Skip to content

[release-4.19] OCPBUGS-60682: Optimistically update Kube Server and Client CA bundles #1920

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: release-4.19
Choose a base branch
from
Open

[release-4.19] OCPBUGS-60682: Optimistically update Kube Server and Client CA bundles #1920

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
aa97831
proof: bump library-go
sanchezl Sep 12, 2025
b58e40d
Optimistically update Kube Server and Client CA bundles
vrutkovs May 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,3 +128,5 @@ require (
sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
sigs.k8s.io/yaml v1.4.0 // indirect
)

replace github.com/openshift/library-go => github.com/openshift-cherrypick-robot/library-go v0.0.0-20250912134350-65142f98d552 //cherry-pick-1936-to-release-4.19
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,14 +160,14 @@ github.com/onsi/ginkgo/v2 v2.21.0 h1:7rg/4f3rB88pb5obDgNZrNHrQ4e6WpjonchcpuBRnZM
github.com/onsi/ginkgo/v2 v2.21.0/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
github.com/onsi/gomega v1.35.1 h1:Cwbd75ZBPxFSuZ6T+rN/WCb/gOc6YgFBXLlZLhC7Ds4=
github.com/onsi/gomega v1.35.1/go.mod h1:PvZbdDc8J6XJEpDK4HCuRBm8a6Fzp9/DmhC9C7yFlog=
github.com/openshift-cherrypick-robot/library-go v0.0.0-20250912134350-65142f98d552 h1:YH3UKjcREsQbXEhGbTXIermM06eCCdvv8p0HHMyrDjc=
github.com/openshift-cherrypick-robot/library-go v0.0.0-20250912134350-65142f98d552/go.mod h1:DAa3BGl0CFtkfJn/g5rU8kDDTErfMVA/QlFm4cvU+MI=
github.com/openshift/api v0.0.0-20250320170726-75d64d71980b h1:GGuFSHESP0BSOu70AqV4u9IVrjYdaeu4Id+HXRIOvkw=
github.com/openshift/api v0.0.0-20250320170726-75d64d71980b/go.mod h1:yk60tHAmHhtVpJQo3TwVYq2zpuP70iJIFDCmeKMIzPw=
github.com/openshift/build-machinery-go v0.0.0-20250102153059-e85a1a7ecb5c h1:6XcszPFZpan4qll5XbdLll7n1So3IsPn28aw2j1obMo=
github.com/openshift/build-machinery-go v0.0.0-20250102153059-e85a1a7ecb5c/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE=
github.com/openshift/client-go v0.0.0-20250125113824-8e1f0b8fa9a7 h1:4iliLcvr1P9EUMZgIaSNEKNQQzBn+L6PSequlFOuB6Q=
github.com/openshift/client-go v0.0.0-20250125113824-8e1f0b8fa9a7/go.mod h1:2tcufBE4Cu6RNgDCxcUJepa530kGo5GFVfR9BSnndhI=
github.com/openshift/library-go v0.0.0-20250512121900-863508cf7a27 h1:9gC5e5821g15dahkbhKd8njBU8l/3l+0LgGvlMKWs2I=
github.com/openshift/library-go v0.0.0-20250512121900-863508cf7a27/go.mod h1:DAa3BGl0CFtkfJn/g5rU8kDDTErfMVA/QlFm4cvU+MI=
github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
Expand Down
109 changes: 90 additions & 19 deletions pkg/operator/targetconfigcontroller/targetconfigcontroller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ import (

"github.com/ghodss/yaml"

"github.com/openshift/api/annotations"
kubecontrolplanev1 "github.com/openshift/api/kubecontrolplane/v1"
operatorv1 "github.com/openshift/api/operator/v1"
"github.com/openshift/cluster-kube-apiserver-operator/bindata"
Expand All @@ -24,6 +23,7 @@ import (
"github.com/openshift/library-go/pkg/operator/certrotation"
"github.com/openshift/library-go/pkg/operator/events"
"github.com/openshift/library-go/pkg/operator/resource/resourceapply"
"github.com/openshift/library-go/pkg/operator/resource/resourcehelper"
"github.com/openshift/library-go/pkg/operator/resource/resourcemerge"
"github.com/openshift/library-go/pkg/operator/resource/resourceread"
"github.com/openshift/library-go/pkg/operator/resourcesynccontroller"
Expand All @@ -38,6 +38,7 @@ import (
"k8s.io/client-go/kubernetes"
coreclientv1 "k8s.io/client-go/kubernetes/typed/core/v1"
corev1listers "k8s.io/client-go/listers/core/v1"
"k8s.io/klog/v2"
)

const (
Expand Down Expand Up @@ -347,12 +348,33 @@ func generateOptionalStartupMonitorPod(isStartupMonitorEnabledFn func() (bool, e
}

func ManageClientCABundle(ctx context.Context, lister corev1listers.ConfigMapLister, client coreclientv1.ConfigMapsGetter, recorder events.Recorder) (*corev1.ConfigMap, bool, error) {
requiredConfigMap, err := resourcesynccontroller.CombineCABundleConfigMaps(
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "client-ca"},

additionalAnnotations := certrotation.AdditionalAnnotations{
JiraComponent: "kube-apiserver",
}
caBundleConfigMapName := "client-ca"

creationRequired := false
updateRequired := false

caBundleConfigMap, err := lister.ConfigMaps(operatorclient.TargetNamespace).Get(caBundleConfigMapName)
switch {
case apierrors.IsNotFound(err):
creationRequired = true
caBundleConfigMap = &corev1.ConfigMap{
ObjectMeta: metav1.ObjectMeta{
Name: caBundleConfigMapName,
Namespace: operatorclient.TargetNamespace,
},
}
case err != nil:
return nil, false, err
}

requiredConfigMap, updateRequired, err := resourcesynccontroller.CombineCABundleConfigMapsOptimistically(
caBundleConfigMap,
lister,
certrotation.AdditionalAnnotations{
JiraComponent: "kube-apiserver",
},
additionalAnnotations,
// this is from the installer and contains the value to verify the admin.kubeconfig user
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.GlobalUserSpecifiedConfigNamespace, Name: "admin-kubeconfig-client-ca"},
// this is from the installer and contains the value to verify the node bootstrapping cert that is baked into images
Expand All @@ -372,21 +394,56 @@ func ManageClientCABundle(ctx context.Context, lister corev1listers.ConfigMapLis
if err != nil {
return nil, false, err
}
if requiredConfigMap.Annotations == nil {
requiredConfigMap.Annotations = map[string]string{}

if creationRequired {
caBundleConfigMap, err = client.ConfigMaps(operatorclient.TargetNamespace).Create(ctx, requiredConfigMap, metav1.CreateOptions{})
resourcehelper.ReportCreateEvent(recorder, caBundleConfigMap, err)
if err != nil {
return nil, false, err
}
klog.V(2).Infof("Created client CA bundle configmap %s/%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name)
return caBundleConfigMap, true, nil
} else if updateRequired {
caBundleConfigMap, err = client.ConfigMaps(operatorclient.TargetNamespace).Update(ctx, requiredConfigMap, metav1.UpdateOptions{})
resourcehelper.ReportUpdateEvent(recorder, caBundleConfigMap, err)
if err != nil {
return nil, false, err
}
klog.V(2).Infof("Updated client CA bundle configmap %s/%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name)
return caBundleConfigMap, true, nil
}
requiredConfigMap.Annotations[annotations.OpenShiftComponent] = "kube-apiserver"

return resourceapply.ApplyConfigMap(ctx, client, recorder, requiredConfigMap)
return caBundleConfigMap, false, nil
}

func manageKubeAPIServerCABundle(ctx context.Context, lister corev1listers.ConfigMapLister, client coreclientv1.ConfigMapsGetter, recorder events.Recorder) (*corev1.ConfigMap, bool, error) {
requiredConfigMap, err := resourcesynccontroller.CombineCABundleConfigMaps(
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "kube-apiserver-server-ca"},

additionalAnnotations := certrotation.AdditionalAnnotations{
JiraComponent: "kube-apiserver",
}
caBundleConfigMapName := "kube-apiserver-server-ca"

creationRequired := false
updateRequired := false

caBundleConfigMap, err := lister.ConfigMaps(operatorclient.TargetNamespace).Get(caBundleConfigMapName)
switch {
case apierrors.IsNotFound(err):
creationRequired = true
caBundleConfigMap = &corev1.ConfigMap{
ObjectMeta: metav1.ObjectMeta{
Name: caBundleConfigMapName,
Namespace: operatorclient.TargetNamespace,
},
}
case err != nil:
return nil, false, err
}

requiredConfigMap, updateRequired, err := resourcesynccontroller.CombineCABundleConfigMapsOptimistically(
caBundleConfigMap,
lister,
certrotation.AdditionalAnnotations{
JiraComponent: "kube-apiserver",
},
additionalAnnotations,
// this bundle is what this operator uses to mint loadbalancers certs
resourcesynccontroller.ResourceLocation{Namespace: operatorclient.OperatorNamespace, Name: "loadbalancer-serving-ca"},
// this bundle is what this operator uses to mint localhost certs
Expand All @@ -399,12 +456,26 @@ func manageKubeAPIServerCABundle(ctx context.Context, lister corev1listers.Confi
if err != nil {
return nil, false, err
}
if requiredConfigMap.Annotations == nil {
requiredConfigMap.Annotations = map[string]string{}

if creationRequired {
caBundleConfigMap, err := client.ConfigMaps(operatorclient.TargetNamespace).Create(ctx, requiredConfigMap, metav1.CreateOptions{})
resourcehelper.ReportCreateEvent(recorder, caBundleConfigMap, err)
if err != nil {
return nil, false, err
}
klog.V(2).Infof("Created kube apiserver CA bundle configmap %s/%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name)
return caBundleConfigMap, true, nil
} else if updateRequired {
caBundleConfigMap, err := client.ConfigMaps(operatorclient.TargetNamespace).Update(ctx, requiredConfigMap, metav1.UpdateOptions{})
resourcehelper.ReportUpdateEvent(recorder, caBundleConfigMap, err)
if err != nil {
return nil, false, err
}
klog.V(2).Infof("Updated kube apiserver CA bundle configmap %s/%s", caBundleConfigMap.Namespace, caBundleConfigMap.Name)
return caBundleConfigMap, true, nil
}
requiredConfigMap.Annotations[annotations.OpenShiftComponent] = "kube-apiserver"

return resourceapply.ApplyConfigMap(ctx, client, recorder, requiredConfigMap)
return caBundleConfigMap, false, nil
}

func ensureKubeAPIServerTrustedCA(ctx context.Context, client coreclientv1.CoreV1Interface, recorder events.Recorder) error {
Expand Down
Loading