Skip to content

Commit 646af7b

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #1374 from vakwetu/add_ca_cert_to_bootstrap
Add CA cert to bootstrap service
2 parents 2eba362 + d2b0b26 commit 646af7b

File tree

17 files changed

+307
-41
lines changed

17 files changed

+307
-41
lines changed

‎config/services/dataplane_v1beta1_openstackdataplaneservice_bootstrap.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,4 @@ metadata:
55
spec:
66
playbook: osp.edpm.bootstrap
77
edpmServiceType: bootstrap
8+
caCerts: combined-ca-bundle

‎pkg/dataplane/deployment.go‎

Lines changed: 54 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,22 @@ func (d *Deployer) Deploy(services []string) (*ctrl.Result, error) {
131131
d.Status.NodeSetConditions[d.NodeSet.Name] = nsConditions
132132
return &ctrl.Result{}, err
133133
}
134+
} else if len(foundService.Spec.CACerts) > 0 {
135+
// In general, we use the install-certs service (which has AddCertMounts=true
136+
// to copy the cacerts over. This may not be early enough for some services
137+
// though. In particular, we want the bootstrap service to copy the cacerts
138+
// to the default location on the compute node.
139+
d.AeeSpec, err = d.addCACertMount(foundService)
140+
if err != nil {
141+
nsConditions.Set(condition.FalseCondition(
142+
readyCondition,
143+
condition.ErrorReason,
144+
condition.SeverityError,
145+
readyErrorMessage,
146+
err.Error()))
147+
d.Status.NodeSetConditions[d.NodeSet.Name] = nsConditions
148+
return &ctrl.Result{}, err
149+
}
134150
}
135151

136152
err = d.ConditionalDeploy(
@@ -351,38 +367,51 @@ func (d *Deployer) addCertMounts(
351367

352368
// add mount for cacert bundle, even if TLS-E is not enabled
353369
if len(service.Spec.CACerts) > 0 {
354-
log.Info("Mounting CA cert bundle for service", "service", svc)
355-
volMounts := storage.VolMounts{}
356-
cacertSecret := &corev1.Secret{}
357-
err := client.Get(d.Ctx, types.NamespacedName{Name: service.Spec.CACerts, Namespace: service.Namespace}, cacertSecret)
370+
d.AeeSpec, err = d.addCACertMount(service)
358371
if err != nil {
359372
return d.AeeSpec, err
360373
}
361-
volumeName := fmt.Sprintf("%s-%s", service.Name, service.Spec.CACerts)
362-
if len(volumeName) > apimachineryvalidation.DNS1123LabelMaxLength {
363-
hash := sha256.Sum224([]byte(volumeName))
364-
volumeName = "cacert" + hex.EncodeToString(hash[:])
365-
}
366-
cacertVolume := storage.Volume{
367-
Name: volumeName,
368-
VolumeSource: storage.VolumeSource{
369-
Secret: &corev1.SecretVolumeSource{
370-
SecretName: service.Spec.CACerts,
371-
},
372-
},
373-
}
374+
}
375+
}
374376

375-
cacertVolumeMount := corev1.VolumeMount{
376-
Name: volumeName,
377-
MountPath: path.Join(CACertPaths, service.Spec.EDPMServiceType),
378-
}
377+
return d.AeeSpec, nil
378+
}
379379

380-
volMounts.Volumes = append(volMounts.Volumes, cacertVolume)
381-
volMounts.Mounts = append(volMounts.Mounts, cacertVolumeMount)
382-
d.AeeSpec.ExtraMounts = append(d.AeeSpec.ExtraMounts, volMounts)
383-
}
380+
func (d *Deployer) addCACertMount(
381+
service dataplanev1.OpenStackDataPlaneService,
382+
) (*dataplanev1.AnsibleEESpec, error) {
383+
log := d.Helper.GetLogger()
384+
client := d.Helper.GetClient()
385+
386+
log.Info("Mounting CA cert bundle for service", "service", service)
387+
volMounts := storage.VolMounts{}
388+
cacertSecret := &corev1.Secret{}
389+
err := client.Get(d.Ctx, types.NamespacedName{Name: service.Spec.CACerts, Namespace: service.Namespace}, cacertSecret)
390+
if err != nil {
391+
return d.AeeSpec, err
392+
}
393+
volumeName := fmt.Sprintf("%s-%s", service.Name, service.Spec.CACerts)
394+
if len(volumeName) > apimachineryvalidation.DNS1123LabelMaxLength {
395+
hash := sha256.Sum224([]byte(volumeName))
396+
volumeName = "cacert" + hex.EncodeToString(hash[:])
397+
}
398+
cacertVolume := storage.Volume{
399+
Name: volumeName,
400+
VolumeSource: storage.VolumeSource{
401+
Secret: &corev1.SecretVolumeSource{
402+
SecretName: service.Spec.CACerts,
403+
},
404+
},
405+
}
406+
407+
cacertVolumeMount := corev1.VolumeMount{
408+
Name: volumeName,
409+
MountPath: path.Join(CACertPaths, service.Spec.EDPMServiceType),
384410
}
385411

412+
volMounts.Volumes = append(volMounts.Volumes, cacertVolume)
413+
volMounts.Mounts = append(volMounts.Mounts, cacertVolumeMount)
414+
d.AeeSpec.ExtraMounts = append(d.AeeSpec.ExtraMounts, volMounts)
386415
return d.AeeSpec, nil
387416
}
388417

‎tests/functional/dataplane/base_test.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,16 @@ func CreateSSHSecret(name types.NamespacedName) *corev1.Secret {
166166
)
167167
}
168168

169+
// Create CABundleSecret
170+
func CreateCABundleSecret(name types.NamespacedName) *corev1.Secret {
171+
return th.CreateSecret(
172+
types.NamespacedName{Namespace: name.Namespace, Name: name.Name},
173+
map[string][]byte{
174+
"tls-ca-bundle.pem": []byte("blah"),
175+
},
176+
)
177+
}
178+
169179
// Create OpenStackVersion
170180
func CreateOpenStackVersion(name types.NamespacedName) *unstructured.Unstructured {
171181
raw := DefaultOpenStackVersion(name)

‎tests/functional/dataplane/openstackdataplanedeployment_controller_test.go‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
2424
var dataplaneDeploymentName types.NamespacedName
2525
var dataplaneNodeSetName types.NamespacedName
2626
var dataplaneSSHSecretName types.NamespacedName
27+
var caBundleSecretName types.NamespacedName
2728
var neutronOvnMetadataSecretName types.NamespacedName
2829
var novaNeutronMetadataSecretName types.NamespacedName
2930
var novaCellComputeConfigSecretName types.NamespacedName
@@ -59,6 +60,10 @@ var _ = Describe("Dataplane Deployment Test", func() {
5960
Namespace: namespace,
6061
Name: "dataplane-ansible-ssh-private-key-secret",
6162
}
63+
caBundleSecretName = types.NamespacedName{
64+
Namespace: namespace,
65+
Name: "combined-ca-bundle",
66+
}
6267
neutronOvnMetadataSecretName = types.NamespacedName{
6368
Namespace: namespace,
6469
Name: "neutron-ovn-metadata-agent-neutron-config",
@@ -110,6 +115,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
110115
When("A dataplaneDeployment is created with matching NodeSet", func() {
111116
BeforeEach(func() {
112117
CreateSSHSecret(dataplaneSSHSecretName)
118+
CreateCABundleSecret(caBundleSecretName)
113119
DeferCleanup(th.DeleteInstance, th.CreateSecret(neutronOvnMetadataSecretName, map[string][]byte{
114120
"fake_keys": []byte("blih"),
115121
}))
@@ -249,6 +255,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
249255
When("A dataplaneDeployment is created with two NodeSets", func() {
250256
BeforeEach(func() {
251257
CreateSSHSecret(dataplaneSSHSecretName)
258+
CreateCABundleSecret(caBundleSecretName)
252259
DeferCleanup(th.DeleteInstance, th.CreateSecret(neutronOvnMetadataSecretName, map[string][]byte{
253260
"fake_keys": []byte("blih"),
254261
}))
@@ -430,9 +437,9 @@ var _ = Describe("Dataplane Deployment Test", func() {
430437
}
431438
ansibleEE := GetAnsibleee(ansibleeeName)
432439
if service.Spec.DeployOnAllNodeSets {
433-
g.Expect(ansibleEE.Spec.Template.Spec.Volumes).Should(HaveLen(4))
440+
g.Expect(ansibleEE.Spec.Template.Spec.Volumes).Should(HaveLen(5))
434441
} else {
435-
g.Expect(ansibleEE.Spec.Template.Spec.Volumes).Should(HaveLen(2))
442+
g.Expect(ansibleEE.Spec.Template.Spec.Volumes).Should(HaveLen(3))
436443
}
437444
ansibleEE.Status.Succeeded = 1
438445
g.Expect(th.K8sClient.Status().Update(th.Ctx, ansibleEE)).To(Succeed())
@@ -469,9 +476,9 @@ var _ = Describe("Dataplane Deployment Test", func() {
469476
}
470477
ansibleEE := GetAnsibleee(ansibleeeName)
471478
if service.Spec.DeployOnAllNodeSets {
472-
g.Expect(ansibleEE.Spec.Template.Spec.Volumes).Should(HaveLen(4))
479+
g.Expect(ansibleEE.Spec.Template.Spec.Volumes).Should(HaveLen(5))
473480
} else {
474-
g.Expect(ansibleEE.Spec.Template.Spec.Volumes).Should(HaveLen(2))
481+
g.Expect(ansibleEE.Spec.Template.Spec.Volumes).Should(HaveLen(3))
475482
}
476483
ansibleEE.Status.Succeeded = 1
477484
g.Expect(th.K8sClient.Status().Update(th.Ctx, ansibleEE)).To(Succeed())
@@ -501,6 +508,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
501508
When("A dataplaneDeployment is created with a missing nodeset", func() {
502509
BeforeEach(func() {
503510
CreateSSHSecret(dataplaneSSHSecretName)
511+
CreateCABundleSecret(caBundleSecretName)
504512
DeferCleanup(th.DeleteInstance, th.CreateSecret(neutronOvnMetadataSecretName, map[string][]byte{
505513
"fake_keys": []byte("blih"),
506514
}))
@@ -638,6 +646,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
638646
BeforeEach(func() {
639647
CreateDataplaneServicesWithSameServiceType(dataplaneServiceName)
640648
CreateSSHSecret(dataplaneSSHSecretName)
649+
CreateCABundleSecret(caBundleSecretName)
641650
DeferCleanup(th.DeleteInstance, th.CreateSecret(neutronOvnMetadataSecretName, map[string][]byte{
642651
"fake_keys": []byte("blih"),
643652
}))
@@ -720,6 +729,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
720729
When("A dataplaneDeployment is created with two NodeSets both containing same globalservice", func() {
721730
BeforeEach(func() {
722731
CreateSSHSecret(dataplaneSSHSecretName)
732+
CreateCABundleSecret(caBundleSecretName)
723733
DeferCleanup(th.DeleteInstance, th.CreateSecret(neutronOvnMetadataSecretName, map[string][]byte{
724734
"fake_keys": []byte("blih"),
725735
}))
@@ -951,6 +961,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
951961
BeforeEach(func() {
952962
CreateDataplaneServicesWithSameServiceType(dataplaneServiceName)
953963
CreateSSHSecret(dataplaneSSHSecretName)
964+
CreateCABundleSecret(caBundleSecretName)
954965
DeferCleanup(th.DeleteInstance, th.CreateSecret(neutronOvnMetadataSecretName, map[string][]byte{
955966
"fake_keys": []byte("blih"),
956967
}))
@@ -1051,6 +1062,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
10511062
When("A dataplaneDeployment is created with serviceoverride containing single global service", func() {
10521063
BeforeEach(func() {
10531064
CreateSSHSecret(dataplaneSSHSecretName)
1065+
CreateCABundleSecret(caBundleSecretName)
10541066
DeferCleanup(th.DeleteInstance, th.CreateSecret(neutronOvnMetadataSecretName, map[string][]byte{
10551067
"fake_keys": []byte("blih"),
10561068
}))
@@ -1258,6 +1270,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
12581270
When("A dataplaneDeployment is created with serviceoverride containing global service", func() {
12591271
BeforeEach(func() {
12601272
CreateSSHSecret(dataplaneSSHSecretName)
1273+
CreateCABundleSecret(caBundleSecretName)
12611274
DeferCleanup(th.DeleteInstance, th.CreateSecret(neutronOvnMetadataSecretName, map[string][]byte{
12621275
"fake_keys": []byte("blih"),
12631276
}))
@@ -1480,6 +1493,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
14801493
When("A dataplaneDeployment is created with non-existent service in nodeset", func() {
14811494
BeforeEach(func() {
14821495
CreateSSHSecret(dataplaneSSHSecretName)
1496+
CreateCABundleSecret(caBundleSecretName)
14831497
DeferCleanup(th.DeleteInstance, th.CreateSecret(neutronOvnMetadataSecretName, map[string][]byte{
14841498
"fake_keys": []byte("blih"),
14851499
}))
@@ -1575,6 +1589,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
15751589
When("A user sets TLSEnabled to true with control plane with PodLevel TLS disabled", func() {
15761590
BeforeEach(func() {
15771591
CreateSSHSecret(dataplaneSSHSecretName)
1592+
CreateCABundleSecret(caBundleSecretName)
15781593
DeferCleanup(th.DeleteInstance, th.CreateSecret(neutronOvnMetadataSecretName, map[string][]byte{
15791594
"fake_keys": []byte("blih"),
15801595
}))
@@ -1674,6 +1689,7 @@ var _ = Describe("Dataplane Deployment Test", func() {
16741689
When("A user sets TLSEnabled to true with control plane PodLevel TLS enabled", func() {
16751690
BeforeEach(func() {
16761691
CreateSSHSecret(dataplaneSSHSecretName)
1692+
CreateCABundleSecret(caBundleSecretName)
16771693
DeferCleanup(th.DeleteInstance, th.CreateSecret(neutronOvnMetadataSecretName, map[string][]byte{
16781694
"fake_keys": []byte("blih"),
16791695
}))

0 commit comments

Comments
 (0)