Skip to content

Commit 0699ba1

Browse files
stuggistuggi
committed
Allow customize http vhost config using HttpdCustomization.CustomConfigSecret
This change allows to customize the httpd vhost config using this parameter to specify a secret that contains service config data. The content of each provided snippet gets rendered as a go template and placed into /etc/httpd/conf/httpd_custom_<endpoint>_<key> . At the end of the vhost config in the default httpd template these custom configs get included using `Include conf/httpd_custom_<endpoint>_*`. For information on how sections in httpd configuration get merged, check section "How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging All possible parameters which can be use in a template can be looked up in the <service>-config-data secret of the service like: $ oc get secret -n openstack barbican-config-data -o json | jq -r .data.TemplateParameters | base64 -d $ oc get secret -n openstack barbicanapi-config-data -o json | jq -r .data.TemplateParameters | base64 -d or in the running pod of the service in the file: $ cat /var/lib/config-data/default/TemplateParameters The content is a versioned dump of the parameters of the service operator, like: ~~~ DatabaseConnection: mysql+pymysql://user:pwd@openstack.<namespace>.svc/keystone?read_default_file=/etc/my.cnf EnableSecureRBAC: true EnabledSecretStores: simple_crypto GlobalDefaultSecretStore: simple_crypto KeystoneAuthURL: http://keystone-internal.openstack.svc:5000 LogFile: /var/log/barbican/barbican-api.log ServicePassword: <pwd> ServiceUser: barbican SimpleCryptoEnabled: true SimpleCryptoKEK: "" TimeOut: 90 TransportURL: rabbit://rabbitmq-secret/fake VHosts: internal: Override: true ServerName: barbican-internal.<namespace>.svc TLS: false public: Override: true ServerName: barbican-public.<namespace>.svc TLS: false ~~~ Depends-On: openstack-k8s-operators/lib-common#591 Depends-On: openstack-k8s-operators/lib-common#593 Jira: https://issues.redhat.com/browse/OSPRH-13100 Signed-off-by: Martin Schuppert <[email protected]>
1 parent a09e481 commit 0699ba1

18 files changed

+256
-22
lines changed

‎api/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,20 @@ spec:
118118
- simple_crypto
119119
- pkcs11
120120
type: string
121+
httpdCustomization:
122+
description: HttpdCustomization - customize the httpd service
123+
properties:
124+
customConfigSecret:
125+
description: |-
126+
CustomConfigSecret - customize the httpd vhost config using this parameter to specify
127+
a secret that contains service config data. The content of each provided snippet gets
128+
rendered as a go template and placed into /etc/httpd/conf/httpd_custom_<key> .
129+
In the default httpd template at the end of the vhost those custom configs get
130+
included using `Include conf/httpd_custom_<endpoint>_*`.
131+
For information on how sections in httpd configuration get merged, check section
132+
"How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging
133+
type: string
134+
type: object
121135
networkAttachments:
122136
description: NetworkAttachments is a list of NetworkAttachment resource
123137
names to expose the services to the given network

‎api/bases/barbican.openstack.org_barbicans.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,20 @@ spec:
9191
description: EnableSecureRBAC - Enable Consistent and Secure RBAC
9292
policies
9393
type: boolean
94+
httpdCustomization:
95+
description: HttpdCustomization - customize the httpd service
96+
properties:
97+
customConfigSecret:
98+
description: |-
99+
CustomConfigSecret - customize the httpd vhost config using this parameter to specify
100+
a secret that contains service config data. The content of each provided snippet gets
101+
rendered as a go template and placed into /etc/httpd/conf/httpd_custom_<key> .
102+
In the default httpd template at the end of the vhost those custom configs get
103+
included using `Include conf/httpd_custom_<endpoint>_*`.
104+
For information on how sections in httpd configuration get merged, check section
105+
"How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging
106+
type: string
107+
type: object
94108
networkAttachments:
95109
description: NetworkAttachments is a list of NetworkAttachment
96110
resource names to expose the services to the given network

‎api/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ go 1.21
55
require (
66
github.com/onsi/ginkgo/v2 v2.20.1
77
github.com/onsi/gomega v1.34.1
8-
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20241216113837-d172b3ac0f4e
8+
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20250116145727-01a8948d5dd7
99
k8s.io/api v0.29.10
1010
k8s.io/apimachinery v0.29.10
1111
k8s.io/client-go v0.29.10

‎api/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,8 @@ github.com/onsi/ginkgo/v2 v2.20.1 h1:YlVIbqct+ZmnEph770q9Q7NVAz4wwIiVNahee6JyUzo
7272
github.com/onsi/ginkgo/v2 v2.20.1/go.mod h1:lG9ey2Z29hR41WMVthyJBGUBcBhGOtoPF2VFMvBXFCI=
7373
github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
7474
github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
75-
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20241216113837-d172b3ac0f4e h1:hf4kVQBkyG79WcHBxdQ25QrDBbGFdarebS1Tc0Xclq4=
76-
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20241216113837-d172b3ac0f4e/go.mod h1:YpNTuJhDWhbXM50O3qBkhO7M+OOyRmWkNVmJ4y3cyFs=
75+
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20250116145727-01a8948d5dd7 h1:vXHpH93PjbAgg5ZN6n5WmxkybVQOs0nhXvVw62o7aZs=
76+
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20250116145727-01a8948d5dd7/go.mod h1:YpNTuJhDWhbXM50O3qBkhO7M+OOyRmWkNVmJ4y3cyFs=
7777
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
7878
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
7979
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=

‎api/v1beta1/barbicanapi_types.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ type BarbicanAPITemplateCore struct {
5353
// +kubebuilder:validation:Optional
5454
// APITimeout for HAProxy and Apache defaults to Barbican APITimeout (seconds)
5555
APITimeout int `json:"apiTimeout"`
56+
57+
// +kubebuilder:validation:Optional
58+
// HttpdCustomization - customize the httpd service
59+
HttpdCustomization HttpdCustomization `json:"httpdCustomization,omitempty"`
5660
}
5761

5862
// APIOverrideSpec to override the generated manifest of several child resources.
@@ -62,6 +66,19 @@ type APIOverrideSpec struct {
6266
Service map[service.Endpoint]service.RoutedOverrideSpec `json:"service,omitempty"`
6367
}
6468

69+
// HttpdCustomization - customize the httpd service
70+
type HttpdCustomization struct {
71+
// +kubebuilder:validation:Optional
72+
// CustomConfigSecret - customize the httpd vhost config using this parameter to specify
73+
// a secret that contains service config data. The content of each provided snippet gets
74+
// rendered as a go template and placed into /etc/httpd/conf/httpd_custom_<key> .
75+
// In the default httpd template at the end of the vhost those custom configs get
76+
// included using `Include conf/httpd_custom_<endpoint>_*`.
77+
// For information on how sections in httpd configuration get merged, check section
78+
// "How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging
79+
CustomConfigSecret *string `json:"customConfigSecret,omitempty"`
80+
}
81+
6582
// BarbicanAPISpec defines the desired state of BarbicanAPI
6683
type BarbicanAPISpec struct {
6784
BarbicanTemplate `json:",inline"`

‎api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 21 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/barbican.openstack.org_barbicanapis.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,20 @@ spec:
118118
- simple_crypto
119119
- pkcs11
120120
type: string
121+
httpdCustomization:
122+
description: HttpdCustomization - customize the httpd service
123+
properties:
124+
customConfigSecret:
125+
description: |-
126+
CustomConfigSecret - customize the httpd vhost config using this parameter to specify
127+
a secret that contains service config data. The content of each provided snippet gets
128+
rendered as a go template and placed into /etc/httpd/conf/httpd_custom_<key> .
129+
In the default httpd template at the end of the vhost those custom configs get
130+
included using `Include conf/httpd_custom_<endpoint>_*`.
131+
For information on how sections in httpd configuration get merged, check section
132+
"How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging
133+
type: string
134+
type: object
121135
networkAttachments:
122136
description: NetworkAttachments is a list of NetworkAttachment resource
123137
names to expose the services to the given network

‎config/crd/bases/barbican.openstack.org_barbicans.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,20 @@ spec:
9191
description: EnableSecureRBAC - Enable Consistent and Secure RBAC
9292
policies
9393
type: boolean
94+
httpdCustomization:
95+
description: HttpdCustomization - customize the httpd service
96+
properties:
97+
customConfigSecret:
98+
description: |-
99+
CustomConfigSecret - customize the httpd vhost config using this parameter to specify
100+
a secret that contains service config data. The content of each provided snippet gets
101+
rendered as a go template and placed into /etc/httpd/conf/httpd_custom_<key> .
102+
In the default httpd template at the end of the vhost those custom configs get
103+
included using `Include conf/httpd_custom_<endpoint>_*`.
104+
For information on how sections in httpd configuration get merged, check section
105+
"How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging
106+
type: string
107+
type: object
94108
networkAttachments:
95109
description: NetworkAttachments is a list of NetworkAttachment
96110
resource names to expose the services to the given network

‎controllers/barbican_common.go‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -41,18 +41,20 @@ func GenerateConfigsGeneric(
4141
customData map[string]string,
4242
cmLabels map[string]string,
4343
scripts bool,
44+
customTemplates map[string]string,
4445
) error {
4546

4647
cms := []util.Template{
4748
// Templates where the BarbicanAPI config is stored
4849
{
49-
Name: fmt.Sprintf("%s-config-data", instance.GetName()),
50-
Namespace: instance.GetNamespace(),
51-
Type: util.TemplateTypeConfig,
52-
InstanceType: instance.GetObjectKind().GroupVersionKind().Kind,
53-
ConfigOptions: templateParameters,
54-
CustomData: customData,
55-
Labels: cmLabels,
50+
Name: fmt.Sprintf("%s-config-data", instance.GetName()),
51+
Namespace: instance.GetNamespace(),
52+
Type: util.TemplateTypeConfig,
53+
InstanceType: instance.GetObjectKind().GroupVersionKind().Kind,
54+
ConfigOptions: templateParameters,
55+
CustomData: customData,
56+
Labels: cmLabels,
57+
StringTemplate: customTemplates,
5658
},
5759
}
5860
if scripts {

‎controllers/barbican_controller.go‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222
"slices"
2323
"time"
2424

25+
"gopkg.in/yaml.v2"
2526
"k8s.io/apimachinery/pkg/runtime"
2627
"k8s.io/apimachinery/pkg/types"
2728
"k8s.io/client-go/kubernetes"
@@ -555,10 +556,11 @@ func (r *BarbicanReconciler) reconcileDelete(ctx context.Context, instance *barb
555556

556557
// fields to index to reconcile when change
557558
const (
558-
passwordSecretField = ".spec.secret"
559-
caBundleSecretNameField = ".spec.tls.caBundleSecretName"
560-
tlsAPIInternalField = ".spec.tls.api.internal.secretName"
561-
tlsAPIPublicField = ".spec.tls.api.public.secretName"
559+
passwordSecretField = ".spec.secret"
560+
caBundleSecretNameField = ".spec.tls.caBundleSecretName"
561+
tlsAPIInternalField = ".spec.tls.api.internal.secretName"
562+
tlsAPIPublicField = ".spec.tls.api.public.secretName"
563+
httpdCustomServiceConfigSecretField = ".spec.httpdCustomization.customServiceConfigSecret"
562564
)
563565

564566
var (
@@ -571,6 +573,7 @@ var (
571573
caBundleSecretNameField,
572574
tlsAPIInternalField,
573575
tlsAPIPublicField,
576+
httpdCustomServiceConfigSecretField,
574577
}
575578
)
576579

@@ -678,7 +681,14 @@ func (r *BarbicanReconciler) generateServiceConfig(
678681
maps.Copy(templateParameters, pkcs11TemplateMap)
679682
}
680683

681-
return GenerateConfigsGeneric(ctx, h, instance, envVars, templateParameters, customData, labels, true)
684+
// Marshal the templateParameters map to YAML
685+
yamlData, err := yaml.Marshal(templateParameters)
686+
if err != nil {
687+
return fmt.Errorf("Error marshalling to YAML: %w", err)
688+
}
689+
customData[common.TemplateParameters] = string(yamlData)
690+
691+
return GenerateConfigsGeneric(ctx, h, instance, envVars, templateParameters, customData, labels, true, map[string]string{})
682692
}
683693

684694
func (r *BarbicanReconciler) transportURLCreateOrUpdate(

0 commit comments

Comments
 (0)