@@ -4,14 +4,19 @@ import (
44 "context"
55 "fmt"
66
7+ "github.com/openstack-k8s-operators/lib-common/modules/certmanager"
78 "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
89 "github.com/openstack-k8s-operators/lib-common/modules/common/helper"
10+ "github.com/openstack-k8s-operators/lib-common/modules/common/service"
911
1012 "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
1113
14+ certmgrv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
1215 corev1beta1 "github.com/openstack-k8s-operators/openstack-operator/apis/core/v1beta1"
1316 ovnv1 "github.com/openstack-k8s-operators/ovn-operator/api/v1beta1"
17+ k8s_errors "k8s.io/apimachinery/pkg/api/errors"
1418 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
19+ "k8s.io/apimachinery/pkg/types"
1520 ctrl "sigs.k8s.io/controller-runtime"
1621)
1722
@@ -76,6 +81,51 @@ func ReconcileOVNDbClusters(ctx context.Context, instance *corev1beta1.OpenStack
7681 continue
7782 }
7883
84+ // preserve any previously set TLS certs, set CA cert
85+ if err := helper .GetClient ().Get (ctx , types.NamespacedName {Name : name , Namespace : instance .Namespace }, OVNDBCluster ); err != nil {
86+ if ! k8s_errors .IsNotFound (err ) {
87+ return false , err
88+ }
89+ }
90+ if instance .Spec .TLS .Enabled (service .EndpointInternal ) {
91+ dbcluster .TLS = OVNDBCluster .Spec .TLS
92+ }
93+ dbcluster .TLS .CaBundleSecretName = instance .Status .TLS .CaBundleSecretName
94+
95+ if OVNDBCluster .Status .Conditions .IsTrue (condition .ExposeServiceReadyCondition ) {
96+ // create certificate for ovndbclusters
97+ certRequest := certmanager.CertificateRequest {
98+ IssuerName : OvnDbCaName ,
99+ CertName : fmt .Sprintf ("%s-ovndbs" , name ),
100+ Duration : nil ,
101+ // Cert needs to be valid for the individual pods in the statefulset so make this a wildcard cert
102+ Hostnames : []string {
103+ fmt .Sprintf ("*.%s.svc" , instance .Namespace ),
104+ fmt .Sprintf ("*.%s.svc.%s" , instance .Namespace , ovnv1 .DNSSuffix ),
105+ },
106+ Ips : nil ,
107+ Usages : []certmgrv1.KeyUsage {
108+ certmgrv1 .UsageKeyEncipherment ,
109+ certmgrv1 .UsageDigitalSignature ,
110+ certmgrv1 .UsageServerAuth ,
111+ certmgrv1 .UsageClientAuth ,
112+ },
113+ }
114+ certSecret , ctrlResult , err := certmanager .EnsureCert (
115+ ctx ,
116+ helper ,
117+ certRequest )
118+ if err != nil {
119+ return false , err
120+ } else if (ctrlResult != ctrl.Result {}) {
121+ return false , nil
122+ }
123+
124+ if instance .Spec .TLS .Enabled (service .EndpointInternal ) {
125+ dbcluster .TLS .SecretName = & certSecret .Name
126+ }
127+ }
128+
79129 Log .Info ("Reconciling OVNDBCluster" , "OVNDBCluster.Namespace" , instance .Namespace , "OVNDBCluster.Name" , name )
80130 op , err := controllerutil .CreateOrPatch (ctx , helper .GetClient (), OVNDBCluster , func () error {
81131
@@ -123,6 +173,49 @@ func ReconcileOVNNorthd(ctx context.Context, instance *corev1beta1.OpenStackCont
123173 return false , nil
124174 }
125175
176+ ovnNorthdSpec := & instance .Spec .Ovn .Template .OVNNorthd
177+
178+ // preserve any previously set TLS certs, set CA cert
179+ if err := helper .GetClient ().Get (ctx , types.NamespacedName {Name : "ovnnorthd" , Namespace : instance .Namespace }, OVNNorthd ); err != nil {
180+ if ! k8s_errors .IsNotFound (err ) {
181+ return false , err
182+ }
183+ }
184+ if instance .Spec .TLS .Enabled (service .EndpointInternal ) {
185+ ovnNorthdSpec .TLS = OVNNorthd .Spec .TLS
186+
187+ serviceName := ovnv1 .ServiceNameOvnNorthd
188+ // create certificate for ovnnorthd
189+ certRequest := certmanager.CertificateRequest {
190+ IssuerName : OvnDbCaName ,
191+ CertName : fmt .Sprintf ("%s-ovndbs" , "ovnnorthd" ),
192+ Duration : nil ,
193+ Hostnames : []string {
194+ fmt .Sprintf ("%s.%s.svc" , serviceName , instance .Namespace ),
195+ fmt .Sprintf ("%s.%s.svc.%s" , serviceName , instance .Namespace , ovnv1 .DNSSuffix ),
196+ },
197+ Ips : nil ,
198+ Usages : []certmgrv1.KeyUsage {
199+ certmgrv1 .UsageKeyEncipherment ,
200+ certmgrv1 .UsageDigitalSignature ,
201+ certmgrv1 .UsageServerAuth ,
202+ certmgrv1 .UsageClientAuth ,
203+ },
204+ }
205+ certSecret , ctrlResult , err := certmanager .EnsureCert (
206+ ctx ,
207+ helper ,
208+ certRequest )
209+ if err != nil {
210+ return false , err
211+ } else if (ctrlResult != ctrl.Result {}) {
212+ return false , nil
213+ }
214+
215+ ovnNorthdSpec .TLS .SecretName = & certSecret .Name
216+ }
217+ ovnNorthdSpec .TLS .CaBundleSecretName = instance .Status .TLS .CaBundleSecretName
218+
126219 Log .Info ("Reconciling OVNNorthd" , "OVNNorthd.Namespace" , instance .Namespace , "OVNNorthd.Name" , "ovnnorthd" )
127220 op , err := controllerutil .CreateOrPatch (ctx , helper .GetClient (), OVNNorthd , func () error {
128221
@@ -171,6 +264,49 @@ func ReconcileOVNController(ctx context.Context, instance *corev1beta1.OpenStack
171264 return false , nil
172265 }
173266
267+ ovnControllerSpec := & instance .Spec .Ovn .Template .OVNController
268+
269+ // preserve any previously set TLS certs, set CA cert
270+ if err := helper .GetClient ().Get (ctx , types.NamespacedName {Name : "ovncontroller" , Namespace : instance .Namespace }, OVNController ); err != nil {
271+ if ! k8s_errors .IsNotFound (err ) {
272+ return false , err
273+ }
274+ }
275+ if instance .Spec .TLS .Enabled (service .EndpointInternal ) {
276+ ovnControllerSpec .TLS = OVNController .Spec .TLS
277+
278+ serviceName := ovnv1 .ServiceNameOvnController
279+ // create certificate for ovncontroller
280+ certRequest := certmanager.CertificateRequest {
281+ IssuerName : OvnDbCaName ,
282+ CertName : fmt .Sprintf ("%s-ovndbs" , "ovncontroller" ),
283+ Duration : nil ,
284+ Hostnames : []string {
285+ fmt .Sprintf ("%s.%s.svc" , serviceName , instance .Namespace ),
286+ fmt .Sprintf ("%s.%s.svc.%s" , serviceName , instance .Namespace , ovnv1 .DNSSuffix ),
287+ },
288+ Ips : nil ,
289+ Usages : []certmgrv1.KeyUsage {
290+ certmgrv1 .UsageKeyEncipherment ,
291+ certmgrv1 .UsageDigitalSignature ,
292+ certmgrv1 .UsageServerAuth ,
293+ certmgrv1 .UsageClientAuth ,
294+ },
295+ }
296+ certSecret , ctrlResult , err := certmanager .EnsureCert (
297+ ctx ,
298+ helper ,
299+ certRequest )
300+ if err != nil {
301+ return false , err
302+ } else if (ctrlResult != ctrl.Result {}) {
303+ return false , nil
304+ }
305+
306+ ovnControllerSpec .TLS .SecretName = & certSecret .Name
307+ }
308+ ovnControllerSpec .TLS .CaBundleSecretName = instance .Status .TLS .CaBundleSecretName
309+
174310 Log .Info ("Reconciling OVNController" , "OVNController.Namespace" , instance .Namespace , "OVNController.Name" , "ovncontroller" )
175311 op , err := controllerutil .CreateOrPatch (ctx , helper .GetClient (), OVNController , func () error {
176312
![openshift-merge-bot[bot]](https://avatars.githubusercontent.com/in/412865?v=4&size=40){kind=avatar}
0 commit comments