Skip to content

Commit 8bc8f8d

Browse files
committed
Automatically set s3_store_cacert when S3 and TLS are enabled
Add automatic S3 CA certificate injection when TLS is enabled, injecting s3_store_cacert parameter to point to the CA bundle. It is based on the mechanism via lib-common util.ExtendCustomServiceConfig() that safely adds configuration options without overwriting existing user settings, preserving customServiceConfig integrity based on user input. Jira: https://issues.redhat.com/browse/OSPRH-14309 Signed-off-by: Francesco Pantano <[email protected]>
1 parent 5b2fa35 commit 8bc8f8d

File tree

7 files changed

+215
-12
lines changed

7 files changed

+215
-12
lines changed

api/go.mod

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,3 +71,5 @@ require (
7171
// mschuppert: map to latest commit from release-4.18 tag
7272
// must consistent within modules and service operators
7373
replace github.com/openshift/api => github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e //allow-merging
74+
75+
replace github.com/openstack-k8s-operators/lib-common/modules/common => github.com/fmount/lib-common/modules/common v0.0.0-20250924115659-e582f0463eb1

api/go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ
1212
github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
1313
github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
1414
github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
15+
github.com/fmount/lib-common/modules/common v0.0.0-20250924115659-e582f0463eb1 h1:KP/STzbdVe18nbnklg3LVxyNe7PXrdAnJhmXp3UqJtw=
16+
github.com/fmount/lib-common/modules/common v0.0.0-20250924115659-e582f0463eb1/go.mod h1:SmKRclrynSSRCXSLOoWlETalJPvt62ObHsfW8iPvtDA=
1517
github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
1618
github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
1719
github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
@@ -75,8 +77,6 @@ github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e h1:E1OdwSpqWuDPCedyU
7577
github.com/openshift/api v0.0.0-20250711200046-c86d80652a9e/go.mod h1:Shkl4HanLwDiiBzakv+con/aMGnVE2MAGvoKp5oyYUo=
7678
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20250922155301-057562fb7182 h1:Ea+FZQOW0Eha1jorgSECFeqI9UrKz8TZlGnSM7X8Yf4=
7779
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20250922155301-057562fb7182/go.mod h1:3Im8PFiRKPaOZpOuqYShJRN2O2pfjUuhDTUpW4KMHZw=
78-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20250922082314-c83d83092a04 h1:JqJd39rF8rD9KIHmOEFbHP8UyYgttfuouj+kAFNtymU=
79-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20250922082314-c83d83092a04/go.mod h1:SmKRclrynSSRCXSLOoWlETalJPvt62ObHsfW8iPvtDA=
8080
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20250922082314-c83d83092a04 h1:j5P/ehO4bQ+VqNvqNiX7N/R8wnBweFy7MX685nh4mmY=
8181
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20250922082314-c83d83092a04/go.mod h1:WbDAhyvX2UTyK9LzYZKjRvEGdn2fsQJHUo5l2J5q/vg=
8282
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=

controllers/glanceapi_controller.go

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -687,6 +687,7 @@ func (r *GlanceAPIReconciler) reconcileNormal(
687687
configVars := make(map[string]env.Setter)
688688
privileged := false
689689
imageConv := false
690+
extConfigOptions := []util.IniOption{}
690691

691692
//
692693
// check for required OpenStack secret holding passwords for service/admin user and add hash to the vars map
@@ -758,7 +759,7 @@ func (r *GlanceAPIReconciler) reconcileNormal(
758759
}
759760
}
760761
// iterate over availableBackends for backend specific cases
761-
for i := 0; i < len(availableBackends); i++ {
762+
for i := range len(availableBackends) {
762763
backendToken := strings.SplitN(availableBackends[i], ":", 2)
763764
switch backendToken[1] {
764765
case "cinder":
@@ -797,6 +798,16 @@ func (r *GlanceAPIReconciler) reconcileNormal(
797798
// enable image conversion by default
798799
Log.Info("Ceph config detected: enable image conversion by default")
799800
imageConv = true
801+
case "s3":
802+
Log.Info(fmt.Sprintf(
803+
"s3 config detected: inject s3_store_cacert parameter to backend %s\n", backendToken[0]))
804+
if instance.Spec.TLS.CaBundleSecretName != "" {
805+
extConfigOptions = append(extConfigOptions, util.IniOption{
806+
Section: backendToken[0],
807+
Key: "s3_store_cacert",
808+
Value: "/etc/pki/tls/certs/ca-bundle.crt",
809+
})
810+
}
800811
}
801812
}
802813
// If we reach this point, it means that either Cinder is not a backend for Glance
@@ -907,7 +918,8 @@ func (r *GlanceAPIReconciler) reconcileNormal(
907918
}
908919

909920
// Generate service config
910-
err = r.generateServiceConfig(ctx, helper, instance, &configVars, imageConv, memcached, wsgi)
921+
err = r.generateServiceConfig(ctx, helper, instance, &configVars,
922+
imageConv, memcached, wsgi, extConfigOptions)
911923
if err != nil {
912924
instance.Status.Conditions.Set(condition.FalseCondition(
913925
condition.ServiceConfigReadyCondition,
@@ -1143,8 +1155,11 @@ func (r *GlanceAPIReconciler) generateServiceConfig(
11431155
imageConv bool,
11441156
memcached *memcachedv1.Memcached,
11451157
wsgi bool,
1158+
extConfigOptions []util.IniOption,
11461159
) error {
1160+
Log := r.GetLogger(ctx)
11471161
labels := labels.GetLabels(instance, labels.GetGroupLabel(glance.ServiceName), GetServiceLabels(instance))
1162+
extendedConfig := instance.Spec.CustomServiceConfig
11481163

11491164
db, err := mariadbv1.GetDatabaseByNameAndAccount(ctx, h, glance.DatabaseName, instance.Spec.DatabaseAccount, instance.Namespace)
11501165
if err != nil {
@@ -1155,9 +1170,18 @@ func (r *GlanceAPIReconciler) generateServiceConfig(
11551170
if instance.Spec.TLS.CaBundleSecretName != "" {
11561171
tlsCfg = &tls.Service{}
11571172
}
1173+
// extend customServiceConfig is []IniOption has elements
1174+
for _, opt := range extConfigOptions {
1175+
extendedConfig, err = util.ExtendCustomServiceConfig(extendedConfig, opt)
1176+
if err != nil {
1177+
// The error returned from this library is not blocking, but it is
1178+
// useful to log it for troubleshooting purposes
1179+
Log.Info(err.Error())
1180+
}
1181+
}
11581182
// 02-config.conf
11591183
customData := map[string]string{
1160-
glance.CustomServiceConfigFileName: instance.Spec.CustomServiceConfig,
1184+
glance.CustomServiceConfigFileName: extendedConfig,
11611185
"my.cnf": db.GetDatabaseClientConfig(tlsCfg), //(mschuppert) for now just get the default my.cnf
11621186
}
11631187

go.mod

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,3 +94,5 @@ replace github.com/openshift/api => github.com/openshift/api v0.0.0-202507112000
9494

9595
// custom RabbitmqClusterSpecCore for OpenStackControlplane (v2.6.0_patches_tag)
9696
replace github.com/rabbitmq/cluster-operator/v2 => github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250717122149-12f70b7f3d8d //allow-merging
97+
98+
replace github.com/openstack-k8s-operators/lib-common/modules/common => github.com/fmount/lib-common/modules/common v0.0.0-20250924115659-e582f0463eb1

go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ
1212
github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
1313
github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
1414
github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
15+
github.com/fmount/lib-common/modules/common v0.0.0-20250924115659-e582f0463eb1 h1:KP/STzbdVe18nbnklg3LVxyNe7PXrdAnJhmXp3UqJtw=
16+
github.com/fmount/lib-common/modules/common v0.0.0-20250924115659-e582f0463eb1/go.mod h1:SmKRclrynSSRCXSLOoWlETalJPvt62ObHsfW8iPvtDA=
1517
github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
1618
github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
1719
github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
@@ -85,8 +87,6 @@ github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20250922155301-0
8587
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20250922155301-057562fb7182/go.mod h1:3Im8PFiRKPaOZpOuqYShJRN2O2pfjUuhDTUpW4KMHZw=
8688
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20250916093250-82a76386143d h1:lSRMftk/MbN4qd8ihHh9ucdX4sfR/HUudEcy2h/BNhQ=
8789
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20250916093250-82a76386143d/go.mod h1:7ZuNZNtwRYklS2H5E5YSjsHOI2sYbAl1AD+N0W/G+8A=
88-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20250922082314-c83d83092a04 h1:JqJd39rF8rD9KIHmOEFbHP8UyYgttfuouj+kAFNtymU=
89-
github.com/openstack-k8s-operators/lib-common/modules/common v0.6.1-0.20250922082314-c83d83092a04/go.mod h1:SmKRclrynSSRCXSLOoWlETalJPvt62ObHsfW8iPvtDA=
9090
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20250922082314-c83d83092a04 h1:1t4qZshLvaTzytFb9foCBtTtKT4uXzYtVaYTlgYbt+4=
9191
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20250922082314-c83d83092a04/go.mod h1:IO6+EHBk1Ttd4L8mfnMtG58cc36tDyvdxzCytn+hKeE=
9292
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20250922082314-c83d83092a04 h1:j5P/ehO4bQ+VqNvqNiX7N/R8wnBweFy7MX685nh4mmY=

test/functional/glance_test_data.go

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,10 @@ const (
4747
GlanceDummyBackend = "enabled_backends=backend1:type1 # CHANGE_ME"
4848
//GlanceCinderBackend -
4949
GlanceCinderBackend = "enabled_backends=default_backend:cinder"
50+
//GlanceS3Backend -
51+
GlanceS3Backend = "[DEFAULT]\nenabled_backends=backend1:s3\n[backend1]\ns3_store_create_bucket_on_put = True"
52+
//GlanceS3BackendOverride -
53+
GlanceS3BackendOverride = "[DEFAULT]\nenabled_backends=backend1:s3\n[backend1]\ns3_store_cacert = \"\""
5054
// MemcachedInstance - name of the memcached instance
5155
MemcachedInstance = "memcached"
5256
// AccountName - name of the MariaDBAccount CR
@@ -86,6 +90,7 @@ type GlanceTestData struct {
8690
GlanceService types.NamespacedName
8791
GlanceConfigMapData types.NamespacedName
8892
GlanceInternalConfigMapData types.NamespacedName
93+
GlanceExternalConfigMapData types.NamespacedName
8994
GlanceSingleConfigMapData types.NamespacedName
9095
GlanceConfigMapScripts types.NamespacedName
9196
InternalAPINAD types.NamespacedName
@@ -180,6 +185,10 @@ func GetGlanceTestData(glanceName types.NamespacedName) GlanceTestData {
180185
Namespace: glanceName.Namespace,
181186
Name: fmt.Sprintf("%s-%s", glanceName.Name, "default-internal-config-data"),
182187
},
188+
GlanceExternalConfigMapData: types.NamespacedName{
189+
Namespace: glanceName.Namespace,
190+
Name: fmt.Sprintf("%s-%s", glanceName.Name, "default-external-config-data"),
191+
},
183192
GlanceSingleConfigMapData: types.NamespacedName{
184193
Namespace: glanceName.Namespace,
185194
Name: fmt.Sprintf("%s-%s", glanceName.Name, "default-single-config-data"),

test/functional/glanceapi_controller_test.go

Lines changed: 171 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,177 @@ var _ = Describe("Glanceapi controller", func() {
247247
}, timeout, interval).Should(Succeed())
248248
})
249249
})
250+
Context("GlanceAPI is deployed with S3 backend and TLS is enabled", func() {
251+
keystoneAPIName := types.NamespacedName{}
252+
253+
BeforeEach(func() {
254+
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, glanceTest.MemcachedInstance, memcachedSpec))
255+
infra.SimulateMemcachedReady(glanceTest.GlanceMemcached)
256+
DeferCleanup(th.DeleteInstance, CreateDefaultGlance(glanceTest.Instance))
257+
DeferCleanup(
258+
mariadb.DeleteDBService,
259+
mariadb.CreateDBService(
260+
glanceName.Namespace,
261+
GetGlance(glanceTest.Instance).Spec.DatabaseInstance,
262+
corev1.ServiceSpec{
263+
Ports: []corev1.ServicePort{{Port: 3306}},
264+
},
265+
),
266+
)
267+
268+
mariadb.CreateMariaDBDatabase(glanceTest.GlanceDatabaseName.Namespace, glanceTest.GlanceDatabaseName.Name, mariadbv1.MariaDBDatabaseSpec{})
269+
DeferCleanup(k8sClient.Delete, ctx, mariadb.GetMariaDBDatabase(glanceTest.GlanceDatabaseName))
270+
271+
DeferCleanup(k8sClient.Delete, ctx, th.CreateCABundleSecret(glanceTest.CABundleSecret))
272+
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(glanceTest.InternalCertSecret))
273+
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(glanceTest.PublicCertSecret))
274+
spec := GetTLSGlanceAPISpec(GlanceAPITypeInternal)
275+
spec["customServiceConfig"] = GlanceS3Backend
276+
DeferCleanup(th.DeleteInstance, CreateGlanceAPI(glanceTest.GlanceInternal, spec))
277+
278+
keystoneAPIName = keystone.CreateKeystoneAPI(glanceTest.GlanceInternal.Namespace)
279+
DeferCleanup(keystone.DeleteKeystoneAPI, keystoneAPIName)
280+
keystone.CreateKeystoneEndpoint(glanceTest.GlanceInternal)
281+
keystone.SimulateKeystoneEndpointReady(glanceTest.GlanceInternal)
282+
th.SimulateStatefulSetReplicaReady(glanceTest.GlanceInternalStatefulSet)
283+
284+
th.ExpectCondition(
285+
glanceTest.GlanceInternal,
286+
ConditionGetterFunc(GlanceAPIConditionGetter),
287+
condition.ReadyCondition,
288+
corev1.ConditionTrue,
289+
)
290+
})
291+
292+
It("s3 backend is present in customServiceConfig", func() {
293+
gapi := GetGlanceAPI(glanceTest.GlanceInternal)
294+
Expect(gapi.Spec.CustomServiceConfig).Should(ContainSubstring("s3"))
295+
})
296+
297+
It("extends customServiceConfig and inject s3_store_cacert", func() {
298+
Eventually(func(g Gomega) {
299+
confSecret := th.GetSecret(glanceTest.GlanceInternalConfigMapData)
300+
g.Expect(confSecret).ShouldNot(BeNil())
301+
g.Expect(confSecret.Data).Should(HaveKey("02-config.conf"))
302+
conf := string(confSecret.Data["02-config.conf"])
303+
g.Expect(string(conf)).Should(
304+
ContainSubstring("s3_store_cacert"))
305+
}, timeout, interval).Should(Succeed())
306+
})
307+
})
308+
Context("GlanceAPI is deployed with S3 backend and a customServiceConfig override and TLS is enabled", func() {
309+
keystoneAPIName := types.NamespacedName{}
310+
311+
BeforeEach(func() {
312+
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, glanceTest.MemcachedInstance, memcachedSpec))
313+
infra.SimulateMemcachedReady(glanceTest.GlanceMemcached)
314+
DeferCleanup(th.DeleteInstance, CreateDefaultGlance(glanceTest.Instance))
315+
DeferCleanup(
316+
mariadb.DeleteDBService,
317+
mariadb.CreateDBService(
318+
glanceName.Namespace,
319+
GetGlance(glanceTest.Instance).Spec.DatabaseInstance,
320+
corev1.ServiceSpec{
321+
Ports: []corev1.ServicePort{{Port: 3306}},
322+
},
323+
),
324+
)
325+
326+
mariadb.CreateMariaDBDatabase(glanceTest.GlanceDatabaseName.Namespace, glanceTest.GlanceDatabaseName.Name, mariadbv1.MariaDBDatabaseSpec{})
327+
DeferCleanup(k8sClient.Delete, ctx, mariadb.GetMariaDBDatabase(glanceTest.GlanceDatabaseName))
328+
329+
DeferCleanup(k8sClient.Delete, ctx, th.CreateCABundleSecret(glanceTest.CABundleSecret))
330+
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(glanceTest.InternalCertSecret))
331+
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(glanceTest.PublicCertSecret))
332+
spec := GetTLSGlanceAPISpec(GlanceAPITypeInternal)
333+
spec["customServiceConfig"] = GlanceS3BackendOverride
334+
DeferCleanup(th.DeleteInstance, CreateGlanceAPI(glanceTest.GlanceInternal, spec))
335+
336+
keystoneAPIName = keystone.CreateKeystoneAPI(glanceTest.GlanceInternal.Namespace)
337+
DeferCleanup(keystone.DeleteKeystoneAPI, keystoneAPIName)
338+
keystone.CreateKeystoneEndpoint(glanceTest.GlanceInternal)
339+
keystone.SimulateKeystoneEndpointReady(glanceTest.GlanceInternal)
340+
th.SimulateStatefulSetReplicaReady(glanceTest.GlanceInternalStatefulSet)
341+
342+
th.ExpectCondition(
343+
glanceTest.GlanceInternal,
344+
ConditionGetterFunc(GlanceAPIConditionGetter),
345+
condition.ReadyCondition,
346+
corev1.ConditionTrue,
347+
)
348+
})
349+
350+
It("s3 backend is present in customServiceConfig", func() {
351+
gapi := GetGlanceAPI(glanceTest.GlanceInternal)
352+
Expect(gapi.Spec.CustomServiceConfig).Should(ContainSubstring("s3"))
353+
})
354+
355+
It("does not extend customServiceConfig because the key s3_store_cacert is already present", func() {
356+
Eventually(func(g Gomega) {
357+
confSecret := th.GetSecret(glanceTest.GlanceInternalConfigMapData)
358+
g.Expect(confSecret).ShouldNot(BeNil())
359+
g.Expect(confSecret.Data).Should(HaveKey("02-config.conf"))
360+
conf := string(confSecret.Data["02-config.conf"])
361+
g.Expect(string(conf)).Should(
362+
ContainSubstring("s3_store_cacert = \"\""))
363+
}, timeout, interval).Should(Succeed())
364+
})
365+
})
366+
Context("GlanceAPI is deployed with S3 backend and TLS is disabled", func() {
367+
keystoneAPIName := types.NamespacedName{}
368+
369+
BeforeEach(func() {
370+
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, glanceTest.MemcachedInstance, memcachedSpec))
371+
infra.SimulateMemcachedReady(glanceTest.GlanceMemcached)
372+
DeferCleanup(th.DeleteInstance, CreateDefaultGlance(glanceTest.Instance))
373+
DeferCleanup(
374+
mariadb.DeleteDBService,
375+
mariadb.CreateDBService(
376+
glanceName.Namespace,
377+
GetGlance(glanceTest.Instance).Spec.DatabaseInstance,
378+
corev1.ServiceSpec{
379+
Ports: []corev1.ServicePort{{Port: 3306}},
380+
},
381+
),
382+
)
383+
384+
mariadb.CreateMariaDBDatabase(glanceTest.GlanceDatabaseName.Namespace, glanceTest.GlanceDatabaseName.Name, mariadbv1.MariaDBDatabaseSpec{})
385+
DeferCleanup(k8sClient.Delete, ctx, mariadb.GetMariaDBDatabase(glanceTest.GlanceDatabaseName))
386+
387+
spec := CreateGlanceAPISpec(GlanceAPITypeInternal)
388+
spec["customServiceConfig"] = GlanceS3Backend
389+
DeferCleanup(th.DeleteInstance, CreateGlanceAPI(glanceTest.GlanceInternal, spec))
390+
391+
keystoneAPIName = keystone.CreateKeystoneAPI(glanceTest.GlanceInternal.Namespace)
392+
DeferCleanup(keystone.DeleteKeystoneAPI, keystoneAPIName)
393+
keystone.CreateKeystoneEndpoint(glanceTest.GlanceInternal)
394+
keystone.SimulateKeystoneEndpointReady(glanceTest.GlanceInternal)
395+
th.SimulateStatefulSetReplicaReady(glanceTest.GlanceInternalStatefulSet)
396+
397+
th.ExpectCondition(
398+
glanceTest.GlanceInternal,
399+
ConditionGetterFunc(GlanceAPIConditionGetter),
400+
condition.ReadyCondition,
401+
corev1.ConditionTrue,
402+
)
403+
})
404+
405+
It("s3 backend is present in customServiceConfig", func() {
406+
gapi := GetGlanceAPI(glanceTest.GlanceInternal)
407+
Expect(gapi.Spec.CustomServiceConfig).Should(ContainSubstring("s3"))
408+
})
409+
410+
It("does not inject s3_store_cacert param", func() {
411+
Eventually(func(g Gomega) {
412+
confSecret := th.GetSecret(glanceTest.GlanceInternalConfigMapData)
413+
g.Expect(confSecret).ShouldNot(BeNil())
414+
g.Expect(confSecret.Data).Should(HaveKey("02-config.conf"))
415+
conf := string(confSecret.Data["02-config.conf"])
416+
g.Expect(string(conf)).Should(Not(
417+
ContainSubstring("s3_store_cacert")))
418+
}, timeout, interval).Should(Succeed())
419+
})
420+
})
250421
When("GlanceAPI is deployed with Cinder backend", func() {
251422
BeforeEach(func() {
252423
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, glanceTest.MemcachedInstance, memcachedSpec))
@@ -771,7 +942,6 @@ var _ = Describe("Glanceapi controller", func() {
771942
)
772943
})
773944
})
774-
775945
When("A split GlanceAPI with TLS is generated by the top-level CR", func() {
776946
BeforeEach(func() {
777947
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, glanceTest.MemcachedInstance, memcachedSpec))
@@ -892,7 +1062,6 @@ var _ = Describe("Glanceapi controller", func() {
8921062
)
8931063
})
8941064
})
895-
8961065
When("A single GlanceAPI with TLS is generated by the top-level CR (single-api)", func() {
8971066
BeforeEach(func() {
8981067
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, glanceTest.MemcachedInstance, memcachedSpec))
@@ -1092,7 +1261,6 @@ var _ = Describe("Glanceapi controller", func() {
10921261
}, timeout, interval).Should(Succeed())
10931262
})
10941263
})
1095-
10961264
When("A GlanceAPI with TLS is created with service override endpointURL", func() {
10971265
BeforeEach(func() {
10981266
DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, glanceTest.MemcachedInstance, memcachedSpec))
@@ -1151,7 +1319,6 @@ var _ = Describe("Glanceapi controller", func() {
11511319
)
11521320
})
11531321
})
1154-
11551322
When("GlanceAPI instance overrides a topology", func() {
11561323
var topologyRefAlt *topologyv1.TopoRef
11571324
BeforeEach(func() {
@@ -1231,7 +1398,6 @@ var _ = Describe("Glanceapi controller", func() {
12311398
}, timeout, interval).Should(Succeed())
12321399
})
12331400
})
1234-
12351401
Context("GlanceAPI is fully deployed", func() {
12361402
keystoneAPIName := types.NamespacedName{}
12371403

0 commit comments

Comments
 (0)