Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add TLS support #23

Closed
wants to merge 2 commits into from
Closed

Add TLS support #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
58731ed
Add TLS support
olliewalsh Jul 1, 2022
a1c76ba
Enable mTLS
olliewalsh May 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions api/bases/mariadb.openstack.org_mariadbs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,18 @@ spec:
type: string
storageRequest:
type: string
tls:
description: TLSSpec defines the TLS options
properties:
caSecretName:
description: Secret in the same namespace containing the CA cert
(ca.crt) for client certificate validation
type: string
secretName:
description: Secret in the same namespace containing the server
private key (tls.key) and public cert (tls.crt) for TLS
type: string
type: object
required:
- containerImage
type: object
Expand Down
10 changes: 10 additions & 0 deletions api/v1beta1/mariadb_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,14 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

// TLSSpec defines the TLS options
type TLSSpec struct {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure how static this is. is this a generic type we want to add to lib-common as its used by all operators?

// Secret in the same namespace containing the server private key (tls.key) and public cert (tls.crt) for TLS
SecretName string `json:"secretName,omitempty"`
// Secret in the same namespace containing the CA cert (ca.crt) for client certificate validation
CaSecretName string `json:"caSecretName,omitempty"`
}

// MariaDBSpec defines the desired state of MariaDB
type MariaDBSpec struct {
// Secret containing a RootPassword
Expand All @@ -34,6 +42,8 @@ type MariaDBSpec struct {
ContainerImage string `json:"containerImage"`

AdoptionRedirect AdoptionRedirectSpec `json:"adoptionRedirect,omitempty"`

TLS TLSSpec `json:"tls,omitempty"`
}

// AdoptionRedirectSpec defines redirection to a different DB instance during Adoption
Expand Down
16 changes: 16 additions & 0 deletions api/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 12 additions & 0 deletions config/crd/bases/mariadb.openstack.org_mariadbs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,18 @@ spec:
type: string
storageRequest:
type: string
tls:
description: TLSSpec defines the TLS options
properties:
caSecretName:
description: Secret in the same namespace containing the CA cert
(ca.crt) for client certificate validation
type: string
secretName:
description: Secret in the same namespace containing the server
private key (tls.key) and public cert (tls.crt) for TLS
type: string
type: object
required:
- containerImage
type: object
Expand Down
13 changes: 13 additions & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ rules:
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
Expand All @@ -112,6 +113,18 @@ rules:
- pods/exec
verbs:
- create
- apiGroups:
- ""
resources:
- secrets
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
Expand Down
110 changes: 106 additions & 4 deletions controllers/mariadb_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,15 @@ import (
rbacv1 "k8s.io/api/rbac/v1"
k8s_errors "k8s.io/apimachinery/pkg/api/errors"
"k8s.io/apimachinery/pkg/api/resource"
k8s_labels "k8s.io/apimachinery/pkg/labels"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/types"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
"sigs.k8s.io/controller-runtime/pkg/handler"
"sigs.k8s.io/controller-runtime/pkg/reconcile"
"sigs.k8s.io/controller-runtime/pkg/source"

condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
configmap "github.com/openstack-k8s-operators/lib-common/modules/common/configmap"
Expand All @@ -38,12 +43,15 @@ import (
job "github.com/openstack-k8s-operators/lib-common/modules/common/job"
labels "github.com/openstack-k8s-operators/lib-common/modules/common/labels"
common_rbac "github.com/openstack-k8s-operators/lib-common/modules/common/rbac"
secret "github.com/openstack-k8s-operators/lib-common/modules/common/secret"
util "github.com/openstack-k8s-operators/lib-common/modules/common/util"
databasev1beta1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
mariadb "github.com/openstack-k8s-operators/mariadb-operator/pkg"
"k8s.io/client-go/kubernetes"
)

const mariaDBReconcileLabel = "mariadb-ref"

// MariaDBReconciler reconciles a MariaDB object
type MariaDBReconciler struct {
Client client.Client
Expand All @@ -55,17 +63,19 @@ type MariaDBReconciler struct {
// +kubebuilder:rbac:groups=mariadb.openstack.org,resources=mariadbs,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=mariadb.openstack.org,resources=mariadbs/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=mariadb.openstack.org,resources=mariadbs/finalizers,verbs=update
// +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;delete;
// +kubebuilder:rbac:groups=core,resources=services,verbs=get;list;watch;create;update;patch;delete;
// +kubebuilder:rbac:groups=core,resources=endpoints,verbs=get;list;watch;create;update;delete;
// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;delete;
// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete;
// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;create;update;patch;delete;
// +kubebuilder:rbac:groups=core,resources=persistentvolumeclaims,verbs=get;list;watch;create;update;delete;
// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;delete;
// +kubebuilder:rbac:groups=core,resources=persistentvolumeclaims,verbs=get;list;watch;create;update;patch;delete;
// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete;
// +kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list;watch;create;update;patch;delete;
// +kubebuilder:rbac:groups="",resources=serviceaccounts,verbs=get;list;watch;create;update
// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=roles,verbs=get;list;watch;create;update
// +kubebuilder:rbac:groups="rbac.authorization.k8s.io",resources=rolebindings,verbs=get;list;watch;create;update
// +kubebuilder:rbac:groups="security.openshift.io",resourceNames=anyuid,resources=securitycontextconstraints,verbs=use
// +kubebuilder:rbac:groups="",resources=pods,verbs=create;delete;get;list;patch;update;watch
// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete;

// Reconcile reconcile mariadb API requests
func (r *MariaDBReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
Expand Down Expand Up @@ -250,7 +260,72 @@ func (r *MariaDBReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
err.Error()))
return ctrl.Result{}, fmt.Errorf("error calculating configmap hash: %w", err)
}

//
// check for TLS secrets
//
if instance.Spec.TLS.SecretName != "" {
tlsSecret, tlsHash, err := secret.GetSecret(ctx, h, instance.Spec.TLS.SecretName, instance.Namespace)
if err != nil {
if k8s_errors.IsNotFound(err) {
return ctrl.Result{RequeueAfter: time.Second * 10}, fmt.Errorf("TLS secret %s not found", instance.Spec.TLS.SecretName)
}
return ctrl.Result{}, err
}

if value, ok := tlsSecret.Labels[mariaDBReconcileLabel]; !ok || value != instance.Name {
tlsSecret.GetObjectMeta().SetLabels(
k8s_labels.Merge(
tlsSecret.GetObjectMeta().GetLabels(),
map[string]string{
mariaDBReconcileLabel: instance.Name,
},
),
)
err = r.Client.Update(ctx, tlsSecret)
if err != nil {
if k8s_errors.IsConflict(err) || k8s_errors.IsNotFound(err) {
return ctrl.Result{Requeue: true}, err
}
return ctrl.Result{}, err
}
}

configMapVars[tlsSecret.Name] = env.SetValue(tlsHash)
}

if instance.Spec.TLS.CaSecretName != "" {
caSecret, caHash, err := secret.GetSecret(ctx, h, instance.Spec.TLS.CaSecretName, instance.Namespace)
if err != nil {
if k8s_errors.IsNotFound(err) {
return ctrl.Result{RequeueAfter: time.Second * 10}, fmt.Errorf("TLS CA secret %s not found", instance.Spec.TLS.CaSecretName)
}
return ctrl.Result{}, err
}

if value, ok := caSecret.Labels[mariaDBReconcileLabel]; !ok || value != instance.Name {
caSecret.GetObjectMeta().SetLabels(
k8s_labels.Merge(
caSecret.GetObjectMeta().GetLabels(),
map[string]string{
mariaDBReconcileLabel: instance.Name,
},
),
)
err = r.Client.Update(ctx, caSecret)
if err != nil {
if k8s_errors.IsConflict(err) || k8s_errors.IsNotFound(err) {
return ctrl.Result{Requeue: true}, err
}
return ctrl.Result{}, err
}
}

configMapVars[caSecret.Name] = env.SetValue(caHash)
}

mergedMapVars := env.MergeEnvs([]corev1.EnvVar{}, configMapVars)

configHash := ""
for _, hashEnv := range mergedMapVars {
configHash = configHash + hashEnv.Value
Expand Down Expand Up @@ -305,6 +380,16 @@ func (r *MariaDBReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct

op, err = controllerutil.CreateOrPatch(ctx, r.Client, pod, func() error {
pod.Spec.Containers[0].Image = instance.Spec.ContainerImage
pod.Spec.Containers[0].Env = []corev1.EnvVar{
{
Name: "KOLLA_CONFIG_STRATEGY",
Value: "COPY_ALWAYS",
},
{
Name: "CONFIG_HASH",
Value: configHash,
},
}
err := controllerutil.SetControllerReference(instance, pod, r.Scheme)
if err != nil {
return err
Expand Down Expand Up @@ -386,5 +471,22 @@ func (r *MariaDBReconciler) SetupWithManager(mgr ctrl.Manager) error {
Owns(&corev1.ConfigMap{}).
Owns(&corev1.PersistentVolumeClaim{}).
Owns(&corev1.Pod{}).
Watches(&source.Kind{Type: &corev1.Secret{}}, handler.EnqueueRequestsFromMapFunc(
func(o client.Object) []reconcile.Request {
labels := o.GetLabels()

reconcileCR, hasLabel := labels[mariaDBReconcileLabel]
if !hasLabel {
return []reconcile.Request{}
}

return []reconcile.Request{
{NamespacedName: types.NamespacedName{
Name: reconcileCR,
Namespace: o.GetNamespace(),
}},
}
},
)).
Complete(r)
}
4 changes: 2 additions & 2 deletions pkg/dbinit.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,10 +50,10 @@ func DbInitJob(db *databasev1beta1.MariaDB) *batchv1.Job {
},
},
},
VolumeMounts: getInitVolumeMounts(),
VolumeMounts: getInitVolumeMounts(db),
},
},
Volumes: getVolumes(db.Name),
Volumes: getVolumes(db),
},
},
},
Expand Down
4 changes: 2 additions & 2 deletions pkg/pod.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,10 +31,10 @@ func Pod(db *databasev1beta1.MariaDB, configHash string) *corev1.Pod {
Value: configHash,
},
},
VolumeMounts: getVolumeMounts(),
VolumeMounts: getVolumeMounts(db),
},
},
Volumes: getVolumes(db.Name),
Volumes: getVolumes(db),
},
}
return pod
Expand Down
Loading