Add option to switch between using certificates and CRs #102
Conversation
As discussed in cert-manager#49 , using `CertificateRequest` resources for interacting with cert-manager has several drawbacks: - this project (openshift-routes) has to duplicate logic for handling the creation of certificates that already exists in cert-manager. - observability is impaired because cert-manager does not offer metrics for `CertificateRequest` resources, only for `Certificates`. Therefore, this patch replaces the management of `CertificateRequests` with `Certificates` (and `Secrets`). In return, it requires slightly higher privileges because openshift-routes needs to be able to create and read `Certificates`. At the same time, the code complexity and LOC has been reduced. Signed-off-by: Jack Henschel <[email protected]>
Signed-off-by: Ashley Davis <[email protected]>
Signed-off-by: Ashley Davis <[email protected]>
Signed-off-by: Ashley Davis <[email protected]>
Signed-off-by: Ashley Davis <[email protected]>
Signed-off-by: Ashley Davis <[email protected]>
Signed-off-by: Ashley Davis <[email protected]>
cert-manager-prow
bot
added
the
dco-signoff: yes
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/hold Until we've decided an approach! |
cert-manager-prow
bot
added
do-not-merge/hold
Signed-off-by: Ashley Davis <[email protected]>
Signed-off-by: Ashley Davis <[email protected]>
SgtCoDFish
force-pushed
the
switch-certs-crs
branch
from
7b03fa6 to
6d684f7
Compare
|
@SgtCoDFish: The following test failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
Going to close this PR since we decided in standup this morning to proceed with just supporting Certificates for now. If we have to re-add CRs in the future this will be useful, but for now we're not doing that. |
In #101 (a followup to #55) we unilaterally switch to using certificates for issuing certs for routes. This PR presents an alternative whereby we allow users to opt in to the old behavior.
We can pick between #101 and this PR.
This PR is WIP until we decide on a path to take. In both cases (i.e. #101 and this PR) the Certificate approach needs further testing, but that can also be done when a path is chosen!