Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adopt Kubernetes style TLS Secret #597

Merged
merged 1 commit into from
Aug 23, 2023
Merged

Adopt Kubernetes style TLS Secret #597

merged 1 commit into from
Aug 23, 2023

Conversation

somtochiama
Copy link
Member

Deprecate the usage of caFile for the .spec.certSecretRef secret in Provider. Both caFile and ca.crt keys are supported for Provider with the latter taking precedence.

Part of: fluxcd/flux2#4137

@somtochiama somtochiama requested a review from aryan9600 August 9, 2023 12:45
@aryan9600 aryan9600 mentioned this pull request Aug 9, 2023
Closed
4 tasks
@somtochiama somtochiama marked this pull request as ready for review August 14, 2023 13:51
@darkowlzz darkowlzz mentioned this pull request Jun 15, 2023
Merged
darkowlzz
darkowlzz reviewed Aug 16, 2023
View reviewed changes
internal/controller/testdata/certs/ca-key.pem Outdated
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would be good to include a makefile that generates this and the other files in this directory.
Similar to https://github.com/fluxcd/source-controller/blob/aa370f284db70e09d8acb49d5bed4e42908b8cb3/internal/controller/testdata/certs/Makefile#L17-L20 .

makkes
makkes reviewed Aug 16, 2023
View reviewed changes
internal/controller/alert_controller.go Outdated
@@ -178,7 +178,7 @@ func (r *AlertReconciler) isProviderReady(ctx context.Context, alert *apiv1beta2
providerName := types.NamespacedName{Namespace: alert.Namespace, Name: alert.Spec.ProviderRef.Name}
if err := r.Get(ctx, providerName, provider); err != nil {
// log not found errors since they get filtered out
ctrl.LoggerFrom(ctx).Error(err, "failed to get provider %s", providerName.String())
ctrl.LoggerFrom(ctx).Error(err, fmt.Sprintf("failed to get provider '%s'", providerName.String()))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In favor of structured logging I suggest:

Suggested change
ctrl.LoggerFrom(ctx).Error(err, fmt.Sprintf("failed to get provider '%s'", providerName.String()))
ctrl.LoggerFrom(ctx).Error(err, "failed to get provider", "provider", providerName.String())

internal/controller/provider_controller.go Outdated
return fmt.Errorf("no caFile found in secret %s", provider.Spec.CertSecretRef.Name)
caFile, ok = secret.Data["caFile"]
if !ok {
return fmt.Errorf("no `ca.crt` key found in secret '%s'", provider.Spec.CertSecretRef.Name)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
return fmt.Errorf("no `ca.crt` key found in secret '%s'", provider.Spec.CertSecretRef.Name)
return fmt.Errorf("no 'ca.crt' nor 'caFile' key found in secret", "secret", provider.Spec.CertSecretRef.Name)

Copy link
Member Author

@somtochiama somtochiama Aug 16, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure if we want to add the deprecated key caFile to the log so as not to encourage users to use it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, had the same thought. Up to you.

internal/controller/provider_controller.go Outdated
if !ok {
return fmt.Errorf("no `ca.crt` key found in secret '%s'", provider.Spec.CertSecretRef.Name)
}
log.Info("warning: specifying CA cert via `caFile` is deprecated, please use `ca.crt` instead")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
log.Info("warning: specifying CA cert via `caFile` is deprecated, please use `ca.crt` instead")
log.Info("warning: specifying CA cert via 'caFile' is deprecated, please use 'ca.crt' instead")

internal/server/event_handlers.go Outdated
continue
caFile, ok = secret.Data["caFile"]
if !ok {
alertLogger.Error(nil, "no `ca.crt` key found in secret '%s'", provider.Spec.CertSecretRef.Name)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
alertLogger.Error(nil, "no `ca.crt` key found in secret '%s'", provider.Spec.CertSecretRef.Name)
alertLogger.Error(nil, "no 'ca.crt' nor 'caFile' key found in secret", "secret", provider.Spec.CertSecretRef.Name)

aryan9600
aryan9600 requested changes Aug 18, 2023
View reviewed changes
docs/spec/v1beta2/providers.md
@@ -1042,7 +1042,7 @@ Secret in the same namespace as the Provider, containing the TLS CA certificate.
#### Example

To enable notification-controller to communicate with a provider API over HTTPS
using a self-signed TLS certificate, set the `caFile` like so:
using a self-signed TLS certificate, set the `ca.crt` like so:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we also need to add a deprecation notice for the caFile key like the one here: https://github.com/fluxcd/source-controller/blob/main/docs/spec/v1beta2/helmrepositories.md#secret-reference

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

my bad, skipped it somehow but the same goes for the API docs

@somtochiama somtochiama requested a review from makkes August 23, 2023 10:38
darkowlzz
darkowlzz reviewed Aug 23, 2023
View reviewed changes
docs/spec/v1beta2/providers.md Outdated
Comment on lines 1127 to 1128
**Note:** Support for the `caFile` key have been
deprecated. If you have any Secrets using these keys,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
**Note:** Support for the `caFile` key have been
deprecated. If you have any Secrets using these keys,
**Warning:** Support for the `caFile` key has been
deprecated. If you have any Secrets using this key,

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, maybe mention the types of Secret that's allowed in the above section, not part of this warning.

aryan9600
aryan9600 approved these changes Aug 23, 2023
View reviewed changes
Copy link
Member

@aryan9600 aryan9600 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm!

@stefanprodan stefanprodan added the area/alerting Alerting related issues and PRs label Aug 23, 2023
stefanprodan
stefanprodan approved these changes Aug 23, 2023
View reviewed changes
Copy link
Member

@stefanprodan stefanprodan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Thanks @somtochiama 🏅

@stefanprodan stefanprodan merged commit c04ad84 into main Aug 23, 2023
@stefanprodan stefanprodan deleted the kube-tls-secret branch August 23, 2023 13:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@darkowlzz darkowlzz darkowlzz left review comments

@stefanprodan stefanprodan stefanprodan approved these changes

@aryan9600 aryan9600 aryan9600 approved these changes

@makkes makkes Awaiting requested review from makkes

Assignees
No one assigned
Labels
area/alerting Alerting related issues and PRs
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@somtochiama @makkes @darkowlzz @stefanprodan @aryan9600