[TLS] TLS for public endpoints terminated at a route

Changes openstacklient
* CRD to allows to pass in CA secret
* use kolla to run the openstackclient and update the environment
  CA on start with passed in CA secret to validate endpoint certs.

Adds CRD parameters to configure TLS for public and internal TLS.
* per default self signed root CA + issuer get created for
  public and internal certs
* public issuer can be provided by the user by referencing a named
  issuer in the namespace. Then this one is used.
* user can provide a CA secret for certs to be added to the combined
  CA secret the openstack-operator creates to pass into services /
  openstackclient
* refactors the current route create for followup on TLS-E to create
  certs for each service endpoint.
* when TLS for public endpoint is enabled (default) a Cert for the
  route gets automatically created and added to the route CR.

Jira: OSP-26299

Depends-On: openstack-k8s-operators/lib-common#351
Depends-On: openstack-k8s-operators/keystone-operator#318
Depends-On: openstack-k8s-operators/tcib#82

apis/bases/client.openstack.org_openstackclients.yaml

@@ -36,15 +36,19 @@ spec:
             type: object
           spec:
             properties:
+              caSecretName:
+                type: string
               containerImage:
                 type: string
               nodeSelector:
                 additionalProperties:
                   type: string
                 type: object
               openStackConfigMap:
+                default: openstack-config
                 type: string
               openStackConfigSecret:
+                default: openstack-config-secret
                 type: string
             required:
             - containerImage

apis/bases/core.openstack.org_openstackcontrolplanes.yaml

@@ -8969,6 +8969,30 @@ spec:
                     - secret
                     type: object
                 type: object
+              openstackclient:
+                properties:
+                  template:
+                    properties:
+                      caSecretName:
+                        type: string
+                      containerImage:
+                        type: string
+                      nodeSelector:
+                        additionalProperties:
+                          type: string
+                        type: object
+                      openStackConfigMap:
+                        default: openstack-config
+                        type: string
+                      openStackConfigSecret:
+                        default: openstack-config-secret
+                        type: string
+                    required:
+                    - containerImage
+                    - openStackConfigMap
+                    - openStackConfigSecret
+                    type: object
+                type: object
               ovn:
                 properties:
                   enabled:
@@ -13778,6 +13802,28 @@ spec:
                     - swiftStorage
                     type: object
                 type: object
+              tls:
+                default:
+                  publicEndpoints:
+                    enabled: true
+                properties:
+                  caSecretName:
+                    type: string
+                  internalEndpoints:
+                    properties:
+                      enabled:
+                        default: false
+                        type: boolean
+                    type: object
+                  publicEndpoints:
+                    properties:
+                      enabled:
+                        default: true
+                        type: boolean
+                      issuer:
+                        type: string
+                    type: object
+                type: object
             required:
             - secret
             - storageClass

apis/client/v1beta1/openstackclient_types.go

@@ -15,6 +15,7 @@ package v1beta1
 
 import (
 	condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/util"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -31,16 +32,25 @@ type OpenStackClientSpec struct {
 	// +kubebuilder:validation:Required
 	// ContainerImage for the the OpenstackClient container (will be set to environmental default if empty)
 	ContainerImage string `json:"containerImage"`
+
 	// +kubebuilder:validation:Required
+	// +kubebuilder:default=openstack-config
 	// OpenStackConfigMap is the name of the ConfigMap containing the clouds.yaml
-	OpenStackConfigMap string `json:"openStackConfigMap"`
+	OpenStackConfigMap *string `json:"openStackConfigMap"`
+
 	// +kubebuilder:validation:Required
+	// +kubebuilder:default=openstack-config-secret
 	// OpenStackConfigSecret is the name of the Secret containing the secure.yaml
-	OpenStackConfigSecret string `json:"openStackConfigSecret"`
+	OpenStackConfigSecret *string `json:"openStackConfigSecret"`
 
 	// +kubebuilder:validation:Optional
 	// NodeSelector to target subset of worker nodes running control plane services (currently only applies to KeystoneAPI and PlacementAPI)
 	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
+
+	// +kubebuilder:validation:Optional
+	//+operator-sdk:csv:customresourcedefinitions:type=spec
+	// Secret containing any CA certificates which should be added to deployment pods
+	tls.Ca `json:",inline"`
 }
 
 // OpenStackClientStatus defines the observed state of OpenStackClient

apis/core/v1beta1/conditions.go

@@ -102,6 +102,9 @@ const (
 	// OpenStackControlPlaneDNSReadyCondition Status=True condition which indicates if DNSMasq is configured and operational
 	OpenStackControlPlaneDNSReadyCondition condition.Type = "OpenStackControlPlaneDNSReadyCondition"
 
+	// OpenStackControlPlaneCAReadyCondition Status=True condition which indicates if the CAs are configured and operational
+	OpenStackControlPlaneCAReadyCondition condition.Type = "OpenStackControlPlaneCAReadyCondition"
+
 	// OpenStackControlPlaneCeilometerReadyCondition Status=True condition which indicates if OpenStack Ceilometer service is configured and operational
 	OpenStackControlPlaneCeilometerReadyCondition condition.Type = "OpenStackControlPlaneCeilometerReady"
 
@@ -384,4 +387,16 @@ const (
 
 	// OpenStackControlPlaneExposeServiceReadyMessage
 	OpenStackControlPlaneExposeServiceReadyMessage = "OpenStackControlPlane %s service exposed"
+
+	// OpenStackControlPlaneCAReadyInitMessage
+	OpenStackControlPlaneCAReadyInitMessage = "OpenStackControlPlane CAs not started"
+
+	// OpenStackControlPlaneCAReadyMessage
+	OpenStackControlPlaneCAReadyMessage = "OpenStackControlPlane CAs completed"
+
+	// OpenStackControlPlaneCAReadyRunningMessage
+	OpenStackControlPlaneCAReadyRunningMessage = "OpenStackControlPlane CAs in progress"
+
+	// OpenStackControlPlaneCAReadyErrorMessage
+	OpenStackControlPlaneCAReadyErrorMessage = "OpenStackControlPlane CAs %s %s error occured %s"
 )

apis/core/v1beta1/openstackcontrolplane_types.go

@@ -23,23 +23,25 @@ import (
 	horizonv1 "github.com/openstack-k8s-operators/horizon-operator/api/v1beta1"
 	memcachedv1 "github.com/openstack-k8s-operators/infra-operator/apis/memcached/v1beta1"
 	networkv1 "github.com/openstack-k8s-operators/infra-operator/apis/network/v1beta1"
+	redisv1 "github.com/openstack-k8s-operators/infra-operator/apis/redis/v1beta1"
 	ironicv1 "github.com/openstack-k8s-operators/ironic-operator/api/v1beta1"
 	keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1"
 	condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/route"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 	"github.com/openstack-k8s-operators/lib-common/modules/common/util"
 	"github.com/openstack-k8s-operators/lib-common/modules/storage"
 	manilav1 "github.com/openstack-k8s-operators/manila-operator/api/v1beta1"
 	mariadbv1 "github.com/openstack-k8s-operators/mariadb-operator/api/v1beta1"
 	neutronv1 "github.com/openstack-k8s-operators/neutron-operator/api/v1beta1"
 	novav1 "github.com/openstack-k8s-operators/nova-operator/api/v1beta1"
 	octaviav1 "github.com/openstack-k8s-operators/octavia-operator/api/v1beta1"
+	"github.com/openstack-k8s-operators/openstack-operator/apis/client/v1beta1"
 	ovnv1 "github.com/openstack-k8s-operators/ovn-operator/api/v1beta1"
 	placementv1 "github.com/openstack-k8s-operators/placement-operator/api/v1beta1"
 	swiftv1 "github.com/openstack-k8s-operators/swift-operator/api/v1beta1"
 	telemetryv1 "github.com/openstack-k8s-operators/telemetry-operator/api/v1beta1"
 	rabbitmqv2 "github.com/rabbitmq/cluster-operator/v2/api/v1beta1"
-	redisv1 "github.com/openstack-k8s-operators/infra-operator/apis/redis/v1beta1"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
@@ -69,6 +71,12 @@ type OpenStackControlPlaneSpec struct {
 	// NodeSelector to target subset of worker nodes running control plane services (currently only applies to KeystoneAPI and PlacementAPI)
 	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
 
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:default={publicEndpoints: {enabled: true}}
+	//+operator-sdk:csv:customresourcedefinitions:type=spec
+	// TLS - Parameters related to the TLS
+	TLS TLSSection `json:"tls,omitempty"`
+
 	// +kubebuilder:validation:Optional
 	//+operator-sdk:csv:customresourcedefinitions:type=spec
 	// DNS - Parameters related to the DNSMasq service
@@ -158,6 +166,11 @@ type OpenStackControlPlaneSpec struct {
 	// Redis - Parameters related to the Redis service
 	Redis RedisSection `json:"redis,omitempty"`
 
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	// OpenStackClient - Parameters related to the OpenStackClient
+	OpenStackClient OpenStackClientSection `json:"openstackclient,omitempty"`
+
 	// ExtraMounts containing conf files and credentials that should be provided
 	// to the underlying operators.
 	// This struct can be defined in the top level CR and propagated to the
@@ -168,6 +181,47 @@ type OpenStackControlPlaneSpec struct {
 	ExtraMounts []OpenStackExtraVolMounts `json:"extraMounts,omitempty"`
 }
 
+// TLSSection defines the desired state of TLS configuration
+type TLSSection struct {
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	// PublicEndpoints tls configuration
+	PublicEndpoints TLSPublicEndpointSection `json:"publicEndpoints,omitempty"`
+
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	// InternalEndpoints tls configuration
+	InternalEndpoints TLSInternalEndpointSection `json:"internalEndpoints,omitempty"`
+
+	// +kubebuilder:validation:optional
+	//+operator-sdk:csv:customresourcedefinitions:type=spec
+	// Secret containing any additional CA certificates, which should be added to deployment pods
+	tls.Ca `json:",inline"`
+}
+
+// TLSPublicEndpointSection defines the desired state of public TLSEndpoint configuration
+type TLSPublicEndpointSection struct {
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:default=true
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"}
+	// Enabled - Whether TLS should be enabled for endpoint type
+	Enabled bool `json:"enabled"`
+
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	// Issuer - cert-manager issuer to be used for the endpoint type. If not specified a self signed will be created.
+	Issuer *string `json:"issuer,omitempty"`
+}
+
+// TLSInternalEndpointSection defines the desired state of internal TLSEndpoint configuration
+type TLSInternalEndpointSection struct {
+	// +kubebuilder:validation:Optional
+	// +kubebuilder:default=false
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"}
+	// Enabled - Whether TLS should be enabled for endpoint type
+	Enabled bool `json:"enabled"`
+}
+
 // DNSMasqSection defines the desired state of DNSMasq service
 type DNSMasqSection struct {
 	// +kubebuilder:validation:Optional
@@ -561,6 +615,14 @@ type RedisSection struct {
 	Templates map[string]redisv1.RedisSpec `json:"templates,omitempty"`
 }
 
+// OpenStackClientSection defines the desired state of the OpenStackClient
+type OpenStackClientSection struct {
+	// +kubebuilder:validation:Optional
+	//+operator-sdk:csv:customresourcedefinitions:type=spec
+	// Template - Overrides to use when creating the OpenStackClient Resource
+	Template v1beta1.OpenStackClientSpec `json:"template,omitempty"`
+}
+
 // OpenStackControlPlaneStatus defines the observed state of OpenStackControlPlane
 type OpenStackControlPlaneStatus struct {
 	//+operator-sdk:csv:customresourcedefinitions:type=status,xDescriptors={"urn:alm:descriptor:io.kubernetes.conditions"}
@@ -642,6 +704,7 @@ func (instance *OpenStackControlPlane) InitConditions() {
 		condition.UnknownCondition(OpenStackControlPlaneSwiftReadyCondition, condition.InitReason, OpenStackControlPlaneSwiftReadyInitMessage),
 		condition.UnknownCondition(OpenStackControlPlaneOctaviaReadyCondition, condition.InitReason, OpenStackControlPlaneOctaviaReadyInitMessage),
 		condition.UnknownCondition(OpenStackControlPlaneRedisReadyCondition, condition.InitReason, OpenStackControlPlaneRedisReadyInitMessage),
+		condition.UnknownCondition(OpenStackControlPlaneCAReadyCondition, condition.InitReason, OpenStackControlPlaneCAReadyInitMessage),
 
 		// Also add the overall status condition as Unknown
 		condition.UnknownCondition(condition.ReadyCondition, condition.InitReason, condition.ReadyInitMessage),