Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add webhookconfig checksum to deployment annotations #269

Merged
merged 1 commit into from
Nov 6, 2024

Conversation

Sir-Jacques
Copy link
Contributor

@Sir-Jacques Sir-Jacques commented Nov 6, 2024

Changing the webhook sometimes results into the creation of a new certificate and because of that an updated secret.
The updated secret introduces the following error:

tls: failed to verify certificate: x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "opa-admission-ca")

The secret is updated in the pod (since kubernetes automatically updates mounted secrets and configmaps), but the OPA process does not reload the secrets. After restarting the pods the issue is solved, we now how to do this manually for each update to this chart.

Adding the sha256 of the certificate secret as an annotation will result in an update to the deployment and thus restarting its pods.

@Sir-Jacques Sir-Jacques changed the title Add webhookconfig checksum to deployment Add webhookconfig checksum to deployment annotations Nov 6, 2024
@eshepelyuk eshepelyuk merged commit 653252e into open-policy-agent:master Nov 6, 2024
2 checks passed
@eshepelyuk
Copy link
Contributor

Thanks, will be available in https://github.com/open-policy-agent/kube-mgmt/releases/tag/8.5.11

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants