Skip to content

Commit 09e8673

Browse files
zzzeekzzzeek
committed
use system MariaDBAccount for the galera server's root pw
This commit ties together the previous ones to create a new MariaDBAccount when a Galera instance is created, and then to use the password from that account/secret in the mariadb bootstrap/maintenance scripts. Galera gets bootstrapped with this secret, then the mariadbaccount controller, who is waiting for galera to be available to set up this new "root" account, wakes up when galera is running, and changes the root password to itself, establishing the initial job hash for the mariadbaccount.
1 parent a3a32f3 commit 09e8673

File tree

16 files changed

+310
-80
lines changed

16 files changed

+310
-80
lines changed

‎api/bases/mariadb.openstack.org_galeras.yaml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,18 @@ spec:
7878
maximum: 3
7979
minimum: 0
8080
type: integer
81+
rootDatabaseAccount:
82+
description: |-
83+
RootDatabaseAccount - name of MariaDBAccount which will be used to
84+
generate root account / password.
85+
this account is generated if not exists, and a name is chosen based
86+
on a naming convention if not present
87+
type: string
8188
secret:
82-
description: Name of the secret to look for password keys
89+
description: |-
90+
Name of the legacy secret to locate the initial galera root
91+
password
92+
this field will be removed once scripts can adjust to using root_auth.sh
8393
type: string
8494
storageClass:
8595
description: Storage class to host the mariadb databases
@@ -118,7 +128,6 @@ spec:
118128
required:
119129
- containerImage
120130
- replicas
121-
- secret
122131
- storageClass
123132
- storageRequest
124133
type: object

‎api/v1beta1/conditions.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,8 @@ const (
8484

8585
MariaDBAccountReadyInitMessage = "MariaDBAccount create / drop not started"
8686

87+
MariaDBSystemAccountReadyMessage = "MariaDBAccount System account '%s' creation complete"
88+
8789
MariaDBAccountReadyMessage = "MariaDBAccount creation complete"
8890

8991
MariaDBAccountNotReadyMessage = "MariaDBAccount is not present: %s"

‎api/v1beta1/galera_types.go‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ limitations under the License.
1717
package v1beta1
1818

1919
import (
20+
topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
2021
condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
2122
"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
2223
"github.com/openstack-k8s-operators/lib-common/modules/common/util"
23-
topologyv1 "github.com/openstack-k8s-operators/infra-operator/apis/topology/v1beta1"
24-
"k8s.io/apimachinery/pkg/util/validation/field"
2524
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
25+
"k8s.io/apimachinery/pkg/util/validation/field"
2626
)
2727

2828
const (
@@ -50,9 +50,19 @@ type GaleraSpec struct {
5050

5151
// GaleraSpec defines the desired state of Galera
5252
type GaleraSpecCore struct {
53-
// Name of the secret to look for password keys
54-
// +kubebuilder:validation:Required
53+
// Name of the legacy secret to locate the initial galera root
54+
// password
55+
// this field will be removed once scripts can adjust to using root_auth.sh
56+
// +kubebuilder:validation:Optional
5557
Secret string `json:"secret"`
58+
59+
// RootDatabaseAccount - name of MariaDBAccount which will be used to
60+
// generate root account / password.
61+
// this account is generated if not exists, and a name is chosen based
62+
// on a naming convention if not present
63+
// +kubebuilder:validation:Optional
64+
RootDatabaseAccount string `json:"rootDatabaseAccount"`
65+
5666
// Storage class to host the mariadb databases
5767
// +kubebuilder:validation:Required
5868
StorageClass string `json:"storageClass"`

‎api/v1beta1/mariadbaccount_types.go‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,6 @@ const (
2828
// AccountDeleteHash hash
2929
AccountDeleteHash = "accountdelete"
3030

31-
// DbRootPassword selector for galera root account
32-
DbRootPasswordSelector = "DbRootPassword"
33-
3431
// DatabasePassword selector for MariaDBAccount->Secret
3532
DatabasePasswordSelector = "DatabasePassword"
3633
)

‎api/v1beta1/mariadbdatabase_funcs.go‎

Lines changed: 95 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -541,6 +541,47 @@ func DeleteDatabaseAndAccountFinalizers(
541541
namespace string,
542542
) error {
543543

544+
err := DeleteAccountFinalizers(
545+
ctx,
546+
h,
547+
accountName,
548+
namespace,
549+
)
550+
if err != nil {
551+
return err
552+
}
553+
554+
// also do a delete for "unused" MariaDBAccounts, associated with
555+
// this MariaDBDatabase.
556+
err = DeleteUnusedMariaDBAccountFinalizers(
557+
ctx, h, name, accountName, namespace,
558+
)
559+
if err != nil && !k8s_errors.IsNotFound(err) {
560+
return err
561+
}
562+
563+
mariaDBDatabase, err := GetDatabase(ctx, h, name, namespace)
564+
if err != nil && !k8s_errors.IsNotFound(err) {
565+
return err
566+
} else if err == nil && controllerutil.RemoveFinalizer(mariaDBDatabase, h.GetFinalizer()) {
567+
err := h.GetClient().Update(ctx, mariaDBDatabase)
568+
if err != nil && !k8s_errors.IsNotFound(err) {
569+
return err
570+
}
571+
util.LogForObject(h, fmt.Sprintf("Removed finalizer %s from MariaDBDatabase %s", h.GetFinalizer(), mariaDBDatabase.Spec.Name), mariaDBDatabase)
572+
}
573+
574+
return nil
575+
}
576+
577+
// DeleteAccountFinalizers performs just the primary account + secret finalizer
578+
// removal part of DeleteDatabaseAndAccountFinalizers
579+
func DeleteAccountFinalizers(
580+
ctx context.Context,
581+
h *helper.Helper,
582+
accountName string,
583+
namespace string,
584+
) error {
544585
databaseAccount, err := GetAccount(ctx, h, accountName, namespace)
545586
if err != nil && !k8s_errors.IsNotFound(err) {
546587
return err
@@ -572,26 +613,6 @@ func DeleteDatabaseAndAccountFinalizers(
572613
}
573614
}
574615

575-
// also do a delete for "unused" MariaDBAccounts, associated with
576-
// this MariaDBDatabase.
577-
err = DeleteUnusedMariaDBAccountFinalizers(
578-
ctx, h, name, accountName, namespace,
579-
)
580-
if err != nil && !k8s_errors.IsNotFound(err) {
581-
return err
582-
}
583-
584-
mariaDBDatabase, err := GetDatabase(ctx, h, name, namespace)
585-
if err != nil && !k8s_errors.IsNotFound(err) {
586-
return err
587-
} else if err == nil && controllerutil.RemoveFinalizer(mariaDBDatabase, h.GetFinalizer()) {
588-
err := h.GetClient().Update(ctx, mariaDBDatabase)
589-
if err != nil && !k8s_errors.IsNotFound(err) {
590-
return err
591-
}
592-
util.LogForObject(h, fmt.Sprintf("Removed finalizer %s from MariaDBDatabase %s", h.GetFinalizer(), mariaDBDatabase.Spec.Name), mariaDBDatabase)
593-
}
594-
595616
return nil
596617
}
597618

@@ -811,6 +832,32 @@ func EnsureMariaDBAccount(ctx context.Context,
811832
userNamePrefix string,
812833
) (*MariaDBAccount, *corev1.Secret, error) {
813834

835+
return ensureMariaDBAccount(
836+
ctx, helper, accountName, namespace, requireTLS,
837+
userNamePrefix, "", "", map[string]string{})
838+
839+
}
840+
841+
// EnsureMariaDBSystemAccount ensures a MariaDBAccount has been created for a given
842+
// operator calling the function, and returns the MariaDBAccount and its
843+
// Secret for use in consumption into a configuration.
844+
// Unlike EnsureMariaDBAccount, the function accepts an exact username that
845+
// expected to remain constant, supporting in-place password changes for the
846+
// account.
847+
func EnsureMariaDBSystemAccount(ctx context.Context,
848+
helper *helper.Helper,
849+
accountName string, galeraInstanceName string, namespace string, requireTLS bool,
850+
exactUserName string, exactPassword string) (*MariaDBAccount, *corev1.Secret, error) {
851+
return ensureMariaDBAccount(
852+
ctx, helper, accountName, namespace, requireTLS,
853+
"", exactUserName, exactPassword, map[string]string{"dbName": galeraInstanceName})
854+
}
855+
856+
func ensureMariaDBAccount(ctx context.Context,
857+
helper *helper.Helper,
858+
accountName string, namespace string, requireTLS bool,
859+
userNamePrefix string, exactUserName string, exactPassword string, labels map[string]string,
860+
) (*MariaDBAccount, *corev1.Secret, error) {
814861
if accountName == "" {
815862
return nil, nil, fmt.Errorf("accountName is empty")
816863
}
@@ -822,9 +869,20 @@ func EnsureMariaDBAccount(ctx context.Context,
822869
return nil, nil, err
823870
}
824871

825-
username, err := generateUniqueUsername(userNamePrefix)
826-
if err != nil {
827-
return nil, nil, err
872+
var username string
873+
var accountType AccountType
874+
875+
if exactUserName == "" {
876+
accountType = "User"
877+
username, err = generateUniqueUsername(userNamePrefix)
878+
if err != nil {
879+
return nil, nil, err
880+
}
881+
} else if userNamePrefix != "" {
882+
return nil, nil, fmt.Errorf("userNamePrefix and exactUserName are mutually exclusive")
883+
} else {
884+
accountType = "System"
885+
username = exactUserName
828886
}
829887

830888
account = &MariaDBAccount{
@@ -837,9 +895,10 @@ func EnsureMariaDBAccount(ctx context.Context,
837895
// MariaDBAccount once this is filled in
838896
},
839897
Spec: MariaDBAccountSpec{
840-
UserName: username,
841-
Secret: fmt.Sprintf("%s-db-secret", accountName),
842-
RequireTLS: requireTLS,
898+
UserName: username,
899+
Secret: fmt.Sprintf("%s-db-secret", accountName),
900+
RequireTLS: requireTLS,
901+
AccountType: accountType,
843902
},
844903
}
845904

@@ -858,9 +917,14 @@ func EnsureMariaDBAccount(ctx context.Context,
858917
return nil, nil, err
859918
}
860919

861-
dbPassword, err := generateDBPassword()
862-
if err != nil {
863-
return nil, nil, err
920+
var dbPassword string
921+
if exactPassword == "" {
922+
dbPassword, err = generateDBPassword()
923+
if err != nil {
924+
return nil, nil, err
925+
}
926+
} else {
927+
dbPassword = exactPassword
864928
}
865929

866930
dbSecret = &corev1.Secret{
@@ -874,7 +938,7 @@ func EnsureMariaDBAccount(ctx context.Context,
874938
}
875939
}
876940

877-
_, err = createOrPatchAccountAndSecret(ctx, helper, account, dbSecret, map[string]string{})
941+
_, err = createOrPatchAccountAndSecret(ctx, helper, account, dbSecret, labels)
878942
if err != nil {
879943
return nil, nil, err
880944
}
@@ -890,6 +954,7 @@ func EnsureMariaDBAccount(ctx context.Context,
890954
)
891955

892956
return account, dbSecret, nil
957+
893958
}
894959

895960
// generateUniqueUsername creates a MySQL-compliant database username based on

‎config/crd/bases/mariadb.openstack.org_galeras.yaml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,18 @@ spec:
7878
maximum: 3
7979
minimum: 0
8080
type: integer
81+
rootDatabaseAccount:
82+
description: |-
83+
RootDatabaseAccount - name of MariaDBAccount which will be used to
84+
generate root account / password.
85+
this account is generated if not exists, and a name is chosen based
86+
on a naming convention if not present
87+
type: string
8188
secret:
82-
description: Name of the secret to look for password keys
89+
description: |-
90+
Name of the legacy secret to locate the initial galera root
91+
password
92+
this field will be removed once scripts can adjust to using root_auth.sh
8393
type: string
8494
storageClass:
8595
description: Storage class to host the mariadb databases
@@ -118,7 +128,6 @@ spec:
118128
required:
119129
- containerImage
120130
- replicas
121-
- secret
122131
- storageClass
123132
- storageRequest
124133
type: object

0 commit comments

Comments
 (0)