You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 18e56a7
Browse filesBrowse the repository at this point in the historyBrowse files
[lb pub endpt] Public endpoint reuse: service cert, front port, live port name
Support a MetalLB LoadBalancer public endpoint with a custom hostname,
certificate and port (RHOSP 17.1 -> RHOSO 18 adoption).
- Service cert: SANs come from the canonical service.GetVHostServerName set
({custom host, short, FQDN}); the custom endpointURL host is added for
public and internal endpoints, a bad endpointURL falls back to the
in-cluster names and is logged. A bring-your-own pod-level cert is taken
from tls.api.<endpoint>.secretName (snapshotted pre-restore at every
EnsureEndpointConfig call site), else one is issued. It applies to the
LoadBalancer public endpoint and the internal endpoint; a Route-backed
public endpoint keeps the operator-issued cert (a custom cert there goes
on the Route via apiOverride.tls.secretName, which is validated only when
a Route exists). Fix the cert cleanup delete target (Service cert, not
Route cert).
- Front port: for a TLS LoadBalancer public endpoint, inject a ports[]
override with the endpointURL port, or else the director legacy port from
lib-common's endpoint.LegacyPublicTLSPorts (legacyServiceName passed in by
each service handler). Injection is skipped for non-TLS or routed
endpoints, non-LoadBalancer Services, services without a legacy entry,
multi-port Services, and while the live port is not yet named after its
endpoint type ("public"), since an override carrying the old
<service>-public name is rejected by the service operator's by-name port
merge before the Service is patched. A watch on managed Services' port
names and type wakes the control plane when the service operator renames
the port. The override Spec is copied before it is mutated.
- Routes: CreateRoute reads the target port name from the live Service
instead of assuming it equals the object name. A user endpointURL is kept
when a Route is replaced by a LoadBalancer.
- Glance: return the requeue of the API that asked for it, and do not let a
later endpoint's valid secret overwrite CustomTLSReady False set earlier
in the same reconcile.
Jira: OSPRH-39364
Jira: OSPRH-39366
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: Martin Schuppert <mschuppert@redhat.com>
0 commit comments