Merge pull request openstack-k8s-operators#704 from stuggi/tls_memc

openshift-merge-bot[bot] · web-flow · commit 58d39d501fb7 · 2024-03-13T12:27:57.000Z
[tlse] memcached tls setup
diff --git a/apis/core/v1beta1/openstackcontrolplane_types.go b/apis/core/v1beta1/openstackcontrolplane_types.go
@@ -30,7 +30,6 @@ import (
 	keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1"
 	condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/route"
-	"github.com/openstack-k8s-operators/lib-common/modules/common/service"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/util"
 	"github.com/openstack-k8s-operators/lib-common/modules/storage"
@@ -822,17 +821,3 @@ func SetupDefaults() {
 
 	SetupOpenStackControlPlaneDefaults(openstackControlPlaneDefaults)
 }
-
-// Enabled - returns status of tls configuration for the passed in endpoint type
-func (t *TLSSection) Enabled(endpt service.Endpoint) bool {
-	if t != nil {
-		switch endpt {
-		case service.EndpointPublic:
-			return t.Ingress.Enabled
-
-		case service.EndpointInternal:
-			return t.PodLevel.Enabled
-		}
-	}
-	return false
-}
diff --git a/apis/go.mod b/apis/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/openstack-k8s-operators/horizon-operator/api v0.3.1-0.20240304130922-946bc7dd0996
 	github.com/openstack-k8s-operators/infra-operator/apis v0.3.1-0.20240308113717-eaf5876d69c3
 	github.com/openstack-k8s-operators/ironic-operator/api v0.3.1-0.20240229174131-28e3aee56d91
-	github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240307113114-033a606862c3
+	github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240310093110-b4b2614f40ba
 	github.com/openstack-k8s-operators/lib-common/modules/common v0.3.1-0.20240306153230-dc65ab49ebc0
 	github.com/openstack-k8s-operators/lib-common/modules/storage v0.3.1-0.20240306153230-dc65ab49ebc0
 	github.com/openstack-k8s-operators/manila-operator/api v0.3.1-0.20240305194401-0fda28a84acb
@@ -54,7 +54,7 @@ require (
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/gophercloud/gophercloud v1.10.0 // indirect
+	github.com/gophercloud/gophercloud v1.11.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
diff --git a/apis/go.sum b/apis/go.sum
@@ -46,8 +46,8 @@ github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 h1:pUa4ghanp6q4IJHwE9
 github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gophercloud/gophercloud v1.10.0 h1:watRMsaMDlSLuLkpLeLSQ87yvcuwIajNg6A5uLcjoIU=
-github.com/gophercloud/gophercloud v1.10.0/go.mod h1:aAVqcocTSXh2vYFZ1JTvx4EQmfgzxRcNupUfxZbBNDM=
+github.com/gophercloud/gophercloud v1.11.0 h1:ls0O747DIq1D8SUHc7r2vI8BFbMLeLFuENaAIfEx7OM=
+github.com/gophercloud/gophercloud v1.11.0/go.mod h1:aAVqcocTSXh2vYFZ1JTvx4EQmfgzxRcNupUfxZbBNDM=
 github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
 github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
@@ -89,8 +89,8 @@ github.com/openstack-k8s-operators/infra-operator/apis v0.3.1-0.20240308113717-e
 github.com/openstack-k8s-operators/infra-operator/apis v0.3.1-0.20240308113717-eaf5876d69c3/go.mod h1:yPqJ+WU8jApuDXNUjpTxMafihuZpX3Yik9ZXqGaxYBQ=
 github.com/openstack-k8s-operators/ironic-operator/api v0.3.1-0.20240229174131-28e3aee56d91 h1:3yvrS33IOQibrXJJlVs/fDxLi5RCZlN5oDrR2c8aShk=
 github.com/openstack-k8s-operators/ironic-operator/api v0.3.1-0.20240229174131-28e3aee56d91/go.mod h1:Yac7wRClzl1/a7uBso4w8wq6Rjm+JLIouEsLre7VSDE=
-github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240307113114-033a606862c3 h1:jMxdglPqLMuIM+s1aC1tYXz/NihB/BaMyutReg2fXpg=
-github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240307113114-033a606862c3/go.mod h1:UruMUJ8wX1fQPcY3olYneAx04Z1alk2Phq33prkoLZw=
+github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240310093110-b4b2614f40ba h1:0wfKrQMGwjh/kKTH/UpZGKk91HrnReYieHFG73OC+Vg=
+github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240310093110-b4b2614f40ba/go.mod h1:gB/IeXuvocAv0yNSf79U1lBHhbx6fdWUB501xFJ0l+A=
 github.com/openstack-k8s-operators/lib-common/modules/common v0.3.1-0.20240306153230-dc65ab49ebc0 h1:1Q/9F3SAKvLN9vX+YxwaEB0WvBekj9eakQPoQbI1K6w=
 github.com/openstack-k8s-operators/lib-common/modules/common v0.3.1-0.20240306153230-dc65ab49ebc0/go.mod h1:R2plZL2JdwDMJwv9+pkPmCB1Mww81J75G0MxRzi2Kug=
 github.com/openstack-k8s-operators/lib-common/modules/openstack v0.3.1-0.20240306153230-dc65ab49ebc0 h1:HRoVOnK5nOSvYKU3Y2N8Ed2SikuRQYSRESeo/ILv0vM=
diff --git a/go.mod b/go.mod
@@ -21,7 +21,7 @@ require (
 	github.com/openstack-k8s-operators/horizon-operator/api v0.3.1-0.20240304130922-946bc7dd0996
 	github.com/openstack-k8s-operators/infra-operator/apis v0.3.1-0.20240308113717-eaf5876d69c3
 	github.com/openstack-k8s-operators/ironic-operator/api v0.3.1-0.20240229174131-28e3aee56d91
-	github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240307113114-033a606862c3
+	github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240310093110-b4b2614f40ba
 	github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.0.0-20240306153230-dc65ab49ebc0
 	github.com/openstack-k8s-operators/lib-common/modules/common v0.3.1-0.20240306153230-dc65ab49ebc0
 	github.com/openstack-k8s-operators/lib-common/modules/test v0.3.1-0.20240306153230-dc65ab49ebc0
@@ -67,7 +67,7 @@ require (
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 // indirect
-	github.com/gophercloud/gophercloud v1.10.0 // indirect
+	github.com/gophercloud/gophercloud v1.11.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/k8snetworkplumbingwg/network-attachment-definition-client v1.4.0 // indirect
diff --git a/go.sum b/go.sum
@@ -52,8 +52,8 @@ github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98 h1:pUa4ghanp6q4IJHwE9
 github.com/google/pprof v0.0.0-20230926050212-f7f687d19a98/go.mod h1:czg5+yv1E0ZGTi6S6vVK1mke0fV+FaUhNGcd6VRS9Ik=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gophercloud/gophercloud v1.10.0 h1:watRMsaMDlSLuLkpLeLSQ87yvcuwIajNg6A5uLcjoIU=
-github.com/gophercloud/gophercloud v1.10.0/go.mod h1:aAVqcocTSXh2vYFZ1JTvx4EQmfgzxRcNupUfxZbBNDM=
+github.com/gophercloud/gophercloud v1.11.0 h1:ls0O747DIq1D8SUHc7r2vI8BFbMLeLFuENaAIfEx7OM=
+github.com/gophercloud/gophercloud v1.11.0/go.mod h1:aAVqcocTSXh2vYFZ1JTvx4EQmfgzxRcNupUfxZbBNDM=
 github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
 github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
@@ -103,8 +103,8 @@ github.com/openstack-k8s-operators/infra-operator/apis v0.3.1-0.20240308113717-e
 github.com/openstack-k8s-operators/infra-operator/apis v0.3.1-0.20240308113717-eaf5876d69c3/go.mod h1:yPqJ+WU8jApuDXNUjpTxMafihuZpX3Yik9ZXqGaxYBQ=
 github.com/openstack-k8s-operators/ironic-operator/api v0.3.1-0.20240229174131-28e3aee56d91 h1:3yvrS33IOQibrXJJlVs/fDxLi5RCZlN5oDrR2c8aShk=
 github.com/openstack-k8s-operators/ironic-operator/api v0.3.1-0.20240229174131-28e3aee56d91/go.mod h1:Yac7wRClzl1/a7uBso4w8wq6Rjm+JLIouEsLre7VSDE=
-github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240307113114-033a606862c3 h1:jMxdglPqLMuIM+s1aC1tYXz/NihB/BaMyutReg2fXpg=
-github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240307113114-033a606862c3/go.mod h1:UruMUJ8wX1fQPcY3olYneAx04Z1alk2Phq33prkoLZw=
+github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240310093110-b4b2614f40ba h1:0wfKrQMGwjh/kKTH/UpZGKk91HrnReYieHFG73OC+Vg=
+github.com/openstack-k8s-operators/keystone-operator/api v0.3.1-0.20240310093110-b4b2614f40ba/go.mod h1:gB/IeXuvocAv0yNSf79U1lBHhbx6fdWUB501xFJ0l+A=
 github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.0.0-20240306153230-dc65ab49ebc0 h1:5uv4LtcThS4hcfuecTJj+rXifbsPGcKRiyTvFXyDgNU=
 github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.0.0-20240306153230-dc65ab49ebc0/go.mod h1:GGbtUK5VQ/BHIT3n0ia31bzNJaQIAANhzT/nC6pygbQ=
 github.com/openstack-k8s-operators/lib-common/modules/common v0.3.1-0.20240306153230-dc65ab49ebc0 h1:1Q/9F3SAKvLN9vX+YxwaEB0WvBekj9eakQPoQbI1K6w=
diff --git a/pkg/openstack/barbican.go b/pkg/openstack/barbican.go
@@ -54,7 +54,7 @@ func ReconcileBarbican(ctx context.Context, instance *corev1beta1.OpenStackContr
 	}
 
 	// preserve any previously set TLS certs, set CA cert
-	if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+	if instance.Spec.TLS.PodLevel.Enabled {
 		instance.Spec.Barbican.Template.BarbicanAPI.TLS = barbican.Spec.BarbicanAPI.TLS
 	}
 	instance.Spec.Barbican.Template.BarbicanAPI.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName
diff --git a/pkg/openstack/cinder.go b/pkg/openstack/cinder.go
@@ -56,7 +56,7 @@ func ReconcileCinder(ctx context.Context, instance *corev1beta1.OpenStackControl
 	}
 
 	// preserve any previously set TLS certs,set CA cert
-	if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+	if instance.Spec.TLS.PodLevel.Enabled {
 		instance.Spec.Cinder.Template.CinderAPI.TLS = cinder.Spec.CinderAPI.TLS
 	}
 	instance.Spec.Cinder.Template.CinderAPI.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName
diff --git a/pkg/openstack/glance.go b/pkg/openstack/glance.go
@@ -68,7 +68,7 @@ func ReconcileGlance(ctx context.Context, instance *corev1beta1.OpenStackControl
 		}
 
 		// preserve any previously set TLS certs,set CA cert
-		if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+		if instance.Spec.TLS.PodLevel.Enabled {
 			glanceAPI.TLS.API = glance.Spec.GlanceAPIs[name].TLS.API
 		}
 		glanceAPI.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName
diff --git a/pkg/openstack/heat.go b/pkg/openstack/heat.go
@@ -67,7 +67,7 @@ func ReconcileHeat(ctx context.Context, instance *corev1beta1.OpenStackControlPl
 	}
 
 	// preserve any previously set TLS certs,set CA cert
-	if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+	if instance.Spec.TLS.PodLevel.Enabled {
 		instance.Spec.Heat.Template.HeatAPI.TLS = heat.Spec.HeatAPI.TLS
 		instance.Spec.Heat.Template.HeatCfnAPI.TLS = heat.Spec.HeatCfnAPI.TLS
 	}
diff --git a/pkg/openstack/horizon.go b/pkg/openstack/horizon.go
@@ -58,7 +58,7 @@ func ReconcileHorizon(ctx context.Context, instance *corev1beta1.OpenStackContro
 	}
 
 	// preserve any previously set TLS certs, set CA cert
-	if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+	if instance.Spec.TLS.PodLevel.Enabled {
 		instance.Spec.Horizon.Template.TLS = horizon.Spec.TLS
 	}
 	instance.Spec.Horizon.Template.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName
diff --git a/pkg/openstack/ironic.go b/pkg/openstack/ironic.go
@@ -64,7 +64,7 @@ func ReconcileIronic(ctx context.Context, instance *corev1beta1.OpenStackControl
 	}
 
 	// preserve any previously set TLS certs,set CA cert
-	if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+	if instance.Spec.TLS.PodLevel.Enabled {
 		instance.Spec.Ironic.Template.IronicAPI.TLS = ironic.Spec.IronicAPI.TLS
 		instance.Spec.Ironic.Template.IronicInspector.TLS = ironic.Spec.IronicInspector.TLS
 	}
diff --git a/pkg/openstack/keystone.go b/pkg/openstack/keystone.go
@@ -57,7 +57,7 @@ func ReconcileKeystoneAPI(ctx context.Context, instance *corev1beta1.OpenStackCo
 	}
 
 	// preserve any previously set TLS certs,set CA cert
-	if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+	if instance.Spec.TLS.PodLevel.Enabled {
 		instance.Spec.Keystone.Template.TLS = keystoneAPI.Spec.TLS
 	}
 	instance.Spec.Keystone.Template.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName
diff --git a/pkg/openstack/manila.go b/pkg/openstack/manila.go
@@ -56,7 +56,7 @@ func ReconcileManila(ctx context.Context, instance *corev1beta1.OpenStackControl
 	}
 
 	// preserve any previously set TLS certs, set CA cert
-	if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+	if instance.Spec.TLS.PodLevel.Enabled {
 		instance.Spec.Manila.Template.ManilaAPI.TLS = manila.Spec.ManilaAPI.TLS
 	}
 	instance.Spec.Manila.Template.ManilaAPI.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName
diff --git a/pkg/openstack/memcached.go b/pkg/openstack/memcached.go
@@ -6,13 +6,17 @@ import (
 	"strings"
 
 	memcachedv1 "github.com/openstack-k8s-operators/infra-operator/apis/memcached/v1beta1"
+	"github.com/openstack-k8s-operators/lib-common/modules/certmanager"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/service"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
 	corev1beta1 "github.com/openstack-k8s-operators/openstack-operator/apis/core/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -81,8 +85,11 @@ func ReconcileMemcacheds(
 	}
 
 	// then reconcile ones listed in spec
+	var ctrlResult ctrl.Result
+	var err error
+	var status memcachedStatus
 	for name, spec := range instance.Spec.Memcached.Templates {
-		status, err := reconcileMemcached(ctx, instance, helper, name, &spec)
+		status, ctrlResult, err = reconcileMemcached(ctx, instance, helper, name, &spec)
 
 		switch status {
 		case memcachedFailed:
@@ -105,7 +112,7 @@ func ReconcileMemcacheds(
 			corev1beta1.OpenStackControlPlaneMemcachedReadyErrorMessage,
 			errors))
 
-		return ctrl.Result{}, fmt.Errorf(errors)
+		return ctrlResult, fmt.Errorf(errors)
 
 	} else if len(inprogress) > 0 {
 		instance.Status.Conditions.Set(condition.FalseCondition(
@@ -120,7 +127,7 @@ func ReconcileMemcacheds(
 		)
 	}
 
-	return ctrl.Result{}, nil
+	return ctrlResult, nil
 }
 
 // reconcileMemcached -
@@ -130,7 +137,7 @@ func reconcileMemcached(
 	helper *helper.Helper,
 	name string,
 	spec *memcachedv1.MemcachedSpec,
-) (memcachedStatus, error) {
+) (memcachedStatus, ctrl.Result, error) {
 	memcached := &memcachedv1.Memcached{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      name,
@@ -142,15 +149,51 @@ func reconcileMemcached(
 
 	if !instance.Spec.Memcached.Enabled {
 		if _, err := EnsureDeleted(ctx, helper, memcached); err != nil {
-			return memcachedFailed, err
+			return memcachedFailed, ctrl.Result{}, err
 		}
 		instance.Status.Conditions.Remove(corev1beta1.OpenStackControlPlaneMemcachedReadyCondition)
-		return memcachedReady, nil
+		return memcachedReady, ctrl.Result{}, nil
 	}
 
 	Log.Info("Reconciling Memcached", "Memcached.Namespace", instance.Namespace, "Memcached.Name", name)
+
+	tlsCert := ""
+	if instance.Spec.TLS.PodLevel.Enabled {
+		certRequest := certmanager.CertificateRequest{
+			IssuerName: tls.DefaultCAPrefix + string(service.EndpointInternal),
+			CertName:   fmt.Sprintf("%s-svc", memcached.Name),
+			Hostnames: []string{
+				fmt.Sprintf("%s.%s.svc", name, instance.Namespace),
+				fmt.Sprintf("*.%s.%s.svc", name, instance.Namespace),
+			},
+		}
+		if instance.Spec.TLS.PodLevel.Internal.Cert.Duration != nil {
+			certRequest.Duration = &instance.Spec.TLS.PodLevel.Internal.Cert.Duration.Duration
+		}
+		if instance.Spec.TLS.PodLevel.Internal.Cert.RenewBefore != nil {
+			certRequest.RenewBefore = &instance.Spec.TLS.PodLevel.Internal.Cert.RenewBefore.Duration
+		}
+		certSecret, ctrlResult, err := certmanager.EnsureCert(
+			ctx,
+			helper,
+			certRequest)
+		if err != nil {
+			return memcachedFailed, ctrlResult, err
+		} else if (ctrlResult != ctrl.Result{}) {
+			return memcachedCreating, ctrlResult, nil
+		}
+
+		tlsCert = certSecret.Name
+	}
+
 	op, err := controllerutil.CreateOrPatch(ctx, helper.GetClient(), memcached, func() error {
 		spec.DeepCopyInto(&memcached.Spec)
+
+		if tlsCert != "" {
+			memcached.Spec.TLS.SecretName = ptr.To(tlsCert)
+		}
+		memcached.Spec.TLS.CaBundleSecretName = tls.CABundleSecret
+
 		err := controllerutil.SetControllerReference(helper.GetBeforeObject(), memcached, helper.GetScheme())
 		if err != nil {
 			return err
@@ -160,15 +203,15 @@ func reconcileMemcached(
 	})
 
 	if err != nil {
-		return memcachedFailed, err
+		return memcachedFailed, ctrl.Result{}, err
 	}
 	if op != controllerutil.OperationResultNone {
 		Log.Info(fmt.Sprintf("Memcached %s - %s", memcached.Name, op))
 	}
 
 	if memcached.IsReady() {
-		return memcachedReady, nil
+		return memcachedReady, ctrl.Result{}, nil
 	}
 
-	return memcachedCreating, nil
+	return memcachedCreating, ctrl.Result{}, nil
 }
diff --git a/pkg/openstack/neutron.go b/pkg/openstack/neutron.go
@@ -59,7 +59,7 @@ func ReconcileNeutron(ctx context.Context, instance *corev1beta1.OpenStackContro
 	}
 
 	// preserve any previously set TLS certs,set CA cert
-	if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+	if instance.Spec.TLS.PodLevel.Enabled {
 		instance.Spec.Neutron.Template.TLS = neutronAPI.Spec.TLS
 
 		serviceName := "neutron"
diff --git a/pkg/openstack/nova.go b/pkg/openstack/nova.go
@@ -76,7 +76,7 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl
 				nova.Name+"-api")
 	}
 	// preserve any previously set TLS certs,set CA cert
-	if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+	if instance.Spec.TLS.PodLevel.Enabled {
 		instance.Spec.Nova.Template.APIServiceTemplate.TLS = nova.Spec.APIServiceTemplate.TLS
 	}
 	instance.Spec.Nova.Template.APIServiceTemplate.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName
@@ -89,7 +89,7 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl
 		instance.Spec.Nova.Template.MetadataServiceTemplate.Override.Service.AddLabel(centralMetadataLabelMap(nova.Name))
 
 		// preserve any previously set TLS certs,set CA cert
-		if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+		if instance.Spec.TLS.PodLevel.Enabled {
 			instance.Spec.Nova.Template.MetadataServiceTemplate.TLS = nova.Spec.MetadataServiceTemplate.TLS
 		}
 		instance.Spec.Nova.Template.MetadataServiceTemplate.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName
@@ -104,7 +104,7 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl
 			cellTemplate.NoVNCProxyServiceTemplate.Override.Service.AddLabel(getNoVNCProxyLabelMap(nova.Name, cellName))
 
 			// preserve any previously set TLS certs,set CA cert
-			if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+			if instance.Spec.TLS.PodLevel.Enabled {
 				cellTemplate.NoVNCProxyServiceTemplate.TLS = nova.Spec.CellTemplates[cellName].NoVNCProxyServiceTemplate.TLS
 			}
 			cellTemplate.NoVNCProxyServiceTemplate.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName
@@ -118,7 +118,7 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl
 			cellTemplate.MetadataServiceTemplate.Override.Service.AddLabel(cellMetadataLabelMap(nova.Name, cellName))
 
 			// preserve any previously set TLS certs,set CA cert
-			if instance.Spec.TLS.Enabled(service.EndpointInternal) {
+			if instance.Spec.TLS.PodLevel.Enabled {
 				cellTemplate.MetadataServiceTemplate.TLS = nova.Spec.CellTemplates[cellName].MetadataServiceTemplate.TLS
 			}
 			cellTemplate.MetadataServiceTemplate.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName
@@ -166,7 +166,7 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl
 	}
 
 	// create certificate for central Metadata agent if internal TLS and Metadata are enabled
-	if instance.Spec.TLS.Enabled(service.EndpointInternal) &&
+	if instance.Spec.TLS.PodLevel.Enabled &&
 		metadataEnabled(instance.Spec.Nova.Template.MetadataServiceTemplate) {
 		certScrt, ctrlResult, err := certmanager.EnsureCertForServiceWithSelector(
 			ctx,
@@ -187,7 +187,7 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl
 	// cell Metadata and NoVNCProxy
 	for cellName, cellTemplate := range instance.Spec.Nova.Template.CellTemplates {
 		// create certificate for Metadata agend if internal TLS and Metadata per cell is enabled
-		if instance.Spec.TLS.Enabled(service.EndpointInternal) &&
+		if instance.Spec.TLS.PodLevel.Enabled &&
 			metadataEnabled(cellTemplate.MetadataServiceTemplate) {
 
 			certScrt, ctrlResult, err := certmanager.EnsureCertForServiceWithSelector(
diff --git a/pkg/openstack/ovn.go b/pkg/openstack/ovn.go
diff --git a/pkg/openstack/placement.go b/pkg/openstack/placement.go
diff --git a/pkg/openstack/rabbitmq.go b/pkg/openstack/rabbitmq.go
diff --git a/pkg/openstack/swift.go b/pkg/openstack/swift.go

Original file line number	Diff line number	Diff line change
`@@ -54,7 +54,7 @@ func ReconcileBarbican(ctx context.Context, instance *corev1beta1.OpenStackContr`
`54`	`54`	`}`
`55`	`55`
`56`	`56`	`// preserve any previously set TLS certs, set CA cert`
`57`		`- if instance.Spec.TLS.Enabled(service.EndpointInternal) {`
	`57`	`+ if instance.Spec.TLS.PodLevel.Enabled {`
`58`	`58`	`instance.Spec.Barbican.Template.BarbicanAPI.TLS = barbican.Spec.BarbicanAPI.TLS`
`59`	`59`	`}`
`60`	`60`	`instance.Spec.Barbican.Template.BarbicanAPI.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName`
Original file line number	Diff line number	Diff line change
`@@ -56,7 +56,7 @@ func ReconcileCinder(ctx context.Context, instance *corev1beta1.OpenStackControl`
`56`	`56`	`}`
`57`	`57`
`58`	`58`	`// preserve any previously set TLS certs,set CA cert`
`59`		`- if instance.Spec.TLS.Enabled(service.EndpointInternal) {`
	`59`	`+ if instance.Spec.TLS.PodLevel.Enabled {`
`60`	`60`	`instance.Spec.Cinder.Template.CinderAPI.TLS = cinder.Spec.CinderAPI.TLS`
`61`	`61`	`}`
`62`	`62`	`instance.Spec.Cinder.Template.CinderAPI.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName`
Original file line number	Diff line number	Diff line change
`@@ -68,7 +68,7 @@ func ReconcileGlance(ctx context.Context, instance *corev1beta1.OpenStackControl`
`68`	`68`	`}`
`69`	`69`
`70`	`70`	`// preserve any previously set TLS certs,set CA cert`
`71`		`- if instance.Spec.TLS.Enabled(service.EndpointInternal) {`
	`71`	`+ if instance.Spec.TLS.PodLevel.Enabled {`
`72`	`72`	`glanceAPI.TLS.API = glance.Spec.GlanceAPIs[name].TLS.API`
`73`	`73`	`}`
`74`	`74`	`glanceAPI.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName`
Original file line number	Diff line number	Diff line change
`@@ -67,7 +67,7 @@ func ReconcileHeat(ctx context.Context, instance *corev1beta1.OpenStackControlPl`
`67`	`67`	`}`
`68`	`68`
`69`	`69`	`// preserve any previously set TLS certs,set CA cert`
`70`		`- if instance.Spec.TLS.Enabled(service.EndpointInternal) {`
	`70`	`+ if instance.Spec.TLS.PodLevel.Enabled {`
`71`	`71`	`instance.Spec.Heat.Template.HeatAPI.TLS = heat.Spec.HeatAPI.TLS`
`72`	`72`	`instance.Spec.Heat.Template.HeatCfnAPI.TLS = heat.Spec.HeatCfnAPI.TLS`
`73`	`73`	`}`
Original file line number	Diff line number	Diff line change
`@@ -58,7 +58,7 @@ func ReconcileHorizon(ctx context.Context, instance *corev1beta1.OpenStackContro`
`58`	`58`	`}`
`59`	`59`
`60`	`60`	`// preserve any previously set TLS certs, set CA cert`
`61`		`- if instance.Spec.TLS.Enabled(service.EndpointInternal) {`
	`61`	`+ if instance.Spec.TLS.PodLevel.Enabled {`
`62`	`62`	`instance.Spec.Horizon.Template.TLS = horizon.Spec.TLS`
`63`	`63`	`}`
`64`	`64`	`instance.Spec.Horizon.Template.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName`