Watch ambassador-certs and ambassador-cacert secrets to avoid need to restart Ambassador
See original GitHub issueWhen setting up TLS termination following https://www.getambassador.io/user-guide/tls-termination, it took me a while to realize that I needed to restart Ambassador for it to detect the ambassador-certs
secret I had created. The same way ambassador/kubewatch.py
watches services for annotation changes, it could watch the ambassador-certs
secret (and the ambassador-cacert
secret while we’re at it).
The watch loops would run concurrently. The official Kubernetes client isn’t asyncio-friendly at the moment https://github.com/kubernetes-client/python/issues?utf8=✓&q=asyncio, but concurrent.futures
with threads or raw threading
would do the trick. If time allows, this multi-watch logic could be implemented upstream in the Kubernetes client: https://github.com/kubernetes-client/python/issues/30
In the meantime, a bold warning in the documentation would be helpful.
Issue Analytics
- State:
- Created 5 years ago
- Reactions:3
- Comments:5 (4 by maintainers)
Top GitHub Comments
@KowalczykBartek volunteered to work on this earlier today 🎉
Done in RC6.