feat: Add support to provide custom CAs in KEDA Operator

CHANGELOG.md

@@ -49,6 +49,7 @@ To learn more about active deprecations, we recommend checking [GitHub Discussio
 
 Here is an overview of all **stable** additions:
 
+- **General**: Add support to register custom CAs globally in KEDA operator ([#4168](https://github.com/kedacore/keda/issues/4168))
 - **General**: Introduce admission webhooks to automatically validate resource changes to prevent misconfiguration and enforce best practices ([#3755](https://github.com/kedacore/keda/issues/3755))
 - **General**: Introduce new ArangoDB Scaler ([#4000](https://github.com/kedacore/keda/issues/4000))
 - **Prometheus Metrics**: Introduce scaler activity in Prometheus metrics ([#4114](https://github.com/kedacore/keda/issues/4114))

Makefile

@@ -236,13 +236,13 @@ set-version:
 
 ##@ Deployment
 
-install: manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
+install: kustomize manifests kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
 	$(KUSTOMIZE) build config/crd | kubectl apply -f -
 
-uninstall: manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config.
+uninstall: kustomize manifests kustomize ## Uninstall CRDs from the K8s cluster specified in ~/.kube/config.
 	$(KUSTOMIZE) build config/crd | kubectl delete -f -
 
-deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
+deploy: kustomize manifests kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
 	cd config/manager && \
 	$(KUSTOMIZE) edit set image ghcr.io/kedacore/keda=${IMAGE_CONTROLLER} && \
 	if [ "$(AZURE_RUN_AAD_POD_IDENTITY_TESTS)" = true ]; then \
@@ -274,10 +274,10 @@ deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in
 	# until this issue is solved: https://github.com/kubernetes-sigs/kustomize/issues/1009
 	@sed -i".out" -e 's@version:[ ].*@version: $(VERSION)@g' config/default/kustomize-config/metadataLabelTransformer.yaml
 	rm -rf config/default/kustomize-config/metadataLabelTransformer.yaml.out
-	$(KUSTOMIZE) build config/default | kubectl apply -f -
+	$(KUSTOMIZE) build config/e2e | kubectl apply -f -
 
-undeploy: e2e-test-clean-crds ## Undeploy controller from the K8s cluster specified in ~/.kube/config.
-	$(KUSTOMIZE) build config/default | kubectl delete -f -
+undeploy: kustomize e2e-test-clean-crds ## Undeploy controller from the K8s cluster specified in ~/.kube/config.
+	$(KUSTOMIZE) build config/e2e | kubectl delete -f -
 
 ## Location to install dependencies to
 LOCALBIN ?= $(shell pwd)/bin

config/e2e/create_cas_volume.yml

@@ -0,0 +1,15 @@
+- op: add
+  path: /spec/template/spec/containers/0/volumeMounts/1
+  value:
+    name: custom-cas
+    mountPath: /custom/ca
+    readOnly: true
+
+- op: add
+  path: /spec/template/spec/volumes/1
+  value:
+    name: custom-cas
+    secret:
+      defaultMode: 420
+      secretName: custom-cas
+      optional: true

config/e2e/kustomization.yaml

@@ -0,0 +1,10 @@
+patchesJson6902:
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+    name: keda-operator
+  path: create_cas_volume.yml
+
+bases:
+- ../default

pkg/scalers/arangodb_scaler.go

@@ -2,7 +2,6 @@ package scalers
 
 import (
 	"context"
-	"crypto/tls"
 	"fmt"
 	"strconv"
 	"strings"
@@ -15,6 +14,7 @@ import (
 	"k8s.io/metrics/pkg/apis/external_metrics"
 
 	"github.com/kedacore/keda/v2/pkg/scalers/authentication"
+	"github.com/kedacore/keda/v2/pkg/util"
 )
 
 type arangoDBScaler struct {
@@ -97,10 +97,7 @@ func getNewArangoDBClient(meta *arangoDBMetadata) (driver.Client, error) {
 
 	conn, err := http.NewConnection(http.ConnectionConfig{
 		Endpoints: strings.Split(meta.endpoints, ","),
-		TLSConfig: &tls.Config{
-			MinVersion:         tls.VersionTLS13,
-			InsecureSkipVerify: meta.unsafeSsl,
-		},
+		TLSConfig: util.CreateTLSClientConfig(meta.unsafeSsl),
 	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to create a new http connection, %w", err)

pkg/scalers/authentication/authentication_helpers.go

@@ -85,21 +85,20 @@ func GetBearerToken(auth *AuthMeta) string {
 	return fmt.Sprintf("Bearer %s", auth.BearerToken)
 }
 
-func NewTLSConfig(auth *AuthMeta) (*tls.Config, error) {
+func NewTLSConfig(auth *AuthMeta, unsafeSsl bool) (*tls.Config, error) {
 	return kedautil.NewTLSConfig(
 		auth.Cert,
 		auth.Key,
 		auth.CA,
+		unsafeSsl,
 	)
 }
 
 func CreateHTTPRoundTripper(roundTripperType TransportType, auth *AuthMeta, conf ...*HTTPTransport) (rt http.RoundTripper, err error) {
-	tlsConfig := &tls.Config{
-		MinVersion:         kedautil.GetMinTLSVersion(),
-		InsecureSkipVerify: false,
-	}
+	unsafeSsl := false
+	tlsConfig := kedautil.CreateTLSClientConfig(unsafeSsl)
 	if auth != nil && (auth.CA != "" || auth.EnableTLS) {
-		tlsConfig, err = NewTLSConfig(auth)
+		tlsConfig, err = NewTLSConfig(auth, unsafeSsl)
 		if err != nil || tlsConfig == nil {
 			return nil, fmt.Errorf("error creating the TLS config: %w", err)
 		}

pkg/scalers/elasticsearch_scaler.go

@@ -3,12 +3,10 @@ package scalers
 import (
 	"bytes"
 	"context"
-	"crypto/tls"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
-	"net/http"
 	"strconv"
 	"strings"
 
@@ -18,7 +16,7 @@ import (
 	v2 "k8s.io/api/autoscaling/v2"
 	"k8s.io/metrics/pkg/apis/external_metrics"
 
-	kedautil "github.com/kedacore/keda/v2/pkg/util"
+	"github.com/kedacore/keda/v2/pkg/util"
 )
 
 type elasticsearchScaler struct {
@@ -218,7 +216,7 @@ func parseElasticsearchMetadata(config *ScalerConfig) (*elasticsearchMetadata, e
 		meta.activationTargetValue = activationTargetValue
 	}
 
-	meta.metricName = GenerateMetricNameWithIndex(config.ScalerIndex, kedautil.NormalizeString(fmt.Sprintf("elasticsearch-%s", meta.searchTemplateName)))
+	meta.metricName = GenerateMetricNameWithIndex(config.ScalerIndex, util.NormalizeString(fmt.Sprintf("elasticsearch-%s", meta.searchTemplateName)))
 	return &meta, nil
 }
 
@@ -243,13 +241,7 @@ func newElasticsearchClient(meta *elasticsearchMetadata, logger logr.Logger) (*e
 		}
 	}
 
-	transport := http.DefaultTransport.(*http.Transport)
-	transport.TLSClientConfig = &tls.Config{
-		MinVersion:         kedautil.GetMinTLSVersion(),
-		InsecureSkipVerify: meta.unsafeSsl,
-	}
-	config.Transport = transport
-
+	config.Transport = util.CreateHTTPTransport(meta.unsafeSsl)
 	esClient, err := elasticsearch.NewClient(config)
 	if err != nil {
 		logger.Error(err, fmt.Sprintf("Found error when creating client: %s", err))

pkg/scalers/etcd_scaler.go

@@ -154,7 +154,7 @@ func getEtcdClients(metadata *etcdMetadata) (*clientv3.Client, error) {
 	var tlsConfig *tls.Config
 	var err error
 	if metadata.enableTLS {
-		tlsConfig, err = kedautil.NewTLSConfigWithPassword(metadata.cert, metadata.key, metadata.keyPassword, metadata.ca)
+		tlsConfig, err = kedautil.NewTLSConfigWithPassword(metadata.cert, metadata.key, metadata.keyPassword, metadata.ca, false)
 		if err != nil {
 			return nil, err
 		}

pkg/scalers/ibmmq_scaler.go

@@ -3,7 +3,6 @@ package scalers
 import (
 	"bytes"
 	"context"
-	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -178,14 +177,7 @@ func (s *IBMMQScaler) getQueueDepthViaHTTP(ctx context.Context) (int64, error) {
 	req.Header.Set("Content-Type", "application/json")
 	req.SetBasicAuth(s.metadata.username, s.metadata.password)
 
-	tr := &http.Transport{
-		TLSClientConfig: &tls.Config{
-			MinVersion:         kedautil.GetMinTLSVersion(),
-			InsecureSkipVerify: s.metadata.tlsDisabled,
-		},
-	}
-	client := kedautil.CreateHTTPClient(s.defaultHTTPTimeout, false)
-	client.Transport = tr
+	client := kedautil.CreateHTTPClient(s.defaultHTTPTimeout, s.metadata.tlsDisabled)
 
 	resp, err := client.Do(req)
 	if err != nil {

pkg/scalers/influxdb_scaler.go

@@ -2,7 +2,6 @@ package scalers
 
 import (
 	"context"
-	"crypto/tls"
 	"fmt"
 	"strconv"
 
@@ -12,7 +11,7 @@ import (
 	v2 "k8s.io/api/autoscaling/v2"
 	"k8s.io/metrics/pkg/apis/external_metrics"
 
-	kedautil "github.com/kedacore/keda/v2/pkg/util"
+	"github.com/kedacore/keda/v2/pkg/util"
 )
 
 type influxDBScaler struct {
@@ -52,10 +51,7 @@ func NewInfluxDBScaler(config *ScalerConfig) (Scaler, error) {
 	client := influxdb2.NewClientWithOptions(
 		meta.serverURL,
 		meta.authToken,
-		influxdb2.DefaultOptions().SetTLSConfig(&tls.Config{
-			MinVersion:         kedautil.GetMinTLSVersion(),
-			InsecureSkipVerify: meta.unsafeSsl,
-		}))
+		influxdb2.DefaultOptions().SetTLSConfig(util.CreateTLSClientConfig(meta.unsafeSsl)))
 
 	return &influxDBScaler{
 		client:     client,
@@ -123,9 +119,9 @@ func parseInfluxDBMetadata(config *ScalerConfig) (*influxDBMetadata, error) {
 	}
 
 	if val, ok := config.TriggerMetadata["metricName"]; ok {
-		metricName = kedautil.NormalizeString(fmt.Sprintf("influxdb-%s", val))
+		metricName = util.NormalizeString(fmt.Sprintf("influxdb-%s", val))
 	} else {
-		metricName = kedautil.NormalizeString(fmt.Sprintf("influxdb-%s", organizationName))
+		metricName = util.NormalizeString(fmt.Sprintf("influxdb-%s", organizationName))
 	}
 
 	if val, ok := config.TriggerMetadata["activationThresholdValue"]; ok {

pkg/scalers/kafka_scaler.go

@@ -318,7 +318,7 @@ func getKafkaClients(metadata kafkaMetadata) (sarama.Client, sarama.ClusterAdmin
 
 	if metadata.enableTLS {
 		config.Net.TLS.Enable = true
-		tlsConfig, err := kedautil.NewTLSConfigWithPassword(metadata.cert, metadata.key, metadata.keyPassword, metadata.ca)
+		tlsConfig, err := kedautil.NewTLSConfigWithPassword(metadata.cert, metadata.key, metadata.keyPassword, metadata.ca, false)
 		if err != nil {
 			return nil, nil, err
 		}

pkg/scalers/metrics_api_scaler.go

@@ -79,11 +79,11 @@ func NewMetricsAPIScaler(config *ScalerConfig) (Scaler, error) {
 	httpClient := kedautil.CreateHTTPClient(config.GlobalHTTPTimeout, meta.unsafeSsl)
 
 	if meta.enableTLS || len(meta.ca) > 0 {
-		config, err := kedautil.NewTLSConfig(meta.cert, meta.key, meta.ca)
+		config, err := kedautil.NewTLSConfig(meta.cert, meta.key, meta.ca, meta.unsafeSsl)
 		if err != nil {
 			return nil, err
 		}
-		httpClient.Transport = &http.Transport{TLSClientConfig: config}
+		httpClient.Transport = kedautil.CreateHTTPTransportWithTLSConfig(config)
 	}
 
 	return &metricsAPIScaler{

pkg/scalers/pulsar_scaler.go

@@ -104,11 +104,11 @@ func NewPulsarScaler(config *ScalerConfig) (Scaler, error) {
 
 	if pulsarMetadata.pulsarAuth != nil {
 		if pulsarMetadata.pulsarAuth.CA != "" || pulsarMetadata.pulsarAuth.EnableTLS {
-			config, err := authentication.NewTLSConfig(pulsarMetadata.pulsarAuth)
+			config, err := authentication.NewTLSConfig(pulsarMetadata.pulsarAuth, false)
 			if err != nil {
 				return nil, err
 			}
-			client.Transport = &http.Transport{TLSClientConfig: config}
+			client.Transport = kedautil.CreateHTTPTransportWithTLSConfig(config)
 		}
 
 		if pulsarMetadata.pulsarAuth.EnableBearerAuth || pulsarMetadata.pulsarAuth.EnableBasicAuth {

pkg/scalers/rabbitmq_scaler.go

@@ -394,7 +394,7 @@ func getConnectionAndChannel(host string, meta *rabbitMQMetadata) (*amqp.Connect
 	var conn *amqp.Connection
 	var err error
 	if meta.enableTLS {
-		tlsConfig, configErr := kedautil.NewTLSConfigWithPassword(meta.cert, meta.key, meta.keyPassword, meta.ca)
+		tlsConfig, configErr := kedautil.NewTLSConfigWithPassword(meta.cert, meta.key, meta.keyPassword, meta.ca, false)
 		if configErr == nil {
 			conn, err = amqp.DialTLS(host, tlsConfig)
 		}