Skip to content

NETOBSERV-1101: fix agent-to-flp mTLS downstream#2553

Open
jotak wants to merge 1 commit intonetobserv:mainfrom
jotak:fix-mtls-issues
Open

NETOBSERV-1101: fix agent-to-flp mTLS downstream#2553
jotak wants to merge 1 commit intonetobserv:mainfrom
jotak:fix-mtls-issues

Conversation

@jotak
Copy link
Copy Markdown
Member

@jotak jotak commented Mar 16, 2026 •
edited
Loading

Description

  • In provided mode, now if agent certificates/CA are provided from a different namespace, they are copied by the operator (using our existing certificate watcher)
  • When not in Auto mode, do not generate openshift annotation-based cert for FLP
  • Fix path missing /

To test Provided mode:

  • Install cert-manager

Install:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: netobserv-ca
  namespace: netobserv
spec:
  isCA: true
  commonName: netobserv-ca
  secretName: netobserv-ca-secret
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: netobserv-self-signed
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: netobserv-self-signed
  namespace: netobserv
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: netobserv-issuer
  namespace: netobserv
spec:
  ca:
    secretName: netobserv-ca-secret
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: flowlogs-pipeline-cert
spec:
  secretName: flowlogs-pipeline-cert
  dnsNames:
  - flowlogs-pipeline.netobserv.svc
  - flowlogs-pipeline.netobserv.svc.cluster.local
  issuerRef:
    name: netobserv-issuer
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ebpf-agent-cert
  namespace: netobserv
spec:
  secretName: ebpf-agent-cert
  commonName: netobserv-ebpf-agent
  issuerRef:
    name: netobserv-issuer
    kind: Issuer
    group: cert-manager.io

Configure FlowCollector:

spec:
  processor:
    service:
      providedCertificates:
        caFile:
          file: ca.crt
          name: netobserv-ca-secret
          namespace: netobserv
          type: secret
        clientCert:
          certFile: tls.crt
          certKey: tls.key
          name: ebpf-agent-cert
          namespace: netobserv
          type: secret
        serverCert:
          certFile: tls.crt
          certKey: tls.key
          name: flowlogs-pipeline-cert
          namespace: netobserv
          type: secret
      tlsType: Provided

Dependencies

n/a

Checklist

  • Does the changes in PR need specific configuration or environment set up for testing?
    • if so please describe it in PR description.
  • I have added thorough unit tests for the change.
  • QE requirements (check 1 from the list):
    • Standard QE validation, with pre-merge tests unless stated otherwise.
    • Regression tests only (e.g. refactoring with no user-facing change).
    • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

@jotak
NETOBSERV-1101: fix agent-to-flp mTLS downstream
4eefb3b 
- In provided mode, now if agent certificates/CA are provided from a
  different namespace, they are copied by the operator
- When not in Auto mode, do not generate openshift annotation-based cert
  for FLP
- Fix path missing /

To test Provided mode:

- Install cert-manager

Install:

```yaml
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: netobserv-ca
  namespace: netobserv
spec:
  isCA: true
  commonName: netobserv-ca
  secretName: netobserv-ca-secret
  privateKey:
    algorithm: ECDSA
    size: 256
  issuerRef:
    name: netobserv-self-signed
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: netobserv-self-signed
  namespace: netobserv
spec:
  selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: netobserv-issuer
  namespace: netobserv
spec:
  ca:
    secretName: netobserv-ca-secret
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: flowlogs-pipeline-cert
spec:
  secretName: flowlogs-pipeline-cert
  dnsNames:
  - flowlogs-pipeline.netobserv.svc
  - flowlogs-pipeline.netobserv.svc.cluster.local
  issuerRef:
    name: netobserv-issuer
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ebpf-agent-cert
  namespace: netobserv
spec:
  secretName: ebpf-agent-cert
  commonName: netobserv-ebpf-agent
  issuerRef:
    name: netobserv-issuer
    kind: Issuer
    group: cert-manager.io
```

Configure FlowCollector:

```yaml
spec:
  processor:
    service:
      providedCertificates:
        caFile:
          file: ca.crt
          name: netobserv-ca-secret
          namespace: netobserv
          type: secret
        clientCert:
          certFile: tls.crt
          certKey: tls.key
          name: ebpf-agent-cert
          namespace: netobserv
          type: secret
        serverCert:
          certFile: tls.crt
          certKey: tls.key
          name: flowlogs-pipeline-cert
          namespace: netobserv
          type: secret
      tlsType: Provided
```
@openshift-ci-robot
Copy link
Copy Markdown
Collaborator

openshift-ci-robot commented Mar 16, 2026 •
edited by openshift-ci bot
Loading

@jotak: This pull request references NETOBSERV-1101 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Description

  • In provided mode, now if agent certificates/CA are provided from a different namespace, they are copied by the operator
  • When not in Auto mode, do not generate openshift annotation-based cert for FLP
  • Fix path missing /

To test Provided mode:

  • Install cert-manager

Install:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: netobserv-ca
 namespace: netobserv
spec:
 isCA: true
 commonName: netobserv-ca
 secretName: netobserv-ca-secret
 privateKey:
   algorithm: ECDSA
   size: 256
 issuerRef:
   name: netobserv-self-signed
   kind: Issuer
   group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
 name: netobserv-self-signed
 namespace: netobserv
spec:
 selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
 name: netobserv-issuer
 namespace: netobserv
spec:
 ca:
   secretName: netobserv-ca-secret
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: flowlogs-pipeline-cert
spec:
 secretName: flowlogs-pipeline-cert
 dnsNames:
 - flowlogs-pipeline.netobserv.svc
 - flowlogs-pipeline.netobserv.svc.cluster.local
 issuerRef:
   name: netobserv-issuer
   kind: Issuer
   group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: ebpf-agent-cert
 namespace: netobserv
spec:
 secretName: ebpf-agent-cert
 commonName: netobserv-ebpf-agent
 issuerRef:
   name: netobserv-issuer
   kind: Issuer
   group: cert-manager.io

Configure FlowCollector:

spec:
 processor:
   service:
     providedCertificates:
       caFile:
         file: ca.crt
         name: netobserv-ca-secret
         namespace: netobserv
         type: secret
       clientCert:
         certFile: tls.crt
         certKey: tls.key
         name: ebpf-agent-cert
         namespace: netobserv
         type: secret
       serverCert:
         certFile: tls.crt
         certKey: tls.key
         name: flowlogs-pipeline-cert
         namespace: netobserv
         type: secret
     tlsType: Provided

Dependencies

n/a

Checklist

  • Does the changes in PR need specific configuration or environment set up for testing?
    • if so please describe it in PR description.
  • I have added thorough unit tests for the change.
  • QE requirements (check 1 from the list):
  • Standard QE validation, with pre-merge tests unless stated otherwise.
  • Regression tests only (e.g. refactoring with no user-facing change).
  • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Mar 16, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign memodi for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot
Copy link
Copy Markdown
Collaborator

openshift-ci-robot commented Mar 16, 2026 •
edited by openshift-ci bot
Loading

@jotak: This pull request references NETOBSERV-1101 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Description

  • In provided mode, now if agent certificates/CA are provided from a different namespace, they are copied by the operator
  • When not in Auto mode, do not generate openshift annotation-based cert for FLP
  • Fix path missing /

To test Provided mode:

  • Install cert-manager

Install:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: netobserv-ca
 namespace: netobserv
spec:
 isCA: true
 commonName: netobserv-ca
 secretName: netobserv-ca-secret
 privateKey:
   algorithm: ECDSA
   size: 256
 issuerRef:
   name: netobserv-self-signed
   kind: Issuer
   group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
 name: netobserv-self-signed
 namespace: netobserv
spec:
 selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
 name: netobserv-issuer
 namespace: netobserv
spec:
 ca:
   secretName: netobserv-ca-secret
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: flowlogs-pipeline-cert
spec:
 secretName: flowlogs-pipeline-cert
 dnsNames:
 - flowlogs-pipeline.netobserv.svc
 - flowlogs-pipeline.netobserv.svc.cluster.local
 issuerRef:
   name: netobserv-issuer
   kind: Issuer
   group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: ebpf-agent-cert
 namespace: netobserv
spec:
 secretName: ebpf-agent-cert
 commonName: netobserv-ebpf-agent
 issuerRef:
   name: netobserv-issuer
   kind: Issuer
   group: cert-manager.io

Configure FlowCollector:

spec:
 processor:
   service:
     providedCertificates:
       caFile:
         file: ca.crt
         name: netobserv-ca-secret
         namespace: netobserv
         type: secret
       clientCert:
         certFile: tls.crt
         certKey: tls.key
         name: ebpf-agent-cert
         namespace: netobserv
         type: secret
       serverCert:
         certFile: tls.crt
         certKey: tls.key
         name: flowlogs-pipeline-cert
         namespace: netobserv
         type: secret
     tlsType: Provided

Dependencies

n/a

Checklist

  • Does the changes in PR need specific configuration or environment set up for testing?
    • if so please describe it in PR description.
  • I have added thorough unit tests for the change.
  • QE requirements (check 1 from the list):
  • Standard QE validation, with pre-merge tests unless stated otherwise.
  • Regression tests only (e.g. refactoring with no user-facing change).
  • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot
Copy link
Copy Markdown
Collaborator

openshift-ci-robot commented Mar 17, 2026 •
edited by openshift-ci bot
Loading

@jotak: This pull request references NETOBSERV-1101 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Description

  • In provided mode, now if agent certificates/CA are provided from a different namespace, they are copied by the operator (using our existing certificate watcher)
  • When not in Auto mode, do not generate openshift annotation-based cert for FLP
  • Fix path missing /

To test Provided mode:

  • Install cert-manager

Install:

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: netobserv-ca
 namespace: netobserv
spec:
 isCA: true
 commonName: netobserv-ca
 secretName: netobserv-ca-secret
 privateKey:
   algorithm: ECDSA
   size: 256
 issuerRef:
   name: netobserv-self-signed
   kind: Issuer
   group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
 name: netobserv-self-signed
 namespace: netobserv
spec:
 selfSigned: {}
---
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
 name: netobserv-issuer
 namespace: netobserv
spec:
 ca:
   secretName: netobserv-ca-secret
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: flowlogs-pipeline-cert
spec:
 secretName: flowlogs-pipeline-cert
 dnsNames:
 - flowlogs-pipeline.netobserv.svc
 - flowlogs-pipeline.netobserv.svc.cluster.local
 issuerRef:
   name: netobserv-issuer
   kind: Issuer
   group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
 name: ebpf-agent-cert
 namespace: netobserv
spec:
 secretName: ebpf-agent-cert
 commonName: netobserv-ebpf-agent
 issuerRef:
   name: netobserv-issuer
   kind: Issuer
   group: cert-manager.io

Configure FlowCollector:

spec:
 processor:
   service:
     providedCertificates:
       caFile:
         file: ca.crt
         name: netobserv-ca-secret
         namespace: netobserv
         type: secret
       clientCert:
         certFile: tls.crt
         certKey: tls.key
         name: ebpf-agent-cert
         namespace: netobserv
         type: secret
       serverCert:
         certFile: tls.crt
         certKey: tls.key
         name: flowlogs-pipeline-cert
         namespace: netobserv
         type: secret
     tlsType: Provided

Dependencies

n/a

Checklist

  • Does the changes in PR need specific configuration or environment set up for testing?
    • if so please describe it in PR description.
  • I have added thorough unit tests for the change.
  • QE requirements (check 1 from the list):
  • Standard QE validation, with pre-merge tests unless stated otherwise.
  • Regression tests only (e.g. refactoring with no user-facing change).
  • No QE (e.g. trivial change with high reviewer's confidence, or per agreement with the QE team).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@jotak jotak added ok-to-test To set manually when a PR is safe to test. Triggers image build on PR. needs-review Tells that the PR needs a review labels Mar 20, 2026
@jotak jotak requested a review from kapjain-rh March 20, 2026 07:36
@github-actions
Copy link
Copy Markdown

github-actions bot commented Mar 20, 2026

New images:

quay.io/netobserv/network-observability-operator:c3e18b6
quay.io/netobserv/network-observability-operator-bundle:v0.0.0-sha-c3e18b6
quay.io/netobserv/network-observability-operator-catalog:v0.0.0-sha-c3e18b6

They will expire in two weeks.

To deploy this build:

# Direct deployment, from operator repo
IMAGE=quay.io/netobserv/network-observability-operator:c3e18b6 make deploy

# Or using operator-sdk
operator-sdk run bundle quay.io/netobserv/network-observability-operator-bundle:v0.0.0-sha-c3e18b6

Or as a Catalog Source:

apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: netobserv-dev
  namespace: openshift-marketplace
spec:
  sourceType: grpc
  image: quay.io/netobserv/network-observability-operator-catalog:v0.0.0-sha-c3e18b6
  displayName: NetObserv development catalog
  publisher: Me
  updateStrategy:
    registryPoll:
      interval: 1m

leandroberetta
leandroberetta approved these changes Mar 27, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@leandroberetta leandroberetta left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@openshift-ci openshift-ci bot added the lgtm label Mar 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leandroberetta leandroberetta leandroberetta approved these changes

@luisjira luisjira Awaiting requested review from luisjira

@jpinsonneau jpinsonneau Awaiting requested review from jpinsonneau

@kapjain-rh kapjain-rh Awaiting requested review from kapjain-rh

Assignees

@leandroberetta leandroberetta

Labels

jira/valid-reference lgtm needs-review Tells that the PR needs a review ok-to-test To set manually when a PR is safe to test. Triggers image build on PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jotak @openshift-ci-robot @leandroberetta