Skip to content

Commit 7f7f55f

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1058 from vakwetu/fix_cacert_mounting
Mount cacerts on computes if tls-e not enabled
2 parents 2dea8f4 + 7b84742 commit 7f7f55f

File tree

4 files changed

+99
-7
lines changed

4 files changed

+99
-7
lines changed

‎pkg/dataplane/deployment.go‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -118,11 +118,9 @@ func (d *Deployer) Deploy(services []string) (*ctrl.Result, error) {
118118
return &ctrl.Result{}, err
119119
}
120120

121-
// Add certMounts if TLS is enabled
122-
if d.NodeSet.Spec.TLSEnabled {
123-
if foundService.Spec.AddCertMounts {
124-
d.AeeSpec, err = d.addCertMounts(services)
125-
}
121+
// Add certMounts
122+
if foundService.Spec.AddCertMounts {
123+
d.AeeSpec, err = d.addCertMounts(services)
126124
if err != nil {
127125
nsConditions.Set(condition.FalseCondition(
128126
readyCondition,
@@ -276,7 +274,7 @@ func (d *Deployer) addCertMounts(
276274
}
277275
}
278276

279-
if service.Spec.TLSCerts != nil {
277+
if service.Spec.TLSCerts != nil && d.NodeSet.Spec.TLSEnabled {
280278
// sort cert list to ensure mount list is consistent
281279
certKeyList := make([]string, 0, len(service.Spec.TLSCerts))
282280
for ckey := range service.Spec.TLSCerts {
@@ -342,7 +340,7 @@ func (d *Deployer) addCertMounts(
342340
}
343341
}
344342

345-
// add mount for cacert bundle
343+
// add mount for cacert bundle, even if TLS-E is not enabled
346344
if len(service.Spec.CACerts) > 0 {
347345
log.Info("Mounting CA cert bundle for service", "service", svc)
348346
volMounts := storage.VolMounts{}

‎tests/kuttl/tests/dataplane-deploy-global-service-test/00-dataplane-create.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
apiVersion: v1
22
kind: Secret
3+
type: Opaque
4+
metadata:
5+
name: combined-ca-bundle
6+
labels:
7+
combined-ca-bundle: ""
8+
data:
9+
tls-ca-bundle.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNlZ0F3SUJBZ0lSQU5TYWxJeHdEclZ5TVBLS3RHK0lLbzB3Q2dZSUtvWkl6ajBFQXdJd0lERWUKTUJ3R0ExVUVBeE1WY205dmRHTmhMV3QxZEhSc0xXbHVkR1Z5Ym1Gc01CNFhEVEkwTURJeU1qRTBNRGcwTTFvWApEVE0wTURJeE9URTBNRGcwTTFvd0lERWVNQndHQTFVRUF4TVZjbTl2ZEdOaExXdDFkSFJzTFdsdWRHVnlibUZzCk1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTQzd2xOK05BQzhYZnkzSk43S1VaSVMvMjE2OTIKNXpWdHVyYnlpNllmZ3hXbFFONGV4ZU5IcVpGT3ZRcUVoZUVVSFR5K2lpWEVpWDVGcytCeit1eUZWYU5DTUVBdwpEZ1lEVlIwUEFRSC9CQVFEQWdLa01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZDRHJnYkhICjh4WmlKbnBKY2gzaEZyZEJLL3lKTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSUNTY3A2QlE3eldQdnlobW9uK00KcTlvbk1PNlRYSVArczdtZjJGaXkvWkVsQWlFQXRxbkF3VE40UXRKQzIrMUZGVUNNd3dpSTZJTmM5blBDVHc1dgo5M1ZWR2ZNPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
10+
---
11+
apiVersion: v1
12+
kind: Secret
313
metadata:
414
name: nova-cell1-compute-config
515
data:

‎tests/kuttl/tests/dataplane-deploy-global-service-test/01-assert.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -791,6 +791,20 @@ spec:
791791
terminationMessagePath: /dev/termination-log
792792
terminationMessagePolicy: File
793793
volumeMounts:
794+
- mountPath: /var/lib/openstack/cacerts/ovn
795+
name: ovn-combined-ca-bundle
796+
- mountPath: /var/lib/openstack/cacerts/neutron-metadata
797+
name: neutron-metadata-combined-ca-bundle
798+
- mountPath: /var/lib/openstack/cacerts/neutron-ovn
799+
name: neutron-ovn-combined-ca-bundle
800+
- mountPath: /var/lib/openstack/cacerts/neutron-sriov
801+
name: neutron-sriov-combined-ca-bundle
802+
- mountPath: /var/lib/openstack/cacerts/neutron-dhcp
803+
name: neutron-dhcp-combined-ca-bundle
804+
- mountPath: /var/lib/openstack/cacerts/libvirt
805+
name: libvirt-combined-ca-bundle
806+
- mountPath: /var/lib/openstack/cacerts/nova
807+
name: nova-combined-ca-bundle
794808
- mountPath: /runner/env/ssh_key
795809
name: ssh-key
796810
subPath: ssh_key
@@ -804,6 +818,34 @@ spec:
804818
serviceAccountName: edpm-compute-global
805819
terminationGracePeriodSeconds: 30
806820
volumes:
821+
- name: ovn-combined-ca-bundle
822+
secret:
823+
defaultMode: 420
824+
secretName: combined-ca-bundle
825+
- name: neutron-metadata-combined-ca-bundle
826+
secret:
827+
defaultMode: 420
828+
secretName: combined-ca-bundle
829+
- name: neutron-ovn-combined-ca-bundle
830+
secret:
831+
defaultMode: 420
832+
secretName: combined-ca-bundle
833+
- name: neutron-sriov-combined-ca-bundle
834+
secret:
835+
defaultMode: 420
836+
secretName: combined-ca-bundle
837+
- name: neutron-dhcp-combined-ca-bundle
838+
secret:
839+
defaultMode: 420
840+
secretName: combined-ca-bundle
841+
- name: libvirt-combined-ca-bundle
842+
secret:
843+
defaultMode: 420
844+
secretName: combined-ca-bundle
845+
- name: nova-combined-ca-bundle
846+
secret:
847+
defaultMode: 420
848+
secretName: combined-ca-bundle
807849
- name: ssh-key
808850
secret:
809851
defaultMode: 420

‎tests/kuttl/tests/dataplane-deploy-no-nodes-test/01-assert.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -682,6 +682,20 @@ spec:
682682
terminationMessagePath: /dev/termination-log
683683
terminationMessagePolicy: File
684684
volumeMounts:
685+
- mountPath: /var/lib/openstack/cacerts/ovn
686+
name: ovn-combined-ca-bundle
687+
- mountPath: /var/lib/openstack/cacerts/neutron-metadata
688+
name: neutron-metadata-combined-ca-bundle
689+
- mountPath: /var/lib/openstack/cacerts/neutron-ovn
690+
name: neutron-ovn-combined-ca-bundle
691+
- mountPath: /var/lib/openstack/cacerts/neutron-sriov
692+
name: neutron-sriov-combined-ca-bundle
693+
- mountPath: /var/lib/openstack/cacerts/neutron-dhcp
694+
name: neutron-dhcp-combined-ca-bundle
695+
- mountPath: /var/lib/openstack/cacerts/libvirt
696+
name: libvirt-combined-ca-bundle
697+
- mountPath: /var/lib/openstack/cacerts/nova
698+
name: nova-combined-ca-bundle
685699
- mountPath: /runner/env/ssh_key
686700
name: ssh-key
687701
subPath: ssh_key
@@ -695,6 +709,34 @@ spec:
695709
serviceAccountName: edpm-compute-no-nodes
696710
terminationGracePeriodSeconds: 30
697711
volumes:
712+
- name: ovn-combined-ca-bundle
713+
secret:
714+
defaultMode: 420
715+
secretName: combined-ca-bundle
716+
- name: neutron-metadata-combined-ca-bundle
717+
secret:
718+
defaultMode: 420
719+
secretName: combined-ca-bundle
720+
- name: neutron-ovn-combined-ca-bundle
721+
secret:
722+
defaultMode: 420
723+
secretName: combined-ca-bundle
724+
- name: neutron-sriov-combined-ca-bundle
725+
secret:
726+
defaultMode: 420
727+
secretName: combined-ca-bundle
728+
- name: neutron-dhcp-combined-ca-bundle
729+
secret:
730+
defaultMode: 420
731+
secretName: combined-ca-bundle
732+
- name: libvirt-combined-ca-bundle
733+
secret:
734+
defaultMode: 420
735+
secretName: combined-ca-bundle
736+
- name: nova-combined-ca-bundle
737+
secret:
738+
defaultMode: 420
739+
secretName: combined-ca-bundle
698740
- name: ssh-key
699741
secret:
700742
defaultMode: 420

0 commit comments

Comments
 (0)