search

tnozicka / openshift-acme

ACME Controller for OpenShift and Kubernetes Cluster. (Supports e.g. Let's Encrypt)
Apache License 2.0
319 stars 116 forks source link

Avoid secret collisions #74

Closed mhutter closed 4 years ago

mhutter commented 6 years ago

This patch adds support for the kubernetes.io/tls-acme-secret-name annotation. When set, the secret used to store the TLS certificate will be named after its value.

If unset, the name of the route will be used instead.

Example usage:

oc annotate route/myapp \
    kubernetes.io/tls-acme="true" \
    kubernetes.io/tls-acme-secret-name="myapp-tls-cert"

This will obtain a TLS certificate and store it in a secret called myapp-tls-cert.

Fixes: #64

Add the option to configure the TLS secret name via an annotation.
tobru commented 6 years ago

@tnozicka Would you mind to have a look at this PR as this solves an issue which hits us from time to time (and others as well).

tnozicka commented 6 years ago

apologies, this slipped thought the cracks for me. I'd prefer to have the secret name configurable by an annotation on the Route, not to have a global prefix.

mhutter commented 5 years ago

Finally came around looking into this again, it turned out to be much easier to implement than expected.

@tnozicka please have a look again :-)

openshift-merge-robot commented 5 years ago

/retest

openshift-merge-robot commented 5 years ago

/retest

tnozicka commented 5 years ago

/ok-to-test

tnozicka commented 5 years ago

/retest

openshift-bot commented 5 years ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close. Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

openshift-bot commented 5 years ago

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten. Rotten issues close after an additional 30d of inactivity. Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten /remove-lifecycle stale

LorbusChris commented 5 years ago

friendly ping @mhutter /remove-lifecycle rotten

mhutter commented 5 years ago

@LorbusChris thanks, that totally dropped off my Radar. Will look into it after my holiday

openshift-ci-robot commented 5 years ago

@mhutter: The following test failed, say /retest to rerun them all:

Test name Commit Details Rerun command
ci/prow/e2e f20d6dc199a36a5daee4154686ae337c7b0ce2e8 link /test e2e

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
mhutter commented 5 years ago

/retest

mhutter commented 5 years ago

@LorbusChris fixed, tests are passing, PR is ready for review

LorbusChris commented 5 years ago

thank you @mhutter, looks great! Not sure if the bot listens to me here on this repo, but I /approve

leaving the lgtm to @tnozicka

openshift-ci-robot commented 5 years ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: LorbusChris, mhutter To complete the pull request process, please assign tnozicka You can assign the PR to them by writing /assign @tnozicka in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/tnozicka/openshift-acme/blob/master/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
mhutter commented 5 years ago

Apparently he doesn't :P so let's

/assign @tnozicka

openshift-bot commented 4 years ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale. Stale issues rot after an additional 30d of inactivity and eventually close. Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

mhutter commented 4 years ago

Closing this in favor of the "v2" rewrite