Skip to content

Commit

Permalink
[tlse] tls for PlacementAPI pod configuration
Browse files Browse the repository at this point in the history
Public/Internal service cert secrets and the CA bundle secret
can be passed to configure httpd virtual hosts for tls termination.
The certs get direct mounted to the appropriate place in
etc/pki/tls/certs/%s.crt|key and a CA bundle to
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem.

Depends-On: openstack-k8s-operators/lib-common#384

Signed-off-by: Veronika Fisarova <[email protected]>
  • Loading branch information
Deydra71 committed Dec 11, 2023
1 parent 4daf37e commit cece1b2
Show file tree
Hide file tree
Showing 20 changed files with 487 additions and 34 deletions.
33 changes: 33 additions & 0 deletions api/bases/placement.openstack.org_placementapis.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -365,6 +365,39 @@ spec:
description: ServiceUser - optional username used for this service
to register in keystone
type: string
tls:
description: TLS - Parameters related to the TLS
properties:
api:
description: API tls type which encapsulates for API services
properties:
disabled:
description: Disabled TLS for the deployment of the service
type: boolean
internal:
description: Internal GenericService - holds the secret for
the internal endpoint
properties:
secretName:
description: SecretName - holding the cert, key for the
service
type: string
type: object
public:
description: Public GenericService - holds the secret for
the public endpoint
properties:
secretName:
description: SecretName - holding the cert, key for the
service
type: string
type: object
type: object
caBundleSecretName:
description: CaBundleSecretName - holding the CA certs in a pre-created
bundle file
type: string
type: object
required:
- containerImage
- databaseInstance
Expand Down
11 changes: 11 additions & 0 deletions api/go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -67,3 +67,14 @@ require (
// mschuppert: map to latest commit from release-4.13 tag
// must consistent within modules and service operators
replace github.com/openshift/api => github.com/openshift/api v0.0.0-20230414143018-3367bc7e6ac7 //allow-merging

replace ( //allow-merging
github.com/google/gnostic => github.com/google/gnostic v0.6.9
// pin to k8s 0.26.x for now
k8s.io/api => k8s.io/api v0.26.11
k8s.io/apimachinery => k8s.io/apimachinery v0.26.11
k8s.io/client-go => k8s.io/client-go v0.26.11
sigs.k8s.io/controller-runtime => sigs.k8s.io/controller-runtime v0.14.7
)

replace github.com/openstack-k8s-operators/lib-common/modules/common => github.com/Deydra71/lib-common/modules/common v0.0.0-20231208095031-62070e5707ac
3 changes: 1 addition & 2 deletions api/go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@ cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9
dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
github.com/Deydra71/lib-common/modules/common v0.0.0-20231208095031-62070e5707ac h1:hbxqV3SSJkEtZOHfbWsz5gYIax7ABdg4ub8iAMbKb2Q=
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
Expand Down Expand Up @@ -220,8 +221,6 @@ github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRW
github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
github.com/onsi/ginkgo/v2 v2.13.2 h1:Bi2gGVkfn6gQcjNjZJVO8Gf0FHzMPf2phUei9tejVMs=
github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
github.com/openstack-k8s-operators/lib-common/modules/common v0.3.1-0.20231209173030-f7a552f208e7 h1:fZ0YF3m9kJDPjHg2rC6XJbGPxv00Nc9N/1/Cdg1Die0=
github.com/openstack-k8s-operators/lib-common/modules/common v0.3.1-0.20231209173030-f7a552f208e7/go.mod h1:gcsno+cczP8lUANyOQ/jHKHv3QgzmZvLv8cMSS0rMws=
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
Expand Down
6 changes: 6 additions & 0 deletions api/v1beta1/placementapi_types.go
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ package v1beta1
import (
condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
"github.com/openstack-k8s-operators/lib-common/modules/common/service"
"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
"github.com/openstack-k8s-operators/lib-common/modules/common/util"

corev1 "k8s.io/api/core/v1"
Expand Down Expand Up @@ -115,6 +116,11 @@ type PlacementAPISpec struct {
// +kubebuilder:validation:Optional
// Override, provides the ability to override the generated manifest of several child resources.
Override APIOverrideSpec `json:"override,omitempty"`

// +kubebuilder:validation:Optional
// +operator-sdk:csv:customresourcedefinitions:type=spec
// TLS - Parameters related to the TLS
TLS tls.API `json:"tls,omitempty"`

Check failure on line 123 in api/v1beta1/placementapi_types.go

View workflow job for this annotation

GitHub Actions / call-build-workflow / placement-operator-bundle

unknown type tls.API
}

// APIOverrideSpec to override the generated manifest of several child resources.
Expand Down
1 change: 1 addition & 0 deletions api/v1beta1/zz_generated.deepcopy.go

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

33 changes: 33 additions & 0 deletions config/crd/bases/placement.openstack.org_placementapis.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -365,6 +365,39 @@ spec:
description: ServiceUser - optional username used for this service
to register in keystone
type: string
tls:
description: TLS - Parameters related to the TLS
properties:
api:
description: API tls type which encapsulates for API services
properties:
disabled:
description: Disabled TLS for the deployment of the service
type: boolean
internal:
description: Internal GenericService - holds the secret for
the internal endpoint
properties:
secretName:
description: SecretName - holding the cert, key for the
service
type: string
type: object
public:
description: Public GenericService - holds the secret for
the public endpoint
properties:
secretName:
description: SecretName - holding the cert, key for the
service
type: string
type: object
type: object
caBundleSecretName:
description: CaBundleSecretName - holding the CA certs in a pre-created
bundle file
type: string
type: object
required:
- containerImage
- databaseInstance
Expand Down
8 changes: 8 additions & 0 deletions config/samples/placement_v1beta1_placementapi.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,14 @@ spec:
service: false
preserveJobs: false
replicas: 1
# tls:
# api:
# disabled: false
# internal:
# secretName: cert-internal-svc
# public:
# secretName: cert-public-svc
# caBundleSecretName: combined-ca-bundle
secret: placement-secret
#resources:
# requests:
Expand Down
Loading

0 comments on commit cece1b2

Please sign in to comment.