Merge pull request #207 from weinimo/cert-management

Cert management
openstack-k8s-operators · Dec 12, 2023 · c143deb · c143deb
2 parents cdbdd42 + 99c281e
commit c143deb
Show file tree

Hide file tree

Showing 11 changed files with 405 additions and 24 deletions.
diff --git a/api/bases/octavia.openstack.org_octaviaamphoracontrollers.yaml b/api/bases/octavia.openstack.org_octaviaamphoracontrollers.yaml
@@ -50,9 +50,15 @@ spec:
             description: OctaviaAmphoraControllerSpec defines common state for all
               Octavia Amphora Controllers
             properties:
+              certspassphrasesecret:
+                default: octavia-ca-passphrase
+                description: Name of secret containing passphrase for the CA private
+                  keys
+                type: string
               certssecret:
-                description: '*kubebuilder:validation:Required Secret containing certs
-                  for securing communication with amphora based Load Balancers'
+                default: octavia-certs-secret
+                description: LoadBalancerCerts - Secret containing certs for securing
+                  communication with amphora based Load Balancers
                 type: string
               containerImage:
                 description: ContainerImage - Amphora Controller Container Image URL

diff --git a/api/bases/octavia.openstack.org_octavias.yaml b/api/bases/octavia.openstack.org_octavias.yaml
@@ -456,9 +456,15 @@ spec:
                 description: OctaviaHousekeeping - Spec definition for the Octavia
                   Housekeeping agent for the Octavia deployment
                 properties:
+                  certspassphrasesecret:
+                    default: octavia-ca-passphrase
+                    description: Name of secret containing passphrase for the CA private
+                      keys
+                    type: string
                   certssecret:
-                    description: '*kubebuilder:validation:Required Secret containing
-                      certs for securing communication with amphora based Load Balancers'
+                    default: octavia-certs-secret
+                    description: LoadBalancerCerts - Secret containing certs for securing
+                      communication with amphora based Load Balancers
                     type: string
                   containerImage:
                     description: ContainerImage - Amphora Controller Container Image
@@ -632,9 +638,15 @@ spec:
                 description: OctaviaHousekeeping - Spec definition for the Octavia
                   Housekeeping agent for the Octavia deployment
                 properties:
+                  certspassphrasesecret:
+                    default: octavia-ca-passphrase
+                    description: Name of secret containing passphrase for the CA private
+                      keys
+                    type: string
                   certssecret:
-                    description: '*kubebuilder:validation:Required Secret containing
-                      certs for securing communication with amphora based Load Balancers'
+                    default: octavia-certs-secret
+                    description: LoadBalancerCerts - Secret containing certs for securing
+                      communication with amphora based Load Balancers
                     type: string
                   containerImage:
                     description: ContainerImage - Amphora Controller Container Image
@@ -808,9 +820,15 @@ spec:
                 description: OctaviaHousekeeping - Spec definition for the Octavia
                   Housekeeping agent for the Octavia deployment
                 properties:
+                  certspassphrasesecret:
+                    default: octavia-ca-passphrase
+                    description: Name of secret containing passphrase for the CA private
+                      keys
+                    type: string
                   certssecret:
-                    description: '*kubebuilder:validation:Required Secret containing
-                      certs for securing communication with amphora based Load Balancers'
+                    default: octavia-certs-secret
+                    description: LoadBalancerCerts - Secret containing certs for securing
+                      communication with amphora based Load Balancers
                     type: string
                   containerImage:
                     description: ContainerImage - Amphora Controller Container Image

diff --git a/api/v1beta1/amphoracontroller_types.go b/api/v1beta1/amphoracontroller_types.go
@@ -77,10 +77,16 @@ type OctaviaAmphoraControllerSpec struct {
 	// Secret containing OpenStack password information for octavia OctaviaDatabasePassword, AdminPassword
 	Secret string `json:"secret"`
 
-	// *kubebuilder:validation:Required
-	// Secret containing certs for securing communication with amphora based Load Balancers
+	// +kubebuilder:validation:Required
+	// +kubebuilder:default=octavia-certs-secret
+	// LoadBalancerCerts - Secret containing certs for securing communication with amphora based Load Balancers
 	LoadBalancerCerts string `json:"certssecret"`
 
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:default=octavia-ca-passphrase
+	// Name of secret containing passphrase for the CA private keys
+	CAKeyPassphraseSecret string `json:"certspassphrasesecret"`
+
 	// +kubebuilder:validation:Optional
 	// +kubebuilder:default={database: OctaviaDatabasePassword, service: OctaviaPassword}
 	// PasswordSelectors - Selectors to identify the DB and AdminUser password from the Secret

diff --git a/config/crd/bases/octavia.openstack.org_octaviaamphoracontrollers.yaml b/config/crd/bases/octavia.openstack.org_octaviaamphoracontrollers.yaml
@@ -50,9 +50,15 @@ spec:
             description: OctaviaAmphoraControllerSpec defines common state for all
               Octavia Amphora Controllers
             properties:
+              certspassphrasesecret:
+                default: octavia-ca-passphrase
+                description: Name of secret containing passphrase for the CA private
+                  keys
+                type: string
               certssecret:
-                description: '*kubebuilder:validation:Required Secret containing certs
-                  for securing communication with amphora based Load Balancers'
+                default: octavia-certs-secret
+                description: LoadBalancerCerts - Secret containing certs for securing
+                  communication with amphora based Load Balancers
                 type: string
               containerImage:
                 description: ContainerImage - Amphora Controller Container Image URL

diff --git a/config/crd/bases/octavia.openstack.org_octavias.yaml b/config/crd/bases/octavia.openstack.org_octavias.yaml
@@ -456,9 +456,15 @@ spec:
                 description: OctaviaHousekeeping - Spec definition for the Octavia
                   Housekeeping agent for the Octavia deployment
                 properties:
+                  certspassphrasesecret:
+                    default: octavia-ca-passphrase
+                    description: Name of secret containing passphrase for the CA private
+                      keys
+                    type: string
                   certssecret:
-                    description: '*kubebuilder:validation:Required Secret containing
-                      certs for securing communication with amphora based Load Balancers'
+                    default: octavia-certs-secret
+                    description: LoadBalancerCerts - Secret containing certs for securing
+                      communication with amphora based Load Balancers
                     type: string
                   containerImage:
                     description: ContainerImage - Amphora Controller Container Image
@@ -632,9 +638,15 @@ spec:
                 description: OctaviaHousekeeping - Spec definition for the Octavia
                   Housekeeping agent for the Octavia deployment
                 properties:
+                  certspassphrasesecret:
+                    default: octavia-ca-passphrase
+                    description: Name of secret containing passphrase for the CA private
+                      keys
+                    type: string
                   certssecret:
-                    description: '*kubebuilder:validation:Required Secret containing
-                      certs for securing communication with amphora based Load Balancers'
+                    default: octavia-certs-secret
+                    description: LoadBalancerCerts - Secret containing certs for securing
+                      communication with amphora based Load Balancers
                     type: string
                   containerImage:
                     description: ContainerImage - Amphora Controller Container Image
@@ -808,9 +820,15 @@ spec:
                 description: OctaviaHousekeeping - Spec definition for the Octavia
                   Housekeeping agent for the Octavia deployment
                 properties:
+                  certspassphrasesecret:
+                    default: octavia-ca-passphrase
+                    description: Name of secret containing passphrase for the CA private
+                      keys
+                    type: string
                   certssecret:
-                    description: '*kubebuilder:validation:Required Secret containing
-                      certs for securing communication with amphora based Load Balancers'
+                    default: octavia-certs-secret
+                    description: LoadBalancerCerts - Secret containing certs for securing
+                      communication with amphora based Load Balancers
                     type: string
                   containerImage:
                     description: ContainerImage - Amphora Controller Container Image

diff --git a/config/samples/octavia_v1beta1_octavia.yaml b/config/samples/octavia_v1beta1_octavia.yaml
@@ -21,7 +21,8 @@ spec:
     serviceUser: octavia
     serviceAccount: octavia
     role: housekeeping
-    certssecret: todo
+    certssecret: octavia-amp-cert-data
+    certspassphrasesecret: octavia-ca-passphrase
     secret: osp-secret
     preserveJobs: false
     customServiceConfig: |
@@ -33,7 +34,8 @@ spec:
     serviceUser: octavia
     serviceAccount: octavia
     role: healthmanager
-    certssecret: todo
+    certssecret: octavia-amp-cert-data
+    certspassphrasesecret: octavia-ca-passphrase
     secret: osp-secret
     preserveJobs: false
     customServiceConfig: |
@@ -45,7 +47,8 @@ spec:
     serviceUser: octavia
     serviceAccount: octavia
     role: worker
-    certssecret: todo
+    certssecret: octavia-amp-cert-data
+    certspassphrasesecret: octavia-ca-passphrase
     secret: osp-secret
     preserveJobs: false
     customServiceConfig: |

diff --git a/controllers/amphoracontroller_controller.go b/controllers/amphoracontroller_controller.go
@@ -31,6 +31,7 @@ import (
 	"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/labels"
 	nad "github.com/openstack-k8s-operators/lib-common/modules/common/networkattachment"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/secret"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/util"
 
 	keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1"
@@ -252,6 +253,17 @@ func (r *OctaviaAmphoraControllerReconciler) reconcileNormal(ctx context.Context
 		return ctrl.Result{}, err
 	}
 
+	err = amphoracontrollers.EnsureAmphoraCerts(ctx, instance, helper, &Log)
+	if err != nil {
+		instance.Status.Conditions.Set(condition.FalseCondition(
+			condition.ServiceConfigReadyCondition,
+			condition.ErrorReason,
+			condition.SeverityWarning,
+			condition.ServiceConfigReadyErrorMessage,
+			err.Error()))
+		return ctrl.Result{}, err
+	}
+
 	instance.Status.Conditions.MarkTrue(condition.InputReadyCondition, condition.InputReadyMessage)
 
 	//
@@ -416,12 +428,25 @@ func (r *OctaviaAmphoraControllerReconciler) generateServiceConfigMaps(
 	if err != nil {
 		return err
 	}
-	templateParameters["ServiceUser"] = instance.Spec.ServiceUser
+	caPassSecret, _, err := secret.GetSecret(
+		ctx, helper, instance.Spec.CAKeyPassphraseSecret, instance.Namespace)
+	if err != nil {
+		return err
+	}
+	spec := instance.Spec
+	templateParameters["ServiceUser"] = spec.ServiceUser
 	templateParameters["KeystoneInternalURL"] = keystoneInternalURL
 	templateParameters["KeystonePublicURL"] = keystonePublicURL
-	templateParameters["ServiceRoleName"] = instance.Spec.Role
+	templateParameters["ServiceRoleName"] = spec.Role
 	templateParameters["LbMgmtNetworkId"] = templateVars.LbMgmtNetworkID
 	templateParameters["AmpFlavorId"] = templateVars.AmphoraDefaultFlavorID
+	serverCAPassphrase := caPassSecret.Data["server-ca-passphrase"]
+	if serverCAPassphrase != nil {
+		templateParameters["ServerCAKeyPassphrase"] = string(serverCAPassphrase)
+	} else {
+		// Can't do string(nil)
+		templateParameters["ServerCAKeyPassphrase"] = ""
+	}
 
 	// TODO(beagles): populate the template parameters
 	cms := []util.Template{