Add self-healing for CA bundle configmaps in user namespaces#3247
Add self-healing for CA bundle configmaps in user namespaces#3247ab-ghosh wants to merge 1 commit intotektoncd:mainfrom
Conversation
tekton-robot
added
the
release-note
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
tekton-robot
added
the
size/L
|
Tested the upgrade scenario and it's working as expected |
| needsCABundle = true | ||
| } else { | ||
| // Self-healing: verify configmaps exist even when label matches | ||
| _, err1 := r.kubeClientSet.CoreV1().ConfigMaps(ns.Name).Get(ctx, trustedCABundleConfigMap, metav1.GetOptions{}) |
There was a problem hiding this comment.
I think you can reuse the r.kubeClientSet.CoreV1().ConfigMaps(ns.Name) part.
ab-ghosh
force-pushed
the
self-healing-ca-bundle-configmaps
branch
from
ccaa779 to
16ef4a8
Compare
|
/lgtm |
|
/lgtm |
|
@mathur07: changing LGTM is restricted to collaborators DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/cc @jkhelil |
| } | ||
|
|
||
| // Check if namespace needs CA bundle reconciliation | ||
| needsCABundle := false |
There was a problem hiding this comment.
@ab-ghosh can you extract cabundle process in its own function for readbility
same for rbac
We wold have
for _, ns := range ... {
if shouldIgnore(ns) {
continue
}
if r.needsRBAC(ns) {
result.RBACNamespaces = append(...)
}
if r.needsCABundle(ns) {
result.CANamespaces = append(...)
}
}
Previously, the operator used the namespace label namespace-trusted-configmaps-version to determine if CA bundle configmaps were reconciled. Once the label matched the current version, the namespace was permanently skipped even if the configmaps were deleted externally. This adds a self-healing check in getNamespacesToBeReconciled(), matching the existing RBAC self-healing pattern that verifies RoleBinding existence. When the label matches but either config-trusted-cabundle or config-service-cabundle configmap is missing, the namespace is marked for re-reconciliation and a warning is logged. Signed-off-by: ab-ghosh <abghosh@redhat.com>
ab-ghosh
force-pushed
the
self-healing-ca-bundle-configmaps
branch
from
16ef4a8 to
c0a2a1d
Compare
|
New changes are detected. LGTM label has been removed. |
5 participants
Changes
getNamespacesToBeReconciled()to verify CA bundle configmaps (config-trusted-cabundle,config-service-cabundle) exist even when the namespace label indicates reconciliation is completeSubmitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
make test lintbefore submitting a PRSee the contribution guide for more details.
Release Notes