helm mode: add implementation for clustermesh connect #1628
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
asauber
force-pushed
the
pr/asauber/helm-mode-clustermesh
branch
from
8aaa5a8
to
09b4047
Compare
|
Converting to draft to fix |
asauber
force-pushed
the
pr/asauber/helm-mode-clustermesh
branch
from
ff8ad73
to
8b5f512
Compare
giorio94
reviewed
May 17, 2023
|
I've tested this PR trying to connect more than two clusters, and it seems to overwrite the previous configuration rather than adding the new cluster (as the legacy implementation did). |
|
Great suggestions all, working on it |
squeed
reviewed
May 24, 2023
squeed
reviewed
May 24, 2023
squeed
reviewed
May 24, 2023
tklauser
added
needs-rebase
asauber
force-pushed
the
pr/asauber/helm-mode-clustermesh
branch
from
8b5f512
to
2ade061
Compare
asauber
force-pushed
the
pr/asauber/helm-mode-clustermesh
branch
from
7aebb66
to
0ff0859
Compare
giorio94
requested changes
Jun 5, 2023
There was a problem hiding this comment.
Overall, the PR looks OK to me, I've left a few minor comments inline. Additionally, there seems to be something wrong with the merging logic, since the cilium clustermesh connect command fails with Error: Unable to connect cluster: existing clustermesh.config.cluters array is invalid when issued a second time.
asauber
force-pushed
the
pr/asauber/helm-mode-clustermesh
branch
from
0ff0859
to
ec41572
Compare
asauber
force-pushed
the
pr/asauber/helm-mode-clustermesh
branch
from
ec41572
to
7d1f94a
Compare
giorio94
approved these changes
Jun 7, 2023
maintainer-s-little-helper
bot
added
the
ready-to-merge
tklauser
removed
the
ready-to-merge
maintainer-s-little-helper
bot
added
the
ready-to-merge
asauber
added
dont-merge/blocked
|
I pushed this rebased commit ce4d16c but GitHub PR's are currently having issues and it has not shown up here. |
asauber
force-pushed
the
pr/asauber/helm-mode-clustermesh
branch
from
82eedfc
to
279eaf1
Compare
asauber
force-pushed
the
pr/asauber/helm-mode-clustermesh
branch
from
279eaf1
to
ce4d16c
Compare
tklauser
reviewed
Jun 8, 2023
asauber
removed
the
dont-merge/bad-bot
Signed-off-by: Andrew Sauber <andrew.sauber@isovalent.com>
Previously, if CA certificates did not match among clusters during clustermesh connect, we would bail out of the connect process. Now, upon a mismatch, present a warning to the user that multicluster features will be degraded, and use the per-cluster PKI configuration in the Helm chart to configure key material for each cluster. Signed-off-by: Andrew Sauber <andrew.sauber@isovalent.com>
asauber
force-pushed
the
pr/asauber/helm-mode-clustermesh
branch
from
ce4d16c
to
0abeec8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add an implementation for
clustermesh connectusing Helm.Like the classic mode implementation, we autodetect the
clustermesh-apiserverIPs and port numbers in order to write theendpoints:configuration. However, rather than generate the certificates in-process, we rely on thecronJob(certgen) mode of the Helm chart to generate (and re-generate) all of the ClusterMesh related certs.As a first pass, we support the same set of flags as the classic mode.
A second pass PR will include all
--helm-*flags, which will allow the use ofextraDnsNamesfor the purpose of Service resolvability, and the use of other PKI modes.Fixes: #1620