{"action":"created","comment":{"url":"https://api.github.com/repos/kubevirt/kubevirt/pulls/comments/276718746","pull_request_review_id":228336288,"id":276718746,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDI3NjcxODc0Ng==","diff_hunk":"@@ -256,6 +256,22 @@ func newApiServerClusterRole() *rbacv1.ClusterRole {\n \t\t\t\t\t\"watch\", \"list\",\n \t\t\t\t},\n \t\t\t},\n+\t\t\t{\n+\t\t\t\tAPIGroups: []string{\n+\t\t\t\t\t\"certificates.k8s.io\",\n+\t\t\t\t},\n+\t\t\t\tResources: []string{\n+\t\t\t\t\t\"certificatesigningrequests\",\n+\t\t\t\t},\n+\t\t\t\tVerbs: []string{\n+\t\t\t\t\t\"create\",\n+\t\t\t\t\t\"update\",","path":"pkg/virt-operator/creation/rbac/apiserver.go","position":13,"original_position":13,"commit_id":"253242634c3f5ce9c14fe05272e6f0fc56ac4f25","original_commit_id":"253242634c3f5ce9c14fe05272e6f0fc56ac4f25","user":{"login":"davidvossel","id":683713,"node_id":"MDQ6VXNlcjY4MzcxMw==","avatar_url":"https://avatars0.githubusercontent.com/u/683713?v=4","gravatar_id":"","url":"https://api.github.com/users/davidvossel","html_url":"https://github.com/davidvossel","followers_url":"https://api.github.com/users/davidvossel/followers","following_url":"https://api.github.com/users/davidvossel/following{/other_user}","gists_url":"https://api.github.com/users/davidvossel/gists{/gist_id}","starred_url":"https://api.github.com/users/davidvossel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davidvossel/subscriptions","organizations_url":"https://api.github.com/users/davidvossel/orgs","repos_url":"https://api.github.com/users/davidvossel/repos","events_url":"https://api.github.com/users/davidvossel/events{/privacy}","received_events_url":"https://api.github.com/users/davidvossel/received_events","type":"User","site_admin":false},"body":"does the apiserver need \"update\" and \"delete\" privs here for csr?","created_at":"2019-04-18T15:34:49Z","updated_at":"2019-04-18T15:41:12Z","html_url":"https://github.com/kubevirt/kubevirt/pull/2027#discussion_r276718746","pull_request_url":"https://api.github.com/repos/kubevirt/kubevirt/pulls/2027","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/kubevirt/kubevirt/pulls/comments/276718746"},"html":{"href":"https://github.com/kubevirt/kubevirt/pull/2027#discussion_r276718746"},"pull_request":{"href":"https://api.github.com/repos/kubevirt/kubevirt/pulls/2027"}}},"pull_request":{"url":"https://api.github.com/repos/kubevirt/kubevirt/pulls/2027","id":253447560,"node_id":"MDExOlB1bGxSZXF1ZXN0MjUzNDQ3NTYw","html_url":"https://github.com/kubevirt/kubevirt/pull/2027","diff_url":"https://github.com/kubevirt/kubevirt/pull/2027.diff","patch_url":"https://github.com/kubevirt/kubevirt/pull/2027.patch","issue_url":"https://api.github.com/repos/kubevirt/kubevirt/issues/2027","number":2027,"state":"open","locked":false,"title":"Add CSR autosigning to kubevirt","user":{"login":"rmohr","id":4534621,"node_id":"MDQ6VXNlcjQ1MzQ2MjE=","avatar_url":"https://avatars3.githubusercontent.com/u/4534621?v=4","gravatar_id":"","url":"https://api.github.com/users/rmohr","html_url":"https://github.com/rmohr","followers_url":"https://api.github.com/users/rmohr/followers","following_url":"https://api.github.com/users/rmohr/following{/other_user}","gists_url":"https://api.github.com/users/rmohr/gists{/gist_id}","starred_url":"https://api.github.com/users/rmohr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmohr/subscriptions","organizations_url":"https://api.github.com/users/rmohr/orgs","repos_url":"https://api.github.com/users/rmohr/repos","events_url":"https://api.github.com/users/rmohr/events{/privacy}","received_events_url":"https://api.github.com/users/rmohr/received_events","type":"User","site_admin":false},"body":"**What this PR does / why we need it**:\r\n\r\nIn order to provide valid certificates to all our components, this PR copies and adjust the autoapprover controller for certificates from k8s. The approver watches sigining requests. Once it gets one, it checks if the requestor has access to the fictional `certificatesigningrequests/kubevirt` subresource. If yes, then it autosigns it if the common name and the orcanization in the request have a `kubevirt.io:system` prefix.\r\n\r\nThe cluster role which allows access to the fictional subresource looks like this:\r\n\r\n```yaml\r\napiVersion: rbac.authorization.k8s.io/v1\r\nkind: ClusterRole\r\nmetadata:\r\n  name: kubevirt.io:system:certificates.k8s.io:certificatesigningrequests:kubevirt\r\nrules:\r\n- apiGroups:\r\n  - certificates.k8s.io\r\n  resources:\r\n  - certificatesigningrequests/kubevirt\r\n  verbs:\r\n  - create\r\n```\r\n\r\nService accounts which need access can be added like this:\r\n\r\n```yaml\r\napiVersion: rbac.authorization.k8s.io/v1\r\nkind: ClusterRoleBinding\r\nmetadata:\r\n  name: kubevirt.io:system:bootstrap\r\nroleRef:\r\n  apiGroup: rbac.authorization.k8s.io\r\n  kind: ClusterRole\r\n  name: kubevirt.io:system:certificates.k8s.io:certificatesigningrequests:kubevirt\r\nsubjects:\r\n- kind: ServiceAccount\r\n  name: kubevirt-controller\r\n  namespace: kubevirt\r\n- kind: ServiceAccount\r\n  name: kubevirt-handler\r\n  namespace: kubevirt\r\n- kind: ServiceAccount\r\n  name: kubevirt-apiserver\r\n  namespace: kubevirt\r\n```\r\n\r\n**virt-handler**\r\n\r\nvirt-handler requests certificates on every start and uses a certificate manager to rotate certificates once the used certificate gets close to being expired. It does not care about reusing certificates. It just requests a new one on every start, because it will get a new IP on every start and we need a certificate which matches the IP.\r\n\r\nvirt-handler uses the certificate for:\r\n\r\n * authentication and encryption for migrations between two virt-handlers\r\n * providing valid certificate on it's rest API where for instance prometheus can scrape metrics\r\n\r\n**virt-controller**\r\n\r\nvirt-controller requests a new certificate on every start too. Every virt-controller instance therefore has it's own valid certificate which matches its podIP.\r\n\r\nvirt-controller uses the certificate for:\r\n\r\n * providing valid certificate on it's rest API where for instance prometheus can scrape metrics\r\n\r\n**virt-api**\r\n\r\nvirt-api uses it's own self-signed certificate right now, because there is not way to rotate certificates at the moment in a good way for aggregated apiservers. Therefore the virt-api prometheus metrics are exposed on an extra port.\r\n\r\n**certificatesigningrequest cleanup**\r\n\r\nAll components except `virt-api` use certificates in an ephemeral way. Once they start they request a new certificate. Old `certificatesigningrequests` are however not building up. k8s contains a CRS cleaner which will delete approved or denied requests after an hour. Pending requests will be deleted after 24 hours.\r\n\r\n**Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*:\r\nFixes #1632 once the PR is done\r\n\r\n**Special notes for your reviewer**:\r\n\r\n**Release note**:\r\n<!--  Write your release note:\r\n1. Enter your extended release note in the below block. If the PR requires additional action from users switching to the new release, include the string \"action required\".\r\n2. If no release note is required, just write \"NONE\".\r\n-->\r\n```release-note\r\nNONE\r\n```\r\n","created_at":"2019-02-15T14:31:10Z","updated_at":"2019-04-18T15:41:12Z","closed_at":null,"merged_at":null,"merge_commit_sha":"81a7b992992b01dd2e1f6e0728b8e4595f34879c","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":974593011,"node_id":"MDU6TGFiZWw5NzQ1OTMwMTE=","url":"https://api.github.com/repos/kubevirt/kubevirt/labels/do-not-merge/hold","name":"do-not-merge/hold","color":"e11d21","default":false},{"id":971140815,"node_id":"MDU6TGFiZWw5NzExNDA4MTU=","url":"https://api.github.com/repos/kubevirt/kubevirt/labels/release-note-none","name":"release-note-none","color":"c2e0c6","default":false},{"id":971140814,"node_id":"MDU6TGFiZWw5NzExNDA4MTQ=","url":"https://api.github.com/repos/kubevirt/kubevirt/labels/size/XXL","name":"size/XXL","color":"ee0000","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/kubevirt/kubevirt/pulls/2027/commits","review_comments_url":"https://api.github.com/repos/kubevirt/kubevirt/pulls/2027/comments","review_comment_url":"https://api.github.com/repos/kubevirt/kubevirt/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubevirt/kubevirt/issues/2027/comments","statuses_url":"https://api.github.com/repos/kubevirt/kubevirt/statuses/253242634c3f5ce9c14fe05272e6f0fc56ac4f25","head":{"label":"rmohr:prometheus-tls-future","ref":"prometheus-tls-future","sha":"253242634c3f5ce9c14fe05272e6f0fc56ac4f25","user":{"login":"rmohr","id":4534621,"node_id":"MDQ6VXNlcjQ1MzQ2MjE=","avatar_url":"https://avatars3.githubusercontent.com/u/4534621?v=4","gravatar_id":"","url":"https://api.github.com/users/rmohr","html_url":"https://github.com/rmohr","followers_url":"https://api.github.com/users/rmohr/followers","following_url":"https://api.github.com/users/rmohr/following{/other_user}","gists_url":"https://api.github.com/users/rmohr/gists{/gist_id}","starred_url":"https://api.github.com/users/rmohr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmohr/subscriptions","organizations_url":"https://api.github.com/users/rmohr/orgs","repos_url":"https://api.github.com/users/rmohr/repos","events_url":"https://api.github.com/users/rmohr/events{/privacy}","received_events_url":"https://api.github.com/users/rmohr/received_events","type":"User","site_admin":false},"repo":{"id":76846344,"node_id":"MDEwOlJlcG9zaXRvcnk3Njg0NjM0NA==","name":"kubevirt","full_name":"rmohr/kubevirt","private":false,"owner":{"login":"rmohr","id":4534621,"node_id":"MDQ6VXNlcjQ1MzQ2MjE=","avatar_url":"https://avatars3.githubusercontent.com/u/4534621?v=4","gravatar_id":"","url":"https://api.github.com/users/rmohr","html_url":"https://github.com/rmohr","followers_url":"https://api.github.com/users/rmohr/followers","following_url":"https://api.github.com/users/rmohr/following{/other_user}","gists_url":"https://api.github.com/users/rmohr/gists{/gist_id}","starred_url":"https://api.github.com/users/rmohr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmohr/subscriptions","organizations_url":"https://api.github.com/users/rmohr/orgs","repos_url":"https://api.github.com/users/rmohr/repos","events_url":"https://api.github.com/users/rmohr/events{/privacy}","received_events_url":"https://api.github.com/users/rmohr/received_events","type":"User","site_admin":false},"html_url":"https://github.com/rmohr/kubevirt","description":"KubeVirt is a virtual machine management architecture built around Kubernetes.","fork":true,"url":"https://api.github.com/repos/rmohr/kubevirt","forks_url":"https://api.github.com/repos/rmohr/kubevirt/forks","keys_url":"https://api.github.com/repos/rmohr/kubevirt/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rmohr/kubevirt/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rmohr/kubevirt/teams","hooks_url":"https://api.github.com/repos/rmohr/kubevirt/hooks","issue_events_url":"https://api.github.com/repos/rmohr/kubevirt/issues/events{/number}","events_url":"https://api.github.com/repos/rmohr/kubevirt/events","assignees_url":"https://api.github.com/repos/rmohr/kubevirt/assignees{/user}","branches_url":"https://api.github.com/repos/rmohr/kubevirt/branches{/branch}","tags_url":"https://api.github.com/repos/rmohr/kubevirt/tags","blobs_url":"https://api.github.com/repos/rmohr/kubevirt/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rmohr/kubevirt/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rmohr/kubevirt/git/refs{/sha}","trees_url":"https://api.github.com/repos/rmohr/kubevirt/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rmohr/kubevirt/statuses/{sha}","languages_url":"https://api.github.com/repos/rmohr/kubevirt/languages","stargazers_url":"https://api.github.com/repos/rmohr/kubevirt/stargazers","contributors_url":"https://api.github.com/repos/rmohr/kubevirt/contributors","subscribers_url":"https://api.github.com/repos/rmohr/kubevirt/subscribers","subscription_url":"https://api.github.com/repos/rmohr/kubevirt/subscription","commits_url":"https://api.github.com/repos/rmohr/kubevirt/commits{/sha}","git_commits_url":"https://api.github.com/repos/rmohr/kubevirt/git/commits{/sha}","comments_url":"https://api.github.com/repos/rmohr/kubevirt/comments{/number}","issue_comment_url":"https://api.github.com/repos/rmohr/kubevirt/issues/comments{/number}","contents_url":"https://api.github.com/repos/rmohr/kubevirt/contents/{+path}","compare_url":"https://api.github.com/repos/rmohr/kubevirt/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rmohr/kubevirt/merges","archive_url":"https://api.github.com/repos/rmohr/kubevirt/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rmohr/kubevirt/downloads","issues_url":"https://api.github.com/repos/rmohr/kubevirt/issues{/number}","pulls_url":"https://api.github.com/repos/rmohr/kubevirt/pulls{/number}","milestones_url":"https://api.github.com/repos/rmohr/kubevirt/milestones{/number}","notifications_url":"https://api.github.com/repos/rmohr/kubevirt/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rmohr/kubevirt/labels{/name}","releases_url":"https://api.github.com/repos/rmohr/kubevirt/releases{/id}","deployments_url":"https://api.github.com/repos/rmohr/kubevirt/deployments","created_at":"2016-12-19T09:10:20Z","updated_at":"2019-03-19T00:47:35Z","pushed_at":"2019-04-18T13:58:26Z","git_url":"git://github.com/rmohr/kubevirt.git","ssh_url":"git@github.com:rmohr/kubevirt.git","clone_url":"https://github.com/rmohr/kubevirt.git","svn_url":"https://github.com/rmohr/kubevirt","homepage":null,"size":185624,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":8,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":0,"open_issues":8,"watchers":0,"default_branch":"master"}},"base":{"label":"kubevirt:master","ref":"master","sha":"bfaba193500880d5eaa05fef46b91db3f3f06d6f","user":{"login":"kubevirt","id":18700703,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE4NzAwNzAz","avatar_url":"https://avatars1.githubusercontent.com/u/18700703?v=4","gravatar_id":"","url":"https://api.github.com/users/kubevirt","html_url":"https://github.com/kubevirt","followers_url":"https://api.github.com/users/kubevirt/followers","following_url":"https://api.github.com/users/kubevirt/following{/other_user}","gists_url":"https://api.github.com/users/kubevirt/gists{/gist_id}","starred_url":"https://api.github.com/users/kubevirt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubevirt/subscriptions","organizations_url":"https://api.github.com/users/kubevirt/orgs","repos_url":"https://api.github.com/users/kubevirt/repos","events_url":"https://api.github.com/users/kubevirt/events{/privacy}","received_events_url":"https://api.github.com/users/kubevirt/received_events","type":"Organization","site_admin":false},"repo":{"id":76686583,"node_id":"MDEwOlJlcG9zaXRvcnk3NjY4NjU4Mw==","name":"kubevirt","full_name":"kubevirt/kubevirt","private":false,"owner":{"login":"kubevirt","id":18700703,"node_id":"MDEyOk9yZ2FuaXphdGlvbjE4NzAwNzAz","avatar_url":"https://avatars1.githubusercontent.com/u/18700703?v=4","gravatar_id":"","url":"https://api.github.com/users/kubevirt","html_url":"https://github.com/kubevirt","followers_url":"https://api.github.com/users/kubevirt/followers","following_url":"https://api.github.com/users/kubevirt/following{/other_user}","gists_url":"https://api.github.com/users/kubevirt/gists{/gist_id}","starred_url":"https://api.github.com/users/kubevirt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubevirt/subscriptions","organizations_url":"https://api.github.com/users/kubevirt/orgs","repos_url":"https://api.github.com/users/kubevirt/repos","events_url":"https://api.github.com/users/kubevirt/events{/privacy}","received_events_url":"https://api.github.com/users/kubevirt/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/kubevirt/kubevirt","description":"Kubernetes Virtualization API and runtime in order to define and manage virtual machines.","fork":false,"url":"https://api.github.com/repos/kubevirt/kubevirt","forks_url":"https://api.github.com/repos/kubevirt/kubevirt/forks","keys_url":"https://api.github.com/repos/kubevirt/kubevirt/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubevirt/kubevirt/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubevirt/kubevirt/teams","hooks_url":"https://api.github.com/repos/kubevirt/kubevirt/hooks","issue_events_url":"https://api.github.com/repos/kubevirt/kubevirt/issues/events{/number}","events_url":"https://api.github.com/repos/kubevirt/kubevirt/events","assignees_url":"https://api.github.com/repos/kubevirt/kubevirt/assignees{/user}","branches_url":"https://api.github.com/repos/kubevirt/kubevirt/branches{/branch}","tags_url":"https://api.github.com/repos/kubevirt/kubevirt/tags","blobs_url":"https://api.github.com/repos/kubevirt/kubevirt/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubevirt/kubevirt/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubevirt/kubevirt/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubevirt/kubevirt/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubevirt/kubevirt/statuses/{sha}","languages_url":"https://api.github.com/repos/kubevirt/kubevirt/languages","stargazers_url":"https://api.github.com/repos/kubevirt/kubevirt/stargazers","contributors_url":"https://api.github.com/repos/kubevirt/kubevirt/contributors","subscribers_url":"https://api.github.com/repos/kubevirt/kubevirt/subscribers","subscription_url":"https://api.github.com/repos/kubevirt/kubevirt/subscription","commits_url":"https://api.github.com/repos/kubevirt/kubevirt/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubevirt/kubevirt/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubevirt/kubevirt/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubevirt/kubevirt/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubevirt/kubevirt/contents/{+path}","compare_url":"https://api.github.com/repos/kubevirt/kubevirt/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubevirt/kubevirt/merges","archive_url":"https://api.github.com/repos/kubevirt/kubevirt/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubevirt/kubevirt/downloads","issues_url":"https://api.github.com/repos/kubevirt/kubevirt/issues{/number}","pulls_url":"https://api.github.com/repos/kubevirt/kubevirt/pulls{/number}","milestones_url":"https://api.github.com/repos/kubevirt/kubevirt/milestones{/number}","notifications_url":"https://api.github.com/repos/kubevirt/kubevirt/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubevirt/kubevirt/labels{/name}","releases_url":"https://api.github.com/repos/kubevirt/kubevirt/releases{/id}","deployments_url":"https://api.github.com/repos/kubevirt/kubevirt/deployments","created_at":"2016-12-16T21:24:26Z","updated_at":"2019-04-18T14:42:58Z","pushed_at":"2019-04-18T15:32:00Z","git_url":"git://github.com/kubevirt/kubevirt.git","ssh_url":"git@github.com:kubevirt/kubevirt.git","clone_url":"https://github.com/kubevirt/kubevirt.git","svn_url":"https://github.com/kubevirt/kubevirt","homepage":"https://kubevirt.io","size":169933,"stargazers_count":1237,"watchers_count":1237,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":262,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":107,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0","node_id":"MDc6TGljZW5zZTI="},"forks":262,"open_issues":107,"watchers":1237,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubevirt/kubevirt/pulls/2027"},"html":{"href":"https://github.com/kubevirt/kubevirt/pull/2027"},"issue":{"href":"https://api.github.com/repos/kubevirt/kubevirt/issues/2027"},"comments":{"href":"https://api.github.com/repos/kubevirt/kubevirt/issues/2027/comments"},"review_comments":{"href":"https://api.github.com/repos/kubevirt/kubevirt/pulls/2027/comments"},"review_comment":{"href":"https://api.github.com/repos/kubevirt/kubevirt/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubevirt/kubevirt/pulls/2027/commits"},"statuses":{"href":"https://api.github.com/repos/kubevirt/kubevirt/statuses/253242634c3f5ce9c14fe05272e6f0fc56ac4f25"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"davidvossel"}}