The serving-operator incorrectly re-initialize knative-ingress-gateway configuration

[chunlongliang-ibm]

I edit the gateway yaml to enable TLS
kubectl edit gateway -n knative-serving knative-ingress-gateway -o yaml
by adding
tls:
mode: SIMPLE
privateKey: /etc/istio/ingressgateway-certs/tls.key
serverCertificate: /etc/istio/ingressgateway-certs/tls.crt

However, after sometime, the gateway configuration is reinitialized and my update is removed.

Steps to recreate the problem:

1. Modify Gateway

oc edit gateway knative-ingress-gateway --namespace knative-serving

e.g.

BEFORE:

• hosts:
  • '*'
    port:
    name: https

AFTER:

• hosts:
  • 'test'
    port:
    name: https

2. Restart one of serving pods

e.g.

oc delete pod -n knative-serving autoscaler-64c549bcf4-vnq6h

3. Verify Gateway again

Modified Gateway is initialized (i.e., 'test' becomes "*" again).

[garron]

In the case of overriding the selector on the Gateway, a means is provided as part of the KnativeServing custom resource spec. Would a similar capability be useful here? Or a means to indicate that the operator shouldn't alter the gateway?

It seems challenging to provide consistent/reliable behavior while supporting both manual overrides to the Gateway and overrides configured inside the KnativeServing resource.

[houshengbo]

@chunlongliang-ibm
Is this config platform-specific, or your personal customization of your cluster?

You have a discussion going on with platform-specific configurations at #122. There are multiple options as candidates to implement. Mutating webhook is one of them.

[chunlongliang-ibm]

@houshengbo I deploy knative serving with serving-operator in openshift (OKD), and I also need TLS enabled (and I follow the instruction to modify gateway configuration in https://github.com/knative/docs/blob/master/docs/serving/using-a-tls-cert.md). I think it is OK for my use case if serving operator implementation has option to edit gateway configuration.

[houshengbo]

@chunlongliang-ibm I guess I found a better solution to the case of knative-ingress-gateway config.

As you can see here:
https://github.com/knative/serving-operator/blob/master/config/crds/serving_v1alpha1_knativeserving_crd.yaml#L54

knative-ingress-gateway is valid property in the CRD, so when you apply the CR, you can config your knative-ingress-gateway in the CR before applying it. Then knative-ingress-gateway will be propagated into your environment.

[ghost]

It seems that we can config the "selector" but not "servers" config of knative-ingress-gateway.

[aliok]

#302 might be the solution for this ticket.