Merge https://github.com/kubernetes/cloud-provider-openstack:release-1.35 (3a512e7) into release-4.22 - #431
Conversation
…ubernetes#3178) Co-authored-by: Yi-Ying Tan <yi-ying.tan.ext@nokia.com>
The Keystone authentication webhook handler writes the raw bearer token submitted in every TokenReview to the log stream when verbosity is 4 or higher. It is pretty common to set this level (-v=4) while e.g. debugging. Additionally, it is common for logs to be sent to a central store, with different access controls than the main cluster. A user with access to this store can use the captured token for replay attacks for any user that authenticates against the cluster until the token's TTL. Stop logging the token and avoid all of this. The combo of user, any error and the usual timestamp etc. should be more than sufficient. Signed-off-by: Stephen Finucane <stephenfin@redhat.com> Co-authored-by: Stephen Finucane <stephenfin@redhat.com>
Adding myself to the OWNERS file. I'm no stranger to CPO, having reviewed a number of patches already [1], and as noted a comment [2] I intend to increase my participation to the project. [1] https://github.com/kubernetes/cloud-provider-openstack/pulls?q=is%3Apr+involves%3Amandre [2] kubernetes#3166 (comment) Co-authored-by: Martin André <m.andre@redhat.com>
…netes#3189) * magnum-auto-healer: Add certificate validation The controller always sets InsecureSkipVerify. The two modern Magnum drivers in use today both use CAPI and thus kubeadm under the hood. kubeadm injects nodes internal IPs as SANs into the certs it generates, meaning certificate validation should pass when using the same root cert. Thus, we add two new configuration knobs: one to point to a CA file to use (defaulting to the well-known location k8s mounts certs to) and another to explicitly disable verification as an escape hatch. Signed-off-by: Stephen Finucane <stephenfin@redhat.com> Assisted-by: Claude Sonnet 4.8 <noreply@anthropic.com> * magnum-auto-healer: Document Endpoint health check parameters Add a parameter reference table covering all Endpoint check options, including the newly added ca-file and tls-insecure fields. Signed-off-by: Stephen Finucane <stephenfin@redhat.com> * magnum-auto-healer: Respect the unhealthy-duration grace period Signed-off-by: Stephen Finucane <stephenfin@redhat.com> --------- Signed-off-by: Stephen Finucane <stephenfin@redhat.com> Co-authored-by: Stephen Finucane <stephenfin@redhat.com>
Co-authored-by: kayrus <kay.diam@gmail.com>
Co-authored-by: kayrus <kay.diam@gmail.com>
Co-authored-by: kayrus <kay.diam@gmail.com>
Co-authored-by: pýrus <kayrus@users.noreply.github.com>
…rvices (kubernetes#2603) * POC of TargetNodeLabels selector on OpenStack LB * Fix type errors * Update implementation of getKeyValuePropertiesFromServiceAnnotation * gofmt -w -s ./pkg * Polish the code and add documentation --------- Co-authored-by: Ririko Nakamura <ririko.nakamura@outlook.com> Co-authored-by: kayrus <kay.diam@gmail.com>
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
…ntainer image to be consistent with ART for 4.17
… image to be consistent with ART for 4.17
…onsistent with ART for 4.17
This causes issue with vendoring.
…clouds.yaml (kubernetes#2911) * handle boolean values correctly when reading from secrets Previously, the validator failed when attempting to parse boolean fields like `UseClouds` in `AuthOpts` from secrets. This was due to secrets being stored as strings, leading to a type mismatch. Added logic to correctly parse string representations of booleans to match the expected type in the struct. (cherry picked from commit f3e4fdb) * Implement clouds.yaml support and make auth params optional Enables reading credentials/config from clouds.yaml when UseClouds is set. Mark Region and AuthURL as optional. (cherry picked from commit 1d66e56)
Co-authored-by: pýrus <kayrus@users.noreply.github.com>
Signed-off-by: moonek <gghonor@naver.com> Signed-off-by: Carlos da Silva <ces.eduardo98@gmail.com>
…ntainer image to be consistent with ART for 4.21 Reconciling with https://github.com/openshift/ocp-build-data/tree/4fbe3fab45239dc4be6f5d9d98a0bf36e0274ec9/images/ose-openstack-cloud-controller-manager.yml
* update test deps * add debug logging on deployment failure, update nfs image --------- Co-authored-by: Jesse Haka <haka.jesse@gmail.com>
…ntainer image to be consistent with ART for 4.22 Reconciling with https://github.com/openshift/ocp-build-data/tree/087d1930e36b609f77d73bd8a313d85c940cff4d/images/ose-openstack-cloud-controller-manager.yml
Add Ella and update the cloud team members. Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
…ntainer image to be consistent with ART for 4.22 Reconciling with https://github.com/openshift/ocp-build-data/tree/56cb39ad358cdec1db7c84ea1919fe8849c2550b/images/ose-openstack-cloud-controller-manager.yml
Signed-off-by: Stephen Finucane <stephenfin@redhat.com>
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci
Bot
added
the
needs-ok-to-test
|
Hi @shiftstack-merge-bot[bot]. Thanks for your PR. I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: shiftstack-merge-bot[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
14 participants
This is an automated rebase PR generated by RebaseBot.
Summary
https://github.com/kubernetes/cloud-provider-openstack:release-1.35https://github.com/openshift/cloud-provider-openstack:release-4.22Logs
View job log