Uh oh!

openshift-ci-robot commented Nov 26, 2025

Uh oh!

lihongan commented Nov 26, 2025

Uh oh!

openshift-ci bot commented Nov 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

openshift-ci-robot commented Oct 2, 2025 •

edited by openshift-ci bot

Loading

aslakknutsen Nov 20, 2025 •

edited

Loading