feat(etcd-backup): add custom CA support #78
Conversation
Signed-off-by: Valentin Maillot <[email protected]>
vmaillot
requested review from
hairmare,
paraenggu,
eyenx,
inisitijitty and
tongpu
backup.sh
Outdated
| if [ "${OCP_BACKUP_S3_CA}" ]; then | ||
| echo -n "${OCP_BACKUP_S3_CA}" > /etc/pki/ca-trust/source/anchors/ca.crt | ||
| update-ca-trust | ||
| fi |
There was a problem hiding this comment.
why can't we just mount the ca to /etc/pki/ca-trust/source/anchors/ca.crt from a ConfigMap?
There was a problem hiding this comment.
this will imply having a dedicated configMap for just the CA, I wanted to avoid that, what do you think?
There was a problem hiding this comment.
afair that's what the previous update-ca-trust call is for
There was a problem hiding this comment.
something like trust-manager could manage the cm (or the ca management thing on openshift?)
There was a problem hiding this comment.
afair that's what the previous
update-ca-trustcall is for
yeah right... let's do it that way then! we can just referencing an item, let's see
something like trust-manager could manage the cm (or the ca management thing on openshift?)
i can totally agree, but this would bring way more overhead that we have already, i wanted to replicate how we are achieving this with velero
There was a problem hiding this comment.
what about this @hairmare?
There was a problem hiding this comment.
afaict we can configure the cluster to know about the CA and create an empty configmap with the config.openshift.io/inject-trusted-cabundle="true" annotation using the openshift-etcd-backup chart and then magick should happen:
There was a problem hiding this comment.
Specifically, the cluster should already know about the right CA. We use the same trust root that for basics like accessing internal registries. it is usually configured during installation, moreso in air-gapped cases than others.
The certificate injection feature seemingly aims to cover the same need that trust-manager wants to cover as a CNCF (sub-)project. The openshift/service-ca-operator looks like RedHat's upstream for their implementation that most likely predates trust-manager.
Co-authored-by: Kevin Cottier <[email protected]>
Signed-off-by: Valentin Maillot <[email protected]>
|
i am closing this PR as we should be able to that in the helm chart only. |
Title says it all.