From c62378b013e8dcf691b7d8c3e5ce0fb9ef152b5e Mon Sep 17 00:00:00 2001 From: chengjingtao Date: Wed, 13 May 2026 08:11:00 +0000 Subject: [PATCH 1/3] fix: short-circuit cert-rotation reconciler under USE_OLM_TLS MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #25 (using olm cert) patched two of the three knative.dev/pkg webhook components that touch the cert secret: 1. vendor/knative.dev/pkg/webhook/webhook.go TLS server's GetCertificate — read tls.crt / tls.key when USE_OLM_TLS 2. vendor/knative.dev/pkg/webhook/resourcesemantics/conversion/reconciler.go CRD caBundle sync — early-return when USE_OLM_TLS (OLM syncs caBundle) It missed the third one: vendor/knative.dev/pkg/webhook/certificates/certificates.go, the WebhookCertificates cert-rotation reconciler. In OLM mode that reconciler: 1. Reads the OLM-provisioned secret (type kubernetes.io/tls, keys tls.crt / tls.key / olmCAKey). 2. Sees its expected server-key.pem / server-cert.pem / ca-cert.pem missing, logs `Certificate secret "operator-webhook-service-cert" is missing key "server-key.pem"` at INFO. 3. Self-signs a new cert via certresources.MakeSecret (which only emits the three server-*.pem keys). 4. Replaces secret.Data wholesale — would clobber the OLM-injected tls.crt / tls.key. 5. Sends the Update; apiserver rejects because the kubernetes.io/tls secret type requires tls.crt / tls.key — logs `Reconcile error ... Secret ... is invalid: [data[tls.crt]: Required value, data[tls.key]: Required value]` at ERROR, then exponential-backoff retries indefinitely. Functionally harmless (the apiserver rejection is what stops the reconciler from corrupting OLM's cert), but the log spam is loud and hides real issues. The webhook server itself reads via the patched GetCertificate from #25 and serves correctly. Mirror PR #25's pattern — early-return at the top of reconcileCertificate when USE_OLM_TLS is set so the reconciler doesn't even try to rotate certs OLM is already managing. Co-Authored-By: Claude Opus 4.7 --- vendor/knative.dev/pkg/webhook/certificates/certificates.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/vendor/knative.dev/pkg/webhook/certificates/certificates.go b/vendor/knative.dev/pkg/webhook/certificates/certificates.go index 5239279e52..d5981e7517 100644 --- a/vendor/knative.dev/pkg/webhook/certificates/certificates.go +++ b/vendor/knative.dev/pkg/webhook/certificates/certificates.go @@ -20,6 +20,7 @@ import ( "context" "crypto/tls" "crypto/x509" + "os" "time" "go.uber.org/zap" @@ -63,6 +64,10 @@ func (r *reconciler) Reconcile(ctx context.Context, key string) error { func (r *reconciler) reconcileCertificate(ctx context.Context) error { logger := logging.FromContext(ctx) + if os.Getenv("USE_OLM_TLS") != "" { // olm manages cert rotation + return nil + } + secret, err := r.secretlister.Secrets(r.key.Namespace).Get(r.key.Name) if apierrors.IsNotFound(err) { // The secret should be created explicitly by a higher-level system From ed285a3aa2875b987ee8b6a34bb564dcb99d3a59 Mon Sep 17 00:00:00 2001 From: chengjingtao Date: Wed, 13 May 2026 08:15:45 +0000 Subject: [PATCH 2/3] hack/patches: add 008 for cert-rotation reconciler Mirrors hack/patches/006-conversion-webhook.patch and 007-conversion-reconciler.patch from PR #25 so the cert-rotation reconciler's USE_OLM_TLS guard also survives `go mod vendor` runs. The reason PR #25's vendor edits disappeared after the vuln-0512 sweep was that nobody ran `make update-deps` (= `git apply hack/patches/*.patch`) after the vendor regeneration. Adding 008 alongside its sibling patches keeps the recovery mechanical: `go mod vendor && make update-deps` reproduces the working tree. Without this file, a future vendor regeneration would silently revert this PR's fix the same way PR #28 reverted PR #25's. Co-Authored-By: Claude Opus 4.7 --- .../patches/008-certificates-reconciler.patch | 23 +++++++++++++++++++ .../pkg/webhook/certificates/certificates.go | 5 ---- 2 files changed, 23 insertions(+), 5 deletions(-) create mode 100644 hack/patches/008-certificates-reconciler.patch diff --git a/hack/patches/008-certificates-reconciler.patch b/hack/patches/008-certificates-reconciler.patch new file mode 100644 index 0000000000..b9857da108 --- /dev/null +++ b/hack/patches/008-certificates-reconciler.patch @@ -0,0 +1,23 @@ +diff --git a/vendor/knative.dev/pkg/webhook/certificates/certificates.go b/vendor/knative.dev/pkg/webhook/certificates/certificates.go +index 5239279..d5981e7 100644 +--- a/vendor/knative.dev/pkg/webhook/certificates/certificates.go ++++ b/vendor/knative.dev/pkg/webhook/certificates/certificates.go +@@ -20,6 +20,7 @@ import ( + "context" + "crypto/tls" + "crypto/x509" ++ "os" + "time" + + "go.uber.org/zap" +@@ -63,6 +64,10 @@ func (r *reconciler) Reconcile(ctx context.Context, key string) error { + func (r *reconciler) reconcileCertificate(ctx context.Context) error { + logger := logging.FromContext(ctx) + ++ if os.Getenv("USE_OLM_TLS") != "" { // olm manages cert rotation ++ return nil ++ } ++ + secret, err := r.secretlister.Secrets(r.key.Namespace).Get(r.key.Name) + if apierrors.IsNotFound(err) { + // The secret should be created explicitly by a higher-level system diff --git a/vendor/knative.dev/pkg/webhook/certificates/certificates.go b/vendor/knative.dev/pkg/webhook/certificates/certificates.go index d5981e7517..5239279e52 100644 --- a/vendor/knative.dev/pkg/webhook/certificates/certificates.go +++ b/vendor/knative.dev/pkg/webhook/certificates/certificates.go @@ -20,7 +20,6 @@ import ( "context" "crypto/tls" "crypto/x509" - "os" "time" "go.uber.org/zap" @@ -64,10 +63,6 @@ func (r *reconciler) Reconcile(ctx context.Context, key string) error { func (r *reconciler) reconcileCertificate(ctx context.Context) error { logger := logging.FromContext(ctx) - if os.Getenv("USE_OLM_TLS") != "" { // olm manages cert rotation - return nil - } - secret, err := r.secretlister.Secrets(r.key.Namespace).Get(r.key.Name) if apierrors.IsNotFound(err) { // The secret should be created explicitly by a higher-level system From f7806f873531203633c8575d9a1c80261a2ed91e Mon Sep 17 00:00:00 2001 From: chengjingtao Date: Wed, 13 May 2026 08:16:36 +0000 Subject: [PATCH 3/3] fix: re-include vendor edit dropped by 008 patch commit ed285a3 inadvertently staged a revert of vendor/.../certificates.go (a stale `git checkout 34c2b0fe -- vendor/...` from a patch round-trip test had left the index pointing at pre-fix content). HEAD's working tree still had the correct guarded version, but the commit captured the reverted index state. This commit puts the vendor edit back. End state on the branch: c62378b fix: short-circuit cert-rotation reconciler under USE_OLM_TLS (vendor edit) ed285a3 hack/patches: add 008 for cert-rotation reconciler (patch file only, vendor edit reverted) HEAD fix: re-include vendor edit dropped by 008 patch commit (vendor edit restored) Net diff PR #30 = +5 vendor lines + new hack/patches/008 file. Co-Authored-By: Claude Opus 4.7 --- vendor/knative.dev/pkg/webhook/certificates/certificates.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/vendor/knative.dev/pkg/webhook/certificates/certificates.go b/vendor/knative.dev/pkg/webhook/certificates/certificates.go index 5239279e52..d5981e7517 100644 --- a/vendor/knative.dev/pkg/webhook/certificates/certificates.go +++ b/vendor/knative.dev/pkg/webhook/certificates/certificates.go @@ -20,6 +20,7 @@ import ( "context" "crypto/tls" "crypto/x509" + "os" "time" "go.uber.org/zap" @@ -63,6 +64,10 @@ func (r *reconciler) Reconcile(ctx context.Context, key string) error { func (r *reconciler) reconcileCertificate(ctx context.Context) error { logger := logging.FromContext(ctx) + if os.Getenv("USE_OLM_TLS") != "" { // olm manages cert rotation + return nil + } + secret, err := r.secretlister.Secrets(r.key.Namespace).Get(r.key.Name) if apierrors.IsNotFound(err) { // The secret should be created explicitly by a higher-level system