-
Story
-
Resolution: Done
-
Major
-
None
-
None
-
None
-
Strategic Portfolio Work
-
8
-
False
-
None
-
False
-
OCPSTRAT-172 - Cert-manager support router to load secrets
-
-
-
CFE Sprint 248, CFE Sprint 249, CFE Sprint 250, CFE Sprint 252, CFE Sprint 253
As part of this EP, there is a use case where there is a need to trigger re-sync of routes based on secret changes observed. The caveat here is that, we are not using secret informers, rather a new interface aka secret monitor (reasons are in the EP but don't pertain to this query). Since the router uses RouterController and not specific controllers for each resource (routes, namespaces, endpoints, etc), it doesn't have access to lower level components of a controller (eg: the workqueue) and without this I don't really see a way to integrate router with the secret monitor. Is re-designing the routercontroller the way forward here? I'm open to suggestions on other way to integrate here.
Router will take feature-gate info from CFE-987
Router will integrate secret-monitor done in CFE-866
Validations required on router
- The secret created should be in the same namespace as that of the route.
- The secret created is of type `kubernetes.io/tls`.
- Verify certificate and key (PEM encode/decode)
- Verify private key matches public certificate
- causes
-
OAPE-27 [GA] Improve route update logic for RouteSecretManager plugin in router
- To Do
- depends on
-
CFE-866 As a developer, I want to add secret monitoring functionality into library-go to enable router to watch single secrets dynamically
- Closed
- relates to
-
OCPBUGS-33574 should reduce error message details when edit route with spec.tls.externalCertificate
- Closed
- links to