-
Notifications
You must be signed in to change notification settings - Fork 90
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: use cert-controller rotator for server certs #93
Conversation
@@ -110,6 +112,8 @@ test_helm_chart() { | |||
--set azureTenantID="${AZURE_TENANT_ID}" \ | |||
--namespace aad-pi-webhook-system \ | |||
--wait | |||
# adding a sleep here because the cert mount is not ready immediately after the deploy | |||
sleep 120 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Had to add this sleep because the mount timing isn't deterministic. @sozercan Is there anything in this change that's different from gatekeeper that you think could cause the delay?
I think the secret data isn't up-to-date during the initial mount republish by kubelet and it only succeeds in the next republish loop.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Couldn't repro this
third_party/open-policy-agent/gatekeeper/helmify/kustomize-for-helm.yaml
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
pending review from @sozercan
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's remove the following volume mount in third_party/open-policy-agent/gatekeeper/helmify/kustomize-for-helm.yaml
, which was merged to the helm chart template:
- mountPath: /tmp/k8s-webhook-server/serving-certs
name: cert
readOnly: true
Signed-off-by: Anish Ramasekar <[email protected]>
Signed-off-by: Anish Ramasekar [email protected]
Reason for Change:
Requirements
Issue Fixed:
fixes #91
Please answer the following questions with yes/no:
Does this change contain code from or inspired by another project? If so, did you notify the maintainers and provide attribution?
The changes have been inspired by the gatekeeper project: https://github.com/open-policy-agent/gatekeeper
Notes for Reviewers:
Doc update to remove cert-manager requirement/install will be done at the time of release.