vsantwana commented on code in PR #1163:
URL:
https://github.com/apache/flink-kubernetes-operator/pull/1163#discussion_r4464534961
##########
helm/flink-kubernetes-operator/templates/cert-manager/certificate.yaml:
##########
@@ -45,5 +45,5 @@ spec:
kind: Issuer
name: flink-operator-selfsigned-issuer
commonName: FlinkDeployment Validator
- secretName: webhook-server-cert
+ secretName: flink-operator-webhook-server-cert
Review Comment:
Renaming the Secret makes the upgrade depend on cert-manager being
available. The new operator pod mounts `flink-operator-webhook-server-cert`,
which does not exist until cert-manager issues it. With the default `Recreate`
strategy, the operator is down until then, and the webhooks (`failurePolicy:
Fail`) reject every FlinkDeployment and FlinkSessionJob create or update. On
main, the new pod mounts the existing Secret, so the same upgrade works while
cert-manager is down.
I tried this on kind with cert-manager v1.16.2. With the cert-manager
controller scaled to 0, upgrading from main's chart to this one left the new
pod in `ContainerCreating` with `secret "flink-operator-webhook-server-cert"
not found`, and the webhook rejected requests until 82 seconds after
cert-manager came back. The same upgrade to main's chart was down for about 10
seconds. With cert-manager running, both upgrades were down for about 6 seconds.
The old `webhook-server-cert` Secret also stays behind after the upgrade, as
[Dennis pointed
out](https://github.com/apache/flink-kubernetes-operator/pull/1163#discussion_r3674239333)
on the earlier version.
Could you add an upgrade note saying that the Secret is renamed, that
cert-manager has to be running during the upgrade, and that the old Secret can
be deleted afterwards?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
