Merge pull request #875 from vakwetu/add_multiple_cert_support

Add multiple cert support
openstack-k8s-operators · Jun 6, 2024 · e2cd3f7 · e2cd3f7
2 parents 650ed3f + ce25cd9
commit e2cd3f7
Show file tree

Hide file tree

Showing 27 changed files with 491 additions and 361 deletions.
diff --git a/api/bases/dataplane.openstack.org_openstackdataplaneservices.yaml b/api/bases/dataplane.openstack.org_openstackdataplaneservices.yaml
@@ -83,52 +83,54 @@ spec:
                 items:
                   type: string
                 type: array
-              tlsCert:
-                properties:
-                  contents:
-                    items:
-                      type: string
-                    minItems: 1
-                    type: array
-                  edpmRoleServiceName:
-                    type: string
-                  issuer:
-                    type: string
-                  keyUsages:
-                    items:
-                      enum:
-                      - signing
-                      - digital signature
-                      - content commitment
-                      - key encipherment
-                      - key agreement
-                      - data encipherment
-                      - cert sign
-                      - crl sign
-                      - encipher only
-                      - decipher only
-                      - any
-                      - server auth
-                      - client auth
-                      - code signing
-                      - email protection
-                      - s/mime
-                      - ipsec end system
-                      - ipsec tunnel
-                      - ipsec user
-                      - timestamping
-                      - ocsp signing
-                      - microsoft sgc
-                      - netscape sgc
+              tlsCerts:
+                additionalProperties:
+                  properties:
+                    contents:
+                      items:
+                        type: string
+                      minItems: 1
+                      type: array
+                    edpmRoleServiceName:
                       type: string
-                    type: array
-                  networks:
-                    items:
-                      pattern: ^[a-zA-Z0-9][a-zA-Z0-9\-_]*[a-zA-Z0-9]$
+                    issuer:
                       type: string
-                    type: array
-                required:
-                - contents
+                    keyUsages:
+                      items:
+                        enum:
+                        - signing
+                        - digital signature
+                        - content commitment
+                        - key encipherment
+                        - key agreement
+                        - data encipherment
+                        - cert sign
+                        - crl sign
+                        - encipher only
+                        - decipher only
+                        - any
+                        - server auth
+                        - client auth
+                        - code signing
+                        - email protection
+                        - s/mime
+                        - ipsec end system
+                        - ipsec tunnel
+                        - ipsec user
+                        - timestamping
+                        - ocsp signing
+                        - microsoft sgc
+                        - netscape sgc
+                        type: string
+                      type: array
+                    networks:
+                      items:
+                        pattern: ^[a-zA-Z0-9][a-zA-Z0-9\-_]*[a-zA-Z0-9]$
+                        type: string
+                      type: array
+                  required:
+                  - contents
+                  type: object
                 type: object
             type: object
           status:

diff --git a/api/v1beta1/openstackdataplaneservice_types.go b/api/v1beta1/openstackdataplaneservice_types.go
@@ -70,9 +70,9 @@ type OpenStackDataPlaneServiceSpec struct {
 	// OpenStackAnsibleEE
 	DataSources []DataSource `json:"datasources,omitempty"`
 
-	// TLSCert tls certs to be generated
+	// TLSCerts tls certs to be generated
 	// +kubebuilder:validation:Optional
-	TLSCert *OpenstackDataPlaneServiceCert `json:"tlsCert,omitempty" yaml:"tlsCert,omitempty"`
+	TLSCerts map[string]OpenstackDataPlaneServiceCert `json:"tlsCerts,omitempty" yaml:"tlsCerts,omitempty"`
 
 	// Play is an inline playbook contents that ansible will run on execution.
 	Play string `json:"play,omitempty"`

diff --git a/api/v1beta1/zz_generated.deepcopy.go b/api/v1beta1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/dataplane.openstack.org_openstackdataplaneservices.yaml b/config/crd/bases/dataplane.openstack.org_openstackdataplaneservices.yaml
@@ -83,52 +83,54 @@ spec:
                 items:
                   type: string
                 type: array
-              tlsCert:
-                properties:
-                  contents:
-                    items:
-                      type: string
-                    minItems: 1
-                    type: array
-                  edpmRoleServiceName:
-                    type: string
-                  issuer:
-                    type: string
-                  keyUsages:
-                    items:
-                      enum:
-                      - signing
-                      - digital signature
-                      - content commitment
-                      - key encipherment
-                      - key agreement
-                      - data encipherment
-                      - cert sign
-                      - crl sign
-                      - encipher only
-                      - decipher only
-                      - any
-                      - server auth
-                      - client auth
-                      - code signing
-                      - email protection
-                      - s/mime
-                      - ipsec end system
-                      - ipsec tunnel
-                      - ipsec user
-                      - timestamping
-                      - ocsp signing
-                      - microsoft sgc
-                      - netscape sgc
+              tlsCerts:
+                additionalProperties:
+                  properties:
+                    contents:
+                      items:
+                        type: string
+                      minItems: 1
+                      type: array
+                    edpmRoleServiceName:
                       type: string
-                    type: array
-                  networks:
-                    items:
-                      pattern: ^[a-zA-Z0-9][a-zA-Z0-9\-_]*[a-zA-Z0-9]$
+                    issuer:
                       type: string
-                    type: array
-                required:
-                - contents
+                    keyUsages:
+                      items:
+                        enum:
+                        - signing
+                        - digital signature
+                        - content commitment
+                        - key encipherment
+                        - key agreement
+                        - data encipherment
+                        - cert sign
+                        - crl sign
+                        - encipher only
+                        - decipher only
+                        - any
+                        - server auth
+                        - client auth
+                        - code signing
+                        - email protection
+                        - s/mime
+                        - ipsec end system
+                        - ipsec tunnel
+                        - ipsec user
+                        - timestamping
+                        - ocsp signing
+                        - microsoft sgc
+                        - netscape sgc
+                        type: string
+                      type: array
+                    networks:
+                      items:
+                        pattern: ^[a-zA-Z0-9][a-zA-Z0-9\-_]*[a-zA-Z0-9]$
+                        type: string
+                      type: array
+                  required:
+                  - contents
+                  type: object
                 type: object
             type: object
           status:

diff --git a/config/services/dataplane_v1beta1_openstackdataplaneservice_libvirt.yaml b/config/services/dataplane_v1beta1_openstackdataplaneservice_libvirt.yaml
@@ -8,16 +8,17 @@ spec:
     # NOTE: this Secret needs to be created before deploying the data plane.
     # It should contain the libvirt sasl auth password using the key LibvirtPassword
     - libvirt-secret
-  tlsCert:
-    contents:
-      - dnsnames
-      - ips
-    networks:
-      - ctlplane
-    keyUsages:
-      - digital signature
-      - key encipherment
-      - server auth
-      - client auth
-    issuer: osp-rootca-issuer-libvirt
+  tlsCerts:
+    default:
+      contents:
+        - dnsnames
+        - ips
+      networks:
+        - ctlplane
+      keyUsages:
+        - digital signature
+        - key encipherment
+        - server auth
+        - client auth
+      issuer: osp-rootca-issuer-libvirt
   caCerts: combined-ca-bundle
diff --git a/config/services/dataplane_v1beta1_openstackdataplaneservice_neutron_metadata.yaml b/config/services/dataplane_v1beta1_openstackdataplaneservice_neutron_metadata.yaml
@@ -7,17 +7,18 @@ spec:
   secrets:
   - neutron-ovn-metadata-agent-neutron-config
   - nova-metadata-neutron-config
-  tlsCert:
-    contents:
-    - dnsnames
-    - ips
-    networks:
-    - ctlplane
-    issuer: osp-rootca-issuer-ovn
-    keyUsages:
-      - digital signature
-      - key encipherment
-      - client auth
+  tlsCerts:
+    default:
+      contents:
+      - dnsnames
+      - ips
+      networks:
+      - ctlplane
+      issuer: osp-rootca-issuer-ovn
+      keyUsages:
+        - digital signature
+        - key encipherment
+        - client auth
   caCerts: combined-ca-bundle
   containerImageFields:
   - EdpmNeutronMetadataAgentImage
diff --git a/config/services/dataplane_v1beta1_openstackdataplaneservice_neutron_ovn.yaml b/config/services/dataplane_v1beta1_openstackdataplaneservice_neutron_ovn.yaml
@@ -6,17 +6,18 @@ spec:
   playbook: osp.edpm.neutron_ovn
   secrets:
   - neutron-ovn-agent-neutron-config
-  tlsCert:
-    contents:
-    - dnsnames
-    - ips
-    networks:
-    - ctlplane
-    issuer: osp-rootca-issuer-ovn
-    keyUsages:
-      - digital signature
-      - key encipherment
-      - client auth
+  tlsCerts:
+    default:
+      contents:
+      - dnsnames
+      - ips
+      networks:
+      - ctlplane
+      issuer: osp-rootca-issuer-ovn
+      keyUsages:
+        - digital signature
+        - key encipherment
+        - client auth
   caCerts: combined-ca-bundle
   containerImageFields:
   - EdpmNeutronOvnAgentImage
diff --git a/config/services/dataplane_v1beta1_openstackdataplaneservice_ovn.yaml b/config/services/dataplane_v1beta1_openstackdataplaneservice_ovn.yaml
@@ -6,18 +6,19 @@ spec:
   playbook: osp.edpm.ovn
   configMaps:
   - ovncontroller-config
-  tlsCert:
-    contents:
-    - dnsnames
-    - ips
-    networks:
-    - ctlplane
-    issuer: osp-rootca-issuer-ovn
-    keyUsages:
-      - digital signature
-      - key encipherment
-      - server auth
-      - client auth
+  tlsCerts:
+    default:
+      contents:
+      - dnsnames
+      - ips
+      networks:
+      - ctlplane
+      issuer: osp-rootca-issuer-ovn
+      keyUsages:
+        - digital signature
+        - key encipherment
+        - server auth
+        - client auth
   caCerts: combined-ca-bundle
   containerImageFields:
   - OvnControllerImage
diff --git a/config/services/dataplane_v1beta1_openstackdataplaneservice_ovn_bgp_agent.yaml b/config/services/dataplane_v1beta1_openstackdataplaneservice_ovn_bgp_agent.yaml
@@ -6,18 +6,19 @@ spec:
   playbook: osp.edpm.ovn_bgp_agent
   secrets:
   - neutron-ovn-agent-neutron-config
-  tlsCert:
-    contents:
-    - dnsnames
-    - ips
-    networks:
-    - ctlplane
-    issuer: osp-rootca-issuer-ovn
-    keyUsages:
-      - digital signature
-      - key encipherment
-      - server auth
-      - client auth
+  tlsCerts:
+    default:
+      contents:
+      - dnsnames
+      - ips
+      networks:
+      - ctlplane
+      issuer: osp-rootca-issuer-ovn
+      keyUsages:
+        - digital signature
+        - key encipherment
+        - server auth
+        - client auth
   caCerts: combined-ca-bundle
   containerImageFields:
   - EdpmOvnBgpAgentImage
diff --git a/config/services/dataplane_v1beta1_openstackdataplaneservice_telemetry.yaml b/config/services/dataplane_v1beta1_openstackdataplaneservice_telemetry.yaml
@@ -6,9 +6,10 @@ spec:
   secrets:
     - ceilometer-compute-config-data
   playbook: osp.edpm.telemetry
-  tlsCert:
-    contents:
-    - ips
+  tlsCerts:
+    default:
+      contents:
+      - ips
   caCerts: combined-ca-bundle
   containerImageFields:
   - CeilometerComputeImage