Skip to content

Commit 4ccc428

Browse files
stuggistuggi
committed
[tlse] internal TLS support for swift
Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: #620 Depends-On: openstack-k8s-operators/swift-operator#109 Jira: OSPRH-4371
1 parent fd60dda commit 4ccc428

File tree

7 files changed

+59
-8
lines changed

7 files changed

+59
-8
lines changed

‎apis/bases/core.openstack.org_openstackcontrolplanes.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15231,6 +15231,24 @@ spec:
1523115231
swiftConfSecret:
1523215232
default: swift-conf
1523315233
type: string
15234+
tls:
15235+
properties:
15236+
api:
15237+
properties:
15238+
internal:
15239+
properties:
15240+
secretName:
15241+
type: string
15242+
type: object
15243+
public:
15244+
properties:
15245+
secretName:
15246+
type: string
15247+
type: object
15248+
type: object
15249+
caBundleSecretName:
15250+
type: string
15251+
type: object
1523415252
required:
1523515253
- containerImageProxy
1523615254
- memcachedServers
@@ -15266,6 +15284,9 @@ spec:
1526615284
type: string
1526715285
containerImageProxy:
1526815286
type: string
15287+
containerSharderEnabled:
15288+
default: false
15289+
type: boolean
1526915290
memcachedServers:
1527015291
default: ""
1527115292
type: string

‎apis/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ require (
2222
github.com/openstack-k8s-operators/octavia-operator/api v0.3.1-0.20240202095506-b8bae01af213
2323
github.com/openstack-k8s-operators/ovn-operator/api v0.3.1-0.20240131114124-8bdccc638150
2424
github.com/openstack-k8s-operators/placement-operator/api v0.3.1-0.20240125124919-72883dc08303
25-
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202092455-1f31bfa3d313
25+
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202170409-a34147b1d7d3
2626
github.com/openstack-k8s-operators/telemetry-operator/api v0.3.1-0.20240130075809-6609fa1c0732
2727
github.com/rabbitmq/cluster-operator/v2 v2.5.0
2828
k8s.io/apimachinery v0.27.7

‎apis/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,8 +168,8 @@ github.com/openstack-k8s-operators/ovn-operator/api v0.3.1-0.20240131114124-8bdc
168168
github.com/openstack-k8s-operators/ovn-operator/api v0.3.1-0.20240131114124-8bdccc638150/go.mod h1:3GRnhrL6Vi0BLaRWVVn1u+lZ632TFS+lSsRt15yjaaE=
169169
github.com/openstack-k8s-operators/placement-operator/api v0.3.1-0.20240125124919-72883dc08303 h1:tFlCfWHt6AuQokBHP+BSZ3a8ouwsugEdJKzWDrUfNf0=
170170
github.com/openstack-k8s-operators/placement-operator/api v0.3.1-0.20240125124919-72883dc08303/go.mod h1:G4XUqjS1C8V5U066HUcjnCyxTNhU4cSZOOGXcOCOhz4=
171-
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202092455-1f31bfa3d313 h1:4x3HfeXJBMTOd1M4fUf6uLrajSmvVJDh7vpvi49gYIA=
172-
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202092455-1f31bfa3d313/go.mod h1:Ihio6ScG9ZN+Lf76z+H+JabQrnzvwC2NcV32YICB/Kw=
171+
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202170409-a34147b1d7d3 h1:r8r+blC7pntMnZuMge7LBMx60+stdbdYhwWjSd8fs10=
172+
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202170409-a34147b1d7d3/go.mod h1:Ihio6ScG9ZN+Lf76z+H+JabQrnzvwC2NcV32YICB/Kw=
173173
github.com/openstack-k8s-operators/telemetry-operator/api v0.3.1-0.20240130075809-6609fa1c0732 h1:xGvG+7KRpf6/GspyUCeY+TyqEdedjyzS6pgFRqoPLfk=
174174
github.com/openstack-k8s-operators/telemetry-operator/api v0.3.1-0.20240130075809-6609fa1c0732/go.mod h1:u5GO5fGJ0CsVRivvQoZE400I+jlI4tIoEqNN4HfMiHg=
175175
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=

‎config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15231,6 +15231,24 @@ spec:
1523115231
swiftConfSecret:
1523215232
default: swift-conf
1523315233
type: string
15234+
tls:
15235+
properties:
15236+
api:
15237+
properties:
15238+
internal:
15239+
properties:
15240+
secretName:
15241+
type: string
15242+
type: object
15243+
public:
15244+
properties:
15245+
secretName:
15246+
type: string
15247+
type: object
15248+
type: object
15249+
caBundleSecretName:
15250+
type: string
15251+
type: object
1523415252
required:
1523515253
- containerImageProxy
1523615254
- memcachedServers
@@ -15266,6 +15284,9 @@ spec:
1526615284
type: string
1526715285
containerImageProxy:
1526815286
type: string
15287+
containerSharderEnabled:
15288+
default: false
15289+
type: boolean
1526915290
memcachedServers:
1527015291
default: ""
1527115292
type: string

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ require (
3232
github.com/openstack-k8s-operators/openstack-operator/apis v0.0.0-20230725141229-4ce90d0120fd
3333
github.com/openstack-k8s-operators/ovn-operator/api v0.3.1-0.20240131114124-8bdccc638150
3434
github.com/openstack-k8s-operators/placement-operator/api v0.3.1-0.20240125124919-72883dc08303
35-
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202092455-1f31bfa3d313
35+
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202170409-a34147b1d7d3
3636
github.com/openstack-k8s-operators/telemetry-operator/api v0.3.1-0.20240130075809-6609fa1c0732
3737
github.com/operator-framework/api v0.20.0
3838
github.com/rabbitmq/cluster-operator/v2 v2.5.0

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -189,8 +189,8 @@ github.com/openstack-k8s-operators/ovn-operator/api v0.3.1-0.20240131114124-8bdc
189189
github.com/openstack-k8s-operators/ovn-operator/api v0.3.1-0.20240131114124-8bdccc638150/go.mod h1:3GRnhrL6Vi0BLaRWVVn1u+lZ632TFS+lSsRt15yjaaE=
190190
github.com/openstack-k8s-operators/placement-operator/api v0.3.1-0.20240125124919-72883dc08303 h1:tFlCfWHt6AuQokBHP+BSZ3a8ouwsugEdJKzWDrUfNf0=
191191
github.com/openstack-k8s-operators/placement-operator/api v0.3.1-0.20240125124919-72883dc08303/go.mod h1:G4XUqjS1C8V5U066HUcjnCyxTNhU4cSZOOGXcOCOhz4=
192-
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202092455-1f31bfa3d313 h1:4x3HfeXJBMTOd1M4fUf6uLrajSmvVJDh7vpvi49gYIA=
193-
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202092455-1f31bfa3d313/go.mod h1:Ihio6ScG9ZN+Lf76z+H+JabQrnzvwC2NcV32YICB/Kw=
192+
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202170409-a34147b1d7d3 h1:r8r+blC7pntMnZuMge7LBMx60+stdbdYhwWjSd8fs10=
193+
github.com/openstack-k8s-operators/swift-operator/api v0.3.1-0.20240202170409-a34147b1d7d3/go.mod h1:Ihio6ScG9ZN+Lf76z+H+JabQrnzvwC2NcV32YICB/Kw=
194194
github.com/openstack-k8s-operators/telemetry-operator/api v0.3.1-0.20240130075809-6609fa1c0732 h1:xGvG+7KRpf6/GspyUCeY+TyqEdedjyzS6pgFRqoPLfk=
195195
github.com/openstack-k8s-operators/telemetry-operator/api v0.3.1-0.20240130075809-6609fa1c0732/go.mod h1:u5GO5fGJ0CsVRivvQoZE400I+jlI4tIoEqNN4HfMiHg=
196196
github.com/operator-framework/api v0.20.0 h1:A2YCRhr+6s0k3pRJacnwjh1Ue8BqjIGuQ2jvPg9XCB4=

‎pkg/openstack/swift.go‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,12 @@ func ReconcileSwift(ctx context.Context, instance *corev1beta1.OpenStackControlP
5757
}
5858
}
5959

60+
// preserve any previously set TLS certs,set CA cert
61+
if instance.Spec.TLS.Enabled(service.EndpointInternal) {
62+
instance.Spec.Swift.Template.SwiftProxy.TLS = swift.Spec.SwiftProxy.TLS
63+
}
64+
instance.Spec.Swift.Template.SwiftProxy.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName
65+
6066
if swift.Status.Conditions.IsTrue(swiftv1.SwiftProxyReadyCondition) {
6167
svcs, err := service.GetServicesListWithLabel(
6268
ctx,
@@ -77,7 +83,7 @@ func ReconcileSwift(ctx context.Context, instance *corev1beta1.OpenStackControlP
7783
instance.Spec.Swift.Template.SwiftProxy.Override.Service,
7884
instance.Spec.Swift.ProxyOverride,
7985
corev1beta1.OpenStackControlPlaneExposeSwiftReadyCondition,
80-
true, // TODO: (mschuppert) disable TLS for now until implemented
86+
false, // TODO (mschuppert) could be removed when all integrated service support TLS
8187
)
8288
if err != nil {
8389
return ctrlResult, err
@@ -86,9 +92,12 @@ func ReconcileSwift(ctx context.Context, instance *corev1beta1.OpenStackControlP
8692
}
8793

8894
instance.Spec.Swift.Template.SwiftProxy.Override.Service = endpointDetails.GetEndpointServiceOverrides()
95+
96+
// update TLS settings with cert secret
97+
instance.Spec.Swift.Template.SwiftProxy.TLS.API.Public.SecretName = endpointDetails.GetEndptCertSecret(service.EndpointPublic)
98+
instance.Spec.Swift.Template.SwiftProxy.TLS.API.Internal.SecretName = endpointDetails.GetEndptCertSecret(service.EndpointInternal)
8999
}
90100

91-
helper.GetLogger().Info("Reconciling Swift", "Swift.Namespace", instance.Namespace, "Swift.Name", "swift")
92101
Log.Info("Reconciling Swift", "Swift.Namespace", instance.Namespace, "Swift.Name", "swift")
93102
op, err := controllerutil.CreateOrPatch(ctx, helper.GetClient(), swift, func() error {
94103
instance.Spec.Swift.Template.DeepCopyInto(&swift.Spec)

0 commit comments

Comments
 (0)