Support TLS for watcher-api #57
Conversation
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/f058f22970a2470aa5ae33a44f3ccfe7 ✔️ noop SUCCESS in 0s |
cescgina
force-pushed
the
watcher_route_tls
branch
from
71111be to
370b1a5
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/f1f5b6ddd3dc433f82ad5f46854ba12c ✔️ noop SUCCESS in 0s |
cescgina
force-pushed
the
watcher_route_tls
branch
from
370b1a5 to
cfbabae
Compare
Duplicate the TLS support code in openstack-operator for TLS support in watcher-operator before it's integrated. This will support TLS to the pod level, but only using certificates pre-created.
Validate the TLS input. Check that when passed, the secret containing certs contain the right fields. Also, check the input corresponds to a valid TLS mode, e.g. when the user has set the secrets to configure PodLevel TLS, ensure that the secret to configure Ingress TLS is also set.
If the user exposes the public endpoint via a MetalLB service, ensure the created route is deleted.
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/8ea6359c3d8942938e00d033bae2a9c4 ✔️ noop SUCCESS in 0s |
cescgina
force-pushed
the
watcher_route_tls
branch
from
cfbabae to
fe5d18f
Compare
|
Build failed (check pipeline). Post https://softwarefactory-project.io/zuul/t/rdoproject.org/buildset/7ead74eeee8947e5a95b8d68fad8eafa ✔️ noop SUCCESS in 0s |
Support TLS for watcher-api. This patch follows the same approach that
openstack-operator uses. The intention is to duplicate some of the openstack-operator
code here temporarily until watcher-operator is integrated.
To use TLS in watcher-operator the user needs to previously create the certifcates, and pass the secret names for the certs for the route and the services (if TLS to pod level is desired).