Only mount untrusted CA in tekton
ACME generated certs from cert-manager don't have a ca.crt key.
*
@@ -344,6 +344,12 @@ func getRegistryCAHash(ctx context.Context, c *kubernetes.Cluster) (string, erro
return "", err
}
+ // cert-manager doesn't add the CA for ACME certificates:
+ // https://github.com/jetstack/cert-manager/issues/2111
+ if _, found := secret.Data["ca.crt"]; !found {
+ return "", nil
+ }
+
hash, err := GenerateHash(secret.Data["ca.crt"])
if err != nil {
return "", err
@@ -373,9 +379,8 @@ func applyTektonStaging(ctx context.Context, c *kubernetes.Cluster, domain strin
return errors.Wrapf(err, "failed to unmarshal task %s", string(fileContents))
}
- // TODO this workaround is only needed for untrusted certs, but it
- // doesn't hurt to do it for trusted CAs, too. Once we can reach
- // Tekton via linkerd, blocked by
+ // TODO this workaround is only needed for untrusted certs.
+ // Once we can reach Tekton via linkerd, blocked by
// https://github.com/tektoncd/catalog/issues/757, we can remove the
// workaround.
@@ -386,6 +391,7 @@ func applyTektonStaging(ctx context.Context, c *kubernetes.Cluster, domain strin
return errors.Wrapf(err, "Failed to get registry CA from %s namespace", TektonStagingNamespace)
}
+ if caHash != "" {
volume := corev1.Volume{
Name: "registry-certs",
VolumeSource: corev1.VolumeSource{
@@ -408,6 +414,7 @@ func applyTektonStaging(ctx context.Context, c *kubernetes.Cluster, domain strin
break
}
}
+ }
clientSet, err := versioned.NewForConfig(c.RestConfig)
if err != nil {
