Skip to content

Commit b57ee63

Browse files
openshift-merge-robotopenshift-merge-robot
authored
Merge pull request #226 from jcpowermac/CORS-1162
Add certificate option to cincinnati client
2 parents c9cb9c6 + 3875a44 commit b57ee63

28 files changed

+418
-107
lines changed

‎Gopkg.lock

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/cincinnati/cincinnati.go

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package cincinnati
22

33
import (
4+
"crypto/tls"
45
"encoding/json"
56
"fmt"
67
"io/ioutil"
@@ -20,13 +21,14 @@ const (
2021
// Client is a Cincinnati client which can be used to fetch update graphs from
2122
// an upstream Cincinnati stack.
2223
type Client struct {
23-
id uuid.UUID
24-
proxyURL *url.URL
24+
id uuid.UUID
25+
proxyURL *url.URL
26+
tlsConfig *tls.Config
2527
}
2628

2729
// NewClient creates a new Cincinnati client with the given client identifier.
28-
func NewClient(id uuid.UUID, proxyURL *url.URL) Client {
29-
return Client{id: id, proxyURL: proxyURL}
30+
func NewClient(id uuid.UUID, proxyURL *url.URL, tlsConfig *tls.Config) Client {
31+
return Client{id: id, proxyURL: proxyURL, tlsConfig: tlsConfig}
3032
}
3133

3234
// Update is a single node from the update graph.
@@ -58,6 +60,9 @@ func (c Client) GetUpdates(upstream string, channel string, version semver.Versi
5860
return nil, err
5961
}
6062
req.Header.Add("Accept", GraphMediaType)
63+
if c.tlsConfig != nil {
64+
transport.TLSClientConfig = c.tlsConfig
65+
}
6166

6267
if c.proxyURL != nil {
6368
transport.Proxy = http.ProxyURL(c.proxyURL)

‎pkg/cincinnati/cincinnati_test.go

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package cincinnati
22

33
import (
4+
"crypto/tls"
45
"encoding/json"
56
"fmt"
67
"net/http"
@@ -121,8 +122,9 @@ func TestGetUpdates(t *testing.T) {
121122
ts := httptest.NewServer(http.HandlerFunc(handler))
122123
defer ts.Close()
123124
var proxyURL *url.URL
125+
var tlsConfig *tls.Config
124126

125-
c := NewClient(clientID, proxyURL)
127+
c := NewClient(clientID, proxyURL, tlsConfig)
126128

127129
updates, err := c.GetUpdates(ts.URL, channelName, semver.MustParse(test.version))
128130
if test.err == "" {

‎pkg/cvo/availableupdates.go

Lines changed: 51 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,20 @@
11
package cvo
22

33
import (
4+
"crypto/tls"
5+
"crypto/x509"
46
"fmt"
5-
"time"
6-
77
"net/url"
8+
"time"
89

910
"github.com/blang/semver"
1011
"github.com/google/uuid"
11-
"k8s.io/apimachinery/pkg/api/errors"
12-
"k8s.io/klog"
13-
1412
"k8s.io/apimachinery/pkg/api/equality"
13+
"k8s.io/apimachinery/pkg/api/errors"
1514
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
15+
"k8s.io/klog"
1616

1717
configv1 "github.com/openshift/api/config/v1"
18-
1918
"github.com/openshift/cluster-version-operator/lib/resourcemerge"
2019
"github.com/openshift/cluster-version-operator/pkg/cincinnati"
2120
)
@@ -24,6 +23,7 @@ import (
2423
// object. It will set the RetrievedUpdates condition. Updates are only checked if it has been more than
2524
// the minimumUpdateCheckInterval since the last check.
2625
func (optr *Operator) syncAvailableUpdates(config *configv1.ClusterVersion) error {
26+
var tlsConfig *tls.Config
2727
usedDefaultUpstream := false
2828
upstream := string(config.Spec.Upstream)
2929
if len(upstream) == 0 {
@@ -39,12 +39,18 @@ func (optr *Operator) syncAvailableUpdates(config *configv1.ClusterVersion) erro
3939
return nil
4040
}
4141

42-
proxyURL, err := optr.getHTTPSProxyURL()
42+
proxyURL, cmNameRef, err := optr.getHTTPSProxyURL()
4343
if err != nil {
4444
return err
4545
}
46+
if cmNameRef != "" {
47+
tlsConfig, err = optr.getTLSConfig(cmNameRef)
48+
if err != nil {
49+
return err
50+
}
51+
}
4652

47-
updates, condition := calculateAvailableUpdatesStatus(string(config.Spec.ClusterID), proxyURL, upstream, channel, optr.releaseVersion)
53+
updates, condition := calculateAvailableUpdatesStatus(string(config.Spec.ClusterID), proxyURL, tlsConfig, upstream, channel, optr.releaseVersion)
4854

4955
if usedDefaultUpstream {
5056
upstream = ""
@@ -111,7 +117,7 @@ func (optr *Operator) getAvailableUpdates() *availableUpdates {
111117
return optr.availableUpdates
112118
}
113119

114-
func calculateAvailableUpdatesStatus(clusterID string, proxyURL *url.URL, upstream, channel, version string) ([]configv1.Update, configv1.ClusterOperatorStatusCondition) {
120+
func calculateAvailableUpdatesStatus(clusterID string, proxyURL *url.URL, tlsConfig *tls.Config, upstream, channel, version string) ([]configv1.Update, configv1.ClusterOperatorStatusCondition) {
115121
if len(upstream) == 0 {
116122
return nil, configv1.ClusterOperatorStatusCondition{
117123
Type: configv1.RetrievedUpdates, Status: configv1.ConditionFalse, Reason: "NoUpstream",
@@ -142,7 +148,7 @@ func calculateAvailableUpdatesStatus(clusterID string, proxyURL *url.URL, upstre
142148
}
143149
}
144150

145-
updates, err := checkForUpdate(clusterID, proxyURL, upstream, channel, currentVersion)
151+
updates, err := checkForUpdate(clusterID, proxyURL, tlsConfig, upstream, channel, currentVersion)
146152
if err != nil {
147153
klog.V(2).Infof("Upstream server %s could not return available updates: %v", upstream, err)
148154
return nil, configv1.ClusterOperatorStatusCondition{
@@ -167,7 +173,7 @@ func calculateAvailableUpdatesStatus(clusterID string, proxyURL *url.URL, upstre
167173
}
168174
}
169175

170-
func checkForUpdate(clusterID string, proxyURL *url.URL, upstream, channel string, currentVersion semver.Version) ([]cincinnati.Update, error) {
176+
func checkForUpdate(clusterID string, proxyURL *url.URL, tlsConfig *tls.Config, upstream, channel string, currentVersion semver.Version) ([]cincinnati.Update, error) {
171177
uuid, err := uuid.Parse(string(clusterID))
172178
if err != nil {
173179
return nil, err
@@ -176,29 +182,56 @@ func checkForUpdate(clusterID string, proxyURL *url.URL, upstream, channel strin
176182
if len(upstream) == 0 {
177183
return nil, fmt.Errorf("no upstream URL set for cluster version")
178184
}
179-
return cincinnati.NewClient(uuid, proxyURL).GetUpdates(upstream, channel, currentVersion)
185+
return cincinnati.NewClient(uuid, proxyURL, tlsConfig).GetUpdates(upstream, channel, currentVersion)
180186
}
181187

182188
// getHTTPSProxyURL returns a url.URL object for the configured
183189
// https proxy only. It can be nil if does not exist or there is an error.
184-
func (optr *Operator) getHTTPSProxyURL() (*url.URL, error) {
190+
func (optr *Operator) getHTTPSProxyURL() (*url.URL, string, error) {
185191
proxy, err := optr.proxyLister.Get("cluster")
186192

187193
if errors.IsNotFound(err) {
188-
return nil, nil
194+
return nil, "", nil
189195
}
190196
if err != nil {
191-
return nil, err
197+
return nil, "", err
192198
}
193199

194200
if &proxy.Spec != nil {
195201
if proxy.Spec.HTTPSProxy != "" {
196202
proxyURL, err := url.Parse(proxy.Spec.HTTPSProxy)
197203
if err != nil {
198-
return nil, err
204+
return nil, "", err
199205
}
200-
return proxyURL, nil
206+
return proxyURL, proxy.Spec.TrustedCA.Name, nil
207+
}
208+
}
209+
return nil, "", nil
210+
}
211+
212+
func (optr *Operator) getTLSConfig(cmNameRef string) (*tls.Config, error) {
213+
cm, err := optr.cmManagedLister.Get(cmNameRef)
214+
215+
if err != nil {
216+
return nil, err
217+
}
218+
219+
certPool, _ := x509.SystemCertPool()
220+
if certPool == nil {
221+
certPool = x509.NewCertPool()
222+
}
223+
224+
if cm.Data["ca-bundle.crt"] != "" {
225+
if ok := certPool.AppendCertsFromPEM([]byte(cm.Data["ca-bundle.crt"])); !ok {
226+
return nil, fmt.Errorf("unable to add ca-bundle.crt certificates")
201227
}
228+
} else {
229+
return nil, nil
202230
}
203-
return nil, nil
231+
232+
config := &tls.Config{
233+
RootCAs: certPool,
234+
}
235+
236+
return config, nil
204237
}

‎pkg/cvo/cvo.go

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,8 @@ import (
77
"sync"
88
"time"
99

10-
"github.com/openshift/cluster-version-operator/pkg/verify"
11-
1210
"github.com/blang/semver"
1311
"github.com/google/uuid"
14-
"k8s.io/klog"
15-
1612
corev1 "k8s.io/api/core/v1"
1713
apierrors "k8s.io/apimachinery/pkg/api/errors"
1814
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -27,12 +23,12 @@ import (
2723
"k8s.io/client-go/tools/cache"
2824
"k8s.io/client-go/tools/record"
2925
"k8s.io/client-go/util/workqueue"
26+
"k8s.io/klog"
3027

3128
configv1 "github.com/openshift/api/config/v1"
3229
clientset "github.com/openshift/client-go/config/clientset/versioned"
3330
configinformersv1 "github.com/openshift/client-go/config/informers/externalversions/config/v1"
3431
configlistersv1 "github.com/openshift/client-go/config/listers/config/v1"
35-
3632
"github.com/openshift/cluster-version-operator/lib"
3733
"github.com/openshift/cluster-version-operator/lib/resourceapply"
3834
"github.com/openshift/cluster-version-operator/lib/resourcebuilder"
@@ -41,6 +37,7 @@ import (
4137
"github.com/openshift/cluster-version-operator/pkg/cvo/internal/dynamicclient"
4238
"github.com/openshift/cluster-version-operator/pkg/internal"
4339
"github.com/openshift/cluster-version-operator/pkg/payload"
40+
"github.com/openshift/cluster-version-operator/pkg/verify"
4441
)
4542

4643
const (
@@ -102,11 +99,12 @@ type Operator struct {
10299
// syncBackoff allows the tests to use a quicker backoff
103100
syncBackoff wait.Backoff
104101

105-
cvLister configlistersv1.ClusterVersionLister
106-
coLister configlistersv1.ClusterOperatorLister
107-
cmLister listerscorev1.ConfigMapNamespaceLister
108-
proxyLister configlistersv1.ProxyLister
109-
cacheSynced []cache.InformerSynced
102+
cvLister configlistersv1.ClusterVersionLister
103+
coLister configlistersv1.ClusterOperatorLister
104+
cmConfigLister listerscorev1.ConfigMapNamespaceLister
105+
cmManagedLister listerscorev1.ConfigMapNamespaceLister
106+
proxyLister configlistersv1.ProxyLister
107+
cacheSynced []cache.InformerSynced
110108

111109
// queue tracks applying updates to a cluster.
112110
queue workqueue.RateLimitingInterface
@@ -140,7 +138,8 @@ func New(
140138
minimumInterval time.Duration,
141139
cvInformer configinformersv1.ClusterVersionInformer,
142140
coInformer configinformersv1.ClusterOperatorInformer,
143-
cmInformer informerscorev1.ConfigMapInformer,
141+
cmConfigInformer informerscorev1.ConfigMapInformer,
142+
cmManagedInformer informerscorev1.ConfigMapInformer,
144143
proxyInformer configinformersv1.ProxyInformer,
145144
client clientset.Interface,
146145
kubeClient kubernetes.Interface,
@@ -180,7 +179,8 @@ func New(
180179
optr.cvLister = cvInformer.Lister()
181180
optr.cacheSynced = append(optr.cacheSynced, cvInformer.Informer().HasSynced)
182181

183-
optr.cmLister = cmInformer.Lister().ConfigMaps(internal.ConfigNamespace)
182+
optr.cmConfigLister = cmConfigInformer.Lister().ConfigMaps(internal.ConfigNamespace)
183+
optr.cmManagedLister = cmManagedInformer.Lister().ConfigMaps(internal.ConfigManagedNamespace)
184184

185185
if enableMetrics {
186186
if err := optr.registerMetrics(coInformer.Informer()); err != nil {

‎pkg/cvo/cvo_test.go

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ import (
3232
configv1 "github.com/openshift/api/config/v1"
3333
clientset "github.com/openshift/client-go/config/clientset/versioned"
3434
"github.com/openshift/client-go/config/clientset/versioned/fake"
35-
3635
"github.com/openshift/cluster-version-operator/pkg/payload"
3736
)
3837

@@ -153,16 +152,16 @@ func (r *coLister) Get(name string) (*configv1.ClusterOperator, error) {
153152
return nil, errors.NewNotFound(schema.GroupResource{}, name)
154153
}
155154

156-
type cmLister struct {
155+
type cmConfigLister struct {
157156
Err error
158157
Items []*corev1.ConfigMap
159158
}
160159

161-
func (l *cmLister) List(selector labels.Selector) ([]*corev1.ConfigMap, error) {
160+
func (l *cmConfigLister) List(selector labels.Selector) ([]*corev1.ConfigMap, error) {
162161
return l.Items, l.Err
163162
}
164163

165-
func (l *cmLister) Get(name string) (*corev1.ConfigMap, error) {
164+
func (l *cmConfigLister) Get(name string) (*corev1.ConfigMap, error) {
166165
if l.Err != nil {
167166
return nil, l.Err
168167
}

‎pkg/cvo/metrics.go

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,11 @@ import (
55

66
apierrors "k8s.io/apimachinery/pkg/api/errors"
77
"k8s.io/apimachinery/pkg/util/sets"
8-
98
"github.com/prometheus/client_golang/prometheus"
10-
119
"k8s.io/apimachinery/pkg/labels"
1210
"k8s.io/client-go/tools/cache"
1311

1412
configv1 "github.com/openshift/api/config/v1"
15-
1613
"github.com/openshift/cluster-version-operator/lib/resourcemerge"
1714
"github.com/openshift/cluster-version-operator/pkg/internal"
1815
)
@@ -278,7 +275,7 @@ func (m *operatorMetrics) Collect(ch chan<- prometheus.Metric) {
278275
ch <- g
279276
}
280277

281-
installer, err := m.optr.cmLister.Get(internal.InstallerConfigMap)
278+
installer, err := m.optr.cmConfigLister.Get(internal.InstallerConfigMap)
282279
if err == nil {
283280
version := "<missing>"
284281
invoker := "<missing>"

0 commit comments

Comments
 (0)