rhobs / rhobs/observability-operator
MonitoringStack.spec.prometheusConfig.webTLSConfig.certificateAuthority: only secret possible, but configmap provided by OpenShift
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 51
- Forks
- 90
- Avg merge
- 5d 15h
- Merged PRs (30d)
- 22
Description
Using OO on OpenShift I'd like to make use of the "service serving certificates", where a key and cert are generated by setting an annotation on the service. The service signer's CA however is by default exported only in ConfigMaps. So my options here are:
- read CA-file from CM and save it into a secret: will break at next automatic rotation
- the same, but in a daily cronjob: cumbersome, need to create adapted SA and RBAC as well in order not to create new security issues
IMHO the ideal solution to this would be to be able to specify a configMap (openshift-service-ca.crt) containing a key (service-ca.crt) whose value is the CA chain.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the MonitoringStack.spec.prometheusConfig.webTLSConfig.certificateAuthority definition and the existing Secret-based handling. Review how a ConfigMap key such as openshift-service-ca.crt is represented, then verify that the requested ConfigMap source and service-ca.crt key are accepted without requiring manual copying during CA rotation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- infrastructure
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100