Merge pull request #1299 from lmiccini/memcached_mtls

openshift-merge-bot[bot] · web-flow · commit 17901c0650ba · 2025-02-24T17:34:15.000Z
Enable memcached mTLS auth
diff --git a/apis/bases/core.openstack.org_openstackcontrolplanes.yaml b/apis/bases/core.openstack.org_openstackcontrolplanes.yaml
@@ -7260,6 +7260,20 @@ spec:
                           properties:
                             caBundleSecretName:
                               type: string
+                            mtls:
+                              properties:
+                                authCertSecret:
+                                  properties:
+                                    secretName:
+                                      type: string
+                                  type: object
+                                sslVerifyMode:
+                                  enum:
+                                  - None
+                                  - Request
+                                  - Require
+                                  type: string
+                              type: object
                             secretName:
                               type: string
                           type: object
diff --git a/apis/go.mod b/apis/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/openstack-k8s-operators/glance-operator/api v0.5.1-0.20250126100316-be560a599e2d
 	github.com/openstack-k8s-operators/heat-operator/api v0.5.1-0.20250129204831-17deaa376556
 	github.com/openstack-k8s-operators/horizon-operator/api v0.5.1-0.20250203063315-e5e6165191f8
-	github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250204091142-ae8379c31edb
+	github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250213075932-926b10c39e96
 	github.com/openstack-k8s-operators/ironic-operator/api v0.5.1-0.20250107140737-1d83138767c2
 	github.com/openstack-k8s-operators/keystone-operator/api v0.5.1-0.20250203105048-182afa0c45d8
 	github.com/openstack-k8s-operators/lib-common/modules/common v0.5.1-0.20250205143454-43504d7ad19a
diff --git a/apis/go.sum b/apis/go.sum
@@ -106,8 +106,8 @@ github.com/openstack-k8s-operators/heat-operator/api v0.5.1-0.20250129204831-17d
 github.com/openstack-k8s-operators/heat-operator/api v0.5.1-0.20250129204831-17deaa376556/go.mod h1:6egBIaHzwbzRHQxkkmHBkBRLHWrJ3eH1EhVuz5Z3dhU=
 github.com/openstack-k8s-operators/horizon-operator/api v0.5.1-0.20250203063315-e5e6165191f8 h1:A5+uQ6KW8PQVlunD/tbrEaZRFeUQMOICVSE/ZaNry7g=
 github.com/openstack-k8s-operators/horizon-operator/api v0.5.1-0.20250203063315-e5e6165191f8/go.mod h1:UGkrLEcGjc+q4tbUT00q4dHOMpcTaMqrs3CTXpetuyc=
-github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250204091142-ae8379c31edb h1:SedlzLahRyzctVTXzVrpmjui78A7Z0g8V1cmPBoQzYY=
-github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250204091142-ae8379c31edb/go.mod h1:TDaE7BVQvJwJGFm33R6xcPTeF8LKAnMh+a1ho+YqJHs=
+github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250213075932-926b10c39e96 h1:5ITGm8DPObxa5joxSAMnztcnIQm7CJcj/+d7unz3Nto=
+github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250213075932-926b10c39e96/go.mod h1:kkjcOSZ7jkHbVzxJd0nDQzjB+vqafuAMgSf7AnEXydw=
 github.com/openstack-k8s-operators/ironic-operator/api v0.5.1-0.20250107140737-1d83138767c2 h1:nFbSN0goC+CWeHa7oRrOD+jOUmVNc+Nn/tGgjtCOjag=
 github.com/openstack-k8s-operators/ironic-operator/api v0.5.1-0.20250107140737-1d83138767c2/go.mod h1:E2y4HZ0WVbDfvf+VBCtA+uy7c8uuR54ED8w5YvlHbYo=
 github.com/openstack-k8s-operators/keystone-operator/api v0.5.1-0.20250203105048-182afa0c45d8 h1:HIL7hIXZPuwMVr46jMoLxHToBHAplGWwOtR4FlMrCUU=
diff --git a/bindata/crds/crds.yaml b/bindata/crds/crds.yaml
@@ -2554,8 +2554,6 @@ spec:
                     type: boolean
                   template:
                     properties:
-                      containerImage:
-                        type: string
                       dnsDataLabelSelectorValue:
                         default: dnsdata
                         type: string
@@ -7426,6 +7424,20 @@ spec:
                           properties:
                             caBundleSecretName:
                               type: string
+                            mtls:
+                              properties:
+                                authCertSecret:
+                                  properties:
+                                    secretName:
+                                      type: string
+                                  type: object
+                                sslVerifyMode:
+                                  enum:
+                                  - None
+                                  - Request
+                                  - Require
+                                  type: string
+                              type: object
                             secretName:
                               type: string
                           type: object
diff --git a/bindata/crds/memcached.openstack.org_memcacheds.yaml b/bindata/crds/memcached.openstack.org_memcacheds.yaml
@@ -82,6 +82,25 @@ spec:
                     description: CaBundleSecretName - holding the CA certs in a pre-created
                       bundle file
                     type: string
+                  mtls:
+                    properties:
+                      authCertSecret:
+                        description: Name of the secret containing the client cert
+                          used to perform mtls auth
+                        properties:
+                          secretName:
+                            description: SecretName - holding the cert, key for the
+                              service
+                            type: string
+                        type: object
+                      sslVerifyMode:
+                        description: Used to enforce client side tls cert validation
+                        enum:
+                        - None
+                        - Request
+                        - Require
+                        type: string
+                    type: object
                   secretName:
                     description: SecretName - holding the cert, key for the service
                     type: string
@@ -140,6 +159,9 @@ spec:
                   type: string
                 description: Map of hashes to track input changes
                 type: object
+              mtlsCert:
+                description: Name of the certificate used for MTLS
+                type: string
               observedGeneration:
                 description: |-
                   ObservedGeneration - the most recent generation observed for this
diff --git a/config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml b/config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml
@@ -7260,6 +7260,20 @@ spec:
                           properties:
                             caBundleSecretName:
                               type: string
+                            mtls:
+                              properties:
+                                authCertSecret:
+                                  properties:
+                                    secretName:
+                                      type: string
+                                  type: object
+                                sslVerifyMode:
+                                  enum:
+                                  - None
+                                  - Request
+                                  - Require
+                                  type: string
+                              type: object
                             secretName:
                               type: string
                           type: object
diff --git a/config/operator/manager_operator_images.yaml b/config/operator/manager_operator_images.yaml
@@ -26,7 +26,7 @@ spec:
         - name: RELATED_IMAGE_HORIZON_OPERATOR_MANAGER_IMAGE_URL
           value: quay.io/openstack-k8s-operators/horizon-operator@sha256:a7fda492ec0dfd798bf1315b6ee828c4febe898aa918b6b0107664d6dcbd6a81
         - name: RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL
-          value: quay.io/openstack-k8s-operators/infra-operator@sha256:73741d7f4e713753311001cbea234ad77c70e834e7c2b03eec2ca37c372a9fcb
+          value: quay.io/openstack-k8s-operators/infra-operator@sha256:2fdcd0eb58650951eb2a2662b89a54ccc7b0dbe981d2f88fb35cb04e24285748
         - name: RELATED_IMAGE_IRONIC_OPERATOR_MANAGER_IMAGE_URL
           value: quay.io/openstack-k8s-operators/ironic-operator@sha256:bad53185041f6003f3f573df9bbf248aa1c47a1060abcb5410201d74bcb08829
         - name: RELATED_IMAGE_KEYSTONE_OPERATOR_MANAGER_IMAGE_URL
diff --git a/go.mod b/go.mod
@@ -18,7 +18,7 @@ require (
 	github.com/openstack-k8s-operators/glance-operator/api v0.5.1-0.20250126100316-be560a599e2d
 	github.com/openstack-k8s-operators/heat-operator/api v0.5.1-0.20250129204831-17deaa376556
 	github.com/openstack-k8s-operators/horizon-operator/api v0.5.1-0.20250203063315-e5e6165191f8
-	github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250204091142-ae8379c31edb
+	github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250213075932-926b10c39e96
 	github.com/openstack-k8s-operators/ironic-operator/api v0.5.1-0.20250107140737-1d83138767c2
 	github.com/openstack-k8s-operators/keystone-operator/api v0.5.1-0.20250203105048-182afa0c45d8
 	github.com/openstack-k8s-operators/lib-common/modules/ansible v0.5.0
diff --git a/go.sum b/go.sum
@@ -110,8 +110,8 @@ github.com/openstack-k8s-operators/heat-operator/api v0.5.1-0.20250129204831-17d
 github.com/openstack-k8s-operators/heat-operator/api v0.5.1-0.20250129204831-17deaa376556/go.mod h1:6egBIaHzwbzRHQxkkmHBkBRLHWrJ3eH1EhVuz5Z3dhU=
 github.com/openstack-k8s-operators/horizon-operator/api v0.5.1-0.20250203063315-e5e6165191f8 h1:A5+uQ6KW8PQVlunD/tbrEaZRFeUQMOICVSE/ZaNry7g=
 github.com/openstack-k8s-operators/horizon-operator/api v0.5.1-0.20250203063315-e5e6165191f8/go.mod h1:UGkrLEcGjc+q4tbUT00q4dHOMpcTaMqrs3CTXpetuyc=
-github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250204091142-ae8379c31edb h1:SedlzLahRyzctVTXzVrpmjui78A7Z0g8V1cmPBoQzYY=
-github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250204091142-ae8379c31edb/go.mod h1:TDaE7BVQvJwJGFm33R6xcPTeF8LKAnMh+a1ho+YqJHs=
+github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250213075932-926b10c39e96 h1:5ITGm8DPObxa5joxSAMnztcnIQm7CJcj/+d7unz3Nto=
+github.com/openstack-k8s-operators/infra-operator/apis v0.5.1-0.20250213075932-926b10c39e96/go.mod h1:kkjcOSZ7jkHbVzxJd0nDQzjB+vqafuAMgSf7AnEXydw=
 github.com/openstack-k8s-operators/ironic-operator/api v0.5.1-0.20250107140737-1d83138767c2 h1:nFbSN0goC+CWeHa7oRrOD+jOUmVNc+Nn/tGgjtCOjag=
 github.com/openstack-k8s-operators/ironic-operator/api v0.5.1-0.20250107140737-1d83138767c2/go.mod h1:E2y4HZ0WVbDfvf+VBCtA+uy7c8uuR54ED8w5YvlHbYo=
 github.com/openstack-k8s-operators/keystone-operator/api v0.5.1-0.20250203105048-182afa0c45d8 h1:HIL7hIXZPuwMVr46jMoLxHToBHAplGWwOtR4FlMrCUU=
diff --git a/hack/export_operator_related_images.sh b/hack/export_operator_related_images.sh
@@ -6,7 +6,7 @@ export RELATED_IMAGE_DESIGNATE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-
 export RELATED_IMAGE_GLANCE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/glance-operator@sha256:3376b637ae0249423be1a8b539b7e7c54a285194fb8a9095062f24a65600c3d5
 export RELATED_IMAGE_HEAT_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/heat-operator@sha256:aa30e36c7cf183f3aa63e90794ea6cb2d191c29cf6825bba19a19e855a8360ed
 export RELATED_IMAGE_HORIZON_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/horizon-operator@sha256:a7fda492ec0dfd798bf1315b6ee828c4febe898aa918b6b0107664d6dcbd6a81
-export RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/infra-operator@sha256:73741d7f4e713753311001cbea234ad77c70e834e7c2b03eec2ca37c372a9fcb
+export RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/infra-operator@sha256:2fdcd0eb58650951eb2a2662b89a54ccc7b0dbe981d2f88fb35cb04e24285748
 export RELATED_IMAGE_IRONIC_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/ironic-operator@sha256:bad53185041f6003f3f573df9bbf248aa1c47a1060abcb5410201d74bcb08829
 export RELATED_IMAGE_KEYSTONE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/keystone-operator@sha256:f5a15209a080f124c2ab9febb2ad9b65af1422d0cd066ec8c6a6abd8e1fd0e84
 export RELATED_IMAGE_MANILA_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/manila-operator@sha256:72a1bef77126188f623eeae40b07359f111d720585e13c991c576c36ef5da3a7
diff --git a/pkg/openstack/memcached.go b/pkg/openstack/memcached.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"strings"
 
+	certmgrv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
 	memcachedv1 "github.com/openstack-k8s-operators/infra-operator/apis/memcached/v1beta1"
 	"github.com/openstack-k8s-operators/lib-common/modules/certmanager"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/clusterdns"
@@ -167,6 +168,7 @@ func reconcileMemcached(
 	Log.Info("Reconciling Memcached", "Memcached.Namespace", instance.Namespace, "Memcached.Name", name)
 
 	tlsCert := ""
+	mtlsCert := ""
 	if instance.Spec.TLS.PodLevel.Enabled {
 		Log.Info("Reconciling Memcached TLS", "Memcached.Namespace", instance.Namespace, "Memcached.Name", name)
 		clusterDomain := clusterdns.GetDNSClusterDomain()
@@ -199,6 +201,44 @@ func reconcileMemcached(
 		}
 
 		tlsCert = certSecret.Name
+
+		// mTLS cert
+		if spec.TLS.MTLS.SslVerifyMode == "Request" || spec.TLS.MTLS.SslVerifyMode == "Require" {
+			Log.Info("Reconciling Memcached mTLS", "Memcached.Namespace", instance.Namespace, "Memcached.Name", name)
+			clusterDomain = clusterdns.GetDNSClusterDomain()
+			certRequest = certmanager.CertificateRequest{
+				IssuerName: instance.GetInternalIssuer(),
+				CertName:   fmt.Sprintf("%s-mtls", memcached.Name),
+				Hostnames: []string{
+					fmt.Sprintf("*.%s.svc", instance.Namespace),
+					fmt.Sprintf("*.%s.svc.%s", instance.Namespace, clusterDomain),
+				},
+				Labels: map[string]string{serviceCertSelector: ""},
+				Usages: []certmgrv1.KeyUsage{
+					certmgrv1.UsageKeyEncipherment,
+					certmgrv1.UsageDigitalSignature,
+					certmgrv1.UsageClientAuth,
+				},
+			}
+			if instance.Spec.TLS.PodLevel.Internal.Cert.Duration != nil {
+				certRequest.Duration = &instance.Spec.TLS.PodLevel.Internal.Cert.Duration.Duration
+			}
+			if instance.Spec.TLS.PodLevel.Internal.Cert.RenewBefore != nil {
+				certRequest.RenewBefore = &instance.Spec.TLS.PodLevel.Internal.Cert.RenewBefore.Duration
+			}
+			certSecret, ctrlResult, err = certmanager.EnsureCert(
+				ctx,
+				helper,
+				certRequest,
+				nil)
+			if err != nil {
+				return memcachedFailed, ctrlResult, err
+			} else if (ctrlResult != ctrl.Result{}) {
+				return memcachedCreating, ctrlResult, nil
+			}
+
+			mtlsCert = certSecret.Name
+		}
 	}
 
 	if spec.NodeSelector == nil {
@@ -211,6 +251,9 @@ func reconcileMemcached(
 		if tlsCert != "" {
 			memcached.Spec.TLS.SecretName = ptr.To(tlsCert)
 		}
+		if mtlsCert != "" {
+			memcached.Spec.TLS.MTLS.AuthCertSecret.SecretName = ptr.To(mtlsCert)
+		}
 		memcached.Spec.TLS.CaBundleSecretName = tls.CABundleSecret
 		memcached.Spec.ContainerImage = *version.Status.ContainerImages.InfraMemcachedImage
 		err := controllerutil.SetControllerReference(helper.GetBeforeObject(), memcached, helper.GetScheme())
