Skip to content

Commit 7c759de

Browse files
cardoecardoe
committed
feat: use mariadb operator for OpenStack db secrets
Generate and inject the database connection info via a secret generated by the MariaDB operator to create a connection string that matches what oslo.config reads. Unfortunately OpenStack Helm doesn't always respect the mount for the db_sync job so this won't work until that's fixed upstream and we bump to releases with those fixes for all the services.
1 parent eda9ef8 commit 7c759de

16 files changed

+599
-9
lines changed

‎components/glance/glance-mariadb-db.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,26 @@ spec:
5050
grantOption: true
5151
host: "%"
5252
retryInterval: 5s
53+
---
54+
apiVersion: k8s.mariadb.com/v1alpha1
55+
kind: Connection
56+
metadata:
57+
name: glance-db-conn
58+
spec:
59+
mariaDbRef:
60+
name: mariadb
61+
username: glance
62+
passwordSecretKeyRef:
63+
name: glance-db-password
64+
key: password
65+
database: glance
66+
secretName: glance-db-conn
67+
secretTemplate:
68+
key: db_conn.conf
69+
format: |
70+
[database]
71+
connection = mysql+pymysql://{{ .Username }}:{{ .Password }}@{{ .Host }}:{{ .Port }}/{{ .Database }}{{ .Params }}
72+
healthCheck:
73+
interval: 30s
74+
retryInterval: 3s
75+
serviceName: mariadb

‎components/glance/values.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,38 @@ pod:
8989
periodSeconds: 10
9090
timeoutSeconds: 8
9191
failureThreshold: 6
92+
mounts:
93+
# oslo.config autoloads certain paths in alphabetical order
94+
# which gives us the opportunity to inject secrets and extra
95+
# configs here. likely the best paths are:
96+
# /etc/${project}/${prog}.conf.d/*.conf
97+
# /etc/${project}/${project}.conf.d/*.conf
98+
# the first would be best for per service separation but since each
99+
# service is in its own pod they won't overlap. further more there
100+
# is an issue with that see https://bugs.launchpad.net/oslo.config/+bug/2098514
101+
# so we'll use the bottom one
102+
glance_api:
103+
glance_api:
104+
volumeMounts:
105+
- mountPath: /etc/glance/glance.conf.d/db_conn.conf
106+
name: glance-db-conn
107+
subPath: db_conf.conf
108+
readOnly: true
109+
volumes:
110+
- name: glance-db-conn
111+
secret:
112+
secretName: glance-db-conn
113+
glance_db_sync:
114+
glance_db_sync:
115+
volumeMounts:
116+
- mountPath: /etc/glance/glance.conf.d/db_conn.conf
117+
name: glance-db-conn
118+
subPath: db_conf.conf
119+
readOnly: true
120+
volumes:
121+
- name: glance-db-conn
122+
secret:
123+
secretName: glance-db-conn
92124

93125
conf:
94126
glance_api_uwsgi:

‎components/horizon/horizon-mariadb-db.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,26 @@ spec:
5050
grantOption: true
5151
host: "%"
5252
retryInterval: 5s
53+
---
54+
apiVersion: k8s.mariadb.com/v1alpha1
55+
kind: Connection
56+
metadata:
57+
name: horizon-db-conn
58+
spec:
59+
mariaDbRef:
60+
name: mariadb
61+
username: horizon
62+
passwordSecretKeyRef:
63+
name: horizon-db-password
64+
key: password
65+
database: horizon
66+
secretName: horizon-db-conn
67+
secretTemplate:
68+
key: db_conn.conf
69+
format: |
70+
[database]
71+
connection = mysql+pymysql://{{ .Username }}:{{ .Password }}@{{ .Host }}:{{ .Port }}/{{ .Database }}{{ .Params }}
72+
healthCheck:
73+
interval: 30s
74+
retryInterval: 3s
75+
serviceName: mariadb

‎components/horizon/values.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,38 @@ pod:
7676
# this should be set to no more than (pod.replicas.horizon - 1)
7777
# usually set on per-deployment basis.
7878
min_available: 0
79+
mounts:
80+
# oslo.config autoloads certain paths in alphabetical order
81+
# which gives us the opportunity to inject secrets and extra
82+
# configs here. likely the best paths are:
83+
# /etc/${project}/${prog}.conf.d/*.conf
84+
# /etc/${project}/${project}.conf.d/*.conf
85+
# the first would be best for per service separation but since each
86+
# service is in its own pod they won't overlap. further more there
87+
# is an issue with that see https://bugs.launchpad.net/oslo.config/+bug/2098514
88+
# so we'll use the bottom one
89+
horizon:
90+
horizon:
91+
volumeMounts:
92+
- mountPath: /etc/horizon/horizon.conf.d/db_conn.conf
93+
name: horizon-db-conn
94+
subPath: db_conf.conf
95+
readOnly: true
96+
volumes:
97+
- name: horizon-db-conn
98+
secret:
99+
secretName: horizon-db-conn
100+
horizon_db_sync:
101+
horizon_db_sync:
102+
volumeMounts:
103+
- mountPath: /etc/horizon/horizon.conf.d/db_conn.conf
104+
name: horizon-db-conn
105+
subPath: db_conf.conf
106+
readOnly: true
107+
volumes:
108+
- name: horizon-db-conn
109+
secret:
110+
secretName: horizon-db-conn
79111

80112
# We don't want to enable OpenStack Helm's
81113
# helm.sh/hooks because they set them as

‎components/ironic/ironic-mariadb-db.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,26 @@ spec:
5050
grantOption: true
5151
host: "%"
5252
retryInterval: 5s
53+
---
54+
apiVersion: k8s.mariadb.com/v1alpha1
55+
kind: Connection
56+
metadata:
57+
name: ironic-db-conn
58+
spec:
59+
mariaDbRef:
60+
name: mariadb
61+
username: ironic
62+
passwordSecretKeyRef:
63+
name: ironic-db-password
64+
key: password
65+
database: ironic
66+
secretName: ironic-db-conn
67+
secretTemplate:
68+
key: db_conn.conf
69+
format: |
70+
[database]
71+
connection = mysql+pymysql://{{ .Username }}:{{ .Password }}@{{ .Host }}:{{ .Port }}/{{ .Database }}{{ .Params }}
72+
healthCheck:
73+
interval: 30s
74+
retryInterval: 3s
75+
serviceName: mariadb

‎components/ironic/values.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,16 +169,54 @@ manifests:
169169

170170
pod:
171171
mounts:
172+
# oslo.config autoloads certain paths in alphabetical order
173+
# which gives us the opportunity to inject secrets and extra
174+
# configs here. likely the best paths are:
175+
# /etc/${project}/${prog}.conf.d/*.conf
176+
# /etc/${project}/${project}.conf.d/*.conf
177+
# the first would be best for per service separation but since each
178+
# service is in its own pod they won't overlap. further more there
179+
# is an issue with that see https://bugs.launchpad.net/oslo.config/+bug/2098514
180+
# so we'll use the bottom one
181+
ironic_api:
182+
ironic_api:
183+
volumeMounts:
184+
- mountPath: /etc/ironic/ironic.conf.d/db_conn.conf
185+
name: ironic-db-conn
186+
subPath: db_conf.conf
187+
readOnly: true
188+
volumes:
189+
- name: ironic-db-conn
190+
secret:
191+
secretName: ironic-db-conn
192+
ironic_db_sync:
193+
ironic_db_sync:
194+
volumeMounts:
195+
- mountPath: /etc/ironic/ironic.conf.d/db_conn.conf
196+
name: ironic-db-conn
197+
subPath: db_conf.conf
198+
readOnly: true
199+
volumes:
200+
- name: ironic-db-conn
201+
secret:
202+
secretName: ironic-db-conn
172203
ironic_conductor:
173204
ironic_conductor:
174205
volumeMounts:
206+
- mountPath: /etc/ironic/ironic.conf.d/db_conn.conf
207+
name: ironic-db-conn
208+
subPath: db_conf.conf
209+
readOnly: true
175210
- name: dnsmasq-ironic
176211
mountPath: /etc/dnsmasq.d/
177212
- name: dnsmasq-dhcp
178213
mountPath: /var/lib/dnsmasq/
179214
- name: understack-data
180215
mountPath: /var/lib/understack
181216
volumes:
217+
- name: ironic-db-conn
218+
secret:
219+
secretName: ironic-db-conn
182220
- name: dnsmasq-ironic
183221
persistentVolumeClaim:
184222
claimName: dnsmasq-ironic

‎components/keystone/keystone-mariadb-db.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,26 @@ spec:
5050
grantOption: true
5151
host: "%"
5252
retryInterval: 5s
53+
---
54+
apiVersion: k8s.mariadb.com/v1alpha1
55+
kind: Connection
56+
metadata:
57+
name: keystone-db-conn
58+
spec:
59+
mariaDbRef:
60+
name: mariadb
61+
username: keystone
62+
passwordSecretKeyRef:
63+
name: keystone-db-password
64+
key: password
65+
database: keystone
66+
secretName: keystone-db-conn
67+
secretTemplate:
68+
key: db_conn.conf
69+
format: |
70+
[database]
71+
connection = mysql+pymysql://{{ .Username }}:{{ .Password }}@{{ .Host }}:{{ .Port }}/{{ .Database }}{{ .Params }}
72+
healthCheck:
73+
interval: 30s
74+
retryInterval: 3s
75+
serviceName: mariadb

‎components/keystone/values.yaml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -225,19 +225,103 @@ pod:
225225
keystone_api:
226226
keystone_api:
227227
volumeMounts:
228+
- mountPath: /etc/keystone/keystone.conf.d/db_conn.conf
229+
name: keystone-db-conn
230+
subPath: db_conf.conf
231+
readOnly: true
228232
- name: keystone-sso
229233
mountPath: /etc/keystone-sso
230234
readOnly: true
231235
- name: oidc-secret
232236
mountPath: /etc/oidc-secret
233237
readOnly: true
234238
volumes:
239+
- name: keystone-db-conn
240+
secret:
241+
secretName: keystone-db-conn
235242
- name: keystone-sso
236243
secret:
237244
secretName: keystone-sso
238245
- name: oidc-secret
239246
secret:
240247
secretName: sso-passphrase
248+
keystone_db_sync:
249+
keystone_db_sync:
250+
volumeMounts:
251+
- mountPath: /etc/keystone/keystone.conf.d/db_conn.conf
252+
name: keystone-db-conn
253+
subPath: db_conf.conf
254+
readOnly: true
255+
volumes:
256+
- name: keystone-db-conn
257+
secret:
258+
secretName: keystone-db-conn
259+
keystone_credential_setup:
260+
keystone_credential_setup:
261+
volumeMounts:
262+
- mountPath: /etc/keystone/keystone.conf.d/db_conn.conf
263+
name: keystone-db-conn
264+
subPath: db_conf.conf
265+
readOnly: true
266+
volumes:
267+
- name: keystone-db-conn
268+
secret:
269+
secretName: keystone-db-conn
270+
keystone_fernet_setup:
271+
keystone_fernet_setup:
272+
volumeMounts:
273+
- mountPath: /etc/keystone/keystone.conf.d/db_conn.conf
274+
name: keystone-db-conn
275+
subPath: db_conf.conf
276+
readOnly: true
277+
volumes:
278+
- name: keystone-db-conn
279+
secret:
280+
secretName: keystone-db-conn
281+
keystone_credential_rotate:
282+
keystone_credential_rotate:
283+
volumeMounts:
284+
- mountPath: /etc/keystone/keystone.conf.d/db_conn.conf
285+
name: keystone-db-conn
286+
subPath: db_conf.conf
287+
readOnly: true
288+
volumes:
289+
- name: keystone-db-conn
290+
secret:
291+
secretName: keystone-db-conn
292+
keystone_fernet_rotate:
293+
keystone_fernet_rotate:
294+
volumeMounts:
295+
- mountPath: /etc/keystone/keystone.conf.d/db_conn.conf
296+
name: keystone-db-conn
297+
subPath: db_conf.conf
298+
readOnly: true
299+
volumes:
300+
- name: keystone-db-conn
301+
secret:
302+
secretName: keystone-db-conn
303+
keystone_credential_cleanup:
304+
keystone_credential_cleanup:
305+
volumeMounts:
306+
- mountPath: /etc/keystone/keystone.conf.d/db_conn.conf
307+
name: keystone-db-conn
308+
subPath: db_conf.conf
309+
readOnly: true
310+
volumes:
311+
- name: keystone-db-conn
312+
secret:
313+
secretName: keystone-db-conn
314+
keystone_domain_manage:
315+
keystone_domain_manage:
316+
volumeMounts:
317+
- mountPath: /etc/keystone/keystone.conf.d/db_conn.conf
318+
name: keystone-db-conn
319+
subPath: db_conf.conf
320+
readOnly: true
321+
volumes:
322+
- name: keystone-db-conn
323+
secret:
324+
secretName: keystone-db-conn
241325
replicas:
242326
api: 2
243327
lifecycle:

‎components/neutron/neutron-mariadb-db.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,26 @@ spec:
5050
grantOption: true
5151
host: "%"
5252
retryInterval: 5s
53+
---
54+
apiVersion: k8s.mariadb.com/v1alpha1
55+
kind: Connection
56+
metadata:
57+
name: neutron-db-conn
58+
spec:
59+
mariaDbRef:
60+
name: mariadb
61+
username: neutron
62+
passwordSecretKeyRef:
63+
name: neutron-db-password
64+
key: password
65+
database: neutron
66+
secretName: neutron-db-conn
67+
secretTemplate:
68+
key: db_conn.conf
69+
format: |
70+
[database]
71+
connection = mysql+pymysql://{{ .Username }}:{{ .Password }}@{{ .Host }}:{{ .Port }}/{{ .Database }}{{ .Params }}
72+
healthCheck:
73+
interval: 30s
74+
retryInterval: 3s
75+
serviceName: mariadb

0 commit comments

Comments
 (0)