Certificate signing controller for TLS bootstrap (alpha)#25764
Certificate signing controller for TLS bootstrap (alpha)#25764k8s-github-robot merged 3 commits intokubernetes:masterfrom
Conversation
|
Can one of the admins verify that this patch is reasonable to test? If so, please reply "ok to test". This message may repeat a few times in short succession due to jenkinsci/ghprb-plugin#292. Sorry. Otherwise, if this message is too spammy, please complain to ixdy. |
2 similar comments
|
Can one of the admins verify that this patch is reasonable to test? If so, please reply "ok to test". This message may repeat a few times in short succession due to jenkinsci/ghprb-plugin#292. Sorry. Otherwise, if this message is too spammy, please complain to ixdy. |
|
Can one of the admins verify that this patch is reasonable to test? If so, please reply "ok to test". This message may repeat a few times in short succession due to jenkinsci/ghprb-plugin#292. Sorry. Otherwise, if this message is too spammy, please complain to ixdy. |
|
Can one of the admins verify that this patch is reasonable to test? If so, please reply "ok to test". This message may repeat a few times in short succession due to jenkinsci/ghprb-plugin#292. Sorry. Otherwise, if this message is too spammy, please complain to ixdy. |
1 similar comment
|
Can one of the admins verify that this patch is reasonable to test? If so, please reply "ok to test". This message may repeat a few times in short succession due to jenkinsci/ghprb-plugin#292. Sorry. Otherwise, if this message is too spammy, please complain to ixdy. |
5c795c2 to
e846e0b
Compare
|
@gtank please rebase. |
e846e0b to
966eebd
Compare
ad54760 to
9feff4e
Compare
9feff4e to
164dfdc
Compare
|
@mikedanese found the flake! |
| ) | ||
| if err != nil { | ||
| glog.Errorf("Failed to start certificate controller: %v", err) | ||
| } else { |
There was a problem hiding this comment.
There was a problem hiding this comment.
How else should this be done? It can't return or exit here, and shouldn't start the control loop if the signer failed to initialize. I can change the conditionals around to reduce indentation, but the control flow will be the same.
There was a problem hiding this comment.
Oops, misread, I withdraw comment
There was a problem hiding this comment.
Why is it not glog.Fatalf though?
There was a problem hiding this comment.
It isn't fatal to Kubernetes; there are a lot ways you could accomplish this task aside from running the signing controller.
|
Looks good. |
164dfdc to
902b9fa
Compare
|
LGTM. Todo:
cc @kubernetes/sig-cluster-lifecycle |
|
GCE e2e build/test passed for commit 902b9fa. |
|
Automatic merge from submit-queue |
|
/cc @dgoodwin |
The controller handles generating and signing certificates when a CertificateSigningRequest has the "Approved" condition. Uses cfssl to support a wide set of possible keys and algorithms. Depends on PR #25562, only the last two commits are relevant to this PR.
cc @mikedanese