Skip to content

Allow customize http vhost config using HttpdCustomization.CustomConfigSecret #437

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Allow customize http vhost config using HttpdCustomization.CustomConfigSecret #437

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions api/bases/octavia.openstack.org_octaviaapis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,20 @@ spec:
But can also be used to add additional files. Those get added to the service config dir in /etc/<service> .
TODO: -> implement
type: object
httpdCustomization:
description: HttpdCustomization - customize the httpd service
properties:
customConfigSecret:
description: |-
CustomConfigSecret - customize the httpd vhost config using this parameter to specify
a secret that contains service config data. The content of each provided snippet gets
rendered as a go template and placed into /etc/httpd/conf/httpd_custom_<key> .
In the default httpd template at the end of the vhost those custom configs get
included using `Include conf/httpd_custom_<endpoint>_*`.
For information on how sections in httpd configuration get merged, check section
"How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging
type: string
type: object
networkAttachments:
description: NetworkAttachments is a list of NetworkAttachment resource
names to expose the services to the given network
Expand Down
14 changes: 14 additions & 0 deletions api/bases/octavia.openstack.org_octavias.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,6 +196,20 @@ spec:
But can also be used to add additional files. Those get added to the service config dir in /etc/<service> .
TODO: -> implement
type: object
httpdCustomization:
description: HttpdCustomization - customize the httpd service
properties:
customConfigSecret:
description: |-
CustomConfigSecret - customize the httpd vhost config using this parameter to specify
a secret that contains service config data. The content of each provided snippet gets
rendered as a go template and placed into /etc/httpd/conf/httpd_custom_<key> .
In the default httpd template at the end of the vhost those custom configs get
included using `Include conf/httpd_custom_<endpoint>_*`.
For information on how sections in httpd configuration get merged, check section
"How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging
type: string
type: object
networkAttachments:
description: NetworkAttachments is a list of NetworkAttachment
resource names to expose the services to the given network
Expand Down
2 changes: 1 addition & 1 deletion api/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ go 1.21
require (
github.com/onsi/ginkgo/v2 v2.20.1
github.com/onsi/gomega v1.34.1
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20241216113837-d172b3ac0f4e
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20250116145727-01a8948d5dd7
k8s.io/api v0.29.13
k8s.io/apimachinery v0.29.13
k8s.io/client-go v0.29.13
Expand Down
4 changes: 2 additions & 2 deletions api/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,8 +72,8 @@ github.com/onsi/ginkgo/v2 v2.20.1 h1:YlVIbqct+ZmnEph770q9Q7NVAz4wwIiVNahee6JyUzo
github.com/onsi/ginkgo/v2 v2.20.1/go.mod h1:lG9ey2Z29hR41WMVthyJBGUBcBhGOtoPF2VFMvBXFCI=
github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20241216113837-d172b3ac0f4e h1:hf4kVQBkyG79WcHBxdQ25QrDBbGFdarebS1Tc0Xclq4=
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20241216113837-d172b3ac0f4e/go.mod h1:YpNTuJhDWhbXM50O3qBkhO7M+OOyRmWkNVmJ4y3cyFs=
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20250116145727-01a8948d5dd7 h1:vXHpH93PjbAgg5ZN6n5WmxkybVQOs0nhXvVw62o7aZs=
github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20250116145727-01a8948d5dd7/go.mod h1:YpNTuJhDWhbXM50O3qBkhO7M+OOyRmWkNVmJ4y3cyFs=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
Expand Down
17 changes: 17 additions & 0 deletions api/v1beta1/octaviaapi_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,10 @@ type OctaviaAPISpecCore struct {
// +kubebuilder:validation:Optional
// APITimeout for HAProxy and Apache defaults to OctaviaSpecCore APITimeout (seconds)
APITimeout int `json:"apiTimeout"`

// +kubebuilder:validation:Optional
// HttpdCustomization - customize the httpd service
HttpdCustomization HttpdCustomization `json:"httpdCustomization,omitempty"`
}

type OctaviaApiTLS struct {
Expand All @@ -174,6 +178,19 @@ type APIOverrideSpec struct {
Service map[service.Endpoint]service.RoutedOverrideSpec `json:"service,omitempty"`
}

// HttpdCustomization - customize the httpd service
type HttpdCustomization struct {
// +kubebuilder:validation:Optional
// CustomConfigSecret - customize the httpd vhost config using this parameter to specify
// a secret that contains service config data. The content of each provided snippet gets
// rendered as a go template and placed into /etc/httpd/conf/httpd_custom_<key> .
// In the default httpd template at the end of the vhost those custom configs get
// included using `Include conf/httpd_custom_<endpoint>_*`.
// For information on how sections in httpd configuration get merged, check section
// "How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging
CustomConfigSecret *string `json:"customConfigSecret,omitempty"`
}

// OctaviaAPIStatus defines the observed state of OctaviaAPI
type OctaviaAPIStatus struct {
// ReadyCount of octavia API instances
Expand Down
21 changes: 21 additions & 0 deletions api/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

14 changes: 14 additions & 0 deletions config/crd/bases/octavia.openstack.org_octaviaapis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,20 @@ spec:
But can also be used to add additional files. Those get added to the service config dir in /etc/<service> .
TODO: -> implement
type: object
httpdCustomization:
description: HttpdCustomization - customize the httpd service
properties:
customConfigSecret:
description: |-
CustomConfigSecret - customize the httpd vhost config using this parameter to specify
a secret that contains service config data. The content of each provided snippet gets
rendered as a go template and placed into /etc/httpd/conf/httpd_custom_<key> .
In the default httpd template at the end of the vhost those custom configs get
included using `Include conf/httpd_custom_<endpoint>_*`.
For information on how sections in httpd configuration get merged, check section
"How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging
type: string
type: object
networkAttachments:
description: NetworkAttachments is a list of NetworkAttachment resource
names to expose the services to the given network
Expand Down
14 changes: 14 additions & 0 deletions config/crd/bases/octavia.openstack.org_octavias.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,6 +196,20 @@ spec:
But can also be used to add additional files. Those get added to the service config dir in /etc/<service> .
TODO: -> implement
type: object
httpdCustomization:
description: HttpdCustomization - customize the httpd service
properties:
customConfigSecret:
description: |-
CustomConfigSecret - customize the httpd vhost config using this parameter to specify
a secret that contains service config data. The content of each provided snippet gets
rendered as a go template and placed into /etc/httpd/conf/httpd_custom_<key> .
In the default httpd template at the end of the vhost those custom configs get
included using `Include conf/httpd_custom_<endpoint>_*`.
For information on how sections in httpd configuration get merged, check section
"How the sections are merged" in https://httpd.apache.org/docs/current/sections.html#merging
type: string
type: object
networkAttachments:
description: NetworkAttachments is a list of NetworkAttachment
resource names to expose the services to the given network
Expand Down
8 changes: 8 additions & 0 deletions controllers/amphoracontroller_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ import (
"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
"github.com/openstack-k8s-operators/lib-common/modules/common/util"
mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
"gopkg.in/yaml.v2"

networkv1 "github.com/k8snetworkplumbingwg/network-attachment-definition-client/pkg/apis/k8s.cni.cncf.io/v1"
keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1"
Expand Down Expand Up @@ -643,6 +644,13 @@ func (r *OctaviaAmphoraControllerReconciler) generateServiceSecrets(
}
templateParameters["HeartbeatKey"] = string(ospSecret.Data["OctaviaHeartbeatKey"])

// Marshal the templateParameters map to YAML
yamlData, err := yaml.Marshal(templateParameters)
if err != nil {
return fmt.Errorf("Error marshalling to YAML: %w", err)
}
customData[common.TemplateParameters] = string(yamlData)

// TODO(beagles): populate the template parameters
cms := []util.Template{
{
Expand Down
22 changes: 16 additions & 6 deletions controllers/octavia_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@ import (
mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
octaviav1 "github.com/openstack-k8s-operators/octavia-operator/api/v1beta1"
"github.com/openstack-k8s-operators/octavia-operator/pkg/octavia"
"gopkg.in/yaml.v2"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/intstr"
Expand Down Expand Up @@ -223,11 +224,12 @@ func (r *OctaviaReconciler) Reconcile(ctx context.Context, req ctrl.Request) (re

// fields to index to reconcile when change
const (
passwordSecretField = ".spec.secret"
caBundleSecretNameField = ".spec.tls.caBundleSecretName"
tlsAPIInternalField = ".spec.tls.api.internal.secretName"
tlsAPIPublicField = ".spec.tls.api.public.secretName"
tlsOvnField = ".spec.tls.ovn.secretName"
passwordSecretField = ".spec.secret"
caBundleSecretNameField = ".spec.tls.caBundleSecretName"
tlsAPIInternalField = ".spec.tls.api.internal.secretName"
tlsAPIPublicField = ".spec.tls.api.public.secretName"
tlsOvnField = ".spec.tls.ovn.secretName"
httpdCustomServiceConfigSecretField = ".spec.httpdCustomization.customServiceConfigSecret"
)

var (
Expand All @@ -237,6 +239,7 @@ var (
tlsAPIInternalField,
tlsAPIPublicField,
tlsOvnField,
httpdCustomServiceConfigSecretField,
}
)

Expand Down Expand Up @@ -1423,6 +1426,13 @@ func (r *OctaviaReconciler) generateServiceSecrets(
templateParameters["ServiceUser"] = instance.Spec.ServiceUser
templateParameters["TenantName"] = instance.Spec.TenantName

// Marshal the templateParameters map to YAML
yamlData, err := yaml.Marshal(templateParameters)
if err != nil {
return fmt.Errorf("Error marshalling to YAML: %w", err)
}
customData[common.TemplateParameters] = string(yamlData)

cms := []util.Template{
{
Name: fmt.Sprintf("%s-scripts", instance.Name),
Expand All @@ -1442,7 +1452,7 @@ func (r *OctaviaReconciler) generateServiceSecrets(
Labels: cmLabels,
},
}
err := oko_secret.EnsureSecrets(ctx, h, instance, cms, envVars)
err = oko_secret.EnsureSecrets(ctx, h, instance, cms, envVars)
if err != nil {
return err
}
Expand Down
54 changes: 47 additions & 7 deletions controllers/octaviaapi_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ import (
"github.com/openstack-k8s-operators/octavia-operator/pkg/octavia"
"github.com/openstack-k8s-operators/octavia-operator/pkg/octaviaapi"
ovnclient "github.com/openstack-k8s-operators/ovn-operator/api/v1beta1"
"gopkg.in/yaml.v2"

appsv1 "k8s.io/api/apps/v1"
batchv1 "k8s.io/api/batch/v1"
Expand Down Expand Up @@ -259,6 +260,18 @@ func (r *OctaviaAPIReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Ma
return err
}

// index httpdOverrideSecretField
if err := mgr.GetFieldIndexer().IndexField(ctx, &octaviav1.OctaviaAPI{}, httpdCustomServiceConfigSecretField, func(rawObj client.Object) []string {
// Extract the secret name from the spec, if one is provided
cr := rawObj.(*octaviav1.OctaviaAPI)
if cr.Spec.HttpdCustomization.CustomConfigSecret == nil {
return nil
}
return []string{*cr.Spec.HttpdCustomization.CustomConfigSecret}
}); err != nil {
return err
}

return ctrl.NewControllerManagedBy(mgr).
For(&octaviav1.OctaviaAPI{}).
Owns(&keystonev1.KeystoneService{}).
Expand Down Expand Up @@ -920,6 +933,14 @@ func (r *OctaviaAPIReconciler) generateServiceSecrets(
return err
}

httpdOverrideSecret := &corev1.Secret{}
if instance.Spec.HttpdCustomization.CustomConfigSecret != nil && *instance.Spec.HttpdCustomization.CustomConfigSecret != "" {
httpdOverrideSecret, _, err = oko_secret.GetSecret(ctx, h, *instance.Spec.HttpdCustomization.CustomConfigSecret, instance.Namespace)
if err != nil {
return err
}
}

databaseAccount, dbSecret, err := mariadbv1.GetAccountAndSecret(
ctx, h, instance.Spec.DatabaseAccount, instance.Namespace)

Expand Down Expand Up @@ -988,6 +1009,7 @@ func (r *OctaviaAPIReconciler) generateServiceSecrets(
templateParameters["TimeOut"] = instance.Spec.APITimeout

// create httpd vhost template parameters
customTemplates := map[string]string{}
httpdVhostConfig := map[string]interface{}{}
for _, endpt := range []service.Endpoint{service.EndpointInternal, service.EndpointPublic} {
endptConfig := map[string]interface{}{}
Expand All @@ -998,10 +1020,27 @@ func (r *OctaviaAPIReconciler) generateServiceSecrets(
endptConfig["SSLCertificateFile"] = fmt.Sprintf("/etc/pki/tls/certs/%s.crt", endpt.String())
endptConfig["SSLCertificateKeyFile"] = fmt.Sprintf("/etc/pki/tls/private/%s.key", endpt.String())
}

endptConfig["Override"] = false
if len(httpdOverrideSecret.Data) > 0 {
endptConfig["Override"] = true
for key, data := range httpdOverrideSecret.Data {
if len(data) > 0 {
customTemplates["httpd_custom_"+endpt.String()+"_"+key] = string(data)
}
}
}
httpdVhostConfig[endpt.String()] = endptConfig
}
templateParameters["VHosts"] = httpdVhostConfig

// Marshal the templateParameters map to YAML
yamlData, err := yaml.Marshal(templateParameters)
if err != nil {
return fmt.Errorf("Error marshalling to YAML: %w", err)
}
customData[common.TemplateParameters] = string(yamlData)

cms := []util.Template{
{
Name: fmt.Sprintf("%s-scripts", instance.Name),
Expand All @@ -1012,13 +1051,14 @@ func (r *OctaviaAPIReconciler) generateServiceSecrets(
Labels: cmLabels,
},
{
Name: fmt.Sprintf("%s-config-data", instance.Name),
Namespace: instance.Namespace,
Type: util.TemplateTypeConfig,
InstanceType: instance.Kind,
CustomData: customData,
ConfigOptions: templateParameters,
Labels: cmLabels,
Name: fmt.Sprintf("%s-config-data", instance.Name),
Namespace: instance.Namespace,
Type: util.TemplateTypeConfig,
InstanceType: instance.Kind,
CustomData: customData,
ConfigOptions: templateParameters,
StringTemplate: customTemplates,
Labels: cmLabels,
},
}
err = oko_secret.EnsureSecrets(ctx, h, instance, cms, envVars)
Expand Down
10 changes: 9 additions & 1 deletion controllers/octaviarsyslog_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ import (
"github.com/openstack-k8s-operators/lib-common/modules/common/labels"
nad "github.com/openstack-k8s-operators/lib-common/modules/common/networkattachment"
"github.com/openstack-k8s-operators/lib-common/modules/common/util"
"gopkg.in/yaml.v2"

oko_secret "github.com/openstack-k8s-operators/lib-common/modules/common/secret"
octaviav1 "github.com/openstack-k8s-operators/octavia-operator/api/v1beta1"
Expand Down Expand Up @@ -387,6 +388,13 @@ func (r *OctaviaRsyslogReconciler) generateServiceSecrets(
spec := instance.Spec
templateParameters["ServiceUser"] = spec.ServiceUser

// Marshal the templateParameters map to YAML
yamlData, err := yaml.Marshal(templateParameters)
if err != nil {
return fmt.Errorf("Error marshalling to YAML: %w", err)
}
customData[common.TemplateParameters] = string(yamlData)

// TODO(beagles): populate the template parameters
cms := []util.Template{
// ScriptsConfigMap
Expand All @@ -409,7 +417,7 @@ func (r *OctaviaRsyslogReconciler) generateServiceSecrets(
},
}

err := oko_secret.EnsureSecrets(ctx, helper, instance, cms, envVars)
err = oko_secret.EnsureSecrets(ctx, helper, instance, cms, envVars)
if err != nil {
r.Log.Error(err, "unable to process config map")
return err
Expand Down
Loading