Closed erikgb closed 7 months ago
@erikgb just for context, do you know why the extra reconciliations and patches keep happening? I would expect that the noop patches do not trigger new reconciliations.
@inteon Neither the JKS nor PKCS#12 format is idempotent, so when the check for keys never match it will patch the target with changes. I really don't know why this didn't happen with JKS only. The added tests only fail on PKCS#12 without the fix...
@erikgb I think we explicitly try to make the JKS encoded value deterministic: https://github.com/cert-manager/trust-manager/blob/54e8b096c2faf5e2f11454739d2abd4f5a691f75/pkg/bundle/sync.go#L191-L193
@erikgb It looks like the pkcs#12 format is using a random salt, which makes it non-idempotent. see https://github.com/SSLMate/go-pkcs12/blob/v0.4.0/pkcs12.go#L704C5-L706
Now that I fully understand the cause of this issue and why it occurs for pkcs#12 & not for JKS, I'm more than happy to merge this. /approve /lgtm
[APPROVALNOTIFIER] This PR is APPROVED
This pull-request has been approved by: inteon
The full list of commands accepted by this bot can be found here.
The pull request process is described here
/cherrypick release-0.7
@erikgb: new pull request created: #265
When checking target keys using managed fields, we must also check
binaryData
field in target configmaps.Fixes #259