Skip to content

Commit c3f7de5

Browse files
nikitkanikitka
authored
append secrets and volumes from storage spec to init-job volumes (#282)
* apend secrets and volumes from storage spec to init-job volumes * wip * rename grpcTLSVolumeName to GRPCTLSVolumeName * remove one test * add changie * fix test
1 parent 3a1af22 commit c3f7de5

File tree

6 files changed

+78
-12
lines changed

6 files changed

+78
-12
lines changed

‎.changes/unreleased/Fixed-20250129-134226.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
kind: Fixed
2+
body: Passing additional secret volumes to blobstorage-init. The init container can now use them without issues.
3+
time: 2025-01-29T13:42:26.145577+01:00

‎internal/resources/database_statefulset.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ func (b *DatabaseStatefulSetBuilder) buildVolumes() []corev1.Volume {
192192
}
193193

194194
if b.Spec.Service.GRPC.TLSConfiguration.Enabled {
195-
volumes = append(volumes, buildTLSVolume(grpcTLSVolumeName, b.Spec.Service.GRPC.TLSConfiguration))
195+
volumes = append(volumes, buildTLSVolume(GRPCTLSVolumeName, b.Spec.Service.GRPC.TLSConfiguration))
196196
}
197197

198198
if b.Spec.Service.Interconnect.TLSConfiguration.Enabled {
@@ -314,7 +314,7 @@ func (b *DatabaseStatefulSetBuilder) buildCaStorePatchingInitContainerVolumeMoun
314314

315315
if b.Spec.Service.GRPC.TLSConfiguration.Enabled {
316316
volumeMounts = append(volumeMounts, corev1.VolumeMount{
317-
Name: grpcTLSVolumeName,
317+
Name: GRPCTLSVolumeName,
318318
ReadOnly: true,
319319
MountPath: grpcTLSVolumeMountPath,
320320
})
@@ -482,7 +482,7 @@ func (b *DatabaseStatefulSetBuilder) buildVolumeMounts() []corev1.VolumeMount {
482482

483483
if b.Spec.Service.GRPC.TLSConfiguration.Enabled {
484484
volumeMounts = append(volumeMounts, corev1.VolumeMount{
485-
Name: grpcTLSVolumeName,
485+
Name: GRPCTLSVolumeName,
486486
ReadOnly: true,
487487
MountPath: grpcTLSVolumeMountPath,
488488
})

‎internal/resources/resource.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ const (
3535
StatusServiceNameFormat = "%s-status"
3636
DatastreamsServiceNameFormat = "%s-datastreams"
3737

38-
grpcTLSVolumeName = "grpc-tls-volume"
38+
GRPCTLSVolumeName = "grpc-tls-volume"
3939
interconnectTLSVolumeName = "interconnect-tls-volume"
4040
datastreamsTLSVolumeName = "datastreams-tls-volume"
4141
statusTLSVolumeName = "status-tls-volume"

‎internal/resources/storage_init_job.go‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ func (b *StorageInitJobBuilder) buildInitJobPodTemplateSpec() corev1.PodTemplate
7575
DNSConfig: &corev1.PodDNSConfig{
7676
Searches: dnsConfigSearches,
7777
},
78+
InitContainers: b.Spec.InitContainers,
7879
},
7980
}
8081

@@ -92,8 +93,7 @@ func (b *StorageInitJobBuilder) buildInitJobPodTemplateSpec() corev1.PodTemplate
9293
}
9394
}
9495

95-
// InitContainer only needed for CaBundle manipulation for now,
96-
// may be probably used for other stuff later
96+
// append an init container for updating the ca.crt if we have any certificates
9797
if b.AnyCertificatesAdded() {
9898
podTemplate.Spec.InitContainers = append(
9999
[]corev1.Container{b.buildCaStorePatchingInitContainer()},
@@ -137,7 +137,7 @@ func (b *StorageInitJobBuilder) buildInitJobVolumes() []corev1.Volume {
137137
}
138138

139139
if b.Spec.Service.GRPC.TLSConfiguration.Enabled {
140-
volumes = append(volumes, buildTLSVolume(grpcTLSVolumeName, b.Spec.Service.GRPC.TLSConfiguration))
140+
volumes = append(volumes, buildTLSVolume(GRPCTLSVolumeName, b.Spec.Service.GRPC.TLSConfiguration))
141141
}
142142

143143
if b.Spec.OperatorConnection != nil {
@@ -153,6 +153,21 @@ func (b *StorageInitJobBuilder) buildInitJobVolumes() []corev1.Volume {
153153
})
154154
}
155155

156+
for _, secret := range b.Spec.Secrets {
157+
volumes = append(volumes, corev1.Volume{
158+
Name: secret.Name,
159+
VolumeSource: corev1.VolumeSource{
160+
Secret: &corev1.SecretVolumeSource{
161+
SecretName: secret.Name,
162+
},
163+
},
164+
})
165+
}
166+
167+
for _, volume := range b.Spec.Volumes {
168+
volumes = append(volumes, *volume)
169+
}
170+
156171
if b.AnyCertificatesAdded() {
157172
volumes = append(volumes, corev1.Volume{
158173
Name: systemCertsVolumeName,
@@ -219,7 +234,7 @@ func (b *StorageInitJobBuilder) buildJobVolumeMounts() []corev1.VolumeMount {
219234

220235
if b.Spec.Service.GRPC.TLSConfiguration.Enabled {
221236
volumeMounts = append(volumeMounts, corev1.VolumeMount{
222-
Name: grpcTLSVolumeName,
237+
Name: GRPCTLSVolumeName,
223238
ReadOnly: true,
224239
MountPath: grpcTLSVolumeMountPath,
225240
})
@@ -302,7 +317,7 @@ func (b *StorageInitJobBuilder) buildCaStorePatchingInitContainerVolumeMounts()
302317

303318
if b.Spec.Service.GRPC.TLSConfiguration.Enabled {
304319
volumeMounts = append(volumeMounts, corev1.VolumeMount{
305-
Name: grpcTLSVolumeName,
320+
Name: GRPCTLSVolumeName,
306321
ReadOnly: true,
307322
MountPath: grpcTLSVolumeMountPath,
308323
})

‎internal/resources/storage_statefulset.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,7 @@ func (b *StorageStatefulSetBuilder) buildVolumes() []corev1.Volume {
216216
}
217217

218218
if b.Spec.Service.GRPC.TLSConfiguration.Enabled {
219-
volumes = append(volumes, buildTLSVolume(grpcTLSVolumeName, b.Spec.Service.GRPC.TLSConfiguration))
219+
volumes = append(volumes, buildTLSVolume(GRPCTLSVolumeName, b.Spec.Service.GRPC.TLSConfiguration))
220220
}
221221

222222
if b.Spec.Service.Interconnect.TLSConfiguration.Enabled {
@@ -326,7 +326,7 @@ func (b *StorageStatefulSetBuilder) buildCaStorePatchingInitContainerVolumeMount
326326

327327
if b.Spec.Service.GRPC.TLSConfiguration.Enabled {
328328
volumeMounts = append(volumeMounts, corev1.VolumeMount{
329-
Name: grpcTLSVolumeName,
329+
Name: GRPCTLSVolumeName,
330330
ReadOnly: true,
331331
MountPath: grpcTLSVolumeMountPath,
332332
})
@@ -438,7 +438,7 @@ func (b *StorageStatefulSetBuilder) buildVolumeMounts() []corev1.VolumeMount {
438438

439439
if b.Spec.Service.GRPC.TLSConfiguration.Enabled {
440440
volumeMounts = append(volumeMounts, corev1.VolumeMount{
441-
Name: grpcTLSVolumeName,
441+
Name: GRPCTLSVolumeName,
442442
ReadOnly: true,
443443
MountPath: grpcTLSVolumeMountPath,
444444
})

‎tests/e2e/smoke_test.go‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -768,6 +768,54 @@ var _ = Describe("Operator smoke test", func() {
768768
ExecuteSimpleTableE2ETestWithSDK(databaseSample.Name, testobjects.YdbNamespace, databasePath)
769769
})
770770

771+
It("Check init job with additional volumes and GRPCS enabled", func() {
772+
By("create stls secrets...")
773+
storageCert := testobjects.StorageCertificate()
774+
775+
secret := storageCert.DeepCopy()
776+
secret.Name = "another-secret"
777+
778+
Expect(k8sClient.Create(ctx, storageCert)).Should(Succeed())
779+
Expect(k8sClient.Create(ctx, secret)).Should(Succeed())
780+
781+
By("create storage...")
782+
storage := testobjects.DefaultStorage(filepath.Join("..", "data", "storage-mirror-3-dc-config-tls.yaml"))
783+
784+
storage.Spec.Service.GRPC.TLSConfiguration = testobjects.TLSConfiguration(
785+
testobjects.StorageCertificateSecretName,
786+
)
787+
788+
storage.Spec.Secrets = []*corev1.LocalObjectReference{
789+
{
790+
Name: secret.Name,
791+
},
792+
}
793+
794+
mountPath := fmt.Sprintf("%s/%s", v1alpha1.AdditionalSecretsDir, secret.Name)
795+
796+
storage.Spec.InitContainers = []corev1.Container{
797+
{
798+
Name: "init-container",
799+
Image: storage.Spec.Image.Name,
800+
Command: []string{"bash", "-xc"},
801+
Args: []string{fmt.Sprintf("ls -la %s", mountPath)},
802+
VolumeMounts: []corev1.VolumeMount{
803+
{
804+
Name: secret.Name,
805+
MountPath: mountPath,
806+
ReadOnly: true,
807+
},
808+
},
809+
},
810+
}
811+
812+
Expect(k8sClient.Create(ctx, storage)).Should(Succeed())
813+
defer DeleteStorageSafely(ctx, k8sClient, storage)
814+
815+
By("waiting until Storage is ready ...")
816+
WaitUntilStorageReady(ctx, k8sClient, storage.Name, testobjects.YdbNamespace)
817+
})
818+
771819
AfterEach(func() {
772820
UninstallOperatorWithHelm(testobjects.YdbNamespace)
773821
Expect(k8sClient.Delete(ctx, &namespace)).Should(Succeed())

0 commit comments

Comments
 (0)