Uploaded image for project: 'OpenShift Service Mesh'
  1. OpenShift Service Mesh
  2. OSSM-10864

[upstream] Make CRL ConfigMap configurable for Multi Control plane support

XMLWordPrintable

    • Icon: Story Story
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • None
    • Istio
    • None

      CRL support adds a new hard coded name to reference the ConfigMap where the CRL should be located. For multiple control plane support we need to be able to configure this name to avoid clashes in the same namespace.

      Some what similar impl: https://github.com/istio/istio/pull/54971

      Upstream feature: https://github.com/openshift-service-mesh/istio/commit/c579f29461a9094851432b13c24c1294ab0ea9ff
      Name variable: https://github.com/openshift-service-mesh/istio/commit/c579f29461a9094851432b13c24c1294ab0ea9ff#diff-ebdb96fe798945a5897b320d63f9428e29849d1540c9f5b3490c379586ff973aR44

      Note: From the initial code scan it looks like the gateway template is not modified to support CRL(yet), only the injection template for side car injection. But assuming it did, it looks like the clash "threat" is only that we might mount the CRL ConfigMap if one exist, but won't read or act on it unless the control plane is configured for CRL support via env.PILOT_ENABLE_CA_CRL which the Cluster Ingress Operator control plane does not set.

      Evaluate the following:

              rh-ee-skriss Steve Kriss
              aknutsen@redhat.com Aslak Knutsen
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: