helm: also mount kvstoremesh-specific certificate into cilium-operator #34295
Conversation
In commit c464e66 the kvstoremesh-specific certificate was mounted into cilium-agent. Since the recent addition of endpointslicesync the operator needs to connect to clustermesh components too meaning that the clustermesh config and secrets should be mirrored to the operator deployment as well. With the addition of the kvstoremesh secrets to the agent and not the operator this resulted into the code connecting to the kvstoremesh not working in the operator context which is now the default as well. Signed-off-by: Arthur Outhenin-Chalandre <arthur@cri.epita.fr>
|
/test |
|
@cilium/sig-clustermesh Could you take a look as well? |
There was a problem hiding this comment.
Thanks for the fix! This is definitely an indicator that it is time to extract that configuration into a reusable template, as otherwise it will diverge over time.
Before approving, I'd like to still figure out why the E2E test supposed to exercise this feature didn't fail, given that the operator cannot connect to kvstoremesh.
|
Thanks for the review!
Uh indeed that's true, my assumption was that kvstoremesh and endpointslicesync was not a covered scenario but that's not true so there must be something wrong with the e2e tests indeed :/. Will take a look! |
I found the issue. I'll open a PR shortly, after double checking that the fix works as expected. |
|
#34455 should fix it. |
There was a problem hiding this comment.
The fix looks good to me, let's get it merged, and then I'll rebase the connectivity test fix on top of it. I've additionally marked this PR for backport to v1.16, as the original agent change had been included there (although it was not yet strictly enforced to prevent issues on upgrade, and the operator is less prone due to the limited number of replicas).
Then, we can extract the configuration into a reusable template as a followup item.
In commit c464e66 the kvstoremesh-specific certificate was mounted into cilium-agent. Since the recent addition of endpointslicesync the operator needs to connect to clustermesh components too meaning that the clustermesh config and secrets should be mirrored to the operator deployment as well. With the addition of the kvstoremesh secrets to the agent and not the operator this resulted into the code connecting to the kvstoremesh not working in the operator context which is now the default as well.