[tlse] Allow using custom tlsConfig.API.Public.SecretName when no ingress used

When also using LoadBalancer (MetalLB) for public endpoints
this change allows to use the service configs tls.API.Public.SecretName
to reference a secret holding a custom TLS cert. The secret
must contain at least tls.key and tls.crt. The custom CA should
be added to the bundle using the secret reference in the osctlplane
crd.

Author: stuggi

pkg/openstack/barbican.go

@@ -81,6 +81,7 @@ func ReconcileBarbican(ctx context.Context, instance *corev1beta1.OpenStackContr
 			instance.Spec.Barbican.APIOverride,
 			corev1beta1.OpenStackControlPlaneExposeBarbicanReadyCondition,
 			false, // TODO: (mschuppert) could be removed when all integrated service support TLS
+			instance.Spec.Barbican.Template.BarbicanAPI.TLS,
 		)
 		if err != nil {
 			return ctrlResult, err

pkg/openstack/cinder.go

@@ -83,6 +83,7 @@ func ReconcileCinder(ctx context.Context, instance *corev1beta1.OpenStackControl
 			instance.Spec.Cinder.APIOverride,
 			corev1beta1.OpenStackControlPlaneExposeCinderReadyCondition,
 			false, // TODO (mschuppert) could be removed when all integrated service support TLS
+			instance.Spec.Cinder.Template.CinderAPI.TLS,
 		)
 		if err != nil {
 			return ctrlResult, err

pkg/openstack/common.go

@@ -191,6 +191,7 @@ func EnsureEndpointConfig(
 	ingressOverride corev1.Override,
 	condType condition.Type,
 	serviceTLSDisabled bool,
+	tlsConfig tls.API,
 ) (Endpoints, ctrl.Result, error) {
 	endpoints := Endpoints{
 		EndpointDetails: map[service.Endpoint]EndpointDetail{},
@@ -257,10 +258,8 @@ func EnsureEndpointConfig(
 				// we'll use this for the service, otherwise issue a cert. This is for
 				// use case where you deploy without ingress/routes and also use
 				// a LoadBalancer (MetalLB) for the public endpoints.
-				// TODO: (mschuppert) it should not be the cert secret from ingressOverride
-				// instead should be the one from template.TLS.API.Public.SecretName.
-				if !ed.Route.Create && (ingressOverride.TLS != nil && ingressOverride.TLS.SecretName != "") {
-					ed.Service.TLS.SecretName = ptr.To(ingressOverride.TLS.SecretName)
+				if !ed.Route.Create && (tlsConfig.API.Public.SecretName != nil && *tlsConfig.API.Public.SecretName != "") {
+					ed.Service.TLS.SecretName = tlsConfig.API.Public.SecretName
 					_, ctrlResult, err := ed.Service.TLS.GenericService.ValidateCertSecret(ctx, helper, instance.GetNamespace())
 					if err != nil {
 						return endpoints, ctrlResult, err

pkg/openstack/designate.go

@@ -7,6 +7,7 @@ import (
 	"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/service"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
@@ -76,6 +77,7 @@ func ReconcileDesignate(ctx context.Context, instance *corev1beta1.OpenStackCont
 			instance.Spec.Designate.APIOverride,
 			corev1beta1.OpenStackControlPlaneExposeDesignateReadyCondition,
 			true, // TODO: (mschuppert) disable TLS for now until implemented
+			tls.API{},
 		)
 		if err != nil {
 			return ctrlResult, err

pkg/openstack/glance.go

@@ -115,6 +115,7 @@ func ReconcileGlance(ctx context.Context, instance *corev1beta1.OpenStackControl
 				instance.Spec.Glance.APIOverride[name],
 				corev1beta1.OpenStackControlPlaneExposeGlanceReadyCondition,
 				false, // TODO (mschuppert) could be removed when all integrated service support TLS
+				glanceAPI.TLS,
 			)
 			if err != nil {
 				return ctrlResult, err

pkg/openstack/heat.go

@@ -96,6 +96,7 @@ func ReconcileHeat(ctx context.Context, instance *corev1beta1.OpenStackControlPl
 			instance.Spec.Heat.APIOverride,
 			corev1beta1.OpenStackControlPlaneExposeHeatReadyCondition,
 			false, // TODO (mschuppert) could be removed when all integrated service support TLS
+			instance.Spec.Heat.Template.HeatAPI.TLS,
 		)
 		if err != nil {
 			return ctrlResult, err
@@ -131,6 +132,7 @@ func ReconcileHeat(ctx context.Context, instance *corev1beta1.OpenStackControlPl
 			instance.Spec.Heat.CnfAPIOverride,
 			corev1beta1.OpenStackControlPlaneExposeHeatReadyCondition,
 			false, // TODO (mschuppert) could be removed when all integrated service support TLS
+			instance.Spec.Heat.Template.HeatCfnAPI.TLS,
 		)
 		if err != nil {
 			return ctrlResult, err

pkg/openstack/horizon.go

@@ -7,6 +7,7 @@ import (
 	"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/service"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
 
@@ -84,6 +85,13 @@ func ReconcileHorizon(ctx context.Context, instance *corev1beta1.OpenStackContro
 			instance.Spec.Horizon.APIOverride,
 			corev1beta1.OpenStackControlPlaneExposeHorizonReadyCondition,
 			false, // TODO (mschuppert) could be removed when all integrated service support TLS
+			tls.API{
+				API: tls.APIService{
+					Public: tls.GenericService{
+						SecretName: instance.Spec.Horizon.Template.TLS.SecretName,
+					},
+				},
+			},
 		)
 		if err != nil {
 			return ctrlResult, err

pkg/openstack/ironic.go

@@ -94,6 +94,7 @@ func ReconcileIronic(ctx context.Context, instance *corev1beta1.OpenStackControl
 			instance.Spec.Ironic.APIOverride,
 			corev1beta1.OpenStackControlPlaneExposeIronicReadyCondition,
 			false, // TODO (mschuppert) could be removed when all integrated service support TLS
+			instance.Spec.Ironic.Template.IronicAPI.TLS,
 		)
 		if err != nil {
 			return ctrlResult, err
@@ -130,6 +131,7 @@ func ReconcileIronic(ctx context.Context, instance *corev1beta1.OpenStackControl
 			instance.Spec.Ironic.InspectorOverride,
 			corev1beta1.OpenStackControlPlaneExposeIronicReadyCondition,
 			false, // TODO (mschuppert) could be removed when all integrated service support TLS
+			instance.Spec.Ironic.Template.IronicInspector.TLS,
 		)
 		if err != nil {
 			return ctrlResult, err

pkg/openstack/keystone.go

@@ -84,6 +84,7 @@ func ReconcileKeystoneAPI(ctx context.Context, instance *corev1beta1.OpenStackCo
 			instance.Spec.Keystone.APIOverride,
 			corev1beta1.OpenStackControlPlaneExposeKeystoneAPIReadyCondition,
 			false, // TODO (mschuppert) could be removed when all integrated service support TLS
+			instance.Spec.Keystone.Template.TLS,
 		)
 		if err != nil {
 			return ctrlResult, err

pkg/openstack/manila.go

@@ -84,6 +84,7 @@ func ReconcileManila(ctx context.Context, instance *corev1beta1.OpenStackControl
 			instance.Spec.Manila.APIOverride,
 			corev1beta1.OpenStackControlPlaneExposeManilaReadyCondition,
 			false, // TODO: (mschuppert) could be removed when all integrated service support TLS
+			instance.Spec.Manila.Template.ManilaAPI.TLS,
 		)
 		if err != nil {
 			return ctrlResult, err