[tlse] tls for GlanceAPI pod configuration #386

stuggi · 2023-12-08T15:08:26Z

Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs get direct mounted to the appropriate place in etc/pki/tls/certs/%s.crt|key and a CA bundle to
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem . Job deployments for bootstrap/cron get the CA bundle added if configured.

Also indexes the named input resources for password, CA bundle, and endpoint secrets to be able to watch them for a change and reconcile.

Depends-On: openstack-k8s-operators/lib-common#384

Jira: OSPRH-1233

stuggi · 2023-12-08T15:08:35Z

/hold

- creates internal CA when internal TLS enabled - creates TLS certs via cert-manager and passes the cert secret information to the services, right now keystone, glance, cinder and neutron For services which at this point don't support TLS, cert validation could be disabled using customService config like e.g.: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true ~~~ For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#384 Depends-On: openstack-k8s-operators/keystone-operator#348 Depends-On: openstack-k8s-operators/neutron-operator#263 Depends-On: openstack-k8s-operators/glance-operator#386 Depends-On: openstack-k8s-operators/cinder-operator#306 Jira: OSPRH-2183 Jira: OSPRH-1233 Jira: OSPRH-1592 Jira: OSPRH-2197

controllers/glance_common.go

- creates internal CA when internal TLS enabled - creates TLS certs via cert-manager and passes the cert secret information to the services, right now keystone, glance, cinder and neutron For services which at this point don't support TLS, cert validation could be disabled using customService config like e.g.: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true ~~~ For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#384 Depends-On: openstack-k8s-operators/keystone-operator#348 Depends-On: openstack-k8s-operators/neutron-operator#263 Depends-On: openstack-k8s-operators/glance-operator#386 Depends-On: openstack-k8s-operators/cinder-operator#306 Jira: OSPRH-2183 Jira: OSPRH-1233 Jira: OSPRH-1592 Jira: OSPRH-2197

abays · 2023-12-11T13:35:50Z

controllers/glance_controller.go

+	// index passwordSecretField
+	if err := mgr.GetFieldIndexer().IndexField(context.Background(), &glancev1.Glance{}, passwordSecretField, func(rawObj client.Object) []string {
+		// Extract the secret name from the spec, if one is provided
+		cr := rawObj.(*glancev1.Glance)
+		if cr.Spec.Secret == "" {
+			return nil
+		}
+		return []string{cr.Spec.Secret}
+	}); err != nil {
+		return err
+	}


Just curious: should the other index fields as specified in the consts be included here as well?

Ah, I see they're covered in the GlanceAPI controller. So maybe not important here.

no, don't think its required to rerun the jobs from glance controller when a cert changes, but should do if password changes.

openshift-merge-robot · 2023-12-13T09:22:45Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci · 2023-12-13T14:16:45Z

@stuggi: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/images	`c637f8d`	link	true	`/test images`
ci/prow/glance-operator-build-deploy-kuttl	`c637f8d`	link	true	`/test glance-operator-build-deploy-kuttl`
ci/prow/glance-operator-build-deploy-tempest	`c637f8d`	link	true	`/test glance-operator-build-deploy-tempest`
ci/prow/functional	`c637f8d`	link	true	`/test functional`
ci/prow/precommit-check	`c637f8d`	link	true	`/test precommit-check`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci · 2023-12-13T14:19:55Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: stuggi

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

- creates internal CA when internal TLS enabled - creates TLS certs via cert-manager and passes the cert secret information to the services, right now keystone, glance, cinder and neutron For services which at this point don't support TLS, cert validation could be disabled using customService config like e.g.: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true ~~~ For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#384 Depends-On: openstack-k8s-operators/keystone-operator#348 Depends-On: openstack-k8s-operators/neutron-operator#263 Depends-On: openstack-k8s-operators/glance-operator#386 Depends-On: openstack-k8s-operators/cinder-operator#306 Jira: OSPRH-2183 Jira: OSPRH-1233 Jira: OSPRH-1592 Jira: OSPRH-2197

stuggi · 2023-12-14T11:31:42Z

can not remember that I have closed this one, and it seems I can not reopen this, so opened a new one #391

- creates internal CA when internal TLS enabled - creates TLS certs via cert-manager and passes the cert secret information to the services, right now keystone, glance, cinder and neutron For services which at this point don't support TLS, cert validation could be disabled using customService config like e.g.: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true ~~~ For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#384 Depends-On: openstack-k8s-operators/keystone-operator#348 Depends-On: openstack-k8s-operators/neutron-operator#263 Depends-On: openstack-k8s-operators/glance-operator#386 Depends-On: openstack-k8s-operators/cinder-operator#306 Jira: OSPRH-2183 Jira: OSPRH-1233 Jira: OSPRH-1592 Jira: OSPRH-2197

- creates internal CA when internal TLS enabled - creates TLS certs via cert-manager and passes the cert secret information to the services, right now keystone, glance, cinder and neutron For services which at this point don't support TLS, cert validation could be disabled using customService config like e.g.: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true ~~~ For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators/keystone-operator#348 Depends-On: openstack-k8s-operators/neutron-operator#263 Depends-On: openstack-k8s-operators/glance-operator#386 Depends-On: openstack-k8s-operators/cinder-operator#306 Jira: OSPRH-2183 Jira: OSPRH-1233 Jira: OSPRH-1592 Jira: OSPRH-2197

openshift-ci bot added the do-not-merge/hold label Dec 8, 2023

stuggi requested review from olliewalsh and Deydra71 December 8, 2023 15:08

openshift-ci bot requested review from dprince and frenzyfriday December 8, 2023 15:09

stuggi requested review from vakwetu and removed request for dprince and frenzyfriday December 8, 2023 15:09

openshift-ci bot added the approved label Dec 8, 2023

stuggi requested a review from fmount December 8, 2023 15:09

stuggi mentioned this pull request Dec 8, 2023

[tlse] initial internal API TLS support for keystone, glance, cinder and neutron openstack-k8s-operators/openstack-operator#592

Closed

openshift-merge-robot added the needs-rebase label Dec 10, 2023

abays reviewed Dec 11, 2023

View reviewed changes

controllers/glance_common.go Outdated Show resolved Hide resolved

stuggi force-pushed the tlse_secret_update branch from 696fe18 to 42de121 Compare December 11, 2023 12:57

stuggi force-pushed the tlse_secret_update branch from 42de121 to a4f18fe Compare December 11, 2023 13:05

openshift-merge-robot removed the needs-rebase label Dec 11, 2023

abays reviewed Dec 11, 2023

View reviewed changes

openshift-merge-robot added the needs-rebase label Dec 13, 2023

stuggi force-pushed the tlse_secret_update branch from a4f18fe to c637f8d Compare December 13, 2023 14:16

stuggi closed this Dec 13, 2023

stuggi force-pushed the tlse_secret_update branch from c637f8d to f890218 Compare December 13, 2023 14:19

openshift-ci bot removed the approved label Dec 13, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[tlse] tls for GlanceAPI pod configuration #386

[tlse] tls for GlanceAPI pod configuration #386

stuggi commented Dec 8, 2023 •

edited by openshift-ci bot

Loading

stuggi commented Dec 8, 2023

abays Dec 11, 2023

abays Dec 11, 2023

stuggi Dec 11, 2023

openshift-merge-robot commented Dec 13, 2023

openshift-ci bot commented Dec 13, 2023

openshift-ci bot commented Dec 13, 2023

stuggi commented Dec 14, 2023

[tlse] tls for GlanceAPI pod configuration #386

[tlse] tls for GlanceAPI pod configuration #386

Conversation

stuggi commented Dec 8, 2023 • edited by openshift-ci bot Loading

stuggi commented Dec 8, 2023

abays Dec 11, 2023

Choose a reason for hiding this comment

abays Dec 11, 2023

Choose a reason for hiding this comment

stuggi Dec 11, 2023

Choose a reason for hiding this comment

openshift-merge-robot commented Dec 13, 2023

openshift-ci bot commented Dec 13, 2023

openshift-ci bot commented Dec 13, 2023

stuggi commented Dec 14, 2023

stuggi commented Dec 8, 2023 •

edited by openshift-ci bot

Loading