eff9f360f7
This switches from the ansible/dhall operator framework to kopf, an operator framework written in pure Python. This allows us to: * Build the operator application as a Python app. * Build the operator image using the opendev python builder images. * Run the operator as a Python CLI program "zuul-operator". * Write procedural Python code to handle operator tasks (such as creating new nodepool launchers when providers are added). * Use Jinja for templating config files and k8s resource files (direct pythonic manipulation of resources is an option too). The new CR nearly matches the existing one, with some minor differences. Some missing features and documentation are added in the commits immediately following; they should be reviewed and merged as a unit. Also, fx waiting for scheduler to settle in functional test since we changed this log line in Zuul. Change-Id: Ib37b67e3444b7cd44692d48eee77775ee9049e9f Change-Id: I70ec31ecd8fe264118215944022b2e7b513dced9
37 lines
695 B
YAML
37 lines
695 B
YAML
---
|
|
apiVersion: cert-manager.io/v1alpha2
|
|
kind: Issuer
|
|
metadata:
|
|
name: selfsigned-issuer
|
|
spec:
|
|
selfSigned: {}
|
|
---
|
|
apiVersion: cert-manager.io/v1alpha2
|
|
kind: Certificate
|
|
metadata:
|
|
name: ca-cert
|
|
spec:
|
|
# Secret names are always required.
|
|
secretName: ca-cert
|
|
duration: 87600h # 10y
|
|
renewBefore: 360h # 15d
|
|
isCA: true
|
|
keySize: 2048
|
|
keyAlgorithm: rsa
|
|
keyEncoding: pkcs1
|
|
commonName: cacert
|
|
# At least one of a DNS Name, URI, or IP address is required.
|
|
dnsNames:
|
|
- caroot
|
|
# Issuer references are always required.
|
|
issuerRef:
|
|
name: selfsigned-issuer
|
|
---
|
|
apiVersion: cert-manager.io/v1alpha2
|
|
kind: Issuer
|
|
metadata:
|
|
name: ca-issuer
|
|
spec:
|
|
ca:
|
|
secretName: ca-cert
|