[TLS] Create full CA bundle from operator base image

Instead of adding additional CAs (public, internal, 3rd party) to the deployments, this will create a full tls-ca-bundle.pem using the operator image ca-bundle as base and adds the public, internal and user provided CAs to it. This allows to mount a full tls-ca-bundle.pem into the deployment pod and don't have to rely on kolla to run update-ca-trust which requires container to run as root. Jira: OSP-26299
stuggi · Oct 10, 2023 · 13c2e93 · 13c2e93
1 parent e5d20e8
commit 13c2e93
Show file tree

Hide file tree

Showing 7 changed files with 200 additions and 46 deletions.
diff --git a/config/samples/core_v1beta1_openstackcontrolplane.yaml b/config/samples/core_v1beta1_openstackcontrolplane.yaml
@@ -10,9 +10,6 @@ spec:
       enabled: false
     publicEndpoints:
       enabled: true
-  openstackclient:
-    template:
-      containerImage: quay.io/mschuppe/openstack-openstackclient:current-podified
   keystone:
     template:
       databaseInstance: openstack

diff --git a/config/samples/core_v1beta1_openstackcontrolplane_galera_network_isolation.yaml b/config/samples/core_v1beta1_openstackcontrolplane_galera_network_isolation.yaml
@@ -10,9 +10,6 @@ spec:
       enabled: false
     publicEndpoints:
       enabled: true
-  openstackclient:
-    template:
-      containerImage: quay.io/mschuppe/openstack-openstackclient:current-podified
   dns:
     template:
       override:

diff --git a/config/samples/core_v1beta1_openstackcontrolplane_galera_network_isolation_3replicas.yaml b/config/samples/core_v1beta1_openstackcontrolplane_galera_network_isolation_3replicas.yaml
@@ -10,9 +10,6 @@ spec:
       enabled: false
     publicEndpoints:
       enabled: true
-  openstackclient:
-    template:
-      containerImage: quay.io/mschuppe/openstack-openstackclient:current-podified
   dns:
     template:
       override:

diff --git a/config/samples/core_v1beta1_openstackcontrolplane_network_isolation.yaml b/config/samples/core_v1beta1_openstackcontrolplane_network_isolation.yaml
@@ -10,9 +10,6 @@ spec:
       enabled: false
     publicEndpoints:
       enabled: true
-  openstackclient:
-    template:
-      containerImage: quay.io/mschuppe/openstack-openstackclient:current-podified
   dns:
     template:
       override:

diff --git a/controllers/core/openstackcontrolplane_controller.go b/controllers/core/openstackcontrolplane_controller.go
@@ -31,6 +31,7 @@ import (
 	keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1"
 	condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
+	corev1 "k8s.io/api/core/v1"
 
 	manilav1 "github.com/openstack-k8s-operators/manila-operator/api/v1beta1"
 	mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
@@ -328,6 +329,7 @@ func (r *OpenStackControlPlaneReconciler) reconcileNormal(ctx context.Context, i
 func (r *OpenStackControlPlaneReconciler) SetupWithManager(mgr ctrl.Manager) error {
 	return ctrl.NewControllerManagedBy(mgr).
 		For(&corev1beta1.OpenStackControlPlane{}).
+		Owns(&corev1.Secret{}).
 		Owns(&mariadbv1.MariaDB{}).
 		Owns(&mariadbv1.Galera{}).
 		Owns(&memcachedv1.Memcached{}).

diff --git a/go.mod b/go.mod
@@ -34,6 +34,7 @@ require (
 	github.com/operator-framework/api v0.17.6
 	github.com/rabbitmq/cluster-operator/v2 v2.5.0
 	go.uber.org/zap v1.26.0
+	golang.org/x/exp v0.0.0-20230905200255-921286631fa9
 	k8s.io/api v0.27.2
 	k8s.io/apimachinery v0.27.4
 	k8s.io/client-go v0.27.2
@@ -46,7 +47,6 @@ require (
 	github.com/google/pprof v0.0.0-20230510103437-eeec1cb781c3 // indirect
 	github.com/metal3-io/baremetal-operator/apis v0.3.1 // indirect
 	github.com/metal3-io/baremetal-operator/pkg/hardwareutils v0.2.0 // indirect
-	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
 	golang.org/x/tools v0.14.0 // indirect
 	sigs.k8s.io/gateway-api v0.6.0 // indirect
 )