Merge pull request #1137 from stuggi/default_edpm_cacerts

Set combined-ca-bundle as the default CACerts secret name
openstack-k8s-operators · Oct 30, 2024 · 937ac9e · 937ac9e
2 parents 1276a85 + 15d7bf8
commit 937ac9e
Show file tree

Hide file tree

Showing 6 changed files with 22 additions and 1 deletion.
diff --git a/apis/bases/dataplane.openstack.org_openstackdataplaneservices.yaml b/apis/bases/dataplane.openstack.org_openstackdataplaneservices.yaml
@@ -35,6 +35,7 @@ spec:
                 default: false
                 type: boolean
               caCerts:
+                default: combined-ca-bundle
                 maxLength: 253
                 type: string
               certsFrom:

diff --git a/apis/dataplane/v1beta1/openstackdataplaneservice_types.go b/apis/dataplane/v1beta1/openstackdataplaneservice_types.go
@@ -75,7 +75,8 @@ type OpenStackDataPlaneServiceSpec struct {
 	// CACerts - Secret containing the CA certificate chain
 	// +kubebuilder:validation:Optional
 	// +kubebuilder:validation:MaxLength:=253
-	CACerts string `json:"caCerts,omitempty" yaml:"caCerts,omitempty"`
+	// +kubebuilder:default="combined-ca-bundle"
+	CACerts string `json:"caCerts" yaml:"caCerts"`
 
 	// OpenStackAnsibleEERunnerImage image to use as the ansibleEE runner image
 	// +kubebuilder:validation:Optional

diff --git a/config/crd/bases/dataplane.openstack.org_openstackdataplaneservices.yaml b/config/crd/bases/dataplane.openstack.org_openstackdataplaneservices.yaml
@@ -35,6 +35,7 @@ spec:
                 default: false
                 type: boolean
               caCerts:
+                default: combined-ca-bundle
                 maxLength: 253
                 type: string
               certsFrom:

diff --git a/tests/kuttl/tests/dataplane-deploy-global-service-test/01-assert.yaml b/tests/kuttl/tests/dataplane-deploy-global-service-test/01-assert.yaml
@@ -763,6 +763,8 @@ spec:
           name: libvirt-combined-ca-bundle
         - mountPath: /var/lib/openstack/cacerts/nova
           name: nova-combined-ca-bundle
+        - mountPath: /var/lib/openstack/cacerts/custom-global-service
+          name: custom-global-service-combined-ca-bundle
         - mountPath: /runner/env/ssh_key
           name: ssh-key
           subPath: ssh_key
@@ -804,6 +806,10 @@ spec:
         secret:
           defaultMode: 420
           secretName: combined-ca-bundle
+      - name: custom-global-service-combined-ca-bundle
+        secret:
+          defaultMode: 420
+          secretName: combined-ca-bundle
       - name: ssh-key
         secret:
           defaultMode: 420

diff --git a/tests/kuttl/tests/dataplane-deploy-multiple-secrets/02-assert.yaml b/tests/kuttl/tests/dataplane-deploy-multiple-secrets/02-assert.yaml
@@ -173,6 +173,8 @@ spec:
         terminationMessagePath: /dev/termination-log
         terminationMessagePolicy: File
         volumeMounts:
+        - mountPath: /var/lib/openstack/cacerts/install-certs-ovr
+          name: install-certs-ovr-combined-ca-bundle
         - mountPath: /var/lib/openstack/certs/generic-service1/default
           name: openstack-edpm-tls-generic-service1-default-certs-0
         - mountPath: /var/lib/openstack/cacerts/generic-service1
@@ -190,6 +192,10 @@ spec:
       serviceAccountName: openstack-edpm-tls
       terminationGracePeriodSeconds: 30
       volumes:
+      - name: install-certs-ovr-combined-ca-bundle
+        secret:
+          defaultMode: 420
+          secretName: combined-ca-bundle
       - name: openstack-edpm-tls-generic-service1-default-certs-0
         projected:
           defaultMode: 420

diff --git a/tests/kuttl/tests/dataplane-deploy-tls-test/02-assert.yaml b/tests/kuttl/tests/dataplane-deploy-tls-test/02-assert.yaml
@@ -206,6 +206,8 @@ spec:
         terminationMessagePath: /dev/termination-log
         terminationMessagePolicy: File
         volumeMounts:
+        - mountPath: /var/lib/openstack/cacerts/install-certs-ovrd
+          name: install-certs-ovrd-combined-ca-bundle
         - mountPath: /var/lib/openstack/certs/tls-dnsnames/default
           name: openstack-edpm-tls-tls-dnsnames-default-certs-0
         - mountPath: /var/lib/openstack/certs/tls-dnsnames/second
@@ -225,6 +227,10 @@ spec:
       serviceAccountName: openstack-edpm-tls
       terminationGracePeriodSeconds: 30
       volumes:
+      - name: install-certs-ovrd-combined-ca-bundle
+        secret:
+          defaultMode: 420
+          secretName: combined-ca-bundle
       - name: openstack-edpm-tls-tls-dnsnames-default-certs-0
         projected:
           defaultMode: 420