Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Cilium migration how-to to always use api-int #369

Merged
merged 1 commit into from
Dec 4, 2024

Conversation

simu
Copy link
Member

@simu simu commented Dec 3, 2024

We can't use the public api record since Cilium simply patches the clientset generated by InClusterConfig() with the provided API host name, cf. https://github.com/cilium/cilium/blob/bb81b095cb64053887e3cb087b53518c162beec6/pkg/k8s/client/cell.go#L348-L352. Notably, the clientset still uses the K8s-managed in-cluster CA bundle which isn't suitable for validating public certificates.

If we actually want to use api record, we'd have to somehow configure Cilium to use a custom kubeconfig (which I'm not sure is possible when running Cilium in a cluster).

@simu simu requested a review from a team December 3, 2024 13:45
@simu simu changed the title Update Cilium migration how-to to always use api-int. Update Cilium migration how-to to always use api-int Dec 4, 2024
We can't use the public `api` record since Cilium simply patches the
clientset generated by `InClusterConfig()` [1] with the provided API host
name, cf. `createConfig()` [2]. Notably, the clientset still uses the
K8s-managed in-cluster CA bundle which isn't suitable for validating
public certificates.

If we actually want to use `api` record, we'd have to somehow configure
Cilium to use a custom kubeconfig (which I'm not sure is possible when
running Cilium in a cluster).

[1]: https://pkg.go.dev/k8s.io/client-go/rest#InClusterConfig
[2]: https://github.com/cilium/cilium/blob/bb81b095cb64053887e3cb087b53518c162beec6/pkg/k8s/client/cell.go#L348-L352
@simu simu force-pushed the fix/cilium-migration-api-int branch from 2f70aea to e364a72 Compare December 4, 2024 08:54
@simu simu merged commit 6b9f678 into master Dec 4, 2024
1 check passed
@simu simu deleted the fix/cilium-migration-api-int branch December 4, 2024 12:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants