Skip to content

OLS-1775: Postgres reconciliation on certificate rotation. #998

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

OLS-1775: Postgres reconciliation on certificate rotation. #998

wants to merge 1 commit into from

Conversation

@sriroopar
Copy link
Contributor

@sriroopar sriroopar commented Sep 23, 2025 •
edited
Loading

Description

Functionality has been added in order to ensure that the reconciliation happens in the postgres pod by watching the config for deletion of ca certs. This will allow the e2e test to run successfully.

Type of change

  • Refactor
  • New feature
  • Bug fix
  • CVE fix
  • Optimization
  • Documentation Update
  • Configuration Update
  • Bump-up dependent library

Related Tickets & Documents

Checklist before requesting a review

  • I have performed a self-review of my code.
  • PR has passed all pre-merge test jobs.
  • If it is a core feature, I have added thorough tests.

Testing

  • Please provide detailed steps to perform tests related to this code change.
    • Build an operator image with changes.
    • Deployed the image, applied an olsconfig with postgres cache settings.
    • Put in a request to the OLS service, and confimed entry in cache table.
    • Deleted signing key using oc delete secret/signing-key -n openshift-service-ca
    • Waited for deployments to restart and the service to become available. ( takes more than 5 mins).
    • Put in a new request to the service.
    • Confirmed contents of both requests and also the successful PVC mount in new pod, confiming complete reconciliation.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 23, 2025
@openshift-ci-robot
Copy link

openshift-ci-robot commented Sep 23, 2025 •
edited by openshift-ci bot
Loading

@sriroopar: This pull request references OLS-1775 which is a valid jira issue.

In response to this:

Description

Functionality has been added in order to ensure that the reconciliation happens in the postgres pod by watching the config for deletion of ca certs. This will allow the e2e test to run successfully.

Type of change

  • Refactor
  • New feature
  • Bug fix
  • CVE fix
  • Optimization
  • Documentation Update
  • Configuration Update
  • Bump-up dependent library

Related Tickets & Documents

Checklist before requesting a review

  • I have performed a self-review of my code.
  • PR has passed all pre-merge test jobs.
  • If it is a core feature, I have added thorough tests.

Testing

  • Please provide detailed steps to perform tests related to this code change.
    Functionality was verified by watching reconciliation activity when ca cert was intentionally deleted.

  • How were the fix/results from this change verified? Please provide relevant screenshots or results.

The fix was verified by deleting the olsconfig-service-ca signing-key certificate, and the pods were observed for rollouts with updated cert.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci bot requested review from bparees and xrajesh September 23, 2025 19:01
@sriroopar
Copy link
Contributor Author

sriroopar commented Sep 24, 2025

/retest

3 similar comments
@sriroopar
Copy link
Contributor Author

sriroopar commented Sep 24, 2025

/retest

@sriroopar
Copy link
Contributor Author

sriroopar commented Sep 24, 2025

/retest

@sriroopar
Copy link
Contributor Author

sriroopar commented Sep 24, 2025

/retest

@sriroopar
Copy link
Contributor Author

sriroopar commented Sep 29, 2025

/test bundle-e2e-4-18

@openshift-ci-robot
Copy link

openshift-ci-robot commented Oct 1, 2025 •
edited by openshift-ci bot
Loading

@sriroopar: This pull request references OLS-1775 which is a valid jira issue.

In response to this:

Description

Functionality has been added in order to ensure that the reconciliation happens in the postgres pod by watching the config for deletion of ca certs. This will allow the e2e test to run successfully.

Type of change

  • Refactor
  • New feature
  • Bug fix
  • CVE fix
  • Optimization
  • Documentation Update
  • Configuration Update
  • Bump-up dependent library

Related Tickets & Documents

Checklist before requesting a review

  • I have performed a self-review of my code.
  • PR has passed all pre-merge test jobs.
  • If it is a core feature, I have added thorough tests.

Testing

  • Please provide detailed steps to perform tests related to this code change.
    Functionality was verified by watching reconciliation activity when ca cert was intentionally deleted.

  • How were the fix/results from this change verified? Please provide relevant screenshots or results.

The fix was verified by deleting the olsconfig-service-ca signing-key certificate/ olsconfig ca.crt configmap, and the pods were observed for rollouts with updated cert.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@sriroopar sriroopar force-pushed the postgres-cert-rotation branch 2 times, most recently from 02cf600 to 3162eff Compare October 1, 2025 12:58
@syedriko
Copy link
Contributor

syedriko commented Oct 13, 2025

@sriroopar could you squash the commits, please?

@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 13, 2025
@sriroopar sriroopar force-pushed the postgres-cert-rotation branch from 6b9f4af to ca97db2 Compare October 13, 2025 17:25
@openshift-ci
Copy link

openshift-ci bot commented Oct 13, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign bparees for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 13, 2025
@sriroopar sriroopar force-pushed the postgres-cert-rotation branch from 439a87e to ca97db2 Compare October 13, 2025 17:36
@openshift-merge-robot openshift-merge-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Oct 13, 2025
@sriroopar sriroopar force-pushed the postgres-cert-rotation branch from 4f9c62c to ca97db2 Compare October 13, 2025 18:04
@openshift-merge-robot openshift-merge-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Oct 13, 2025
@sriroopar
Copy link
Contributor Author

sriroopar commented Oct 13, 2025

/retest

1 similar comment
@sriroopar
Copy link
Contributor Author

sriroopar commented Oct 13, 2025

/retest

@sriroopar sriroopar force-pushed the postgres-cert-rotation branch from 7bfce63 to e1f4b37 Compare October 13, 2025 20:01
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 13, 2025
@sriroopar sriroopar force-pushed the postgres-cert-rotation branch from e1f4b37 to 07eb78c Compare October 13, 2025 20:17
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 13, 2025
@sriroopar sriroopar force-pushed the postgres-cert-rotation branch from 07eb78c to 3aa1f4a Compare October 13, 2025 20:21
syedriko
syedriko reviewed Oct 14, 2025
View reviewed changes
syedriko
syedriko reviewed Oct 14, 2025
View reviewed changes
syedriko
syedriko reviewed Oct 14, 2025
View reviewed changes
syedriko
syedriko reviewed Oct 14, 2025
View reviewed changes
syedriko
syedriko reviewed Oct 14, 2025
View reviewed changes
syedriko
syedriko reviewed Oct 14, 2025
View reviewed changes
syedriko
syedriko reviewed Oct 14, 2025
View reviewed changes
syedriko
syedriko reviewed Oct 14, 2025
View reviewed changes
syedriko
syedriko reviewed Oct 14, 2025
View reviewed changes
syedriko
syedriko reviewed Oct 14, 2025
View reviewed changes
@syedriko
Copy link
Contributor

syedriko commented Oct 15, 2025

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 15, 2025
@sriroopar sriroopar force-pushed the postgres-cert-rotation branch from 82a858d to 41e0fd8 Compare October 15, 2025 02:35
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 15, 2025
@syedriko
Copy link
Contributor

syedriko commented Oct 15, 2025

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 15, 2025
xrajesh
xrajesh reviewed Oct 29, 2025
View reviewed changes
xrajesh
xrajesh reviewed Oct 29, 2025
View reviewed changes
xrajesh
xrajesh reviewed Oct 29, 2025
View reviewed changes
xrajesh
xrajesh reviewed Oct 29, 2025
View reviewed changes
@openshift-ci openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Nov 3, 2025
@openshift-ci
Copy link

openshift-ci bot commented Nov 3, 2025

New changes are detected. LGTM label has been removed.

@openshift-ci-robot
Copy link

openshift-ci-robot commented Nov 3, 2025 •
edited by openshift-ci bot
Loading

@sriroopar: This pull request references OLS-1775 which is a valid jira issue.

In response to this:

Description

Functionality has been added in order to ensure that the reconciliation happens in the postgres pod by watching the config for deletion of ca certs. This will allow the e2e test to run successfully.

Type of change

  • Refactor
  • New feature
  • Bug fix
  • CVE fix
  • Optimization
  • Documentation Update
  • Configuration Update
  • Bump-up dependent library

Related Tickets & Documents

Checklist before requesting a review

  • I have performed a self-review of my code.
  • PR has passed all pre-merge test jobs.
  • If it is a core feature, I have added thorough tests.

Testing

  • Please provide detailed steps to perform tests related to this code change.
    • Build an operator image with changes.
    • Deployed the image, applied an olsconfig with postgres cache settings.
    • Put in a request to the OLS service, and confimed entry in cache table.
    • Deleted signing key using oc delete secret/signing-key -n openshift-service-ca
    • Waited for deployments to restart and the service to become available. ( takes more than 5 mins).
    • Put in a new request to the service.
    • Confirmed contents of both requests and also the successful PVC mount in new pod, confiming complete reconciliation.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@sriroopar sriroopar force-pushed the postgres-cert-rotation branch 2 times, most recently from baf50e7 to abbbb32 Compare November 3, 2025 22:20
@openshift-ci
Copy link

openshift-ci bot commented Nov 3, 2025 •
edited
Loading

@sriroopar: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/bundle-e2e-4-18 51d0e9d link true /test bundle-e2e-4-18

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@sriroopar sriroopar force-pushed the postgres-cert-rotation branch from abbbb32 to 797f4bc Compare November 3, 2025 22:24
@sriroopar sriroopar force-pushed the postgres-cert-rotation branch from 797f4bc to eda09f2 Compare November 3, 2025 22:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@xrajesh xrajesh xrajesh left review comments

@bparees bparees Awaiting requested review from bparees

+1 more reviewer

@syedriko syedriko syedriko left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@syedriko syedriko

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@sriroopar @openshift-ci-robot @syedriko @xrajesh @openshift-merge-robot