Proposal: Enhance `EcternalEtcd` Configuration to Support Retrieving etcd Client Credentials from a Kubernetes Secret #5260

jabellard · 2024-07-26T16:29:29Z

What type of PR is this?

/kind design

What this PR does / why we need it:

Details are provided in the proposal.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

codecov-commenter · 2024-07-26T16:43:30Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 32.33%. Comparing base (721495d) to head (750e076).
Report is 288 commits behind head on master.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #5260      +/-   ##
==========================================
+ Coverage   28.26%   32.33%   +4.07%     
==========================================
  Files         632      643      +11     
  Lines       43732    44445     +713     
==========================================
+ Hits        12359    14373    +2014     
+ Misses      30472    28981    -1491     
- Partials      901     1091     +190

Flag	Coverage Δ
unittests	`32.33% <ø> (+4.07%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

zhzhuang-zju · 2024-07-27T02:43:07Z

docs/proposals/external-etcd-credentials-ref/README.md

+
+- Enable the use of Kubernetes secrets for storing and retrieving external etcd connection credentials.
+- Improve the security of sensitive data by leveraging Kubernetes' native secret management capabilities.
+- Simplify the management of external etcd configurations.


Since the current Karmada operator does not actually provide the ability to connect to an external etcd cluster, we can add a goal, such as completing the Karmada operator's capability to connect to an external etcd cluster through the ExternalEtcd configuration.

zhzhuang-zju · 2024-07-27T02:48:36Z

docs/proposals/external-etcd-credentials-ref/README.md

+## Proposal
+
+Introduce a new field, `SecretRef`, within the `ExternalEtcd` configuration to reference a Kubernetes secret that contains the necessary etcd connection credentials. 
+The existing inline configuration fields will be preserved to maintain backward compatibility. However, given that they are currently unused, it would make sense to mark them as deprecated.


given that they are currently unused, it would make sense to mark them as deprecated.

This is a good concern. cc @RainbowMango @calvin0327

Given those fields are unused and might bring security concerns, I think we should mark them deprecated.

Given those fields are unused and might bring security concerns, I think we should mark them deprecated

agree, also reduces maintenance costs

zhzhuang-zju · 2024-07-27T02:52:45Z

docs/proposals/external-etcd-credentials-ref/README.md

+  // ca.crt: The Certificate Authority (CA) certificate data.
+  // tls.crt: The TLS certificate data.
+  // tls.key: The TLS private key data.
+  // +optional


Suggested change

// +optional

// Required if using a TLS connection.

// +optional

zhzhuang-zju · 2024-07-27T02:58:24Z

docs/proposals/external-etcd-credentials-ref/README.md

+  ca.crt: <base64-encoded-data>
+  tls.crt: <base64-encoded-data>
+  tls.key: <base64-encoded-data>
+```


Perhaps we can add a bit of description about how the Karmada operator will use these credentials, such as incorporating them into the startup flags to configure some Karmada components.

The data of the secret will be shared with karmada-apiserver, karmada-aggregate-apiserver, and karmada-search, which requires access to ETCD.

jabellard · 2024-07-29T16:20:53Z

@zhzhuang-zju , thanks for the constructive feedback. I pushed a change to address comments.

RainbowMango

Generally looks good to me.
Thanks @jabellard
This feature is more like supporting external ETCD in a security gesture!

RainbowMango · 2024-09-02T03:35:03Z

docs/proposals/external-etcd-credentials-ref/README.md

+## Proposal
+
+Introduce a new field, `SecretRef`, within the `ExternalEtcd` configuration to reference a Kubernetes secret that contains the necessary etcd connection credentials. 
+The existing inline configuration fields will be preserved to maintain backward compatibility. However, given that they are currently unused, it would make sense to mark them as deprecated.


Given those fields are unused and might bring security concerns, I think we should mark them deprecated.

RainbowMango · 2024-09-02T03:39:07Z

docs/proposals/external-etcd-credentials-ref/README.md

@jabellard Do you think we should group operator-related proposals into a separated directory? Like docs/proposals/operator?

Signed-off-by: Joe Nathan Abellard <[email protected]> Initial structure Signed-off-by: Joe Nathan Abellard <[email protected]> Fix typos Signed-off-by: Joe Nathan Abellard <[email protected]> Fix typos Signed-off-by: Joe Nathan Abellard <[email protected]> Address comments Signed-off-by: Joe Nathan Abellard <[email protected]> Address comments Signed-off-by: Joe Nathan Abellard <[email protected]>

jabellard · 2024-09-09T16:46:57Z

@RainbowMango , thanks for your constructive feedback. I just pushed some changes to address your comments so I think this should be ready to go.

zhzhuang-zju · 2024-09-10T01:40:13Z

The hosted runner: GitHub Actions 607 lost communication with the server. Anything in your workflow that terminates the runner process, starves it for CPU/Memory, or blocks its network access can cause this error.

the lint failed for some unknown reason
/retest

RainbowMango

/lgtm
/approve

karmada-bot · 2024-09-12T02:06:07Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RainbowMango

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [RainbowMango]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

karmada-bot added the kind/design Categorizes issue or PR as related to design. label Jul 26, 2024

karmada-bot requested review from Tingtal and whitewindmills July 26, 2024 16:29

karmada-bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 26, 2024

jabellard mentioned this pull request Jul 26, 2024

Add The Ability to Retrieve External Etcd Client Credentials From Secret #5242

Closed

zhzhuang-zju reviewed Jul 27, 2024

View reviewed changes

RainbowMango reviewed Sep 2, 2024

View reviewed changes

jabellard force-pushed the extern_etcd_secret_ref branch from f3137c4 to 750e076 Compare September 9, 2024 16:45

RainbowMango approved these changes Sep 12, 2024

View reviewed changes

karmada-bot assigned RainbowMango Sep 12, 2024

karmada-bot added the lgtm Indicates that a PR is ready to be merged. label Sep 12, 2024

karmada-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 12, 2024

karmada-bot merged commit 2ce29ea into karmada-io:master Sep 12, 2024
12 checks passed

jabellard mentioned this pull request Sep 12, 2024

External etcd Support for Karmada Operator #5536

Closed

This was referenced Oct 15, 2024

External etcd Support for Karmada Operator - Part 1 #5699

Merged

External etcd Support for Karmada Operator - Part 2 #5720

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Proposal: Enhance `EcternalEtcd` Configuration to Support Retrieving etcd Client Credentials from a Kubernetes Secret #5260

Proposal: Enhance `EcternalEtcd` Configuration to Support Retrieving etcd Client Credentials from a Kubernetes Secret #5260

jabellard commented Jul 26, 2024

codecov-commenter commented Jul 26, 2024 •

edited

Loading

zhzhuang-zju Jul 27, 2024

RainbowMango Sep 2, 2024

zhzhuang-zju Jul 27, 2024

RainbowMango Sep 2, 2024

zhzhuang-zju Sep 3, 2024

zhzhuang-zju Jul 27, 2024

zhzhuang-zju Jul 27, 2024

RainbowMango Sep 2, 2024

jabellard commented Jul 29, 2024

RainbowMango left a comment

RainbowMango Sep 2, 2024

RainbowMango Sep 2, 2024

jabellard commented Sep 9, 2024

zhzhuang-zju commented Sep 10, 2024

RainbowMango left a comment

karmada-bot commented Sep 12, 2024

	// +optional
	// Required if using a TLS connection.
	// +optional

Proposal: Enhance EcternalEtcd Configuration to Support Retrieving etcd Client Credentials from a Kubernetes Secret #5260

Proposal: Enhance EcternalEtcd Configuration to Support Retrieving etcd Client Credentials from a Kubernetes Secret #5260

Conversation

jabellard commented Jul 26, 2024

codecov-commenter commented Jul 26, 2024 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jabellard commented Jul 29, 2024

RainbowMango left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jabellard commented Sep 9, 2024

zhzhuang-zju commented Sep 10, 2024

RainbowMango left a comment

Choose a reason for hiding this comment

karmada-bot commented Sep 12, 2024

Proposal: Enhance `EcternalEtcd` Configuration to Support Retrieving etcd Client Credentials from a Kubernetes Secret #5260

Proposal: Enhance `EcternalEtcd` Configuration to Support Retrieving etcd Client Credentials from a Kubernetes Secret #5260

codecov-commenter commented Jul 26, 2024 •

edited

Loading