Skip to content

Commit 4a24ead

Browse files
YCShen1010YCShen1010
authored
Enhance Keycloak 26 truststore file and sa certs import (#2338)
* remove truststore startup configmap for keycloak 24 and 26 Signed-off-by: YuChen <yuchen.shen@mail.utoronto.ca> * create convert keycloak certs job Signed-off-by: YuChen <yuchen.shen@mail.utoronto.ca> * updates rules Signed-off-by: YuChen <yuchen.shen@mail.utoronto.ca> * add spec.truststores for keycloak 24+ Signed-off-by: YuChen <yuchen.shen@mail.utoronto.ca> * generate secrets conversion script Signed-off-by: YuChen <yuchen.shen@mail.utoronto.ca> * create cpfs-utils image as env value Signed-off-by: YuChen <yuchen.shen@mail.utoronto.ca> * add untils image to non olm Signed-off-by: YuChen <yuchen.shen@mail.utoronto.ca> --------- Signed-off-by: YuChen <yuchen.shen@mail.utoronto.ca>
1 parent 2438f53 commit 4a24ead

File tree

6 files changed

+136
-36
lines changed

6 files changed

+136
-36
lines changed

‎api/v3/commonservice_types.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ type CSData struct {
4747
ExcludedCatalog string
4848
StatusMonitoredServices string
4949
ServiceNames map[string][]string
50+
UtilsImage string
5051
}
5152

5253
// +kubebuilder:pruning:PreserveUnknownFields

‎bundle/manifests/ibm-common-service-operator.clusterserviceversion.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ metadata:
2323
capabilities: Seamless Upgrades
2424
cloudPakThemesVersion: styles4100.css
2525
containerImage: icr.io/cpopen/common-service-operator:4.12.0
26-
createdAt: "2025-02-20T00:28:09Z"
26+
createdAt: "2025-03-18T21:27:31Z"
2727
description: The IBM Cloud Pak foundational services operator is used to deploy IBM foundational services.
2828
features.operators.openshift.io/disconnected: "true"
2929
features.operators.openshift.io/fips-compliant: "true"
@@ -383,6 +383,8 @@ spec:
383383
fieldPath: metadata.annotations['olm.targetNamespaces']
384384
- name: OPERATOR_NAME
385385
value: ibm-common-service-operator
386+
- name: UTILS_IMAGE
387+
value: icr.io/cpopen/cpfs/cpfs-utils:latest
386388
image: icr.io/cpopen/common-service-operator:4.12.0
387389
imagePullPolicy: IfNotPresent
388390
livenessProbe:

‎config/manager/manager.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,8 @@ spec:
7474
fieldPath: metadata.annotations['olm.targetNamespaces']
7575
- name: OPERATOR_NAME
7676
value: "ibm-common-service-operator"
77+
- name: UTILS_IMAGE
78+
value: icr.io/cpopen/cpfs/cpfs-utils:latest
7779
resources:
7880
limits:
7981
cpu: 500m

‎internal/controller/bootstrap/init.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ func NewNonOLMBootstrap(mgr manager.Manager) (bs *Bootstrap, err error) {
117117
ExcludedCatalog: constant.ExcludedCatalog,
118118
StatusMonitoredServices: constant.StatusMonitoredServices,
119119
ServiceNames: constant.ServiceNames,
120+
UtilsImage: util.GetUtilsImage(),
120121
}
121122

122123
bs = &Bootstrap{
@@ -162,6 +163,7 @@ func NewBootstrap(mgr manager.Manager) (bs *Bootstrap, err error) {
162163
ExcludedCatalog: constant.ExcludedCatalog,
163164
StatusMonitoredServices: constant.StatusMonitoredServices,
164165
ServiceNames: constant.ServiceNames,
166+
UtilsImage: util.GetUtilsImage(),
165167
}
166168

167169
bs = &Bootstrap{

‎internal/controller/common/util.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -279,6 +279,14 @@ func GetWatchNamespace() string {
279279
return ns
280280
}
281281

282+
func GetUtilsImage() string {
283+
image, found := os.LookupEnv("UTILS_IMAGE")
284+
if !found {
285+
return ""
286+
}
287+
return image
288+
}
289+
282290
// GetNSSCMSynchronization returns whether NSS ConfigMap shchronization with OperatorGroup is enabled
283291
func GetNSSCMSynchronization() bool {
284292
isEnable, found := os.LookupEnv("NSSCM_SYNC_MODE")

‎internal/controller/constant/odlm.go‎

Lines changed: 120 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -784,9 +784,7 @@ spec:
784784
privileged: false
785785
readOnlyRootFilesystem: false
786786
containers:
787-
- command:
788-
- bash
789-
- '-c'
787+
- command: ["bash", "-c"]
790788
args:
791789
- |
792790
kubectl delete pods -l app.kubernetes.io/name=cloud-native-postgresql
@@ -831,19 +829,9 @@ spec:
831829
namespace: "{{ $.OperatorNs }}"
832830
data:
833831
rules:
834-
- apiGroups:
835-
- ""
836-
resources:
837-
- pods
838-
- secrets
839-
verbs:
840-
- create
841-
- update
842-
- patch
843-
- get
844-
- list
845-
- delete
846-
- watch
832+
- apiGroups: [""]
833+
resources: ["pods", "secrets"]
834+
verbs: ["create", "update", "patch", "get", "list", "delete", "watch"]
847835
- apiVersion: rbac.authorization.k8s.io/v1
848836
kind: RoleBinding
849837
name: edb-license-rolebinding
@@ -1041,6 +1029,94 @@ spec:
10411029
force: true
10421030
kind: ConfigMap
10431031
name: cs-keycloak-user-profile
1032+
- apiVersion: v1
1033+
kind: ServiceAccount
1034+
name: convert-secret-sa
1035+
- apiVersion: rbac.authorization.k8s.io/v1
1036+
kind: Role
1037+
name: convert-secret-role
1038+
data:
1039+
rules:
1040+
- apiGroups: [""]
1041+
resources: ["configmaps", "secrets"]
1042+
verbs: ["create", "update", "patch", "get", "list", "delete", "watch"]
1043+
- apiVersion: rbac.authorization.k8s.io/v1
1044+
kind: RoleBinding
1045+
name: convert-secret-rolebinding
1046+
data:
1047+
subjects:
1048+
- kind: ServiceAccount
1049+
name: convert-secret-sa
1050+
roleRef:
1051+
kind: Role
1052+
name: convert-secret-role
1053+
apiGroup: rbac.authorization.k8s.io
1054+
- apiVersion: v1
1055+
kind: ConfigMap
1056+
name: convert-secrets
1057+
data:
1058+
data:
1059+
convert-secrets.sh: |
1060+
#!/usr/bin/env bash
1061+
# Check if the secret already exists
1062+
if oc get secret cs-keycloak-ca-certs >/dev/null 2>&1; then
1063+
echo "Secret cs-keycloak-ca-certs already exists. Skipping conversion."
1064+
exit 0
1065+
fi
1066+
1067+
# Check if ConfigMap exists
1068+
if ! oc get configmap cs-keycloak-ca-certs >/dev/null 2>&1; then
1069+
echo "ConfigMap cs-keycloak-ca-certs not found. Nothing to conversion."
1070+
exit 0
1071+
fi
1072+
1073+
# Extract certificate file names from ConfigMap
1074+
CERT_FILES=$(oc get configmap cs-keycloak-ca-certs -o yaml | yq e '.data | keys | .[]' -)
1075+
1076+
# Create a temporary directory
1077+
mkdir -p /tmp/certs
1078+
# Extract certificates from ConfigMap and save them as files
1079+
for CERT in $CERT_FILES; do
1080+
oc get configmap cs-keycloak-ca-certs -o yaml | yq e ".data[\"$CERT\"]"> /tmp/certs/$CERT
1081+
done
1082+
1083+
# Create Secret from extracted certificates
1084+
oc create secret generic cs-keycloak-ca-certs \
1085+
$(for CERT in $CERT_FILES; do echo --from-file=/tmp/certs/$CERT; done)
1086+
1087+
echo "Conversion complete. Secret created: cs-keycloak-ca-certs"
1088+
- apiVersion: batch/v1
1089+
kind: Job
1090+
force: true
1091+
name: convert-secret-job
1092+
data:
1093+
spec:
1094+
template:
1095+
spec:
1096+
affinity:
1097+
nodeAffinity:
1098+
requiredDuringSchedulingIgnoredDuringExecution:
1099+
nodeSelectorTerms:
1100+
- matchExpressions:
1101+
- key: kubernetes.io/arch
1102+
operator: In
1103+
values:
1104+
- amd64
1105+
- ppc64le
1106+
- s390x
1107+
restartPolicy: OnFailure
1108+
serviceAccountName: convert-secret-sa
1109+
containers:
1110+
- name: convert-secret-job
1111+
image: {{ .UtilsImage }}
1112+
command: ["/bin/sh", "/mnt/scripts/convert-secrets.sh"]
1113+
volumeMounts:
1114+
- name: script-volume
1115+
mountPath: /mnt/scripts
1116+
volumes:
1117+
- name: script-volume
1118+
configMap:
1119+
name: convert-secrets
10441120
- apiVersion: v1
10451121
annotations:
10461122
service.beta.openshift.io/serving-cert-secret-name: cpfs-opcon-cs-keycloak-tls-secret
@@ -1151,6 +1227,11 @@ spec:
11511227
- amd64
11521228
- ppc64le
11531229
- s390x
1230+
truststores:
1231+
my-truststore:
1232+
secret:
1233+
name: cs-keycloak-ca-certs
1234+
optional: true
11541235
proxy:
11551236
headers: xforwarded
11561237
features:
@@ -1230,9 +1311,7 @@ spec:
12301311
required: true
12311312
spec:
12321313
containers:
1233-
- command:
1234-
- /bin/sh
1235-
- /mnt/startup/cs-keycloak-entrypoint.sh
1314+
- command: ["/bin/sh", "/mnt/startup/cs-keycloak-entrypoint.sh"]
12361315
volumeMounts:
12371316
- mountPath: /mnt/truststore
12381317
name: truststore-volume
@@ -1315,6 +1394,24 @@ spec:
13151394
kind: CustomResourceDefinition
13161395
key: .spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.scheduling
13171396
operator: DoesNotExist
1397+
- path: .spec.unsupported.podTemplate.spec.containers[0].command
1398+
operation: remove
1399+
matchExpressions:
1400+
- objectRef:
1401+
name: keycloaks.k8s.keycloak.org
1402+
apiVersion: apiextensions.k8s.io/v1
1403+
kind: CustomResourceDefinition
1404+
key: .spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.truststores
1405+
operator: Exists
1406+
- path: .spec.truststores
1407+
operation: remove
1408+
matchExpressions:
1409+
- objectRef:
1410+
name: keycloaks.k8s.keycloak.org
1411+
apiVersion: apiextensions.k8s.io/v1
1412+
kind: CustomResourceDefinition
1413+
key: .spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.truststores
1414+
operator: DoesNotExist
13181415
- apiVersion: v1
13191416
kind: ConfigMap
13201417
force: true
@@ -1482,9 +1579,7 @@ spec:
14821579
privileged: false
14831580
readOnlyRootFilesystem: false
14841581
containers:
1485-
- command:
1486-
- bash
1487-
- '-c'
1582+
- command: ["bash", "-c"]
14881583
args:
14891584
- |
14901585
kubectl delete pods -l app.kubernetes.io/name=cloud-native-postgresql
@@ -1529,19 +1624,9 @@ spec:
15291624
namespace: "{{ .OperatorNs }}"
15301625
data:
15311626
rules:
1532-
- apiGroups:
1533-
- ""
1534-
resources:
1535-
- pods
1536-
- secrets
1537-
verbs:
1538-
- create
1539-
- update
1540-
- patch
1541-
- get
1542-
- list
1543-
- delete
1544-
- watch
1627+
- apiGroups: [""]
1628+
resources: ["pods", "secrets"]
1629+
verbs: ["create", "update", "patch", "get", "list", "delete", "watch"]
15451630
- apiVersion: rbac.authorization.k8s.io/v1
15461631
kind: RoleBinding
15471632
name: edb-license-rolebinding

0 commit comments

Comments
 (0)