csiaddons: add support for TLS #172
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bipuladh
force-pushed
the
csi-drivers
branch
from
50a7c52
to
3ea6c94
Compare
bipuladh
changed the title
Adds required permissions Signed-off-by: Bipul Adhikari <[email protected]>
Signed-off-by: Bipul Adhikari <[email protected]>
bipuladh
force-pushed
the
csi-drivers
branch
from
3ea6c94
to
1fd8b72
Compare
6 tasks
bipuladh
commented
Nov 15, 2024
| @@ -0,0 +1,132 @@ | |||
| /* | |||
There was a problem hiding this comment.
As discussed with the team the CSI operator should not be responsible for generation of certificates. ODF operators can generate these certificates.
|
pls excuse I partly understood what the code is doing but don't get the "why". Why should csi-op behave like a trimmed down CertificateAuthority? A CA has much more functionalities like rotation, revocation to name a few in addition to a lot of options in x509 cert. btw, I was OOO during some of csi-op meetings, pls do let me know if this PR premise was already discussed based on #172 (comment) and this PR is being reworked/removed. thanks! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces a controller to approve CSR requests intended for Ceph CSI TLS communications.
Context
To have a secure gRPC communication between the CSI add-ons sidecar and CSI manager we need to create certificates that can be verified by a CA. We use the k8s CSR resource to sign our certificates. Related to: csi-addons/kubernetes-csi-addons#692
Is the change backward compatible?
No
Are there concerns around backward compatibility?
We will move ahead with disabled by default approach so that it doesn't introduce breakages.
Provide any external context for the change, if any.
For example:
Checklist:
guidelines in the developer
guide.
Request
notes
updated with breaking and/or notable changes for the next major release.