Skip to content

Commit 3c0bfee

Browse files
pdabelf5pdabelf5
committed
add runtime config for Otel CA cert updates
1 parent 568bcdb commit 3c0bfee

File tree

3 files changed

+58
-15
lines changed

3 files changed

+58
-15
lines changed

‎internal/configs/configmaps.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -988,6 +988,11 @@ func GenerateNginxMainConfig(staticCfgParams *StaticConfigParams, config *Config
988988
ResolverValid: config.ZoneSync.ResolverValid,
989989
}
990990

991+
mainOtelExporterTrustedCA := ""
992+
if config.MainOtelExporterTrustedCA != "" {
993+
mainOtelExporterTrustedCA = fmt.Sprintf("%s-%s-%s", os.Getenv("POD_NAMESPACE"), config.MainOtelExporterTrustedCA, CACrtKey)
994+
}
995+
991996
nginxCfg := &version1.MainConfig{
992997
AccessLog: config.MainAccessLog,
993998
DefaultServerAccessLogOff: config.DefaultServerAccessLogOff,
@@ -1012,7 +1017,7 @@ func GenerateNginxMainConfig(staticCfgParams *StaticConfigParams, config *Config
10121017
MainOtelLoadModule: config.MainOtelLoadModule,
10131018
MainOtelGlobalTraceEnabled: config.MainOtelGlobalTraceEnabled,
10141019
MainOtelExporterEndpoint: config.MainOtelExporterEndpoint,
1015-
MainOtelExporterTrustedCA: fmt.Sprintf("%s-%s-%s", os.Getenv("POD_NAMESPACE"), config.MainOtelExporterTrustedCA, CACrtKey),
1020+
MainOtelExporterTrustedCA: mainOtelExporterTrustedCA,
10161021
MainOtelExporterHeaderName: config.MainOtelExporterHeaderName,
10171022
MainOtelExporterHeaderValue: config.MainOtelExporterHeaderValue,
10181023
MainOtelServiceName: config.MainOtelServiceName,

‎internal/configs/configurator.go‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -826,8 +826,11 @@ func generateTLSPassthroughHostsConfig(tlsPassthroughPairs map[string]tlsPassthr
826826
// AddOrUpdateCASecret writes the secret content to disk returning the files added/updated
827827
func (cnf *Configurator) AddOrUpdateCASecret(secret *api_v1.Secret, crtFileName, crlFileName string) string {
828828
crtData, crlData := GenerateCAFileContent(secret)
829+
crlFilePath := ""
829830
crtFilePath := cnf.nginxManager.CreateSecret(crtFileName, crtData, nginx.ReadWriteOnlyFileMode)
830-
crlFilePath := cnf.nginxManager.CreateSecret(crlFileName, crlData, nginx.ReadWriteOnlyFileMode)
831+
if len(crlData) > 0 {
832+
crlFilePath = cnf.nginxManager.CreateSecret(crlFileName, crlData, nginx.ReadWriteOnlyFileMode)
833+
}
831834
return fmt.Sprintf("%s %s", crtFilePath, crlFilePath)
832835
}
833836

‎internal/k8s/controller.go‎

Lines changed: 48 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -102,11 +102,12 @@ type podEndpoint struct {
102102
}
103103

104104
type specialSecrets struct {
105-
defaultServerSecret string
106-
wildcardTLSSecret string
107-
licenseSecret string
108-
clientAuthSecret string
109-
trustedCertSecret string
105+
defaultServerSecret string
106+
wildcardTLSSecret string
107+
licenseSecret string
108+
clientAuthSecret string
109+
mgmtTrustedCertSecret string
110+
otelTrustedCertSecret string
110111
}
111112

112113
type controllerMetadata struct {
@@ -247,14 +248,19 @@ type NewLoadBalancerControllerInput struct {
247248

248249
// NewLoadBalancerController creates a controller
249250
func NewLoadBalancerController(input NewLoadBalancerControllerInput) *LoadBalancerController {
251+
otelTrustedCertSecret := ""
252+
if input.NginxConfigurator.CfgParams.MainOtelExporterTrustedCA != "" {
253+
otelTrustedCertSecret = fmt.Sprintf("%s/%s", input.ControllerNamespace, input.NginxConfigurator.CfgParams.MainOtelExporterTrustedCA)
254+
}
250255
specialSecrets := specialSecrets{
251-
defaultServerSecret: input.DefaultServerSecret,
252-
wildcardTLSSecret: input.WildcardTLSSecret,
256+
defaultServerSecret: input.DefaultServerSecret,
257+
wildcardTLSSecret: input.WildcardTLSSecret,
258+
otelTrustedCertSecret: otelTrustedCertSecret,
253259
}
254260
if input.IsNginxPlus {
255261
specialSecrets.licenseSecret = fmt.Sprintf("%s/%s", input.ControllerNamespace, input.NginxConfigurator.MgmtCfgParams.Secrets.License)
256262
specialSecrets.clientAuthSecret = fmt.Sprintf("%s/%s", input.ControllerNamespace, input.NginxConfigurator.MgmtCfgParams.Secrets.ClientAuth)
257-
specialSecrets.trustedCertSecret = fmt.Sprintf("%s/%s", input.ControllerNamespace, input.NginxConfigurator.MgmtCfgParams.Secrets.TrustedCert)
263+
specialSecrets.mgmtTrustedCertSecret = fmt.Sprintf("%s/%s", input.ControllerNamespace, input.NginxConfigurator.MgmtCfgParams.Secrets.TrustedCert)
258264
}
259265
lbc := &LoadBalancerController{
260266
client: input.KubeClient,
@@ -924,7 +930,7 @@ func (lbc *LoadBalancerController) updateAllConfigs() {
924930
if _, hasCRL := secret.Data[configs.CACrlKey]; hasCRL {
925931
lbc.configurator.MgmtCfgParams.Secrets.TrustedCRL = secret.Name
926932
}
927-
lbc.specialSecrets.trustedCertSecret = fmt.Sprintf("%s/%s", secret.Namespace, secret.Name)
933+
lbc.specialSecrets.mgmtTrustedCertSecret = fmt.Sprintf("%s/%s", secret.Namespace, secret.Name)
928934
lbc.handleSpecialSecretUpdate(secret, reloadNginx)
929935
}
930936
// update special ClientAuth secret in mgmtConfigParams
@@ -937,6 +943,15 @@ func (lbc *LoadBalancerController) updateAllConfigs() {
937943
lbc.handleSpecialSecretUpdate(secret, reloadNginx)
938944
}
939945
}
946+
// update special Otel CA secret in configParams
947+
if cfgParams.MainOtelExporterTrustedCA != "" {
948+
secret, err := lbc.client.CoreV1().Secrets(lbc.configMap.GetNamespace()).Get(context.TODO(), cfgParams.MainOtelExporterTrustedCA, meta_v1.GetOptions{})
949+
if err != nil {
950+
nl.Errorf(lbc.Logger, "secret %s/%s: %v", lbc.configMap.GetNamespace(), cfgParams.MainOtelExporterTrustedCA, err)
951+
}
952+
lbc.specialSecrets.otelTrustedCertSecret = fmt.Sprintf("%s/%s", secret.Namespace, secret.Name)
953+
lbc.handleSpecialSecretUpdate(secret, reloadNginx)
954+
}
940955
resources := lbc.configuration.GetResources()
941956
nl.Debugf(lbc.Logger, "Updating %v resources", len(resources))
942957
resourceExes := lbc.createExtendedResources(resources)
@@ -1843,7 +1858,9 @@ func (lbc *LoadBalancerController) isSpecialSecret(secretName string) bool {
18431858
return true
18441859
case lbc.specialSecrets.clientAuthSecret:
18451860
return true
1846-
case lbc.specialSecrets.trustedCertSecret:
1861+
case lbc.specialSecrets.mgmtTrustedCertSecret:
1862+
return true
1863+
case lbc.specialSecrets.otelTrustedCertSecret:
18471864
return true
18481865
default:
18491866
return false
@@ -1918,7 +1935,12 @@ func (lbc *LoadBalancerController) handleSpecialSecretUpdate(secret *api_v1.Secr
19181935
if ok := lbc.performNGINXReload(secret); !ok {
19191936
return
19201937
}
1921-
case lbc.specialSecrets.trustedCertSecret:
1938+
case lbc.specialSecrets.mgmtTrustedCertSecret:
1939+
lbc.updateAllConfigs()
1940+
if ok := lbc.performNGINXReload(secret); !ok {
1941+
return
1942+
}
1943+
case lbc.specialSecrets.otelTrustedCertSecret:
19221944
lbc.updateAllConfigs()
19231945
if ok := lbc.performNGINXReload(secret); !ok {
19241946
return
@@ -1944,7 +1966,12 @@ func (lbc *LoadBalancerController) writeSpecialSecrets(secret *api_v1.Secret, sp
19441966
return false
19451967
}
19461968
case secrets.SecretTypeCA:
1947-
lbc.configurator.AddOrUpdateCASecret(secret, fmt.Sprintf("mgmt/%s", configs.CACrtKey), fmt.Sprintf("mgmt/%s", configs.CACrlKey))
1969+
if lbc.specialSecrets.mgmtTrustedCertSecret != "" {
1970+
lbc.configurator.AddOrUpdateCASecret(secret, fmt.Sprintf("mgmt/%s", configs.CACrtKey), fmt.Sprintf("mgmt/%s", configs.CACrlKey))
1971+
}
1972+
if lbc.specialSecrets.otelTrustedCertSecret != "" {
1973+
lbc.configurator.AddOrUpdateCASecret(secret, fmt.Sprintf("%s-%s-%s", lbc.metadata.namespace, lbc.configurator.CfgParams.MainOtelExporterTrustedCA, configs.CACrtKey), "")
1974+
}
19481975
case api_v1.SecretTypeTLS:
19491976
// if the secret name matches the specified
19501977
if secretNsName == mgmtClientAuthNamespaceName {
@@ -1981,7 +2008,7 @@ func (lbc *LoadBalancerController) specialSecretValidation(secretNsName string,
19812008
return false
19822009
}
19832010
}
1984-
if secretNsName == lbc.specialSecrets.trustedCertSecret {
2011+
if secretNsName == lbc.specialSecrets.mgmtTrustedCertSecret {
19852012
err := secrets.ValidateCASecret(secret)
19862013
if err != nil {
19872014
nl.Errorf(lbc.Logger, "Couldn't validate the special Secret %v: %v", secretNsName, err)
@@ -1997,6 +2024,14 @@ func (lbc *LoadBalancerController) specialSecretValidation(secretNsName string,
19972024
return false
19982025
}
19992026
}
2027+
if secretNsName == lbc.specialSecrets.otelTrustedCertSecret {
2028+
err := secrets.ValidateCASecret(secret)
2029+
if err != nil {
2030+
nl.Errorf(lbc.Logger, "Couldn't validate the special Secret %v: %v", secretNsName, err)
2031+
lbc.recorder.Eventf(lbc.metadata.pod, api_v1.EventTypeWarning, nl.EventReasonRejected, "the special Secret %v was rejected, using the previous version: %v", secretNsName, err)
2032+
return false
2033+
}
2034+
}
20002035
return true
20012036
}
20022037

0 commit comments

Comments
 (0)