[WIP] Use GetCertificate for certificate lazy loading #13695
Conversation
This patch uses `GetCertificate` to load certificate lazily. Activator loads the server certificates lazily by this patch. Note, the CA cert, which is used by `activator -> QP` does not do the lazy loading so activator restart is still necessary.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: nak3 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
knative-prow
bot
added
area/autoscale
approved
nak3
changed the title
knative-prow
bot
added
the
do-not-merge/work-in-progress
Codecov ReportBase: 86.23% // Head: 86.20% // Decreases project coverage by
Additional details and impacted files@@ Coverage Diff @@
## main #13695 +/- ##
==========================================
- Coverage 86.23% 86.20% -0.03%
==========================================
Files 197 197
Lines 14774 14777 +3
==========================================
- Hits 12740 12739 -1
- Misses 1732 1736 +4
Partials 302 302
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. ☔ View full report at Codecov. |
| @@ -165,6 +165,7 @@ func main() { | |||
| // Enable TLS client when queue-proxy-ca is specified. | |||
| // At this moment activator with TLS does not disable HTTP. | |||
| // See also https://github.com/knative/serving/issues/12808. | |||
| // Also, the current activator must be restarted when updating the secret of CA. | |||
There was a problem hiding this comment.
(Thinking out loud) It seems that a cert pool uses a map underneath would it be possible to override the existing rootCA pool when the secret is updated? What are the options here?
There was a problem hiding this comment.
Thank you for the comment.
Please let me try to solve only server cert part in this PR. Even only server certs part, it is not easy as some CI is failing and need to figure out it.
|
I will debug this on my local and hopefully re-open once figured out the probolem. |
This patch uses
GetCertificateto load certificate lazily. Activator loads the server certificates lazily by this patch.Note, the CA cert, which is used by
activator -> QPdoes not do the lazy loading so activator restart is still necessary.Part of #13694