GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — fix: Set TLS certificate annotation only on gRPC service (#5715) · Marcus-Rosti/feast@75d13db

File tree

Expand file treeCollapse file tree

Open diff view settings

Filter options

infra/feast-operator/internal/controller/services
- services.go

Expand file treeCollapse file tree

Open diff view settings

Collapse file

`‎infra/feast-operator/internal/controller/services/services.go‎`

Copy file name to clipboardExpand all lines: infra/feast-operator/internal/controller/services/services.go

+14-8Lines changed: 14 additions & 8 deletions

Original file line number	Diff line number	Diff line change
`@@ -676,14 +676,20 @@ func (feast FeastServices) setService(svc corev1.Service, feastType FeastServi`
`676`	`676`	`restEnabled := feast.isRegistryRestEnabled()`
`677`	`677`
`678`	`678`	`if grpcEnabled && restEnabled {`
`679`		`- // Both services enabled: Use gRPC service name as primary, add REST as SAN`
`680`		`- grpcSvcName := feast.initFeastSvc(RegistryFeastType).Name`
`681`		`- svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = grpcSvcName + tlsNameSuffix`
`682`		`-`
`683`		`- // Add Subject Alternative Names (SANs) for both services`
`684`		`- grpcHostname := grpcSvcName + "." + svc.Namespace + ".svc.cluster.local"`
`685`		`- restHostname := feast.GetFeastRestServiceName(RegistryFeastType) + "." + svc.Namespace + ".svc.cluster.local"`
`686`		`- svc.Annotations["service.beta.openshift.io/serving-cert-sans"] = grpcHostname + "," + restHostname`
	`679`	`+ // Both services enabled: Only set TLS annotation on gRPC service to ensure`
	`680`	`+ // OpenShift creates certificate with gRPC service name as CN (not REST service name)`
	`681`	`+ // The certificate will include both hostnames as SANs`
	`682`	`+ if !isRestService {`
	`683`	`+ grpcSvcName := feast.initFeastSvc(RegistryFeastType).Name`
	`684`	`+ svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = grpcSvcName + tlsNameSuffix`
	`685`	`+`
	`686`	`+ // Add Subject Alternative Names (SANs) for both services`
	`687`	`+ grpcHostname := grpcSvcName + "." + svc.Namespace + ".svc.cluster.local"`
	`688`	`+ restHostname := feast.GetFeastRestServiceName(RegistryFeastType) + "." + svc.Namespace + ".svc.cluster.local"`
	`689`	`+ svc.Annotations["service.beta.openshift.io/serving-cert-sans"] = grpcHostname + "," + restHostname`
	`690`	`+ }`
	`691`	`+ // REST service should not have the annotation - it will use the same certificate`
	`692`	`+ // from the gRPC service secret (mounted in the pod)`
`687`	`693`	`} else if grpcEnabled && !restEnabled {`
`688`	`694`	`// Only gRPC enabled: Use gRPC service name`
`689`	`695`	`grpcSvcName := feast.initFeastSvc(RegistryFeastType).Name`

0 commit comments

Comments

0 (0)

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.