[tlse] TLS database connection #383
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: stuggi The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
stuggi
force-pushed
the
tlse_db_status
branch
from
18879ff to
426b7a6
Compare
stuggi
requested review from
olliewalsh,
dciabrin and
Deydra71
and removed request for
lewisdenny and
viroel
|
/test functional |
stuggi
force-pushed
the
tlse_db_status
branch
4 times, most recently
from
5098599 to
cdb8dff
Compare
|
/hold |
The my.cnf file gets added to the secret holding the service configs. The content of my.cnf is centrally managed in the mariadb-operator and retrieved calling db.GetDatabaseClientConfig(tlsCfg) Depends-On: openstack-k8s-operators/mariadb-operator#190 Depends-On: openstack-k8s-operators/mariadb-operator#191 Jira: OSPRH-4547
stuggi
force-pushed
the
tlse_db_status
branch
from
cdb8dff to
9f53adf
Compare
| @@ -1168,12 +1121,18 @@ func (r *KeystoneAPIReconciler) generateServiceConfigMaps( | |||
|
|
|||
| cmLabels := labels.GetLabels(instance, labels.GetGroupLabel(keystone.ServiceName), map[string]string{}) | |||
|
|
|||
| var tlsCfg *tls.Service | |||
| if instance.Spec.TLS.Ca.CaBundleSecretName != "" { | |||
There was a problem hiding this comment.
Is it possible that CaBundleSecretName is set but internal TLS is disabled?
There was a problem hiding this comment.
yes it is possible that the CaBundleSecretName and internal TLS is disabled, the mariadbdatabase is reflecting if tls should be used for the DB connection. https://github.com/openstack-k8s-operators/mariadb-operator/blob/main/controllers/mariadbdatabase_controller.go#L172 . so if CaBundleSecretName is not empty, but the DB does not support TLS, https://github.com/openstack-k8s-operators/mariadb-operator/blob/main/api/v1beta1/mariadbdatabase_funcs.go#L475 does not return a my.cnf to use tls. Does that make sense and answer the question?
|
/lgtm |
openshift-merge-bot
bot
merged commit b1b853e
into
openstack-k8s-operators:main
The my.cnf file gets added to the secret holding the service configs. The content of my.cnf is centrally managed in the mariadb-operator and retrieved calling db.GetDatabaseClientConfig(tlsCfg)
Depends-On: openstack-k8s-operators/mariadb-operator#190
Depends-On: openstack-k8s-operators/mariadb-operator#191
Jira: OSPRH-4547