[tlse] tls for NeutronAPI pod configuration #263
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/hold |
stuggi
requested review from
olliewalsh,
Deydra71,
vakwetu and
slawqo
and removed request for
viroel
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Dec 8, 2023
- creates internal CA when internal TLS enabled
- creates TLS certs via cert-manager and passes the cert secret
information to the services, right now keystone, glance, cinder and
neutron
For services which at this point don't support TLS, cert validation
could be disabled using customService config like e.g.:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
~~~
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#384
Depends-On: openstack-k8s-operators/keystone-operator#348
Depends-On: openstack-k8s-operators/neutron-operator#263
Depends-On: openstack-k8s-operators/glance-operator#386
Depends-On: openstack-k8s-operators/cinder-operator#306
Jira: OSPRH-2183
Jira: OSPRH-1233
Jira: OSPRH-1592
Jira: OSPRH-2197
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Dec 8, 2023
- creates internal CA when internal TLS enabled
- creates TLS certs via cert-manager and passes the cert secret
information to the services, right now keystone, glance, cinder and
neutron
For services which at this point don't support TLS, cert validation
could be disabled using customService config like e.g.:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
~~~
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#384
Depends-On: openstack-k8s-operators/keystone-operator#348
Depends-On: openstack-k8s-operators/neutron-operator#263
Depends-On: openstack-k8s-operators/glance-operator#386
Depends-On: openstack-k8s-operators/cinder-operator#306
Jira: OSPRH-2183
Jira: OSPRH-1233
Jira: OSPRH-1592
Jira: OSPRH-2197
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Dec 11, 2023
- creates internal CA when internal TLS enabled
- creates TLS certs via cert-manager and passes the cert secret
information to the services, right now keystone, glance, cinder and
neutron
For services which at this point don't support TLS, cert validation
could be disabled using customService config like e.g.:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
~~~
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#384
Depends-On: openstack-k8s-operators/keystone-operator#348
Depends-On: openstack-k8s-operators/neutron-operator#263
Depends-On: openstack-k8s-operators/glance-operator#386
Depends-On: openstack-k8s-operators/cinder-operator#306
Jira: OSPRH-2183
Jira: OSPRH-1233
Jira: OSPRH-1592
Jira: OSPRH-2197
stuggi
force-pushed
the
tlse_secret_update
branch
from
6667e40 to
dd3f9e1
Compare
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Dec 11, 2023
- creates internal CA when internal TLS enabled
- creates TLS certs via cert-manager and passes the cert secret
information to the services, right now keystone, glance, cinder and
neutron
For services which at this point don't support TLS, cert validation
could be disabled using customService config like e.g.:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
~~~
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#384
Depends-On: openstack-k8s-operators/keystone-operator#348
Depends-On: openstack-k8s-operators/neutron-operator#263
Depends-On: openstack-k8s-operators/glance-operator#386
Depends-On: openstack-k8s-operators/cinder-operator#306
Jira: OSPRH-2183
Jira: OSPRH-1233
Jira: OSPRH-1592
Jira: OSPRH-2197
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Dec 13, 2023
- creates internal CA when internal TLS enabled
- creates TLS certs via cert-manager and passes the cert secret
information to the services, right now keystone, glance, cinder and
neutron
For services which at this point don't support TLS, cert validation
could be disabled using customService config like e.g.:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
~~~
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#384
Depends-On: openstack-k8s-operators/keystone-operator#348
Depends-On: openstack-k8s-operators/neutron-operator#263
Depends-On: openstack-k8s-operators/glance-operator#386
Depends-On: openstack-k8s-operators/cinder-operator#306
Jira: OSPRH-2183
Jira: OSPRH-1233
Jira: OSPRH-1592
Jira: OSPRH-2197
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Dec 15, 2023
- creates internal CA when internal TLS enabled
- creates TLS certs via cert-manager and passes the cert secret
information to the services, right now keystone, glance, cinder and
neutron
For services which at this point don't support TLS, cert validation
could be disabled using customService config like e.g.:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
~~~
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#384
Depends-On: openstack-k8s-operators/keystone-operator#348
Depends-On: openstack-k8s-operators/neutron-operator#263
Depends-On: openstack-k8s-operators/glance-operator#386
Depends-On: openstack-k8s-operators/cinder-operator#306
Jira: OSPRH-2183
Jira: OSPRH-1233
Jira: OSPRH-1592
Jira: OSPRH-2197
stuggi
force-pushed
the
tlse_secret_update
branch
from
dd3f9e1 to
54cefc4
Compare
stuggi
force-pushed
the
tlse_secret_update
branch
from
54cefc4 to
618dc27
Compare
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Dec 21, 2023
- creates internal CA when internal TLS enabled
- creates TLS certs via cert-manager and passes the cert secret
information to the services, right now keystone, glance, cinder and
neutron
For services which at this point don't support TLS, cert validation
could be disabled using customService config like e.g.:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
~~~
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#384
Depends-On: openstack-k8s-operators/keystone-operator#348
Depends-On: openstack-k8s-operators/neutron-operator#263
Depends-On: openstack-k8s-operators/glance-operator#386
Depends-On: openstack-k8s-operators/cinder-operator#306
Jira: OSPRH-2183
Jira: OSPRH-1233
Jira: OSPRH-1592
Jira: OSPRH-2197
stuggi
force-pushed
the
tlse_secret_update
branch
2 times, most recently
from
fcd7230 to
5d0d826
Compare
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Jan 4, 2024
- creates internal CA when internal TLS enabled
- creates TLS certs via cert-manager and passes the cert secret
information to the services, right now keystone, glance, cinder and
neutron
For services which at this point don't support TLS, cert validation
could be disabled using customService config like e.g.:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
~~~
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#384
Depends-On: openstack-k8s-operators/keystone-operator#348
Depends-On: openstack-k8s-operators/neutron-operator#263
Depends-On: openstack-k8s-operators/glance-operator#386
Depends-On: openstack-k8s-operators/cinder-operator#306
Jira: OSPRH-2183
Jira: OSPRH-1233
Jira: OSPRH-1592
Jira: OSPRH-2197
stuggi
force-pushed
the
tlse_secret_update
branch
from
5d0d826 to
fe01077
Compare
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Jan 5, 2024
- creates internal CA when internal TLS enabled
- creates TLS certs via cert-manager and passes the cert secret
information to the services, right now keystone, glance, cinder and
neutron
For services which at this point don't support TLS, cert validation
could be disabled using customService config like e.g.:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
~~~
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#384
Depends-On: openstack-k8s-operators/keystone-operator#348
Depends-On: openstack-k8s-operators/neutron-operator#263
Depends-On: openstack-k8s-operators/glance-operator#386
Depends-On: openstack-k8s-operators/cinder-operator#306
Jira: OSPRH-2183
Jira: OSPRH-1233
Jira: OSPRH-1592
Jira: OSPRH-2197
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Jan 12, 2024
Creates certs for k8s service of the service operator when
spec.tls.endpoint.internal.enabled: true
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#428
Depends-On: openstack-k8s-operators#620
Depends-On: openstack-k8s-operators/neutron-operator#263
Jira: OSPRH-2197
stuggi
force-pushed
the
tlse_secret_update
branch
2 times, most recently
from
d28bc1d to
4ec3b41
Compare
slawqo
approved these changes
Jan 18, 2024
stuggi
force-pushed
the
tlse_secret_update
branch
from
4ec3b41 to
156cb5d
Compare
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/3eb27bfb6f504ef4bc8c1d58e325db03 ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 41m 01s |
stuggi
force-pushed
the
tlse_secret_update
branch
from
156cb5d to
2cd34c1
Compare
|
Build failed (check pipeline). Post https://review.rdoproject.org/zuul/buildset/f91074d342024eea8e7d76a4e8082f0c ✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 41m 25s |
stuggi
force-pushed
the
tlse_secret_update
branch
3 times, most recently
from
627b7b7 to
0ff07ea
Compare
|
/unhold |
stuggi
force-pushed
the
tlse_secret_update
branch
from
0ff07ea to
9c0a2be
Compare
Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs get direct mounted to the appropriate place in etc/pki/tls/certs/%s.crt|key and a CA bundle to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem . Job deployments for bootstrap/cron get the CA bundle added if configured. Also indexes the named input resources for password, CA bundle, and endpoint secrets to be able to watch them for any changes and reconcile if needed. Depends-On: openstack-k8s-operators/lib-common#428 Jira: OSPRH-2197
Adds kuttl test for tls using pre-created CA bundle and certificate secrets to not have a dependency on cert manager for testing. Jira: OSPRH-2197
stuggi
force-pushed
the
tlse_secret_update
branch
from
9c0a2be to
db92830
Compare
|
@slawqo I have added some more tests and rebased it. can you please restore the approval? |
karelyatin
approved these changes
Jan 29, 2024
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: karelyatin, slawqo, stuggi The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
bot
merged commit ae87be7
into
openstack-k8s-operators:main
6 checks passed
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Jan 29, 2024
Creates certs for k8s service of the service operator when
spec.tls.endpoint.internal.enabled: true
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#428
Depends-On: openstack-k8s-operators#620
Depends-On: openstack-k8s-operators/neutron-operator#263
Jira: OSPRH-2197
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Jan 30, 2024
Creates certs for k8s service of the service operator when
spec.tls.endpoint.internal.enabled: true
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#428
Depends-On: openstack-k8s-operators#620
Depends-On: openstack-k8s-operators/neutron-operator#263
Jira: OSPRH-2197
stuggi
added a commit
to stuggi/openstack-operator
that referenced
this pull request
Feb 13, 2024
Creates certs for k8s service of the service operator when
spec.tls.endpoint.internal.enabled: true
For a service like nova which talks to multiple service internal
endpoints, this has to be set for each of them for, like:
~~~
customServiceConfig: |
[keystone_authtoken]
insecure = true
[placement]
insecure = true
[neutron]
insecure = true
[glance]
insecure = true
[cinder]
insecure = true
~~~
Depends-On: openstack-k8s-operators/lib-common#428
Depends-On: openstack-k8s-operators#620
Depends-On: openstack-k8s-operators/neutron-operator#263
Jira: OSPRH-2197
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs get direct mounted to the appropriate place in etc/pki/tls/certs/%s.crt|key and a CA bundle to
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem . Job deployments for bootstrap/cron get the CA bundle added if configured.
Also indexes the named input resources for password, CA bundle, and endpoint secrets to be able to watch them for any changes and reconcile if needed.
Depends-On: openstack-k8s-operators/lib-common#428
Jira: OSPRH-2197