From df76cf3b4f08cc54ee05c14917ca6bac4cdedf2a Mon Sep 17 00:00:00 2001 From: Lukasz Szaszkiewicz Date: Tue, 2 Apr 2024 20:12:32 +0200 Subject: [PATCH] operator/certrotationcontroller/certrotationcontroller: make use of UseSecretUpdateOnly UseSecretUpdateOnly is intended as a short term hack for a very specific use case, and it works in tandem with a particular carry patch applied to the openshift kube-apiserver. (https://github.com/openshift/kubernetes/pull/1924) we will remove this when we migrate all of the affected secret objects to their intended type: https://issues.redhat.com/browse/API-1800 in short tls secrets used by this operator are reconciled by multiple controllers at the same time without any coordination. the issue is that the secret's crypto material can be regenerated, which has serious consequences for the platform as it can break external clients and the cluster itself. --- .../certrotationcontroller/certrotationcontroller.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkg/operator/certrotationcontroller/certrotationcontroller.go b/pkg/operator/certrotationcontroller/certrotationcontroller.go index f4a6954ed..d30c54a0b 100644 --- a/pkg/operator/certrotationcontroller/certrotationcontroller.go +++ b/pkg/operator/certrotationcontroller/certrotationcontroller.go @@ -95,6 +95,7 @@ func newCertRotationController( Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(), Client: secretsGetter, EventRecorder: eventRecorder, + UseSecretUpdateOnly: true, }, certrotation.CABundleConfigMap{ Namespace: operatorclient.OperatorNamespace, @@ -119,10 +120,11 @@ func newCertRotationController( CertCreator: &certrotation.SignerRotation{ SignerName: "kube-csr-signer", }, - Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets(), - Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(), - Client: secretsGetter, - EventRecorder: eventRecorder, + Informer: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets(), + Lister: kubeInformersForNamespaces.InformersFor(operatorclient.OperatorNamespace).Core().V1().Secrets().Lister(), + Client: secretsGetter, + EventRecorder: eventRecorder, + UseSecretUpdateOnly: true, }, eventRecorder, &certrotation.StaticPodConditionStatusReporter{OperatorClient: operatorClient},