search

openshift / cluster-image-registry-operator

The image registry operator installs+maintains the internal registry on a cluster
Apache License 2.0
58 stars 123 forks source link

HOSTEDCP-2019: Use Client Cert Auth for ARO HCP deployments #1131

Closed bryan-cox closed 3 weeks ago

bryan-cox commented 1 month ago

Use Client Certificate Authentication for ARO HCP deployments. HyperShift will pass the needed environment variables for this authentication method: ARO_HCP_MI_CLIENT_ID, ARO_HCP_TENANT_ID, and ARO_HCP_CLIENT_CERTIFICATE_PATH.

openshift-ci[bot] commented 1 month ago

Skipping CI for Draft Pull Request. If you want CI signal for your change, please convert it to an actual PR. You can still manually trigger a test run with /test all

openshift-ci-robot commented 1 month ago

@bryan-cox: This pull request references HOSTEDCP-1994 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target only the "4.18.0" version, but multiple target versions were set.

In response to [this](https://github.com/openshift/cluster-image-registry-operator/pull/1131): >Refactor to use the Azure SDK for Go's default credential chain function, NewDefaultAzureCredential. Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fcluster-image-registry-operator). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
openshift-ci-robot commented 1 month ago

@bryan-cox: This pull request references HOSTEDCP-2019 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target only the "4.18.0" version, but multiple target versions were set.

In response to [this](https://github.com/openshift/cluster-image-registry-operator/pull/1131): >Refactor to use the Azure SDK for Go's default credential chain function, NewDefaultAzureCredential. Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fcluster-image-registry-operator). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
bryan-cox commented 1 month ago

/retest

bryan-cox commented 1 month ago

/test e2e-azure-operator

flavianmissi commented 1 month ago

Hi @bryan-cox, are you planning on addressing this comment? Relatedly, if your preference would be to change the entire auth path for Azure, will you be available in the future to aid investigation of potential bugs related to this change?

Additionally, what is the automated test plan for this change, if any?

flavianmissi commented 1 month ago

worth mentioning that the e2e-*-operator tests can be quite flaky and are also failing in a different way each run (sigh). the e2e-hypershift failures look unrelated to me.

/test e2e-aws-operator /test e2e-azure-operator

bryan-cox commented 1 month ago

/test e2e-hypershift

openshift-ci-robot commented 4 weeks ago

@bryan-cox: This pull request references HOSTEDCP-2019 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target only the "4.18.0" version, but multiple target versions were set.

In response to [this](https://github.com/openshift/cluster-image-registry-operator/pull/1131): >Use Client Certificate Authentication for ARO HCP deployments. HyperShift will pass the needed environment variables for this authentication method: ARO_HCP_MI_CLIENT_ID, ARO_HCP_TENANT_ID, and ARO_HCP_CLIENT_CERTIFICATE_PATH. Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fcluster-image-registry-operator). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
bryan-cox commented 4 weeks ago

I tested this PR with the following PRs and was able to deploy an Azure Hosted Cluster from an AKS management cluster:

bryan-cox commented 3 weeks ago

/retest

openshift-ci[bot] commented 3 weeks ago

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
flavianmissi commented 3 weeks ago

/lgtm

openshift-ci[bot] commented 3 weeks ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, flavianmissi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/openshift/cluster-image-registry-operator/blob/master/OWNERS)~~ [flavianmissi] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
xenolinux commented 3 weeks ago

/label docs-approved

sferich888 commented 3 weeks ago

/label px_approved

openshift-ci[bot] commented 3 weeks ago

@sferich888: The label(s) /label px_approved cannot be applied. These labels are supported: acknowledge-critical-fixes-only, platform/aws, platform/azure, platform/baremetal, platform/google, platform/libvirt, platform/openstack, ga, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, px-approved, docs-approved, qe-approved, no-qe, downstream-change-needed, rebase/manual, cluster-config-api-changed, approved, backport-risk-assessed, bugzilla/valid-bug, cherry-pick-approved, jira/valid-bug, staff-eng-approved. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

In response to [this](https://github.com/openshift/cluster-image-registry-operator/pull/1131#issuecomment-2435644612): >/label px_approved > Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
sferich888 commented 3 weeks ago

/label px-approved

xiuwang commented 3 weeks ago

/label qe-approved

openshift-ci-robot commented 3 weeks ago

@bryan-cox: This pull request references HOSTEDCP-2019 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target only the "4.18.0" version, but multiple target versions were set.

In response to [this](https://github.com/openshift/cluster-image-registry-operator/pull/1131): >Use Client Certificate Authentication for ARO HCP deployments. HyperShift will pass the needed environment variables for this authentication method: ARO_HCP_MI_CLIENT_ID, ARO_HCP_TENANT_ID, and ARO_HCP_CLIENT_CERTIFICATE_PATH. Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fcluster-image-registry-operator). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
openshift-bot commented 3 weeks ago

[ART PR BUILD NOTIFIER]

Distgit: ose-cluster-image-registry-operator This PR has been included in build ose-cluster-image-registry-operator-container-v4.18.0-202410251041.p0.g4c7e4ef.assembly.stream.el9. All builds following this will include this PR.