Bug 1565545
| Summary: | asb etcd '/extracted_credentials' should be migrated to secret in asb namepsace | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Zihan Tang <zitang> |
| Component: | Service Broker | Assignee: | Shawn Hurley <shurley> |
| Status: | CLOSED ERRATA | QA Contact: | Zihan Tang <zitang> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 3.10.0 | CC: | aos-bugs, chezhang, jiazha, jmatthew, shurley, zhsun |
| Target Milestone: | --- | ||
| Target Release: | 3.10.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | No Doc Update | |
| Doc Text: |
undefined
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2018-07-30 19:12:35 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1577867 | ||
| Bug Blocks: | |||
|
Description
Zihan Tang
2018-04-10 09:28:32 UTC
To be clear, we are not creating a CRD for extracted credentials. We are using secrets for extracted credentials now. We need to move etcd /extracted_credentials to secrets. Do you mean when provision a apb, will create a secret in openshift-ansible-service-broker namespace?
like :
[root@host-172-16-120-160 ~]# oc get secret -n openshift-ansible-service-broker
NAME TYPE DATA AGE
7bef73a9-3e1a-11e8-ba42-0a580a80000b Opaque 1 2h
9ed5381f-3e2c-11e8-ba42-0a580a80000b Opaque 1 2m
bb9745da-3e2c-11e8-ba42-0a580a80000b Opaque 1 12m
Then the secret key ref will be stored in jobstate metedata.labels ?
like :
[root@host-172-16-120-160 ~]# oc get jobstates 2b086f32-40bd-4f82-9f41-67fa8966dafb -o yaml
apiVersion: automationbroker.io/v1
kind: JobState
metadata:
clusterName: ""
creationTimestamp: 2018-04-12T08:37:30Z
generation: 0
labels:
instanceId: bb9745da-3e2c-11e8-ba42-0a580a80000b
state: succeeded
name: 2b086f32-40bd-4f82-9f41-67fa8966dafb
namespace: openshift-ansible-service-broker
resourceVersion: "25794"
selfLink: /apis/automationbroker.io/v1/namespaces/openshift-ansible-service-broker/jobstates/2b086f32-40bd-4f82-9f41-67fa8966dafb
uid: bd0f76b0-3e2c-11e8-8cfd-fa163ea56fcb
spec:
description: provision job completed
error: ""
method: provision
podName: ""
state: succeeded
Yes, that is mostly correct. One note is that the label reference is for the service instance id or the binding id and that is the same value we use the secret. Do you mean that ? 1. the secret name when provision is the same with service instance id 2. the secret name when binding is the same with service binding id but parameters of 2 secret for instance and binding are the same , why create a new secret for binding ? btw, the secret is not easily readable to check its usage. > 1. the secret name when provision is the same with service instance id > 2. the secret name when the binding is the same with service binding id Yes that is correct. > but parameters of 2 secrets for instance and binding are the same, > why create a new secret for binding? Because we can delete a binding and we should delete the secret associated with that. More specifically, with async bind being supported this will not always be the case. Shawn, In v3.9 when create binding, it don't create new credentials in etcd '/extracted_credentials' , and no new jobstate in etcd 'state/serviceinstance_id/job', In 3.10 , creating binding will create a new secret in asb ns, can you help clarify enhancement purpose? thanks. They are two different workflows. Async bind causes a jobstate to be added and an extracted credential. This is because of the configuration value `launch_apb_on_bind` is set to false and no action occurs for those bind calls. If you are have set `launch_apb_on_bind` to false then you are correct about the behavior stated above. I tried this in v3.9 and v3.10
in summary
v3.9
sync binding no new job state/no extracted credential
async binding new job state /extracted credential
v3.10
sync binding no new job state/extracted credential secret
async binding new job state /extracted credential
when in sync binding , 3.10 asb extract credential secret which is not in v3.9(in etcd) .
in my opinion , it's better to keep the same behavior between 3.10 and 3.9 . please correct me if it is for some enhancement .
Hello, When a binding is created we should create an extracted credential. This behavior is what is expected. It appears that the behavior changed between 3.7 and 3.9. I would expect for ease of use that the behavior would be that the extracted credential is created for a binding. This not only sets us up for future work but also fixes a bug in 3.9 that I just realized was happening. image is ready, change it to ON_QA the upgrade env is not ready ,change it to MODIFIED. bug 1577867 block to build env. In OCP 3.10, asb 1.2.12 when provision apb, will create a secret in openshift-ansible-service-broker ns. and this secret will be deleted when deprovision. when create binding, will also create a secret in openshift-ansible-service-broker ns, and the secret will be deleted when unbind. so marked this as verified. will use other bug to trace the etcd migration from v3.9 to v3.10 issue. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:1816 |