@@ -23,17 +23,21 @@ import (
2323
2424 corev1 "k8s.io/api/core/v1"
2525 k8s_errors "k8s.io/apimachinery/pkg/api/errors"
26+ "k8s.io/apimachinery/pkg/types"
27+ "k8s.io/utils/ptr"
2628 ctrl "sigs.k8s.io/controller-runtime"
2729 "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
2830
2931 common "github.com/openstack-k8s-operators/lib-common/modules/common"
3032 condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
3133 endpoint "github.com/openstack-k8s-operators/lib-common/modules/common/endpoint"
34+ env "github.com/openstack-k8s-operators/lib-common/modules/common/env"
3235 helper "github.com/openstack-k8s-operators/lib-common/modules/common/helper"
3336 job "github.com/openstack-k8s-operators/lib-common/modules/common/job"
3437 secret "github.com/openstack-k8s-operators/lib-common/modules/common/secret"
3538 service "github.com/openstack-k8s-operators/lib-common/modules/common/service"
3639 statefulset "github.com/openstack-k8s-operators/lib-common/modules/common/statefulset"
40+ "github.com/openstack-k8s-operators/lib-common/modules/common/tls"
3741 util "github.com/openstack-k8s-operators/lib-common/modules/common/util"
3842 mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
3943
@@ -264,8 +268,17 @@ func (r *AutoscalingReconciler) reconcileNormalAodh(
264268 common .AppSelector : autoscaling .ServiceName ,
265269 }
266270
271+ // ConfigVars
272+ configVars := make (map [string ]env.Setter )
273+
267274 sfsetDef , err := autoscaling .AodhStatefulSet (instance , inputHash , serviceLabels )
268275 if err != nil {
276+ instance .Status .Conditions .Set (condition .FalseCondition (
277+ condition .DeploymentReadyCondition ,
278+ condition .ErrorReason ,
279+ condition .SeverityWarning ,
280+ condition .DeploymentReadyErrorMessage ,
281+ err .Error ()))
269282 return ctrl.Result {}, err
270283 }
271284 sfset := statefulset .NewStatefulSet (
@@ -401,7 +414,12 @@ func (r *AutoscalingReconciler) reconcileNormalAodh(
401414 }
402415 // create service - end
403416
404- // TODO: TLS, pass in https as protocol, create TLS cert
417+ // if TLS is enabled
418+ if instance .Spec .Aodh .TLS .API .Enabled (endpointType ) {
419+ // set endpoint protocol to https
420+ data .Protocol = ptr .To (service .ProtocolHTTPS )
421+ }
422+
405423 apiEndpoints [string (endpointType )], err = svc .GetAPIEndpoint (
406424 svcOverride .EndpointURL , data .Protocol , data .Path )
407425 if err != nil {
@@ -440,6 +458,55 @@ func (r *AutoscalingReconciler) reconcileNormalAodh(
440458 return ctrlResult , nil
441459 }
442460
461+ //
462+ // TLS input validation
463+ //
464+ // Validate the CA cert secret if provided
465+ if instance .Spec .Aodh .TLS .CaBundleSecretName != "" {
466+ hash , ctrlResult , err := tls .ValidateCACertSecret (
467+ ctx ,
468+ helper .GetClient (),
469+ types.NamespacedName {
470+ Name : instance .Spec .Aodh .TLS .CaBundleSecretName ,
471+ Namespace : instance .Namespace ,
472+ },
473+ )
474+ if err != nil {
475+ instance .Status .Conditions .Set (condition .FalseCondition (
476+ condition .TLSInputReadyCondition ,
477+ condition .ErrorReason ,
478+ condition .SeverityWarning ,
479+ condition .TLSInputErrorMessage ,
480+ err .Error ()))
481+ return ctrlResult , err
482+ } else if (ctrlResult != ctrl.Result {}) {
483+ return ctrlResult , nil
484+ }
485+
486+ if hash != "" {
487+ configVars [tls .CABundleKey ] = env .SetValue (hash )
488+ }
489+
490+ // Validate API service certs secrets
491+ certsHash , ctrlResult , err := instance .Spec .Aodh .TLS .API .ValidateCertSecrets (ctx , helper , instance .Namespace )
492+ if err != nil {
493+ instance .Status .Conditions .Set (condition .FalseCondition (
494+ condition .TLSInputReadyCondition ,
495+ condition .ErrorReason ,
496+ condition .SeverityWarning ,
497+ condition .TLSInputErrorMessage ,
498+ err .Error ()))
499+ return ctrlResult , err
500+ } else if (ctrlResult != ctrl.Result {}) {
501+ return ctrlResult , nil
502+ }
503+
504+ configVars [tls .TLSHashName ] = env .SetValue (certsHash )
505+ }
506+
507+ // all cert input checks out so report InputReady
508+ instance .Status .Conditions .MarkTrue (condition .TLSInputReadyCondition , condition .InputReadyMessage )
509+
443510 Log .Info ("Reconciled Service Aodh successfully" )
444511 return ctrl.Result {}, nil
445512}
0 commit comments