Pipeline: Tekton Pipelines Integration with Istio

[jpower432]

Expected Behavior

To be able to submit a Tekton CR to K8 admission controller through tekton-pipelines-webhook with Istio integrated

Actual Behavior

The certificate on the tekton-pipelines-webhook secure backend has a no CN and only the SAN is populated with the service name. See the error below.

Steps to Reproduce the Problem

1. Install Istio v1.5
2. Install Tekton-Pipelines with sidecars auto-injection enabled
3. Try to submit a test Taskrun to the controller

Additional Info

• Kubernetes version:

Client Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.1", GitCommit:"7879fc12a63337efff607952a323df90cdc7a335", GitTreeState:"clean", BuildDate:"2020-04-08T17:38:50Z", GoVersion:"go1.13.9", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.3", GitCommit:"2e7996e3e2712684bc73f0dec0200d64eec7fe40", GitTreeState:"clean", BuildDate:"2020-05-20T12:43:34Z", GoVersion:"go1.13.9", Compiler:"gc", Platform:"linux/amd64"}

• Tekton Pipeline version: v0.11.0-rc2

• Istio Version: v1.5 - Strict mTLS enabled

[mattmoor]

cc @tcnghia

[afflom]

Since istio is providing mTLS for tekton in this instance, would it be acceptable for tekton to be deployed plain text comms between services? Is there a flag for that? @mattmoor @tcnghia

[afflom]

This should be closed by https://github.com/knative/pkg/pull/1384

[vdemeester]

@afflom we still need to bump our dependency on knative/pkg :upside_down_face:

[afflom]

Understood. I have patience. Thank you.

[vdemeester]

/kind misc
/assign

[vdemeester]

https://github.com/tektoncd/pipeline/blob/master/go.mod#L39 we now depend on knative 0.16. This should be fixed in 0.15.x (and on master)
/close

[tekton-robot]

@vdemeester: Closing this issue.

In response to this:

https://github.com/tektoncd/pipeline/blob/master/go.mod#L39 we now depend on knative 0.16. This should be fixed in 0.15.x (and on master)
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.