Repository navigation
Use real per-pool TSIG keys in shared mode - #607
openshift-merge-bot[bot] merged 3 commits into
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Comment |
omersch381
changed the title
080c672 to
6bec976
Compare
|
Build succeeded (check pipeline). ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 58m 20s |
6bec976 to
deb69dc
Compare
|
Build succeeded (check pipeline). ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 58m 49s |
deb69dc to
e9523f0
Compare
Leave the default pool unsigned outside AZ-aware mode and register each non-default pool key with scope POOL and its actual pool UUID. Read and watch the key ID mapping in both modes when generating pools.yaml. Preserve existing key material when repairing pool bindings and retain the legacy shared DB key during migration. Wait for BIND to load the new Secrets before publishing key IDs, and reconcile Secrets while StatefulSets are pending to avoid a bootstrap dependency cycle. Keep nameserver TSIG IDs limited to AZ-aware mode for compatibility with legacy Designate YAML adapters. Refresh completed pool discovery Jobs when required pools are missing, read only the current Job's pod logs, and exclude unregistered dry-run pools without real UUIDs. Make the merged named.conf copy owner-writable so non-root BIND init can append the TSIG include after copying read-only Secret files. Add unit and functional coverage for default pool behavior, per-pool identities, migration readiness, key binding repair, legacy YAML compatibility, discovery refresh and init file permissions. Update multipool KUTTL assertions for per-pool Secret creation and cleanup. Signed-off-by: Omer <oschwart@oschwart-thinkpadp16vgen1.rmtes.csb>
e9523f0 to
64f9680
Compare
Honor requeue results from required producer Secret lookups so reconciliation stops before creating configuration or deployments. Wait for InputReady=False before asserting that configuration Secrets are absent. Reference the TransportURL Secret in the producer fixture and add deterministic coverage for each missing input Secret.
omersch381
changed the title
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 17m 41s |
|
recheck |
|
Build succeeded (check pipeline). ✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 17m 51s Warning: |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: beagles, omersch381 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
f25c0c4
into
openstack-k8s-operators:main
Leave the default pool unsigned outside AZ-aware mode and register each non-default pool key with scope POOL and its actual pool UUID. Read and watch the key ID mapping in both modes when generating pools.yaml.
Preserve existing key material when repairing pool bindings and retain the legacy shared DB key during migration. Wait for BIND to load the new Secrets before publishing key IDs, and reconcile Secrets while StatefulSets are pending to avoid a bootstrap dependency cycle.
Add unit and functional coverage for default pool behavior, per-pool identities, migration readiness and key binding repair. Update multipool KUTTL assertions for per-pool Secret creation and cleanup.