openshift-ci-robot
commented
2 weeks ago @stephenfin: This pull request references OSASINFRA-3657 which is a valid jira issue.
In response to [this](https://github.com/openshift/installer/pull/9194):
>If a CA bundle is required to talk to your OpenStack then obviously all
>services that talk to the cloud need to have both credentials and said bundle.
>Currently, these users can get their credentials via cloud credential operator,
>but they need to source their CA bundle from elsewhere (typically by extracting
>it from the cloud controller manager's configuration). This makes configuration
>of services more complicated than necessary.
>
>Continue the resolution of the issue by storing the CA bundle, if any, in the
>root secret on OpenStack. When coupled with the changes introduced in
>openshift/cloud-credential-operator#780, this allows us to dole out the bundle
>to anyone who asks for it via a `CredentialsRequest`.
>
>While we're here, we also tweak the configuration for the cloud provider to (a)
>start generating the configuration file in the new format expected by
>cluster-cloud-controller-manager-operator and (b) stop generating an old secret
>that only the old, now-removed in-tree OpenStack cloud provider needed and
>used.
>
Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Finstaller). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
openshift-ci[bot]
stephenfin
If a CA bundle is required to talk to your OpenStack then obviously all services that talk to the cloud need to have both credentials and said bundle. Currently, these users can get their credentials via cloud credential operator, but they need to source their CA bundle from elsewhere (typically by extracting it from the cloud controller manager's configuration). This makes configuration of services more complicated than necessary.
Continue the resolution of the issue by storing the CA bundle, if any, in the root secret on OpenStack. When coupled with the changes introduced in openshift/cloud-credential-operator#780, this allows us to dole out the bundle to anyone who asks for it via a
CredentialsRequest.While we're here, we also tweak the configuration for the cloud provider to (a) start generating the configuration file in the new format expected by
cluster-cloud-controller-manager-operatorand (b) stop generating an old secret that only the old, now-removed in-tree OpenStack cloud provider needed and used.