Skip to content

Commit c057149

Browse files
neiswci-robot
neisw
authored and
ci-robot
committed
UPSTREAM: <carry>: Revert "UPSTREAM: <carry>: use projected volume for CAs to avoid subPath limitations"
This reverts commit 548caa4.
1 parent 8d57e3c commit c057149

File tree

4 files changed

+62
-50
lines changed

4 files changed

+62
-50
lines changed

‎openshift/catalogd/kustomize/overlays/openshift/olmv1-ns/patches/manager_deployment_certs.yaml

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,25 @@
33
value: {"name":"catalogserver-certs", "secret":{"optional":false,"secretName":"catalogserver-cert"}}
44
- op: add
55
path: /spec/template/spec/volumes/-
6-
value: {"name":"ca-certs", "projected": {"sources":[{"configMap":{"optional":false,"name":"trusted-ca-bundle", "items":[{"key":"ca-bundle.crt","path":"ca-bundle.crt"}]}},{"configMap":{"optional":false,"name":"openshift-service-ca.crt", "items":[{"key":"service-ca.crt","path":"service-ca.crt"}]}}]}}
6+
value: {"name":"trusted-ca-bundle", "configMap":{"optional":false,"name":"trusted-ca-bundle", "items":[{"key":"ca-bundle.crt","path":"ca-bundle.crt"}]}}
7+
- op: add
8+
path: /spec/template/spec/volumes/-
9+
value: {"name":"service-ca", "configMap":{"optional":false,"name":"openshift-service-ca.crt", "items":[{"key":"service-ca.crt","path":"service-ca.crt"}]}}
710
- op: add
811
path: /spec/template/spec/containers/0/volumeMounts/-
912
value: {"name":"catalogserver-certs", "mountPath":"/var/certs"}
1013
- op: add
1114
path: /spec/template/spec/containers/0/volumeMounts/-
12-
value: {"name":"ca-certs", "mountPath":"/var/ca-certs", "readOnly": true}
15+
value: {"name":"trusted-ca-bundle", "mountPath":"/var/trusted-cas/ca-bundle.crt", "subPath":"ca-bundle.crt"}
16+
- op: add
17+
path: /spec/template/spec/containers/0/volumeMounts/-
18+
value: {"name":"service-ca", "mountPath":"/var/trusted-cas/service-ca.crt", "subPath":"service-ca.crt"}
1319
- op: add
1420
path: /spec/template/spec/containers/0/args/-
1521
value: "--tls-cert=/var/certs/tls.crt"
1622
- op: add
1723
path: /spec/template/spec/containers/0/args/-
1824
value: "--tls-key=/var/certs/tls.key"
1925
- op: add
20-
path: /spec/template/spec/containers/0/env
21-
value: [{"name":"SSL_CERT_DIR", "value":"/var/ca-certs"}]
26+
path: /spec/template/spec/containers/0/args/-
27+
value: "--ca-certs-dir=/var/trusted-cas"

‎openshift/catalogd/manifests/14-deployment-openshift-catalogd-catalogd-controller-manager.yml

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,11 @@ spec:
4646
- --external-address=catalogd-service.openshift-catalogd.svc
4747
- --tls-cert=/var/certs/tls.crt
4848
- --tls-key=/var/certs/tls.key
49+
- --ca-certs-dir=/var/trusted-cas
4950
- --v=${LOG_VERBOSITY}
5051
- --global-pull-secret=openshift-config/pull-secret
5152
command:
5253
- ./catalogd
53-
env:
54-
- name: SSL_CERT_DIR
55-
value: /var/ca-certs
5654
image: ${CATALOGD_IMAGE}
5755
imagePullPolicy: IfNotPresent
5856
livenessProbe:
@@ -83,9 +81,12 @@ spec:
8381
name: cache
8482
- mountPath: /var/certs
8583
name: catalogserver-certs
86-
- mountPath: /var/ca-certs
87-
name: ca-certs
88-
readOnly: true
84+
- mountPath: /var/trusted-cas/ca-bundle.crt
85+
name: trusted-ca-bundle
86+
subPath: ca-bundle.crt
87+
- mountPath: /var/trusted-cas/service-ca.crt
88+
name: service-ca
89+
subPath: service-ca.crt
8990
- mountPath: /etc/containers
9091
name: etc-containers
9192
readOnly: true
@@ -120,21 +121,20 @@ spec:
120121
secret:
121122
optional: false
122123
secretName: catalogserver-cert
123-
- name: ca-certs
124-
projected:
125-
sources:
126-
- configMap:
127-
items:
128-
- key: ca-bundle.crt
129-
path: ca-bundle.crt
130-
name: catalogd-trusted-ca-bundle
131-
optional: false
132-
- configMap:
133-
items:
134-
- key: service-ca.crt
135-
path: service-ca.crt
136-
name: openshift-service-ca.crt
137-
optional: false
124+
- configMap:
125+
items:
126+
- key: ca-bundle.crt
127+
path: ca-bundle.crt
128+
name: catalogd-trusted-ca-bundle
129+
optional: false
130+
name: trusted-ca-bundle
131+
- configMap:
132+
items:
133+
- key: service-ca.crt
134+
path: service-ca.crt
135+
name: openshift-service-ca.crt
136+
optional: false
137+
name: service-ca
138138
- hostPath:
139139
path: /etc/containers
140140
type: Directory

‎openshift/operator-controller/kustomize/overlays/openshift/olmv1-ns/patches/manager_deployment_certs.yaml

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,25 @@
33
value: {"name":"operator-controller-certs", "secret":{"optional":false,"secretName":"operator-controller-cert"}}
44
- op: add
55
path: /spec/template/spec/volumes/-
6-
value: {"name":"ca-certs", "projected": {"sources":[{"configMap":{"optional":false,"name":"trusted-ca-bundle", "items":[{"key":"ca-bundle.crt","path":"ca-bundle.crt"}]}},{"configMap":{"optional":false,"name":"openshift-service-ca.crt", "items":[{"key":"service-ca.crt","path":"service-ca.crt"}]}}]}}
6+
value: {"name":"trusted-ca-bundle", "configMap":{"optional":false,"name":"trusted-ca-bundle", "items":[{"key":"ca-bundle.crt","path":"ca-bundle.crt"}]}}
7+
- op: add
8+
path: /spec/template/spec/volumes/-
9+
value: {"name":"service-ca", "configMap":{"optional":false,"name":"openshift-service-ca.crt", "items":[{"key":"service-ca.crt","path":"service-ca.crt"}]}}
710
- op: add
811
path: /spec/template/spec/containers/0/volumeMounts/-
912
value: {"name":"operator-controller-certs", "mountPath":"/var/certs"}
1013
- op: add
1114
path: /spec/template/spec/containers/0/volumeMounts/-
12-
value: {"name":"ca-certs", "mountPath":"/var/ca-certs", "readOnly": true}
15+
value: {"name":"trusted-ca-bundle", "mountPath":"/var/trusted-cas/ca-bundle.crt", "subPath":"ca-bundle.crt" }
16+
- op: add
17+
path: /spec/template/spec/containers/0/volumeMounts/-
18+
value: {"name":"service-ca", "mountPath":"/var/trusted-cas/service-ca.crt", "subPath":"service-ca.crt" }
1319
- op: add
1420
path: /spec/template/spec/containers/0/args/-
1521
value: "--tls-cert=/var/certs/tls.crt"
1622
- op: add
1723
path: /spec/template/spec/containers/0/args/-
1824
value: "--tls-key=/var/certs/tls.key"
1925
- op: add
20-
path: /spec/template/spec/containers/0/env
21-
value: [{"name":"SSL_CERT_DIR", "value":"/var/ca-certs"}]
26+
path: /spec/template/spec/containers/0/args/-
27+
value: "--ca-certs-dir=/var/trusted-cas"

‎openshift/operator-controller/manifests/20-deployment-openshift-operator-controller-operator-controller-controller-manager.yml

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,11 @@ spec:
4545
- --leader-elect
4646
- --tls-cert=/var/certs/tls.crt
4747
- --tls-key=/var/certs/tls.key
48+
- --ca-certs-dir=/var/trusted-cas
4849
- --v=${LOG_VERBOSITY}
4950
- --global-pull-secret=openshift-config/pull-secret
5051
command:
5152
- /operator-controller
52-
env:
53-
- name: SSL_CERT_DIR
54-
value: /var/ca-certs
5553
image: ${OPERATOR_CONTROLLER_IMAGE}
5654
imagePullPolicy: IfNotPresent
5755
livenessProbe:
@@ -82,9 +80,12 @@ spec:
8280
name: cache
8381
- mountPath: /var/certs
8482
name: operator-controller-certs
85-
- mountPath: /var/ca-certs
86-
name: ca-certs
87-
readOnly: true
83+
- mountPath: /var/trusted-cas/ca-bundle.crt
84+
name: trusted-ca-bundle
85+
subPath: ca-bundle.crt
86+
- mountPath: /var/trusted-cas/service-ca.crt
87+
name: service-ca
88+
subPath: service-ca.crt
8889
- mountPath: /etc/containers
8990
name: etc-containers
9091
readOnly: true
@@ -119,21 +120,20 @@ spec:
119120
secret:
120121
optional: false
121122
secretName: operator-controller-cert
122-
- name: ca-certs
123-
projected:
124-
sources:
125-
- configMap:
126-
items:
127-
- key: ca-bundle.crt
128-
path: ca-bundle.crt
129-
name: operator-controller-trusted-ca-bundle
130-
optional: false
131-
- configMap:
132-
items:
133-
- key: service-ca.crt
134-
path: service-ca.crt
135-
name: openshift-service-ca.crt
136-
optional: false
123+
- configMap:
124+
items:
125+
- key: ca-bundle.crt
126+
path: ca-bundle.crt
127+
name: operator-controller-trusted-ca-bundle
128+
optional: false
129+
name: trusted-ca-bundle
130+
- configMap:
131+
items:
132+
- key: service-ca.crt
133+
path: service-ca.crt
134+
name: openshift-service-ca.crt
135+
optional: false
136+
name: service-ca
137137
- hostPath:
138138
path: /etc/containers
139139
type: Directory

0 commit comments

Comments
 (0)