Skip to content

Commit 1abe781

Browse files
zzzeekzzzeek
committed
DNM (yet): Get MYSQL_PWD from cluster query, not env
In order to suit the use case of the MariaDB root password being changed, we would like to use an approach where a new secret object is created that contains the new password for root, which would replace the previous secret. This secret object would be specific to just the MariaDB root password and no longer part of osp-secret, and it would ideally be immutable as well, thus the requirement that a new secret is created, replacing a previous one, in order to change the password. (this architecture would also require the previous secret be accessible in some way in order to facilitate a root pw change, however that's out of the scope of this particular commit. Additionally, we may seek to use the MariaDBAccount CR as a parent of this root-holding secret, but that's also out of scope here and does not change the fact that a new secret object replaces an old one in order to change the password). The implication of this architecture is that all JobSpecs created by controllers must no longer include the name of the Galera "secret" inside either any EnvVars or any Volumes, which historically is the case when using SecretKeySelector, because the presence of this (now potentially changing) name would become part of the hash for the Job. This would mean that upon a change of root secret name all jobs for galera objects mariadbdatabase, mariadbaccount would go stale, leading to all these scripts being re-run again, even though the mariadb root password has no implication of the job results changing. There's also no mechanism for an "indirect" form of SecretKeySelector to be named that would move from a parent CR of some kind such as MariaDBAccount, as this goes against the notion of the "downward API". Additionally, the scripts running inside the Galera containers also need access to an updated root password; the current approach of using a combination of secret volume mounts as well as envvars would imply, IIUC, these containers need to be rebuilt on root PW change. This can all be replaced by a robust mechanism to retrieve the current MySQL root password directly from the k8s API instead, where all scripts in containers have access to the most recent secret / password at all times. The approach here is therefore a POC that retrieves the password from Galera->Spec->Secret. Later, when root password changes are introduced, this secret will be pulled from a status field instead indicating the corret root password at the current moment regardless of changes to secret within the spec.
1 parent 08026fd commit 1abe781

File tree

28 files changed

+176
-164
lines changed

28 files changed

+176
-164
lines changed

‎controllers/galera_controller.go‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -481,6 +481,21 @@ func (r *GaleraReconciler) Reconcile(ctx context.Context, req ctrl.Request) (res
481481
Resources: []string{"services"},
482482
Verbs: []string{"get", "list", "update", "patch"},
483483
},
484+
{
485+
APIGroups: []string{"mariadb.openstack.org"},
486+
Resources: []string{"galeras"},
487+
Verbs: []string{"get", "list"},
488+
},
489+
{
490+
APIGroups: []string{"mariadb.openstack.org"},
491+
Resources: []string{"mariadbaccounts"},
492+
Verbs: []string{"get"},
493+
},
494+
{
495+
APIGroups: []string{""},
496+
Resources: []string{"secrets"},
497+
Verbs: []string{"get"},
498+
},
484499
}
485500
rbacResult, err := common_rbac.ReconcileRbac(ctx, helper, instance, rbacRules)
486501
if err != nil {
@@ -930,19 +945,21 @@ func (r *GaleraReconciler) generateConfigMaps(
930945
) error {
931946
log := GetLog(ctx, "galera")
932947
templateParameters := map[string]interface{}{
933-
"logToDisk": instance.Spec.LogToDisk,
948+
"logToDisk": instance.Spec.LogToDisk,
949+
"galeraInstanceName": instance.Name,
934950
}
935951
customData := make(map[string]string)
936952
customData[mariadbv1.CustomServiceConfigFile] = instance.Spec.CustomServiceConfig
937953

938954
cms := []util.Template{
939955
// ScriptsConfigMap
940956
{
941-
Name: configMapNameForScripts(instance),
942-
Namespace: instance.Namespace,
943-
Type: util.TemplateTypeScripts,
944-
InstanceType: instance.Kind,
945-
Labels: map[string]string{},
957+
Name: configMapNameForScripts(instance),
958+
Namespace: instance.Namespace,
959+
Type: util.TemplateTypeScripts,
960+
InstanceType: instance.Kind,
961+
Labels: map[string]string{},
962+
ConfigOptions: templateParameters,
946963
},
947964
// ConfigMap
948965
{

‎controllers/mariadbaccount_controller.go‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -237,14 +237,13 @@ func (r *MariaDBAccountReconciler) reconcileCreate(
237237
return ctrl.Result{}, err
238238
}
239239

240-
var dbAdminSecret, dbContainerImage, serviceAccountName string
240+
var dbContainerImage, serviceAccountName string
241241

242242
if !dbGalera.Status.Bootstrapped {
243243
log.Info("DB bootstrap not complete. Requeue...")
244244
return ctrl.Result{RequeueAfter: time.Duration(10) * time.Second}, nil
245245
}
246246

247-
dbAdminSecret = dbGalera.Spec.Secret
248247
dbContainerImage = dbGalera.Spec.ContainerImage
249248
serviceAccountName = dbGalera.RbacResourceName()
250249

@@ -282,7 +281,7 @@ func (r *MariaDBAccountReconciler) reconcileCreate(
282281

283282
log.Info(fmt.Sprintf("Running account create '%s' MariaDBDatabase '%s'", instance.Name, mariadbDatabaseName))
284283

285-
jobDef, err := mariadb.CreateDbAccountJob(instance, mariadbDatabase.Spec.Name, dbHostname, dbAdminSecret, dbContainerImage, serviceAccountName, dbGalera.Spec.NodeSelector)
284+
jobDef, err := mariadb.CreateDbAccountJob(dbGalera, instance, mariadbDatabase.Spec.Name, dbHostname, dbContainerImage, serviceAccountName, dbGalera.Spec.NodeSelector)
286285
if err != nil {
287286
return ctrl.Result{}, err
288287
}
@@ -473,7 +472,7 @@ func (r *MariaDBAccountReconciler) reconcileDelete(
473472
}
474473
}
475474

476-
var dbAdminSecret, dbContainerImage, serviceAccountName string
475+
var dbContainerImage, serviceAccountName string
477476

478477
if !dbGalera.Status.Bootstrapped {
479478
log.Info("DB bootstrap not complete. Requeue...")
@@ -488,7 +487,6 @@ func (r *MariaDBAccountReconciler) reconcileDelete(
488487
return ctrl.Result{RequeueAfter: time.Second * 10}, nil
489488
}
490489

491-
dbAdminSecret = dbGalera.Spec.Secret
492490
dbContainerImage = dbGalera.Spec.ContainerImage
493491
serviceAccountName = dbGalera.RbacResourceName()
494492

@@ -507,7 +505,7 @@ func (r *MariaDBAccountReconciler) reconcileDelete(
507505

508506
log.Info(fmt.Sprintf("Running account delete '%s' MariaDBDatabase '%s'", instance.Name, mariadbDatabaseName))
509507

510-
jobDef, err := mariadb.DeleteDbAccountJob(instance, mariadbDatabase.Spec.Name, dbHostname, dbAdminSecret, dbContainerImage, serviceAccountName, dbGalera.Spec.NodeSelector)
508+
jobDef, err := mariadb.DeleteDbAccountJob(dbGalera, instance, mariadbDatabase.Spec.Name, dbHostname, dbContainerImage, serviceAccountName, dbGalera.Spec.NodeSelector)
511509
if err != nil {
512510
return ctrl.Result{}, err
513511
}

‎controllers/mariadbdatabase_controller.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ func (r *MariaDBDatabaseReconciler) Reconcile(ctx context.Context, req ctrl.Requ
161161
//
162162
// Non-deletion (normal) flow follows
163163
//
164-
var dbSecret, dbContainerImage, serviceAccount string
164+
var dbContainerImage, serviceAccount string
165165
// NOTE(dciabrin) When configured to only allow TLS connections, all clients
166166
// accessing this DB must support client connection via TLS.
167167
useTLS := dbGalera.Spec.TLS.Enabled() && dbGalera.Spec.DisableNonTLSListeners
@@ -179,7 +179,6 @@ func (r *MariaDBDatabaseReconciler) Reconcile(ctx context.Context, req ctrl.Requ
179179
return ctrl.Result{RequeueAfter: time.Second * 10}, nil
180180
}
181181

182-
dbSecret = dbGalera.Spec.Secret
183182
dbContainerImage = dbGalera.Spec.ContainerImage
184183
serviceAccount = dbGalera.RbacResourceName()
185184

@@ -195,7 +194,7 @@ func (r *MariaDBDatabaseReconciler) Reconcile(ctx context.Context, req ctrl.Requ
195194
)
196195

197196
// Define a new Job object (hostname, password, containerImage)
198-
jobDef, err := mariadb.DbDatabaseJob(instance, dbHostname, dbSecret, dbContainerImage, serviceAccount, useTLS, dbGalera.Spec.NodeSelector)
197+
jobDef, err := mariadb.DbDatabaseJob(dbGalera, instance, dbHostname, dbContainerImage, serviceAccount, useTLS, dbGalera.Spec.NodeSelector)
199198
if err != nil {
200199
return ctrl.Result{}, err
201200
}

‎pkg/mariadb/account.go‎

Lines changed: 10 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55

66
util "github.com/openstack-k8s-operators/lib-common/modules/common/util"
77
databasev1beta1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
8+
mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
89
batchv1 "k8s.io/api/batch/v1"
910
corev1 "k8s.io/api/core/v1"
1011
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -18,7 +19,7 @@ type accountCreateOrDeleteOptions struct {
1819
RequireTLS string
1920
}
2021

21-
func CreateDbAccountJob(account *databasev1beta1.MariaDBAccount, databaseName string, databaseHostName string, databaseSecret string, containerImage string, serviceAccountName string, nodeSelector *map[string]string) (*batchv1.Job, error) {
22+
func CreateDbAccountJob(galera *mariadbv1.Galera, account *databasev1beta1.MariaDBAccount, databaseName string, databaseHostName string, containerImage string, serviceAccountName string, nodeSelector *map[string]string) (*batchv1.Job, error) {
2223
var tlsStatement string
2324
if account.Spec.RequireTLS {
2425
tlsStatement = " REQUIRE SSL"
@@ -60,17 +61,6 @@ func CreateDbAccountJob(account *databasev1beta1.MariaDBAccount, databaseName st
6061
Image: containerImage,
6162
Command: []string{"/bin/sh", "-c", dbCmd},
6263
Env: []corev1.EnvVar{
63-
{
64-
Name: "MYSQL_PWD",
65-
ValueFrom: &corev1.EnvVarSource{
66-
SecretKeyRef: &corev1.SecretKeySelector{
67-
LocalObjectReference: corev1.LocalObjectReference{
68-
Name: databaseSecret,
69-
},
70-
Key: databasev1beta1.DbRootPasswordSelector,
71-
},
72-
},
73-
},
7464
{
7565
Name: "DatabasePassword",
7666
ValueFrom: &corev1.EnvVarSource{
@@ -83,8 +73,10 @@ func CreateDbAccountJob(account *databasev1beta1.MariaDBAccount, databaseName st
8373
},
8474
},
8575
},
76+
VolumeMounts: getGaleraRootOnlyVolumeMounts(),
8677
},
8778
},
79+
Volumes: getGaleraRootOnlyVolumes(galera),
8880
},
8981
},
9082
},
@@ -97,7 +89,7 @@ func CreateDbAccountJob(account *databasev1beta1.MariaDBAccount, databaseName st
9789
return job, nil
9890
}
9991

100-
func DeleteDbAccountJob(account *databasev1beta1.MariaDBAccount, databaseName string, databaseHostName string, databaseSecret string, containerImage string, serviceAccountName string, nodeSelector *map[string]string) (*batchv1.Job, error) {
92+
func DeleteDbAccountJob(galera *mariadbv1.Galera, account *databasev1beta1.MariaDBAccount, databaseName string, databaseHostName string, containerImage string, serviceAccountName string, nodeSelector *map[string]string) (*batchv1.Job, error) {
10193

10294
opts := accountCreateOrDeleteOptions{account.Spec.UserName, databaseName, databaseHostName, "root", ""}
10395

@@ -121,24 +113,13 @@ func DeleteDbAccountJob(account *databasev1beta1.MariaDBAccount, databaseName st
121113
ServiceAccountName: serviceAccountName,
122114
Containers: []corev1.Container{
123115
{
124-
Name: "mariadb-account-delete",
125-
Image: containerImage,
126-
Command: []string{"/bin/sh", "-c", delCmd},
127-
Env: []corev1.EnvVar{
128-
{
129-
Name: "MYSQL_PWD",
130-
ValueFrom: &corev1.EnvVarSource{
131-
SecretKeyRef: &corev1.SecretKeySelector{
132-
LocalObjectReference: corev1.LocalObjectReference{
133-
Name: databaseSecret,
134-
},
135-
Key: databasev1beta1.DbRootPasswordSelector,
136-
},
137-
},
138-
},
139-
},
116+
Name: "mariadb-account-delete",
117+
Image: containerImage,
118+
Command: []string{"/bin/sh", "-c", delCmd},
119+
VolumeMounts: getGaleraRootOnlyVolumeMounts(),
140120
},
141121
},
122+
Volumes: getGaleraRootOnlyVolumes(galera),
142123
},
143124
},
144125
},

‎pkg/mariadb/database.go‎

Lines changed: 17 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55

66
util "github.com/openstack-k8s-operators/lib-common/modules/common/util"
77
databasev1beta1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
8+
mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
89
batchv1 "k8s.io/api/batch/v1"
910
corev1 "k8s.io/api/core/v1"
1011
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -20,7 +21,7 @@ type dbCreateOptions struct {
2021
}
2122

2223
// DbDatabaseJob -
23-
func DbDatabaseJob(database *databasev1beta1.MariaDBDatabase, databaseHostName string, databaseSecret string, containerImage string, serviceAccountName string, useTLS bool, nodeSelector *map[string]string) (*batchv1.Job, error) {
24+
func DbDatabaseJob(galera *mariadbv1.Galera, database *databasev1beta1.MariaDBDatabase, databaseHostName string, containerImage string, serviceAccountName string, useTLS bool, nodeSelector *map[string]string) (*batchv1.Job, error) {
2425
var tlsStatement string
2526
if useTLS {
2627
tlsStatement = " REQUIRE SSL"
@@ -48,17 +49,6 @@ func DbDatabaseJob(database *databasev1beta1.MariaDBDatabase, databaseHostName s
4849

4950
if database.Spec.Secret != nil {
5051
scriptEnv = []corev1.EnvVar{
51-
{
52-
Name: "MYSQL_PWD",
53-
ValueFrom: &corev1.EnvVarSource{
54-
SecretKeyRef: &corev1.SecretKeySelector{
55-
LocalObjectReference: corev1.LocalObjectReference{
56-
Name: databaseSecret,
57-
},
58-
Key: "DbRootPassword",
59-
},
60-
},
61-
},
6252
// send deprecated Secret field but only if non-nil
6353
{
6454
Name: "DatabasePassword",
@@ -73,19 +63,7 @@ func DbDatabaseJob(database *databasev1beta1.MariaDBDatabase, databaseHostName s
7363
},
7464
}
7565
} else {
76-
scriptEnv = []corev1.EnvVar{
77-
{
78-
Name: "MYSQL_PWD",
79-
ValueFrom: &corev1.EnvVarSource{
80-
SecretKeyRef: &corev1.SecretKeySelector{
81-
LocalObjectReference: corev1.LocalObjectReference{
82-
Name: databaseSecret,
83-
},
84-
Key: "DbRootPassword",
85-
},
86-
},
87-
},
88-
}
66+
scriptEnv = []corev1.EnvVar{}
8967
}
9068

9169
job := &batchv1.Job{
@@ -104,12 +82,14 @@ func DbDatabaseJob(database *databasev1beta1.MariaDBDatabase, databaseHostName s
10482
ServiceAccountName: serviceAccountName,
10583
Containers: []corev1.Container{
10684
{
107-
Name: "mariadb-database-create",
108-
Image: containerImage,
109-
Command: []string{"/bin/sh", "-c", dbCmd},
110-
Env: scriptEnv,
85+
Name: "mariadb-database-create",
86+
Image: containerImage,
87+
Command: []string{"/bin/sh", "-c", dbCmd},
88+
Env: scriptEnv,
89+
VolumeMounts: getGaleraRootOnlyVolumeMounts(),
11190
},
11291
},
92+
Volumes: getGaleraRootOnlyVolumes(galera),
11393
},
11494
},
11595
},
@@ -123,7 +103,7 @@ func DbDatabaseJob(database *databasev1beta1.MariaDBDatabase, databaseHostName s
123103
}
124104

125105
// DeleteDbDatabaseJob -
126-
func DeleteDbDatabaseJob(database *databasev1beta1.MariaDBDatabase, databaseHostName string, databaseSecret string, containerImage string, serviceAccountName string, nodeSelector *map[string]string) (*batchv1.Job, error) {
106+
func DeleteDbDatabaseJob(galera *mariadbv1.Galera, database *databasev1beta1.MariaDBDatabase, databaseHostName string, containerImage string, serviceAccountName string, nodeSelector *map[string]string) (*batchv1.Job, error) {
127107

128108
opts := dbCreateOptions{
129109
database.Spec.Name,
@@ -145,17 +125,6 @@ func DeleteDbDatabaseJob(database *databasev1beta1.MariaDBDatabase, databaseHost
145125

146126
if database.Spec.Secret != nil {
147127
scriptEnv = []corev1.EnvVar{
148-
{
149-
Name: "MYSQL_PWD",
150-
ValueFrom: &corev1.EnvVarSource{
151-
SecretKeyRef: &corev1.SecretKeySelector{
152-
LocalObjectReference: corev1.LocalObjectReference{
153-
Name: databaseSecret,
154-
},
155-
Key: databasev1beta1.DbRootPasswordSelector,
156-
},
157-
},
158-
},
159128
// send deprecated Secret field but only if non-nil. otherwise
160129
// the script should not try to drop usernames from mysql.user
161130
{
@@ -171,19 +140,7 @@ func DeleteDbDatabaseJob(database *databasev1beta1.MariaDBDatabase, databaseHost
171140
},
172141
}
173142
} else {
174-
scriptEnv = []corev1.EnvVar{
175-
{
176-
Name: "MYSQL_PWD",
177-
ValueFrom: &corev1.EnvVarSource{
178-
SecretKeyRef: &corev1.SecretKeySelector{
179-
LocalObjectReference: corev1.LocalObjectReference{
180-
Name: databaseSecret,
181-
},
182-
Key: databasev1beta1.DbRootPasswordSelector,
183-
},
184-
},
185-
},
186-
}
143+
scriptEnv = []corev1.EnvVar{}
187144
}
188145

189146
job := &batchv1.Job{
@@ -199,12 +156,14 @@ func DeleteDbDatabaseJob(database *databasev1beta1.MariaDBDatabase, databaseHost
199156
ServiceAccountName: serviceAccountName,
200157
Containers: []corev1.Container{
201158
{
202-
Name: "mariadb-database-create",
203-
Image: containerImage,
204-
Command: []string{"/bin/sh", "-c", delCmd},
205-
Env: scriptEnv,
159+
Name: "mariadb-database-create",
160+
Image: containerImage,
161+
Command: []string{"/bin/sh", "-c", delCmd},
162+
Env: scriptEnv,
163+
VolumeMounts: getGaleraRootOnlyVolumeMounts(),
206164
},
207165
},
166+
Volumes: getGaleraRootOnlyVolumes(galera),
208167
},
209168
},
210169
},

‎pkg/mariadb/statefulset.go‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -104,16 +104,6 @@ func getGaleraInitContainers(g *mariadbv1.Galera) []corev1.Container {
104104
}, {
105105
Name: "KOLLA_CONFIG_STRATEGY",
106106
Value: "COPY_ALWAYS",
107-
}, {
108-
Name: "DB_ROOT_PASSWORD",
109-
ValueFrom: &corev1.EnvVarSource{
110-
SecretKeyRef: &corev1.SecretKeySelector{
111-
LocalObjectReference: corev1.LocalObjectReference{
112-
Name: g.Spec.Secret,
113-
},
114-
Key: "DbRootPassword",
115-
},
116-
},
117107
}},
118108
VolumeMounts: getGaleraInitVolumeMounts(g),
119109
}}
@@ -131,16 +121,6 @@ func getGaleraContainers(g *mariadbv1.Galera, configHash string) []corev1.Contai
131121
}, {
132122
Name: "KOLLA_CONFIG_STRATEGY",
133123
Value: "COPY_ALWAYS",
134-
}, {
135-
Name: "DB_ROOT_PASSWORD",
136-
ValueFrom: &corev1.EnvVarSource{
137-
SecretKeyRef: &corev1.SecretKeySelector{
138-
LocalObjectReference: corev1.LocalObjectReference{
139-
Name: g.Spec.Secret,
140-
},
141-
Key: "DbRootPassword",
142-
},
143-
},
144124
}},
145125
Ports: []corev1.ContainerPort{{
146126
ContainerPort: 3306,

0 commit comments

Comments
 (0)