Skip to content

Commit 2385f25

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #310 from Deydra71/tls-support
[tlse] tls support for telemetry aodh
2 parents 7d21e7f + e8e3714 commit 2385f25

26 files changed

+731
-10
lines changed

‎api/bases/telemetry.openstack.org_autoscalings.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,36 @@ spec:
294294
description: ServiceUser - optional username used for this service
295295
to register in keystone
296296
type: string
297+
tls:
298+
description: TLS - Parameters related to the TLS
299+
properties:
300+
api:
301+
description: API tls type which encapsulates for API services
302+
properties:
303+
internal:
304+
description: Internal GenericService - holds the secret
305+
for the internal endpoint
306+
properties:
307+
secretName:
308+
description: SecretName - holding the cert, key for
309+
the service
310+
type: string
311+
type: object
312+
public:
313+
description: Public GenericService - holds the secret
314+
for the public endpoint
315+
properties:
316+
secretName:
317+
description: SecretName - holding the cert, key for
318+
the service
319+
type: string
320+
type: object
321+
type: object
322+
caBundleSecretName:
323+
description: CaBundleSecretName - holding the CA certs in
324+
a pre-created bundle file
325+
type: string
326+
type: object
297327
required:
298328
- apiImage
299329
- databaseInstance

‎api/bases/telemetry.openstack.org_telemetries.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -308,6 +308,36 @@ spec:
308308
description: ServiceUser - optional username used for this
309309
service to register in keystone
310310
type: string
311+
tls:
312+
description: TLS - Parameters related to the TLS
313+
properties:
314+
api:
315+
description: API tls type which encapsulates for API services
316+
properties:
317+
internal:
318+
description: Internal GenericService - holds the secret
319+
for the internal endpoint
320+
properties:
321+
secretName:
322+
description: SecretName - holding the cert, key
323+
for the service
324+
type: string
325+
type: object
326+
public:
327+
description: Public GenericService - holds the secret
328+
for the public endpoint
329+
properties:
330+
secretName:
331+
description: SecretName - holding the cert, key
332+
for the service
333+
type: string
334+
type: object
335+
type: object
336+
caBundleSecretName:
337+
description: CaBundleSecretName - holding the CA certs
338+
in a pre-created bundle file
339+
type: string
340+
type: object
311341
required:
312342
- apiImage
313343
- databaseInstance

‎api/v1beta1/autoscaling_types.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,11 @@ package v1beta1
1818

1919
import (
2020
condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
21+
"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
2122
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2223

23-
"github.com/openstack-k8s-operators/lib-common/modules/common/util"
2424
"github.com/openstack-k8s-operators/lib-common/modules/common/service"
25+
"github.com/openstack-k8s-operators/lib-common/modules/common/util"
2526
)
2627

2728
const (
@@ -37,7 +38,6 @@ const (
3738
DbSyncHash = "dbsync"
3839
)
3940

40-
4141
// Aodh defines the aodh component spec
4242
type Aodh struct {
4343
// RabbitMQ instance name
@@ -109,6 +109,11 @@ type Aodh struct {
109109

110110
// +kubebuilder:validation:Required
111111
ListenerImage string `json:"listenerImage"`
112+
113+
// +kubebuilder:validation:Optional
114+
// +operator-sdk:csv:customresourcedefinitions:type=spec
115+
// TLS - Parameters related to the TLS
116+
TLS tls.API `json:"tls,omitempty"`
112117
}
113118

114119
// APIOverrideSpec to override the generated manifest of several child resources.

‎api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/telemetry.openstack.org_autoscalings.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,36 @@ spec:
294294
description: ServiceUser - optional username used for this service
295295
to register in keystone
296296
type: string
297+
tls:
298+
description: TLS - Parameters related to the TLS
299+
properties:
300+
api:
301+
description: API tls type which encapsulates for API services
302+
properties:
303+
internal:
304+
description: Internal GenericService - holds the secret
305+
for the internal endpoint
306+
properties:
307+
secretName:
308+
description: SecretName - holding the cert, key for
309+
the service
310+
type: string
311+
type: object
312+
public:
313+
description: Public GenericService - holds the secret
314+
for the public endpoint
315+
properties:
316+
secretName:
317+
description: SecretName - holding the cert, key for
318+
the service
319+
type: string
320+
type: object
321+
type: object
322+
caBundleSecretName:
323+
description: CaBundleSecretName - holding the CA certs in
324+
a pre-created bundle file
325+
type: string
326+
type: object
297327
required:
298328
- apiImage
299329
- databaseInstance

‎config/crd/bases/telemetry.openstack.org_telemetries.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -308,6 +308,36 @@ spec:
308308
description: ServiceUser - optional username used for this
309309
service to register in keystone
310310
type: string
311+
tls:
312+
description: TLS - Parameters related to the TLS
313+
properties:
314+
api:
315+
description: API tls type which encapsulates for API services
316+
properties:
317+
internal:
318+
description: Internal GenericService - holds the secret
319+
for the internal endpoint
320+
properties:
321+
secretName:
322+
description: SecretName - holding the cert, key
323+
for the service
324+
type: string
325+
type: object
326+
public:
327+
description: Public GenericService - holds the secret
328+
for the public endpoint
329+
properties:
330+
secretName:
331+
description: SecretName - holding the cert, key
332+
for the service
333+
type: string
334+
type: object
335+
type: object
336+
caBundleSecretName:
337+
description: CaBundleSecretName - holding the CA certs
338+
in a pre-created bundle file
339+
type: string
340+
type: object
311341
required:
312342
- apiImage
313343
- databaseInstance

‎config/samples/telemetry_v1beta1_autoscaling_tls.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: telemetry.openstack.org/v1beta1
2+
kind: Autoscaling
3+
metadata:
4+
labels:
5+
app.kubernetes.io/name: autoscaling
6+
app.kubernetes.io/instance: autoscaling-sample
7+
app.kubernetes.io/part-of: telemetry-operator
8+
app.kubernetes.io/managed-by: kustomize
9+
app.kubernetes.io/created-by: telemetry-operator
10+
name: autoscaling
11+
spec:
12+
aodh:
13+
secret: osp-secret
14+
passwordSelectors:
15+
databaseUser: aodh
16+
databaseInstance: openstack
17+
memcachedInstance: memcached
18+
tls:
19+
api:
20+
internal:
21+
secretName: cert-aodh-internal-svc
22+
public:
23+
secretName: cert-aodh-public-svc
24+
caBundleSecretName: combined-ca-bundle

‎controllers/aodh_controller.go‎

Lines changed: 68 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,17 +23,21 @@ import (
2323

2424
corev1 "k8s.io/api/core/v1"
2525
k8s_errors "k8s.io/apimachinery/pkg/api/errors"
26+
"k8s.io/apimachinery/pkg/types"
27+
"k8s.io/utils/ptr"
2628
ctrl "sigs.k8s.io/controller-runtime"
2729
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
2830

2931
common "github.com/openstack-k8s-operators/lib-common/modules/common"
3032
condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
3133
endpoint "github.com/openstack-k8s-operators/lib-common/modules/common/endpoint"
34+
env "github.com/openstack-k8s-operators/lib-common/modules/common/env"
3235
helper "github.com/openstack-k8s-operators/lib-common/modules/common/helper"
3336
job "github.com/openstack-k8s-operators/lib-common/modules/common/job"
3437
secret "github.com/openstack-k8s-operators/lib-common/modules/common/secret"
3538
service "github.com/openstack-k8s-operators/lib-common/modules/common/service"
3639
statefulset "github.com/openstack-k8s-operators/lib-common/modules/common/statefulset"
40+
"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
3741
util "github.com/openstack-k8s-operators/lib-common/modules/common/util"
3842
mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
3943

@@ -264,8 +268,17 @@ func (r *AutoscalingReconciler) reconcileNormalAodh(
264268
common.AppSelector: autoscaling.ServiceName,
265269
}
266270

271+
// ConfigVars
272+
configVars := make(map[string]env.Setter)
273+
267274
sfsetDef, err := autoscaling.AodhStatefulSet(instance, inputHash, serviceLabels)
268275
if err != nil {
276+
instance.Status.Conditions.Set(condition.FalseCondition(
277+
condition.DeploymentReadyCondition,
278+
condition.ErrorReason,
279+
condition.SeverityWarning,
280+
condition.DeploymentReadyErrorMessage,
281+
err.Error()))
269282
return ctrl.Result{}, err
270283
}
271284
sfset := statefulset.NewStatefulSet(
@@ -401,7 +414,12 @@ func (r *AutoscalingReconciler) reconcileNormalAodh(
401414
}
402415
// create service - end
403416

404-
// TODO: TLS, pass in https as protocol, create TLS cert
417+
// if TLS is enabled
418+
if instance.Spec.Aodh.TLS.API.Enabled(endpointType) {
419+
// set endpoint protocol to https
420+
data.Protocol = ptr.To(service.ProtocolHTTPS)
421+
}
422+
405423
apiEndpoints[string(endpointType)], err = svc.GetAPIEndpoint(
406424
svcOverride.EndpointURL, data.Protocol, data.Path)
407425
if err != nil {
@@ -440,6 +458,55 @@ func (r *AutoscalingReconciler) reconcileNormalAodh(
440458
return ctrlResult, nil
441459
}
442460

461+
//
462+
// TLS input validation
463+
//
464+
// Validate the CA cert secret if provided
465+
if instance.Spec.Aodh.TLS.CaBundleSecretName != "" {
466+
hash, ctrlResult, err := tls.ValidateCACertSecret(
467+
ctx,
468+
helper.GetClient(),
469+
types.NamespacedName{
470+
Name: instance.Spec.Aodh.TLS.CaBundleSecretName,
471+
Namespace: instance.Namespace,
472+
},
473+
)
474+
if err != nil {
475+
instance.Status.Conditions.Set(condition.FalseCondition(
476+
condition.TLSInputReadyCondition,
477+
condition.ErrorReason,
478+
condition.SeverityWarning,
479+
condition.TLSInputErrorMessage,
480+
err.Error()))
481+
return ctrlResult, err
482+
} else if (ctrlResult != ctrl.Result{}) {
483+
return ctrlResult, nil
484+
}
485+
486+
if hash != "" {
487+
configVars[tls.CABundleKey] = env.SetValue(hash)
488+
}
489+
490+
// Validate API service certs secrets
491+
certsHash, ctrlResult, err := instance.Spec.Aodh.TLS.API.ValidateCertSecrets(ctx, helper, instance.Namespace)
492+
if err != nil {
493+
instance.Status.Conditions.Set(condition.FalseCondition(
494+
condition.TLSInputReadyCondition,
495+
condition.ErrorReason,
496+
condition.SeverityWarning,
497+
condition.TLSInputErrorMessage,
498+
err.Error()))
499+
return ctrlResult, err
500+
} else if (ctrlResult != ctrl.Result{}) {
501+
return ctrlResult, nil
502+
}
503+
504+
configVars[tls.TLSHashName] = env.SetValue(certsHash)
505+
}
506+
507+
// all cert input checks out so report InputReady
508+
instance.Status.Conditions.MarkTrue(condition.TLSInputReadyCondition, condition.InputReadyMessage)
509+
443510
Log.Info("Reconciled Service Aodh successfully")
444511
return ctrl.Result{}, nil
445512
}

0 commit comments

Comments
 (0)