Skip to content

Commit d22bef9

Browse files
Deydra71Deydra71
committed
[tls] Support for aodh
Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs are directly mounted to /var/lib/config-data/* and coppied to the appropriate place in etc/pki/tls/certs/%s.crt|key and a CA bundle to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem . Job deployments for bootstrap/cron get the CA bundle added if configured. Signed-off-by: Veronika Fisarova <[email protected]> Depends-On: openstack-k8s-operators/lib-common#428
1 parent 0d4f1ec commit d22bef9

26 files changed

+797
-10
lines changed

‎api/bases/telemetry.openstack.org_autoscalings.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,36 @@ spec:
294294
description: ServiceUser - optional username used for this service
295295
to register in keystone
296296
type: string
297+
tls:
298+
description: TLS - Parameters related to the TLS
299+
properties:
300+
api:
301+
description: API tls type which encapsulates for API services
302+
properties:
303+
internal:
304+
description: Internal GenericService - holds the secret
305+
for the internal endpoint
306+
properties:
307+
secretName:
308+
description: SecretName - holding the cert, key for
309+
the service
310+
type: string
311+
type: object
312+
public:
313+
description: Public GenericService - holds the secret
314+
for the public endpoint
315+
properties:
316+
secretName:
317+
description: SecretName - holding the cert, key for
318+
the service
319+
type: string
320+
type: object
321+
type: object
322+
caBundleSecretName:
323+
description: CaBundleSecretName - holding the CA certs in
324+
a pre-created bundle file
325+
type: string
326+
type: object
297327
required:
298328
- apiImage
299329
- databaseInstance

‎api/go.sum‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8Yc
99
github.com/emicklei/go-restful/v3 v3.11.2 h1:1onLa9DcsMYO9P+CXaL0dStDqQ2EHHXLiz+BtnqkLAU=
1010
github.com/emicklei/go-restful/v3 v3.11.2/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
1111
github.com/evanphx/json-patch v5.6.0+incompatible h1:jBYDEEiFBPxA0v50tFdvOzQQTCvpL6mnFh5mB2/l16U=
12+
github.com/evanphx/json-patch v5.6.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
1213
github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
1314
github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
1415
github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
@@ -55,7 +56,9 @@ github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHm
5556
github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
5657
github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
5758
github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
59+
github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
5860
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
61+
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
5962
github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
6063
github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
6164
github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -90,16 +93,19 @@ github.com/rhobs/obo-prometheus-operator/pkg/apis/monitoring v0.64.1-rhobs3/go.m
9093
github.com/rhobs/observability-operator v0.0.20 h1:u4Ejzq/Yt3rY4b/apKhpgYIvmp+MpcV9hhEzhzedpk4=
9194
github.com/rhobs/observability-operator v0.0.20/go.mod h1:F+exF/48C17xz9Ci9WK9Ri53Z9EZdad0otSOpeFxCXE=
9295
github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
96+
github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
9397
github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
9498
github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
9599
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
96100
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
97101
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
98102
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
103+
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
99104
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
100105
github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
101106
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
102107
go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
108+
go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
103109
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
104110
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
105111
go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
@@ -169,6 +175,7 @@ google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7
169175
google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
170176
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
171177
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
178+
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
172179
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
173180
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
174181
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

‎api/v1beta1/autoscaling_types.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,11 @@ package v1beta1
1818

1919
import (
2020
condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
21+
"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
2122
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2223

23-
"github.com/openstack-k8s-operators/lib-common/modules/common/util"
2424
"github.com/openstack-k8s-operators/lib-common/modules/common/service"
25+
"github.com/openstack-k8s-operators/lib-common/modules/common/util"
2526
)
2627

2728
const (
@@ -37,7 +38,6 @@ const (
3738
DbSyncHash = "dbsync"
3839
)
3940

40-
4141
// Aodh defines the aodh component spec
4242
type Aodh struct {
4343
// RabbitMQ instance name
@@ -109,6 +109,11 @@ type Aodh struct {
109109

110110
// +kubebuilder:validation:Required
111111
ListenerImage string `json:"listenerImage"`
112+
113+
// +kubebuilder:validation:Optional
114+
// +operator-sdk:csv:customresourcedefinitions:type=spec
115+
// TLS - Parameters related to the TLS
116+
TLS tls.API `json:"tls,omitempty"`
112117
}
113118

114119
// APIOverrideSpec to override the generated manifest of several child resources.

‎api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/telemetry.openstack.org_autoscalings.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -294,6 +294,36 @@ spec:
294294
description: ServiceUser - optional username used for this service
295295
to register in keystone
296296
type: string
297+
tls:
298+
description: TLS - Parameters related to the TLS
299+
properties:
300+
api:
301+
description: API tls type which encapsulates for API services
302+
properties:
303+
internal:
304+
description: Internal GenericService - holds the secret
305+
for the internal endpoint
306+
properties:
307+
secretName:
308+
description: SecretName - holding the cert, key for
309+
the service
310+
type: string
311+
type: object
312+
public:
313+
description: Public GenericService - holds the secret
314+
for the public endpoint
315+
properties:
316+
secretName:
317+
description: SecretName - holding the cert, key for
318+
the service
319+
type: string
320+
type: object
321+
type: object
322+
caBundleSecretName:
323+
description: CaBundleSecretName - holding the CA certs in
324+
a pre-created bundle file
325+
type: string
326+
type: object
297327
required:
298328
- apiImage
299329
- databaseInstance

‎config/samples/telemetry_v1beta1_autoscaling_tls.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
apiVersion: telemetry.openstack.org/v1beta1
2+
kind: Autoscaling
3+
metadata:
4+
labels:
5+
app.kubernetes.io/name: autoscaling
6+
app.kubernetes.io/instance: autoscaling-sample
7+
app.kubernetes.io/part-of: telemetry-operator
8+
app.kubernetes.io/managed-by: kustomize
9+
app.kubernetes.io/created-by: telemetry-operator
10+
name: autoscaling
11+
spec:
12+
aodh:
13+
secret: osp-secret
14+
passwordSelectors:
15+
databaseUser: aodh
16+
databaseInstance: openstack
17+
memcachedInstance: memcached
18+
tls:
19+
api:
20+
internal:
21+
secretName: cert-aodh-internal-svc
22+
public:
23+
secretName: cert-aodh-public-svc
24+
caBundleSecretName: combined-ca-bundle

‎controllers/aodh_controller.go‎

Lines changed: 68 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,17 +23,21 @@ import (
2323

2424
corev1 "k8s.io/api/core/v1"
2525
k8s_errors "k8s.io/apimachinery/pkg/api/errors"
26+
"k8s.io/apimachinery/pkg/types"
27+
"k8s.io/utils/ptr"
2628
ctrl "sigs.k8s.io/controller-runtime"
2729
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
2830

2931
common "github.com/openstack-k8s-operators/lib-common/modules/common"
3032
condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
3133
endpoint "github.com/openstack-k8s-operators/lib-common/modules/common/endpoint"
34+
env "github.com/openstack-k8s-operators/lib-common/modules/common/env"
3235
helper "github.com/openstack-k8s-operators/lib-common/modules/common/helper"
3336
job "github.com/openstack-k8s-operators/lib-common/modules/common/job"
3437
secret "github.com/openstack-k8s-operators/lib-common/modules/common/secret"
3538
service "github.com/openstack-k8s-operators/lib-common/modules/common/service"
3639
statefulset "github.com/openstack-k8s-operators/lib-common/modules/common/statefulset"
40+
"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
3741
util "github.com/openstack-k8s-operators/lib-common/modules/common/util"
3842
mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
3943

@@ -264,8 +268,17 @@ func (r *AutoscalingReconciler) reconcileNormalAodh(
264268
common.AppSelector: autoscaling.ServiceName,
265269
}
266270

271+
// ConfigVars
272+
configVars := make(map[string]env.Setter)
273+
267274
sfsetDef, err := autoscaling.AodhStatefulSet(instance, inputHash, serviceLabels)
268275
if err != nil {
276+
instance.Status.Conditions.Set(condition.FalseCondition(
277+
condition.DeploymentReadyCondition,
278+
condition.ErrorReason,
279+
condition.SeverityWarning,
280+
condition.DeploymentReadyErrorMessage,
281+
err.Error()))
269282
return ctrl.Result{}, err
270283
}
271284
sfset := statefulset.NewStatefulSet(
@@ -401,7 +414,12 @@ func (r *AutoscalingReconciler) reconcileNormalAodh(
401414
}
402415
// create service - end
403416

404-
// TODO: TLS, pass in https as protocol, create TLS cert
417+
// if TLS is enabled
418+
if instance.Spec.Aodh.TLS.API.Enabled(endpointType) {
419+
// set endpoint protocol to https
420+
data.Protocol = ptr.To(service.ProtocolHTTPS)
421+
}
422+
405423
apiEndpoints[string(endpointType)], err = svc.GetAPIEndpoint(
406424
svcOverride.EndpointURL, data.Protocol, data.Path)
407425
if err != nil {
@@ -440,6 +458,55 @@ func (r *AutoscalingReconciler) reconcileNormalAodh(
440458
return ctrlResult, nil
441459
}
442460

461+
//
462+
// TLS input validation
463+
//
464+
// Validate the CA cert secret if provided
465+
if instance.Spec.Aodh.TLS.CaBundleSecretName != "" {
466+
hash, ctrlResult, err := tls.ValidateCACertSecret(
467+
ctx,
468+
helper.GetClient(),
469+
types.NamespacedName{
470+
Name: instance.Spec.Aodh.TLS.CaBundleSecretName,
471+
Namespace: instance.Namespace,
472+
},
473+
)
474+
if err != nil {
475+
instance.Status.Conditions.Set(condition.FalseCondition(
476+
condition.TLSInputReadyCondition,
477+
condition.ErrorReason,
478+
condition.SeverityWarning,
479+
condition.TLSInputErrorMessage,
480+
err.Error()))
481+
return ctrlResult, err
482+
} else if (ctrlResult != ctrl.Result{}) {
483+
return ctrlResult, nil
484+
}
485+
486+
if hash != "" {
487+
configVars[tls.CABundleKey] = env.SetValue(hash)
488+
}
489+
490+
// Validate API service certs secrets
491+
certsHash, ctrlResult, err := instance.Spec.Aodh.TLS.API.ValidateCertSecrets(ctx, helper, instance.Namespace)
492+
if err != nil {
493+
instance.Status.Conditions.Set(condition.FalseCondition(
494+
condition.TLSInputReadyCondition,
495+
condition.ErrorReason,
496+
condition.SeverityWarning,
497+
condition.TLSInputErrorMessage,
498+
err.Error()))
499+
return ctrlResult, err
500+
} else if (ctrlResult != ctrl.Result{}) {
501+
return ctrlResult, nil
502+
}
503+
504+
configVars[tls.TLSHashName] = env.SetValue(certsHash)
505+
}
506+
507+
// all cert input checks out so report InputReady
508+
instance.Status.Conditions.MarkTrue(condition.TLSInputReadyCondition, condition.InputReadyMessage)
509+
443510
Log.Info("Reconciled Service Aodh successfully")
444511
return ctrl.Result{}, nil
445512
}

0 commit comments

Comments
 (0)