Fix/restart on tenanttokenchange without fieldchange (release-1.4) #4376
Conversation
gkrenn
requested review from
andriisoldatenko,
0sewa0,
chrismuellner,
waodim,
StefanHauth and
aorcholski
and removed request for
a team
|
Codecov ReportAttention: Patch coverage is
❗ Your organization needs to install the Codecov GitHub app to enable full functionality. Additional details and impacted files@@ Coverage Diff @@
## release-1.4 #4376 +/- ##
===============================================
+ Coverage 64.28% 64.29% +0.01%
===============================================
Files 401 402 +1
Lines 27072 27135 +63
===============================================
+ Hits 17403 17447 +44
- Misses 8302 8317 +15
- Partials 1367 1371 +4
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
StefanHauth
changed the title
| if err != nil { | ||
| log.Error(err, "secret for tenant token was not available at DaemonSet build time", "dynakube", r.dk.Name) | ||
| conditions.SetKubeApiError(r.dk.Conditions(), conditionType, err) | ||
| } |
There was a problem hiding this comment.
IMHO we should return err and shouldn't change the template if K8S API error encountered. We don't know if the secret/tenant has changed or not.
| if err != nil { | ||
| log.Error(err, "secret for tenant token was not available at DaemonSet build time", "dynakube", r.dk.Name) | ||
| conditions.SetKubeApiError(r.dk.Conditions(), oaConditionType, err) | ||
| } |
There was a problem hiding this comment.
IMHO we should return err and shouldn't change the template if K8S API error encountered. We don't know if the secret/tenant has changed or not.
|
|
||
| if err != nil { | ||
| log.Error(err, "secret for activegate token was not available at StatefulSet build time", "dynakube", r.dk.Name) | ||
| } |
There was a problem hiding this comment.
IMHO we should return err and should'n change the template if K8S API error encountered. We don't know if the secret/tenant has changed or not.
|
Thanks for your detailed checks, I adapted the PR according to the review. |
gkrenn
deleted the
fix/restart-on-tenanttokenchange-without-fieldchange
branch
Description
The tenant and ActiveGate tokens can be rotated using the tenant's rotation API.
This process updates the
oneagent-tenant-secretand ActiveGate secret. To activate these changes, the OneAgents and ActiveGates need to be restarted.To accomplish this, this PR adds a hash as an annotation to the DaemonSet and StatefulSet. If the hash changes, the pods will be restarted.
To not introduce a new field on a bugfix version, it uses the old bugfix implementation. For the new implementation including a new field look at PR #4361
Jira
How can this be tested?