NO-JIRA: Support multiple Vault instance deployment#80457
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@ardaguclu: This pull request explicitly references no jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (5)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (3)
WalkthroughThis PR refactors Vault Enterprise setup scripts to support two instances (primary and secondary) by introducing parameterized functions for installation and KMS configuration. The install script is split into reusable ChangesDual Vault Instance Setup Refactoring
🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested labels: Suggested reviewers:
Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error, 1 warning)
✅ Passed checks (13 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
openshift-ci
Bot
added
the
approved
|
/pj-rehearse pull-ci-openshift-cluster-kube-apiserver-operator-main-e2e-aws-operator-encryption-kms periodic-ci-openshift-cluster-kube-apiserver-operator-main-periodics-e2e-metal-encryption-kms-ipv6 pull-ci-openshift-cluster-openshift-apiserver-operator-main-e2e-aws-operator-encryption-kms periodic-ci-openshift-cluster-kube-apiserver-operator-main-periodics-e2e-aws-encryption-kms-single-node periodic-ci-openshift-cluster-kube-apiserver-operator-main-periodics-e2e-gcp-encryption-kms |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@ci-operator/step-registry/etcd-encryption/vault-configure/etcd-encryption-vault-configure-commands.sh`:
- Around line 11-16: The function configure_vault() currently hardcodes the
Vault service host as "vault.${namespace}.svc:8200" causing wrong endpoint logs
for secondary instances; change the function signature to accept a Vault service
name (add local service_name="$4" or replace an arg), update all internal uses
that assemble the endpoint (the echo/log lines that build
"vault.${namespace}.svc:8200" — referenced around configure_vault() and the
print sites at the blocks noted ~98-100 and ~107-108) to use
"${service_name}.${namespace}.svc:8200" (or accept a full host:port and use
"${service_name}" directly), and ensure callers that invoke configure_vault pass
the correct service name for primary vs secondary.
In
`@ci-operator/step-registry/etcd-encryption/vault-configure/etcd-encryption-vault-configure-ref.yaml`:
- Around line 25-33: Update the ref docs to reflect dual-Vault behavior: replace
any single-namespace text referencing ${VAULT_NAMESPACE} with explicit
descriptions for both VAULT_NAMESPACE and VAULT_SECONDARY_NAMESPACE and note
that two Vault instances are configured; update key docs to mention
VAULT_KMS_KEY_NAME and VAULT_SECONDARY_KMS_KEY_NAME (and that they must differ)
and remove the stale "unseal-key" output since
etcd-encryption-vault-configure-commands.sh does not emit it, instead list only
the secret keys and outputs that the script actually creates. Reference the env
var names VAULT_NAMESPACE, VAULT_SECONDARY_NAMESPACE, VAULT_KMS_KEY_NAME,
VAULT_SECONDARY_KMS_KEY_NAME and the script
etcd-encryption-vault-configure-commands.sh when making these edits.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 199fa81a-62b7-4a48-9d06-f0e671ea3be7
📒 Files selected for processing (5)
ci-operator/step-registry/etcd-encryption/vault-configure/etcd-encryption-vault-configure-commands.shci-operator/step-registry/etcd-encryption/vault-configure/etcd-encryption-vault-configure-ref.yamlci-operator/step-registry/etcd-encryption/vault-install/etcd-encryption-vault-install-commands.shci-operator/step-registry/etcd-encryption/vault-install/etcd-encryption-vault-install-ref.yamlci-operator/step-registry/etcd-encryption/vault-setup/etcd-encryption-vault-setup-chain.yaml
|
@ardaguclu: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
ardaguclu
force-pushed
the
deploy-multiple-vault
branch
from
e030d65 to
3efb74d
Compare
|
/pj-rehearse pull-ci-openshift-cluster-kube-apiserver-operator-main-e2e-aws-operator-encryption-kms periodic-ci-openshift-cluster-kube-apiserver-operator-main-periodics-e2e-metal-encryption-kms-ipv6 pull-ci-openshift-cluster-openshift-apiserver-operator-main-e2e-aws-operator-encryption-kms periodic-ci-openshift-cluster-kube-apiserver-operator-main-periodics-e2e-aws-encryption-kms-single-node periodic-ci-openshift-cluster-kube-apiserver-operator-main-periodics-e2e-gcp-encryption-kms |
|
[REHEARSALNOTIFIER]
Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@ardaguclu: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
|
Periodic failures are unrelated. KMS tests passed. |
|
@ardaguclu: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel. |
openshift-merge-bot
Bot
added
the
rehearsals-ack
|
waiting for CI to pass. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ardaguclu, sandeepknd The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
yep lgtm for me too. |
openshift-ci
Bot
added
the
do-not-merge/hold
|
/hold cancel one of the kms jobs finished, sorry! |
openshift-ci
Bot
removed
the
do-not-merge/hold
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
|
/hold cancel |
openshift-ci
Bot
removed
the
do-not-merge/hold
openshift-merge-bot
Bot
merged commit 684bae3
into
openshift:main
|
@ardaguclu: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
This PR wraps the functionality in vault install/configure into functions to make them reusable for installation of multiple Vault instances. We need it in our KMS to KMS migration scenarios.
This PR supersedes #80405
Summary by CodeRabbit
This PR refactors the etcd-encryption Vault install/configuration steps in the OpenShift CI (openshift/release) to support deploying and configuring multiple Vault Enterprise instances side-by-side, enabling KMS-to-KMS migration scenarios.
What changed in practical terms
Scope / Impact
Notes for reviewers