Skip to content

APIExport identity rotation - #4351

Open
mjudeikis wants to merge 9 commits into
kcp-dev:mainfrom
mjudeikis:apiexport-identity-rotation
Open

APIExport identity rotation#4351
mjudeikis wants to merge 9 commits into
kcp-dev:mainfrom
mjudeikis:apiexport-identity-rotation

Conversation

@mjudeikis

@mjudeikis mjudeikis commented Sep 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

This prs enables APIExport identity rotation but doing few things:

  1. Adding alias identities so we can serve 2+ identities at the same time
  2. etcd key rewrite for migratable data (identity is etcd key)
  3. fixup to informers machinery to prevent delete-> create being emited, instead it does update
  4. A lot of fixes to make it smooth.

What Type of PR Is This?

Related Issue(s)

Fixes #

Release Notes

Add APIExport identity migration in migration api

@kcp-ci-bot

kcp-ci-bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@kcp-ci-bot kcp-ci-bot added release-note-none Denotes a PR that doesn't merit a release note. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. dco-signoff: yes Indicates the PR's author has signed the DCO. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API labels Sep 4, 2026
@kcp-ci-bot

kcp-ci-bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mjudeikis for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kcp-ci-bot kcp-ci-bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Sep 4, 2026
@mjudeikis

mjudeikis commented Sep 4, 2026

Copy link
Copy Markdown
Contributor Author

/test all

@mjudeikis

mjudeikis commented Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

/test alll

@kcp-ci-bot

kcp-ci-bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

@mjudeikis: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

/build-image

/test pull-kcp-build-image

/test pull-kcp-lint

/test pull-kcp-test-e2e

/test pull-kcp-test-e2e-multiple-runs

/test pull-kcp-test-e2e-sharded

/test pull-kcp-test-e2e-shared

/test pull-kcp-test-integration

/test pull-kcp-test-unit

/test pull-kcp-validate-prow-yaml

/test pull-kcp-verify

/test pull-kcp-verify-codegen

The following commands are available to trigger optional jobs:

/test pull-kcp-test-e2e-sharded-controller-runtime

/test pull-kcp-test-e2e-sharded-embedded-vw

Use /test all to run the following jobs that were automatically triggered:

pull-kcp-build-image

pull-kcp-lint

pull-kcp-test-e2e

pull-kcp-test-e2e-multiple-runs

pull-kcp-test-e2e-sharded

pull-kcp-test-e2e-sharded-controller-runtime

pull-kcp-test-e2e-sharded-embedded-vw

pull-kcp-test-e2e-shared

pull-kcp-test-integration

pull-kcp-test-unit

pull-kcp-validate-prow-yaml

pull-kcp-verify

pull-kcp-verify-codegen
Details

In response to this:

/test alll

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@mjudeikis

mjudeikis commented Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

/test all

3 similar comments
@mjudeikis

mjudeikis commented Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

/test all

@mjudeikis

mjudeikis commented Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

/test all

@mjudeikis

mjudeikis commented Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

/test all

@mjudeikis

mjudeikis commented Sep 8, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@mjudeikis

mjudeikis commented Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

/test all

2 similar comments
@mjudeikis

mjudeikis commented Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

/test all

@mjudeikis

mjudeikis commented Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

/test all

@mjudeikis

mjudeikis commented Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@mjudeikis
mjudeikis marked this pull request as ready for review September 10, 2026 07:37
@mjudeikis mjudeikis changed the title WIP: APIExport identity rotation APIExport identity rotation Sep 10, 2026
@kcp-ci-bot kcp-ci-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. and removed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note-none Denotes a PR that doesn't merit a release note. labels Sep 10, 2026
mjudeikis
mjudeikis commented Sep 10, 2026
View reviewed changes
Comment thread staging/src/github.com/kcp-dev/sdk/apis/apis/v1alpha2/types_apiexport.go
//
// +optional
// +listType=set
IdentityAliasHashes []string `json:"identityAliasHashes,omitempty"`

@mjudeikis mjudeikis Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I dont quite like this. But we need something like this. And annotations looked like a bit of a brittle solution for them. Very much on the line with the shape of the api

@mjudeikis

mjudeikis commented Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

#4358 fixing flakes here

@mjudeikis
mjudeikis force-pushed the apiexport-identity-rotation branch from 9d92f58 to 2ce8e43 Compare September 10, 2026 11:10
@kcp-ci-bot

kcp-ci-bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

@mjudeikis: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-kcp-test-e2e-sharded 2ce8e43 link true /test pull-kcp-test-e2e-sharded

Full PR test history

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dco-signoff: yes Indicates the PR's author has signed the DCO. kind/api-change Categorizes issue or PR as related to adding, removing, or otherwise changing an API release-note Denotes a PR that will be considered when it comes time to generate release notes. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mjudeikis @kcp-ci-bot