Add missing Pod IPs to created certificates
@Techassi 已经在做这个了。
开始于 2026年2月25日。
评估
这个 Issue 还没有评估数据。
描述
Some tools call the Pods via their PodIP, e.g. Prometheus when using a ServiceMonitor.
For this to work with HTTPS-enabled products, we need to add the Pod IP to the certificate because
- The clients should be able to validate the cert
- Some products (currently only NiFi) raise an "Invalid SNI" error if they can not find a matching cert in it's keystore
There is currently already code for this.
The Pod IPs are gathered here:
https://github.com/stackabletech/secret-operator/blob/e5224ab480e219e434ddc695c9361a16a56a43ed/rust/operator-binary/src/backend/pod_info.rs#L142-L153
and stuffed into the certificate here
https://github.com/stackabletech/secret-operator/blob/e5224ab480e219e434ddc695c9361a16a56a43ed/rust/operator-binary/src/backend/mod.rs#L229
However the comment already highlights the problem:
This will generally be empty, since Kubernetes assigns pod IPs after CSI plugins are successful
Because of this, we are lacking SAN entries for the Pod IPs.
I don't know if this "is even possible" with our current architecture of secret-operator being a CSI driver.
So I though "maybe listener-op can help"? Not from the top of my head, as it itself is "only" a CSI driver, so the Pod has no IPs assigned when it is running as well. listener-op can currently only block Pod creation until a Service (such as a LoadBalancer) has an address assigned. But there might be some other clever way how listener-op can do this which I didn't though of.
Another though is that certificate hot-reloading should work, because we can add the IP to the cert after the Pod has an IP assigned.
But that's a bigger story - e.g. do all tools support this?
Run secret-op as init container? As sidecar?
- 主要语言
- Rust
- 星标
- 13
- 派生
- 8
- 平均合并
- 1 天 8 小时
- 30 天内合并 PR
- 10
贡献指南
这个仓库没有索引到贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
stackabletech/secret-operator 的其他 Issue
-
type/bug
难度 4/5 3-5 天 新手友好度 45/100
stackabletech/secret-operator#754 ·
-
难度 3/5 1-2 天 新手友好度 48/100
stackabletech/secret-operator#753 · 1 条评论 ·
-
难度 3/5 1-2 天 新手友好度 72/100
stackabletech/secret-operator#720 · 1 条评论 ·
-
customer-request type/bug
难度 3/5 1-2 天 新手友好度 38/100
stackabletech/secret-operator#666 · 2 条评论 ·
-
customer-request type/feature-improvement
stackabletech/secret-operator#630 · 7 条评论 · 已指派 1 人 ·
查看 stackabletech/secret-operator 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 75/100
-
state:needs triage
难度 2/5 1-3 小时 新手友好度 70/100
zed-industries/zed#64680 · 2 条评论 ·
-
难度 2/5 1-3 小时 新手友好度 70/100
-
难度 2/5 1-3 小时 新手友好度 70/100
RustPython/RustPython#8802 ·
-
难度 2/5 1-3 小时 新手友好度 75/100
TheLarkInn/aipm#2390 ·