Merge pull request #5306 from muraee/fix-oauthv2-kcmv2

NO-JIRA: Fix oauth-v2 and kcm-v2
openshift · Dec 19, 2024 · 253fa18 · 253fa18
2 parents 7b99ad8 + 286d57f
commit 253fa18
Show file tree

Hide file tree

Showing 6 changed files with 16 additions and 12 deletions.
diff --git a/...dcontrolplane/testdata/kube-controller-manager/zz_fixture_TestControlPlaneComponents.yaml b/...dcontrolplane/testdata/kube-controller-manager/zz_fixture_TestControlPlaneComponents.yaml
@@ -108,9 +108,9 @@ spec:
         - --cluster-signing-duration=17520h
         - --tls-cert-file=/etc/kubernetes/certs/server/tls.crt
         - --tls-private-key-file=/etc/kubernetes/certs/server/tls.key
-        - --node-monitor-grace-period=50s
         - --cluster-cidr=10.132.0.0/14
         - --service-cluster-ip-range=
+        - --node-monitor-grace-period=50s
         - --tls-min-version=VersionTLS12
         - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
         - --feature-gates=OpenShiftPodSecurityAdmission=true

diff --git a/...a/kube-controller-manager/zz_fixture_TestControlPlaneComponents_TechPreviewNoUpgrade.yaml b/...a/kube-controller-manager/zz_fixture_TestControlPlaneComponents_TechPreviewNoUpgrade.yaml
@@ -108,9 +108,9 @@ spec:
         - --cluster-signing-duration=17520h
         - --tls-cert-file=/etc/kubernetes/certs/server/tls.crt
         - --tls-private-key-file=/etc/kubernetes/certs/server/tls.key
-        - --node-monitor-grace-period=50s
         - --cluster-cidr=10.132.0.0/14
         - --service-cluster-ip-range=
+        - --node-monitor-grace-period=50s
         - --tls-min-version=VersionTLS12
         - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
         - --feature-gates=OpenShiftPodSecurityAdmission=true

diff --git a/...operator/controllers/hostedcontrolplane/v2/assets/kube-controller-manager/deployment.yaml b/...operator/controllers/hostedcontrolplane/v2/assets/kube-controller-manager/deployment.yaml
@@ -3,7 +3,6 @@ kind: Deployment
 metadata:
   name: kube-controller-manager
 spec:
-  replicas: 1
   revisionHistoryLimit: 2
   selector:
     matchLabels:
@@ -49,7 +48,6 @@ spec:
         - --cluster-signing-duration=17520h
         - --tls-cert-file=/etc/kubernetes/certs/server/tls.crt
         - --tls-private-key-file=/etc/kubernetes/certs/server/tls.key
-        - --node-monitor-grace-period=50s
         command:
         - hyperkube
         - kube-controller-manager

diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kcm/deployment.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kcm/deployment.go
@@ -14,7 +14,6 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	"k8s.io/utils/ptr"
 
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -35,6 +34,13 @@ func adaptDeployment(cpContext component.WorkloadContext, deployment *appsv1.Dep
 		if hcp.Spec.Platform.Type == hyperv1.AzurePlatform {
 			c.Args = append(c.Args, fmt.Sprintf("--cloud-provider=%s", "external"))
 		}
+
+		if hcp.Spec.Platform.Type == hyperv1.IBMCloudPlatform {
+			c.Args = append(c.Args, "--node-monitor-grace-period=55s")
+		} else {
+			c.Args = append(c.Args, "--node-monitor-grace-period=50s")
+		}
+
 		if tlsMinVersion := config.MinTLSVersion(hcp.Spec.Configuration.GetTLSSecurityProfile()); tlsMinVersion != "" {
 			c.Args = append(c.Args, fmt.Sprintf("--tls-min-version=%s", tlsMinVersion))
 		}
@@ -44,6 +50,7 @@ func adaptDeployment(cpContext component.WorkloadContext, deployment *appsv1.Dep
 		if util.StringListContains(hcp.Annotations[hyperv1.DisableProfilingAnnotation], ComponentName) {
 			c.Args = append(c.Args, "--profiling=false")
 		}
+
 		for _, f := range config.FeatureGates(hcp.Spec.Configuration.GetFeatureGateSelection()) {
 			c.Args = append(c.Args, fmt.Sprintf("--feature-gates=%s", f))
 		}
@@ -69,11 +76,6 @@ func adaptDeployment(cpContext component.WorkloadContext, deployment *appsv1.Dep
 		}
 	})
 
-	deployment.Spec.Replicas = ptr.To[int32](2)
-	if hcp.Spec.ControllerAvailabilityPolicy == hyperv1.SingleReplica {
-		deployment.Spec.Replicas = ptr.To[int32](1)
-	}
-
 	return nil
 }
 

diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/oauth/idp_convert.go b/control-plane-operator/controllers/hostedcontrolplane/v2/oauth/idp_convert.go
@@ -689,7 +689,10 @@ func transportForCARef(ctx context.Context, kclient crclient.Reader, namespace,
 	transport := net.SetTransportDefaults(&http.Transport{
 		TLSClientConfig: &tls.Config{},
 	})
-	roots := x509.NewCertPool()
+	roots, err := x509.SystemCertPool()
+	if err != nil {
+		return nil, fmt.Errorf("failed to create system cert pool: %w", err)
+	}
 
 	if !skipKonnectivityDialer {
 		var err error

diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/oauth/idp_convert_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/oauth/idp_convert_test.go
@@ -380,7 +380,8 @@ users:
 			g.Expect(gotURL).To(Equal(tc.expectedProxyRequestURL))
 
 			// Validate RootCAs expectations.
-			expectedCertPool := x509.NewCertPool()
+			expectedCertPool, err := x509.SystemCertPool()
+			g.Expect(err).ToNot(HaveOccurred())
 			if tc.hcp.Spec.Configuration != nil {
 				if tc.hcp.Spec.Configuration.Proxy.TrustedCA.Name != "" {
 					expectedCertPool.AppendCertsFromPEM([]byte(fakeProxyCertCADecoded))