-
Story
-
Resolution: Unresolved
-
Undefined
-
None
-
None
-
None
CRL support adds a new hard coded name to reference the ConfigMap where the CRL should be located. For multiple control plane support we need to be able to configure this name to avoid clashes in the same namespace.
Some what similar impl: https://github.com/istio/istio/pull/54971
Upstream feature: https://github.com/openshift-service-mesh/istio/commit/c579f29461a9094851432b13c24c1294ab0ea9ff
Name variable: https://github.com/openshift-service-mesh/istio/commit/c579f29461a9094851432b13c24c1294ab0ea9ff#diff-ebdb96fe798945a5897b320d63f9428e29849d1540c9f5b3490c379586ff973aR44
Note: From the initial code scan it looks like the gateway template is not modified to support CRL(yet), only the injection template for side car injection. But assuming it did, it looks like the clash "threat" is only that we might mount the CRL ConfigMap if one exist, but won't read or act on it unless the control plane is configured for CRL support via env.PILOT_ENABLE_CA_CRL which the Cluster Ingress Operator control plane does not set.
Evaluate the following:
- If accepted upstream in the OSSM 3.2 time frame, evaluate retro fit and back port to support https://github.com/openshift-service-mesh/istio/pull/493/files.
- Adding support for setting it on the Cluster Ingress Operator. https://github.com/openshift/cluster-ingress-operator/blob/master/pkg/operator/controller/gatewayclass/istio.go#L139
- is Informed by
-
OSSM-10813 Review changes required after crl support for plugged-in CA
-
- Closed
-