Conversation
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
b01ee71 to
8ca54aa
Compare
|
Build failed (check pipeline). Post ❌ openstack-k8s-operators-content-provider FAILURE in 7m 30s |
8ca54aa to
d167503
Compare
The Skupper Keystone Listener is created before OSCP deployment (services need immediate authentication), but its TLS certificate only becomes available after OSCP creates the cert-manager Issuer. The Listener does not auto-reconcile when the certificate appears later, leaving it unconfigured and blocking OSCP readiness. Add a scenario-gated task between apply and wait_conditions that waits for the certificate and restarts the Skupper controller deployment. On restart, the controller re-reads all Listeners and configures successfully. Gated on cifmw_skupper_keystone_enabled and the control-plane2 stage, so it only runs for SKMO deployments. Signed-off-by: Samuel Rac <srac@redhat.com>
d167503 to
8d4e82d
Compare
srac0
changed the title
|
This PR is stale because it has been for over 15 days with no activity. |
1 participant
The Skupper Listener playbook creates a cert-manager Certificate and immediately attempts to create a Listener referencing the TLS secret. In practice, cert-manager can take 5-10 minutes to issue certificates, causing the Listener to enter an Error state when the secret doesn't exist yet. The Skupper controller does not re-reconcile automatically, leaving the Listener permanently broken.