Skip to content

Commit 8808d50

Browse files
dmagedmage
committed
Add CABundle to storage drivers
1 parent 3473f04 commit 8808d50

File tree

15 files changed

+225
-50
lines changed

15 files changed

+225
-50
lines changed

‎pkg/client/listers.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ type StorageListers struct {
2121
Secrets kcorelisters.SecretNamespaceLister
2222
}
2323

24+
func NewStorageListers(
25+
infrastructures configlisters.InfrastructureLister,
26+
openshiftConfig kcorelisters.ConfigMapNamespaceLister,
27+
openshiftConfigManaged kcorelisters.ConfigMapNamespaceLister,
28+
secrets kcorelisters.SecretNamespaceLister,
29+
) *StorageListers {
30+
return &StorageListers{
31+
Infrastructures: infrastructures,
32+
OpenShiftConfig: openshiftConfig,
33+
OpenShiftConfigManaged: openshiftConfigManaged,
34+
Secrets: secrets,
35+
}
36+
}
37+
2438
type Listers struct {
2539
StorageListers
2640
Deployments kappslisters.DeploymentNamespaceLister

‎pkg/operator/imageregistrycertificates.go

Lines changed: 45 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -10,61 +10,91 @@ import (
1010
corev1informers "k8s.io/client-go/informers/core/v1"
1111
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
1212
corev1listers "k8s.io/client-go/listers/core/v1"
13+
restclient "k8s.io/client-go/rest"
1314
"k8s.io/client-go/tools/cache"
1415
"k8s.io/client-go/util/workqueue"
1516
"k8s.io/klog/v2"
1617

1718
operatorv1 "github.com/openshift/api/operator/v1"
1819
configv1informers "github.com/openshift/client-go/config/informers/externalversions/config/v1"
1920
configv1listers "github.com/openshift/client-go/config/listers/config/v1"
21+
imageregistryv1informers "github.com/openshift/client-go/imageregistry/informers/externalversions/imageregistry/v1"
22+
imageregistryv1listers "github.com/openshift/client-go/imageregistry/listers/imageregistry/v1"
2023
"github.com/openshift/library-go/pkg/operator/v1helpers"
2124

25+
"github.com/openshift/cluster-image-registry-operator/pkg/client"
2226
"github.com/openshift/cluster-image-registry-operator/pkg/defaults"
2327
"github.com/openshift/cluster-image-registry-operator/pkg/resource"
2428
)
2529

2630
type ImageRegistryCertificatesController struct {
27-
coreClient corev1client.CoreV1Interface
28-
operatorClient v1helpers.OperatorClient
29-
configMapLister corev1listers.ConfigMapNamespaceLister
30-
serviceLister corev1listers.ServiceNamespaceLister
31-
imageConfigLister configv1listers.ImageLister
32-
openshiftConfigLister corev1listers.ConfigMapNamespaceLister
31+
kubeconfig *restclient.Config
32+
coreClient corev1client.CoreV1Interface
33+
operatorClient v1helpers.OperatorClient
34+
configMapLister corev1listers.ConfigMapNamespaceLister
35+
serviceLister corev1listers.ServiceNamespaceLister
36+
imageConfigLister configv1listers.ImageLister
37+
openshiftConfigLister corev1listers.ConfigMapNamespaceLister
38+
imageRegistryConfigLister imageregistryv1listers.ConfigLister
39+
storageListers *client.StorageListers
3340

3441
cachesToSync []cache.InformerSynced
3542
queue workqueue.RateLimitingInterface
3643
}
3744

3845
func NewImageRegistryCertificatesController(
46+
kubeconfig *restclient.Config,
3947
coreClient corev1client.CoreV1Interface,
4048
operatorClient v1helpers.OperatorClient,
4149
configMapInformer corev1informers.ConfigMapInformer,
50+
secretInformer corev1informers.SecretInformer,
4251
serviceInformer corev1informers.ServiceInformer,
4352
imageConfigInformer configv1informers.ImageInformer,
53+
infrastructureInformer configv1informers.InfrastructureInformer,
4454
openshiftConfigInformer corev1informers.ConfigMapInformer,
55+
openshiftConfigManagedInformer corev1informers.ConfigMapInformer,
56+
imageRegistryConfigInformer imageregistryv1informers.ConfigInformer,
4557
) *ImageRegistryCertificatesController {
4658
c := &ImageRegistryCertificatesController{
47-
coreClient: coreClient,
48-
operatorClient: operatorClient,
49-
configMapLister: configMapInformer.Lister().ConfigMaps(defaults.ImageRegistryOperatorNamespace),
50-
serviceLister: serviceInformer.Lister().Services(defaults.ImageRegistryOperatorNamespace),
51-
imageConfigLister: imageConfigInformer.Lister(),
52-
openshiftConfigLister: openshiftConfigInformer.Lister().ConfigMaps(defaults.OpenShiftConfigNamespace),
53-
queue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "ImageRegistryCertificatesController"),
59+
kubeconfig: kubeconfig,
60+
coreClient: coreClient,
61+
operatorClient: operatorClient,
62+
configMapLister: configMapInformer.Lister().ConfigMaps(defaults.ImageRegistryOperatorNamespace),
63+
serviceLister: serviceInformer.Lister().Services(defaults.ImageRegistryOperatorNamespace),
64+
imageConfigLister: imageConfigInformer.Lister(),
65+
openshiftConfigLister: openshiftConfigInformer.Lister().ConfigMaps(defaults.OpenShiftConfigNamespace),
66+
imageRegistryConfigLister: imageRegistryConfigInformer.Lister(),
67+
queue: workqueue.NewNamedRateLimitingQueue(workqueue.DefaultControllerRateLimiter(), "ImageRegistryCertificatesController"),
5468
}
5569

5670
configMapInformer.Informer().AddEventHandler(c.eventHandler())
5771
c.cachesToSync = append(c.cachesToSync, configMapInformer.Informer().HasSynced)
5872

73+
secretInformer.Informer().AddEventHandler(c.eventHandler())
74+
c.cachesToSync = append(c.cachesToSync, secretInformer.Informer().HasSynced)
75+
5976
serviceInformer.Informer().AddEventHandler(c.eventHandler())
6077
c.cachesToSync = append(c.cachesToSync, serviceInformer.Informer().HasSynced)
6178

6279
imageConfigInformer.Informer().AddEventHandler(c.eventHandler())
6380
c.cachesToSync = append(c.cachesToSync, imageConfigInformer.Informer().HasSynced)
6481

82+
infrastructureInformer.Informer().AddEventHandler(c.eventHandler())
83+
c.cachesToSync = append(c.cachesToSync, infrastructureInformer.Informer().HasSynced)
84+
6585
openshiftConfigInformer.Informer().AddEventHandler(c.eventHandler())
6686
c.cachesToSync = append(c.cachesToSync, openshiftConfigInformer.Informer().HasSynced)
6787

88+
openshiftConfigManagedInformer.Informer().AddEventHandler(c.eventHandler())
89+
c.cachesToSync = append(c.cachesToSync, openshiftConfigManagedInformer.Informer().HasSynced)
90+
91+
c.storageListers = client.NewStorageListers(
92+
infrastructureInformer.Lister(),
93+
c.openshiftConfigLister,
94+
openshiftConfigManagedInformer.Lister().ConfigMaps(defaults.OpenShiftConfigManagedNamespace),
95+
secretInformer.Lister().Secrets(defaults.ImageRegistryOperatorNamespace),
96+
)
97+
6898
return c
6999
}
70100

@@ -102,7 +132,8 @@ func (c *ImageRegistryCertificatesController) processNextWorkItem() bool {
102132

103133
func (c *ImageRegistryCertificatesController) sync() error {
104134
ctx := context.TODO()
105-
g := resource.NewGeneratorCAConfig(c.configMapLister, c.imageConfigLister, c.openshiftConfigLister, c.serviceLister, c.coreClient)
135+
136+
g := resource.NewGeneratorCAConfig(c.configMapLister, c.imageConfigLister, c.openshiftConfigLister, c.serviceLister, c.imageRegistryConfigLister, c.storageListers, c.kubeconfig, c.coreClient)
106137
err := resource.ApplyMutator(g)
107138
if err != nil {
108139
_, _, updateError := v1helpers.UpdateStatus(

‎pkg/operator/starter.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,12 +98,17 @@ func RunOperator(ctx context.Context, kubeconfig *restclient.Config) error {
9898
)
9999

100100
imageRegistryCertificatesController := NewImageRegistryCertificatesController(
101+
kubeconfig,
101102
kubeClient.CoreV1(),
102103
configOperatorClient,
103104
kubeInformers.Core().V1().ConfigMaps(),
105+
kubeInformers.Core().V1().Secrets(),
104106
kubeInformers.Core().V1().Services(),
105107
configInformers.Config().V1().Images(),
108+
configInformers.Config().V1().Infrastructures(),
106109
kubeInformersForOpenShiftConfig.Core().V1().ConfigMaps(),
110+
kubeInformersForOpenShiftConfigManaged.Core().V1().ConfigMaps(),
111+
imageregistryInformers.Imageregistry().V1().Configs(),
107112
)
108113

109114
nodeCADaemonController := NewNodeCADaemonController(

‎pkg/resource/caconfig.go

Lines changed: 66 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -11,30 +11,50 @@ import (
1111
"k8s.io/apimachinery/pkg/runtime"
1212
coreset "k8s.io/client-go/kubernetes/typed/core/v1"
1313
corelisters "k8s.io/client-go/listers/core/v1"
14+
restclient "k8s.io/client-go/rest"
1415
"k8s.io/klog/v2"
1516

17+
operatorv1 "github.com/openshift/api/operator/v1"
1618
configlisters "github.com/openshift/client-go/config/listers/config/v1"
19+
imageregistryv1listers "github.com/openshift/client-go/imageregistry/listers/imageregistry/v1"
1720

21+
"github.com/openshift/cluster-image-registry-operator/pkg/client"
1822
"github.com/openshift/cluster-image-registry-operator/pkg/defaults"
23+
"github.com/openshift/cluster-image-registry-operator/pkg/storage"
1924
)
2025

2126
var _ Mutator = &generatorCAConfig{}
2227

2328
type generatorCAConfig struct {
24-
lister corelisters.ConfigMapNamespaceLister
25-
imageConfigLister configlisters.ImageLister
26-
openshiftConfigLister corelisters.ConfigMapNamespaceLister
27-
serviceLister corelisters.ServiceNamespaceLister
28-
client coreset.CoreV1Interface
29+
lister corelisters.ConfigMapNamespaceLister
30+
imageConfigLister configlisters.ImageLister
31+
openshiftConfigLister corelisters.ConfigMapNamespaceLister
32+
serviceLister corelisters.ServiceNamespaceLister
33+
imageRegistryConfigLister imageregistryv1listers.ConfigLister
34+
storageListers *client.StorageListers
35+
kubeconfig *restclient.Config
36+
client coreset.CoreV1Interface
2937
}
3038

31-
func NewGeneratorCAConfig(lister corelisters.ConfigMapNamespaceLister, imageConfigLister configlisters.ImageLister, openshiftConfigLister corelisters.ConfigMapNamespaceLister, serviceLister corelisters.ServiceNamespaceLister, client coreset.CoreV1Interface) Mutator {
39+
func NewGeneratorCAConfig(
40+
lister corelisters.ConfigMapNamespaceLister,
41+
imageConfigLister configlisters.ImageLister,
42+
openshiftConfigLister corelisters.ConfigMapNamespaceLister,
43+
serviceLister corelisters.ServiceNamespaceLister,
44+
imageRegistryConfigLister imageregistryv1listers.ConfigLister,
45+
storageListers *client.StorageListers,
46+
kubeconfig *restclient.Config,
47+
client coreset.CoreV1Interface,
48+
) Mutator {
3249
return &generatorCAConfig{
33-
lister: lister,
34-
imageConfigLister: imageConfigLister,
35-
openshiftConfigLister: openshiftConfigLister,
36-
serviceLister: serviceLister,
37-
client: client,
50+
lister: lister,
51+
imageConfigLister: imageConfigLister,
52+
openshiftConfigLister: openshiftConfigLister,
53+
serviceLister: serviceLister,
54+
imageRegistryConfigLister: imageRegistryConfigLister,
55+
storageListers: storageListers,
56+
kubeconfig: kubeconfig,
57+
client: client,
3858
}
3959
}
4060

@@ -50,6 +70,30 @@ func (gcac *generatorCAConfig) GetName() string {
5070
return defaults.ImageRegistryCertificatesName
5171
}
5272

73+
func (gcac *generatorCAConfig) storageDriver() (storage.Driver, error) {
74+
imageRegistryConfig, err := gcac.imageRegistryConfigLister.Get("cluster")
75+
if errors.IsNotFound(err) {
76+
return nil, nil
77+
} else if err != nil {
78+
return nil, err
79+
}
80+
81+
if imageRegistryConfig.Spec.ManagementState == operatorv1.Removed {
82+
// The certificates controller does not need to know about
83+
// storage when the management state is Removed.
84+
return nil, nil
85+
}
86+
87+
driver, err := storage.NewDriver(&imageRegistryConfig.Spec.Storage, gcac.kubeconfig, gcac.storageListers)
88+
if err == storage.ErrStorageNotConfigured || storage.IsMultiStoragesError(err) {
89+
return nil, nil
90+
} else if err != nil {
91+
return nil, err
92+
}
93+
94+
return driver, nil
95+
}
96+
5397
func (gcac *generatorCAConfig) expected() (runtime.Object, error) {
5498
cm := &corev1.ConfigMap{
5599
ObjectMeta: metav1.ObjectMeta{
@@ -102,14 +146,18 @@ func (gcac *generatorCAConfig) expected() (runtime.Object, error) {
102146
}
103147
}
104148

105-
cp_ca, err := gcac.openshiftConfigLister.Get("cloud-provider-config")
106-
if errors.IsNotFound(err) {
107-
klog.V(4).Infof("missing the cloud-provider-config configmap: %s", err)
108-
} else if err != nil {
149+
driver, err := gcac.storageDriver()
150+
if err != nil {
109151
return cm, err
110-
} else {
111-
if cert, ok := cp_ca.Data["ca-bundle.pem"]; ok {
112-
cm.Data["cloud-provider-ca-bundle.pem"] = cert
152+
}
153+
if driver != nil {
154+
storageCABundle, _, err := driver.CABundle()
155+
if err != nil {
156+
return cm, err
157+
}
158+
if storageCABundle != "" {
159+
klog.V(4).Infof("using storage ca bundle (%d bytes)", len(storageCABundle))
160+
cm.Data["storage-ca-bundle.pem"] = storageCABundle
113161
}
114162
}
115163

‎pkg/resource/deployment_test.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,10 @@ func waitForUpdatedSecret(ctx context.Context, kubeClient kubeclient.Interface,
182182

183183
type testDriver struct{}
184184

185+
func (d *testDriver) CABundle() (string, bool, error) {
186+
return "", false, nil
187+
}
188+
185189
func (d *testDriver) ConfigEnv() (envvar.List, error) {
186190
return nil, nil
187191
}

‎pkg/resource/podtemplatespec_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -506,7 +506,7 @@ func TestMakePodTemplateSpecS3CloudFront(t *testing.T) {
506506
testBuilder.AddNamespaces(imageRegNs)
507507

508508
fixture := testBuilder.Build()
509-
s3Storage := s3.NewDriver(ctx, config.Spec.Storage.S3, fixture.Listers)
509+
s3Storage := s3.NewDriver(ctx, config.Spec.Storage.S3, &fixture.Listers.StorageListers)
510510
pod, _, err := makePodTemplateSpec(fixture.KubeClient.CoreV1(), fixture.Listers.ProxyConfigs, s3Storage, config)
511511
if err != nil {
512512
t.Fatalf("error creating pod template: %v", err)

‎pkg/storage/azure/azure.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -338,6 +338,10 @@ func (d *driver) getKey(cfg *Azure, environment autorestazure.Environment) (stri
338338
return key, nil
339339
}
340340

341+
func (d *driver) CABundle() (string, bool, error) {
342+
return "", true, nil
343+
}
344+
341345
// ConfigEnv configures the environment variables that will be used in the
342346
// image registry deployment.
343347
func (d *driver) ConfigEnv() (envs envvar.List, err error) {

‎pkg/storage/emptydir/emptydir.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ func NewDriver(c *imageregistryv1.ImageRegistryConfigStorageEmptyDir) *driver {
2727
}
2828
}
2929

30+
func (d *driver) CABundle() (string, bool, error) {
31+
return "", false, nil
32+
}
33+
3034
func (d *driver) ConfigEnv() (envs envvar.List, err error) {
3135
envs = append(envs,
3236
envvar.EnvVar{Name: "REGISTRY_STORAGE", Value: "filesystem"},

‎pkg/storage/gcs/gcs.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,10 @@ func GetConfig(listers *regopclient.StorageListers) (*GCS, error) {
121121
return gcsConfig, nil
122122
}
123123

124+
func (d *driver) CABundle() (string, bool, error) {
125+
return "", true, nil
126+
}
127+
124128
func (d *driver) ConfigEnv() (envs envvar.List, err error) {
125129
envs = append(envs,
126130
envvar.EnvVar{Name: "REGISTRY_STORAGE", Value: "gcs"},

‎pkg/storage/ibmcos/ibmcos.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,11 @@ func NewDriver(ctx context.Context, c *imageregistryv1.ImageRegistryConfigStorag
6969
}
7070
}
7171

72+
// CABundle returns a additional CA bundle for IBM COS.
73+
func (d *driver) CABundle() (string, bool, error) {
74+
return "", true, nil
75+
}
76+
7277
// ConfigEnv configures the environment variables that will be
7378
// used in the image registry deployment.
7479
func (d *driver) ConfigEnv() (envs envvar.List, err error) {

0 commit comments

Comments
 (0)