[tlse] internal TLS support for placement #625

stuggi · 2024-01-11T12:11:47Z

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true

For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like:

  customServiceConfig: |
    [keystone_authtoken]
    insecure = true
    [placement]
    insecure = true
    [neutron]
    insecure = true
    [glance]
    insecure = true
    [cinder]
    insecure = true

Depends-On: openstack-k8s-operators/lib-common#428
Depends-On: #620
Depends-On: openstack-k8s-operators/placement-operator#92

Jira: OSPRH-2368

softwarefactory-project-zuul · 2024-01-11T12:12:02Z

Merge Failed.

This change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.
Warning:
Error merging github.com/openstack-k8s-operators/lib-common for 384,7629711060c894e11a1d5dff6feed8e3d6a731ae

stuggi · 2024-01-11T12:12:25Z

needs to be rebased when #620 landed. only last commit is relevant for this PR

Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs are mounted to in var/lib/config-data/tls/certs/%s.crt|key and a CA bundle to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem. Server cert and key are intended to be moved by kolla to /etc/pki/tls/certs|private. Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators/openstack-operator#625 Signed-off-by: Veronika Fisarova <[email protected]>

softwarefactory-project-zuul · 2024-01-12T16:24:14Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://review.rdoproject.org/zuul/buildset/5caa55bcca19459d8032f5d4e0664011

Warning:
Dependency cycle detected

Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs are mounted to in var/lib/config-data/tls/certs/%s.crt|key and a CA bundle to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem. Server cert and key are intended to be moved by kolla to /etc/pki/tls/certs|private. Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators/openstack-operator#625 Signed-off-by: Veronika Fisarova <[email protected]>

Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs get direct mounted to the appropriate place in etc/pki/tls/certs/%s.crt|key and a CA bundle to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem . Job deployments for bootstrap/cron get the CA bundle added if configured. Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators/openstack-operator#625 Signed-off-by: Veronika Fisarova <[email protected]>

Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs are mounted to in var/lib/config-data/tls/certs/%s.crt|key and a CA bundle to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem. Server cert and key are intended to be moved by kolla to /etc/pki/tls/certs|private. Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators/openstack-operator#625 Signed-off-by: Veronika Fisarova <[email protected]>

Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs get direct mounted to the appropriate place in etc/pki/tls/certs/%s.crt|key and a CA bundle to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem . Job deployments for bootstrap/cron get the CA bundle added if configured. Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators/openstack-operator#625 Signed-off-by: Veronika Fisarova <[email protected]>

gibizer

look OK to me

pkg/openstack/placement.go

Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs are mounted to in var/lib/config-data/tls/certs/%s.crt|key and a CA bundle to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem. Server cert and key are intended to be moved by kolla to /etc/pki/tls/certs|private. Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators/openstack-operator#625 Signed-off-by: Veronika Fisarova <[email protected]>

softwarefactory-project-zuul · 2024-01-26T00:39:21Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://review.rdoproject.org/zuul/buildset/002c1ec9b4d146a7a666e818ca13e435

✔️ openstack-k8s-operators-content-provider SUCCESS in 2h 19m 27s
✔️ podified-multinode-edpm-deployment-crc SUCCESS in 1h 12m 44s
❌ cifmw-crc-podified-edpm-baremetal FAILURE in 1h 20m 45s
✔️ cifmw-data-plane-adoption-osp-17-to-extracted-crc SUCCESS in 2h 01m 59s
✔️ openstack-operator-tempest-multinode SUCCESS in 1h 30m 12s

stuggi · 2024-01-26T01:51:56Z

recheck

softwarefactory-project-zuul · 2024-01-26T02:55:13Z

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://review.rdoproject.org/zuul/buildset/81f08f0162f04f95aaeac432fcd586a2

✔️ openstack-k8s-operators-content-provider SUCCESS in 1h 02m 05s
❌ podified-multinode-edpm-deployment-crc RETRY_LIMIT in 38m 07s
❌ cifmw-crc-podified-edpm-baremetal RETRY_LIMIT in 32m 51s
❌ cifmw-data-plane-adoption-osp-17-to-extracted-crc RETRY_LIMIT in 40m 56s
❌ openstack-operator-tempest-multinode RETRY_LIMIT in 39m 02s

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/placement-operator#92 Jira: OSPRH-2368

stuggi · 2024-01-30T08:13:43Z

/retest

olliewalsh

/lgtm

openshift-ci · 2024-01-30T10:40:13Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: olliewalsh, stuggi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [olliewalsh,stuggi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci bot requested review from abays and viroel January 11, 2024 12:11

openshift-ci bot added the approved label Jan 11, 2024

stuggi requested review from olliewalsh and Deydra71 and removed request for abays and viroel January 11, 2024 12:12

stuggi marked this pull request as draft January 11, 2024 12:12

openshift-ci bot added the do-not-merge/work-in-progress label Jan 11, 2024

stuggi mentioned this pull request Jan 11, 2024

[tlse] initial internal API TLS support for keystone, glance, cinder and neutron #592

Closed

Deydra71 mentioned this pull request Jan 11, 2024

[tlse] tls for PlacementAPI pod configuration openstack-k8s-operators/placement-operator#92

Merged

stuggi force-pushed the tlse_placement branch from c4b7555 to 9a7f938 Compare January 12, 2024 16:24

stuggi marked this pull request as ready for review January 12, 2024 16:25

openshift-ci bot removed the do-not-merge/work-in-progress label Jan 12, 2024

openshift-ci bot requested review from abays and frenzyfriday January 12, 2024 16:25

Deydra71 mentioned this pull request Jan 18, 2024

[tlse] tls for ManilaAPI pod configuration openstack-k8s-operators/manila-operator#212

Merged

gibizer reviewed Jan 19, 2024

View reviewed changes

pkg/openstack/placement.go Show resolved Hide resolved

openshift-merge-robot added the needs-rebase label Jan 19, 2024

stuggi force-pushed the tlse_placement branch from 9a7f938 to 6d269ce Compare January 25, 2024 22:18

openshift-merge-robot removed the needs-rebase label Jan 25, 2024

openshift-merge-robot added the needs-rebase label Jan 27, 2024

stuggi force-pushed the tlse_placement branch from 6d269ce to 6594e72 Compare January 29, 2024 07:31

openshift-merge-robot removed the needs-rebase label Jan 29, 2024

olliewalsh approved these changes Jan 30, 2024

View reviewed changes

openshift-ci bot assigned olliewalsh Jan 30, 2024

openshift-ci bot added the lgtm label Jan 30, 2024

openshift-merge-bot bot merged commit a5d7799 into openstack-k8s-operators:main Jan 30, 2024
7 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[tlse] internal TLS support for placement #625

[tlse] internal TLS support for placement #625

stuggi commented Jan 11, 2024 •

edited by openshift-ci bot

Loading

softwarefactory-project-zuul bot commented Jan 11, 2024

stuggi commented Jan 11, 2024

softwarefactory-project-zuul bot commented Jan 12, 2024

gibizer left a comment

softwarefactory-project-zuul bot commented Jan 26, 2024

stuggi commented Jan 26, 2024

softwarefactory-project-zuul bot commented Jan 26, 2024

stuggi commented Jan 30, 2024

olliewalsh left a comment

openshift-ci bot commented Jan 30, 2024

[tlse] internal TLS support for placement #625

[tlse] internal TLS support for placement #625

Conversation

stuggi commented Jan 11, 2024 • edited by openshift-ci bot Loading

softwarefactory-project-zuul bot commented Jan 11, 2024

stuggi commented Jan 11, 2024

softwarefactory-project-zuul bot commented Jan 12, 2024

gibizer left a comment

Choose a reason for hiding this comment

softwarefactory-project-zuul bot commented Jan 26, 2024

stuggi commented Jan 26, 2024

softwarefactory-project-zuul bot commented Jan 26, 2024

stuggi commented Jan 30, 2024

olliewalsh left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Jan 30, 2024

stuggi commented Jan 11, 2024 •

edited by openshift-ci bot

Loading