[tls] Add functionality to create service certs if internal tls enabled #620

stuggi · 2024-01-11T08:35:01Z

creates internal CA when internal TLS enabled
adds functionality to create the certificates via CertManager for the k8s services used for the API endpoints. In follow ups when the service components allow to pass in the service certificate secrets those will be set on the component cr.

Adds information on created CAs for the endpoints and their expire information to the osctlplane CR:

    tls:
      caBundleSecretName: combined-ca-bundle
      endpoint:
        internal:
          expires: 2024-04-09 15:28:04 +0000 UTC
          name: rootca-internal
        public:
          expires: 2024-04-09 15:28:04 +0000 UTC
          name: rootca-public

Also refactors the nova pkg in preparation for better/easier tls cert create for metadata/vncproxy as they are not typical api endpoints.

Depends-On: openstack-k8s-operators/lib-common#428

Jira: OSPRH-3268

config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml

pkg/openstack/ca.go

softwarefactory-project-zuul · 2024-01-11T10:04:49Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://review.rdoproject.org/zuul/buildset/20c38024ebbb470f8347634f31a50062

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 28m 29s
❌ podified-multinode-edpm-deployment-crc FAILURE in 57m 00s
✔️ cifmw-crc-podified-edpm-baremetal SUCCESS in 1h 13m 40s
❌ openstack-operator-tempest-multinode FAILURE in 1h 03m 11s

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For services which at this point don't support TLS, cert validation could be disabled using customService config like e.g.: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true ~~~ For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/keystone-operator#348 Jira: OSPRH-2183

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/neutron-operator#263 Jira: OSPRH-2197

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/glance-operator#391 Jira: OSPRH-1233

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/cinder-operator#306 Jira: OSPRH-1592

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/placement-operator#92 Jira: OSPRH-2368

softwarefactory-project-zuul · 2024-01-11T12:22:10Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://review.rdoproject.org/zuul/buildset/636b29fa3ba0402b940405967cae9a2e

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 21m 37s
❌ podified-multinode-edpm-deployment-crc FAILURE in 1h 02m 51s
❌ cifmw-crc-podified-edpm-baremetal FAILURE in 39m 02s
❌ openstack-operator-tempest-multinode FAILURE in 1h 07m 51s

Creates TLS certs via cert-manager for NovaAPI, NovaMetadata and NovaNoVNCProxy when spec.tls.endpoint.internal.enabled: true Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: https://github.com/openstack-k8s-operators/nova-operator/pull/TODO Jira: TODO

Creates TLS certs via cert-manager for NovaAPI, NovaMetadata and NovaNoVNCProxy when spec.tls.endpoint.internal.enabled: true Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/nova-operator#646 Jira: OSPRH-3294

softwarefactory-project-zuul · 2024-01-11T15:46:35Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://review.rdoproject.org/zuul/buildset/0a3dc6d897074b09ba0e13ae7a7b41e9

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 34m 24s
❌ podified-multinode-edpm-deployment-crc FAILURE in 1h 02m 12s
❌ cifmw-crc-podified-edpm-baremetal FAILURE in 1h 19m 20s
❌ openstack-operator-tempest-multinode RETRY_LIMIT in 14m 13s

- creates internal CA when internal TLS enabled - adds functionality to create the certificates via CertManager for the k8s services used for the API endpoints. In follow ups when the service components allow to pass in the service certificate secrets those will be set on the component cr. Depends-On: openstack-k8s-operators/lib-common#428 Jira: OSPRH-3268

Jira: OSPRH-3268

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/manila-operator#212 Signed-off-by: Veronika Fisarova <[email protected]>

spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/barbican-operator#55 Jira: OSPRH-2349

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For services which at this point don't support TLS, cert validation could be disabled using customService config like e.g.: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true ~~~ For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/keystone-operator#348 Jira: OSPRH-2183

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/neutron-operator#263 Jira: OSPRH-2197

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/glance-operator#391 Jira: OSPRH-1233

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/placement-operator#92 Jira: OSPRH-2368

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/heat-operator#300 Jira: OSPRH3851

Creates TLS certs via cert-manager for NovaAPI, NovaMetadata and NovaNoVNCProxy when spec.tls.endpoint.internal.enabled: true Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/nova-operator#646 Jira: OSPRH-3294

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/ironic-operator#380 Depends-On: openstack-k8s-operators/tcib#126 Jira: OSPRH-4220

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/swift-operator#109 Jira: OSPRH-4371

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/cinder-operator#306 Jira: OSPRH-1592

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/manila-operator#212 Signed-off-by: Veronika Fisarova <[email protected]>

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/telemetry-operator#310 Depends-On: openstack-k8s-operators/telemetry-operator#327 Depends-On: openstack-k8s-operators/telemetry-operator#330 Signed-off-by: Veronika Fisarova <[email protected]>

Creates the telemetry aodh route and svc overrides. Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/telemetry-operator#310 Depends-On: openstack-k8s-operators/telemetry-operator#327 Depends-On: openstack-k8s-operators/telemetry-operator#330 Signed-off-by: Veronika Fisarova <[email protected]>

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/octavia-operator#265 Signed-off-by: Veronika Fisarova <[email protected]>

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/octavia-operator#265 Co-authored-by: [email protected] Signed-off-by: Veronika Fisarova <[email protected]>

Creates the telemetry aodh route and svc overrides. Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/telemetry-operator#310 Depends-On: openstack-k8s-operators/telemetry-operator#327 Depends-On: openstack-k8s-operators/telemetry-operator#330 Signed-off-by: Veronika Fisarova <[email protected]>

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/octavia-operator#265 Co-authored-by: [email protected] Signed-off-by: Veronika Fisarova <[email protected]>

openshift-ci bot requested review from abays and lewisdenny January 11, 2024 08:35

stuggi requested review from olliewalsh and removed request for lewisdenny and abays January 11, 2024 08:35

openshift-ci bot added the approved label Jan 11, 2024

stuggi requested review from Deydra71 and vakwetu January 11, 2024 08:35

olliewalsh reviewed Jan 11, 2024

View reviewed changes

config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml Show resolved Hide resolved

pkg/openstack/ca.go Outdated Show resolved Hide resolved

stuggi force-pushed the tlse_base branch from c6b92ab to e1aa2e4 Compare January 11, 2024 10:58

stuggi mentioned this pull request Jan 11, 2024

[tlse] internal TLS support for keystone #621

Merged

stuggi mentioned this pull request Jan 11, 2024

[tlse] internal TLS support for neutron #622

Merged

stuggi mentioned this pull request Jan 11, 2024

[tlse] internal TLS support for glance #623

Merged

stuggi mentioned this pull request Jan 11, 2024

[tlse] internal TLS support for cinder #624

Merged

stuggi mentioned this pull request Jan 11, 2024

[tlse] internal TLS support for placement #625

Merged

stuggi force-pushed the tlse_base branch from e1aa2e4 to 261036f Compare January 11, 2024 14:10

stuggi mentioned this pull request Jan 11, 2024

[tlse] initial internal API TLS support for keystone, glance, cinder and neutron #592

Closed

stuggi mentioned this pull request Jan 11, 2024

[tlse] internal TLS support for Nova #626

Merged

stuggi added 2 commits January 11, 2024 17:29

[nova] refactor pkg/nova.go as prepare for tls

b1a7f05

Jira: OSPRH-3268

Deydra71 mentioned this pull request Mar 7, 2024

[tlse] internal TLS support for telemetry aodh service #695

Merged

Deydra71 mentioned this pull request Mar 20, 2024

[tlse] internal TLS support for octavia #715

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[tls] Add functionality to create service certs if internal tls enabled #620

[tls] Add functionality to create service certs if internal tls enabled #620

stuggi commented Jan 11, 2024 •

edited by openshift-ci bot

Loading

softwarefactory-project-zuul bot commented Jan 11, 2024

softwarefactory-project-zuul bot commented Jan 11, 2024

softwarefactory-project-zuul bot commented Jan 11, 2024

[tls] Add functionality to create service certs if internal tls enabled #620

[tls] Add functionality to create service certs if internal tls enabled #620

Conversation

stuggi commented Jan 11, 2024 • edited by openshift-ci bot Loading

softwarefactory-project-zuul bot commented Jan 11, 2024

softwarefactory-project-zuul bot commented Jan 11, 2024

softwarefactory-project-zuul bot commented Jan 11, 2024

stuggi commented Jan 11, 2024 •

edited by openshift-ci bot

Loading