From 6594e72b86a5824b46ed5156c04bfae8a32ed2a2 Mon Sep 17 00:00:00 2001 From: Martin Schuppert Date: Fri, 12 Jan 2024 17:23:47 +0100 Subject: [PATCH] [tlse] internal TLS support for placement Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: https://github.com/openstack-k8s-operators/lib-common/pull/428 Depends-On: https://github.com/openstack-k8s-operators/openstack-operator/pull/620 Depends-On: https://github.com/openstack-k8s-operators/placement-operator/pull/92 Jira: OSPRH-2368 --- pkg/openstack/placement.go | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/pkg/openstack/placement.go b/pkg/openstack/placement.go index 7e04c78a2..156f36bbd 100644 --- a/pkg/openstack/placement.go +++ b/pkg/openstack/placement.go @@ -55,6 +55,12 @@ func ReconcilePlacementAPI(ctx context.Context, instance *corev1beta1.OpenStackC } } + // set CA cert and preserve any previously set TLS certs + if instance.Spec.TLS.Enabled(service.EndpointInternal) { + instance.Spec.Placement.Template.TLS = placementAPI.Spec.TLS + } + instance.Spec.Placement.Template.TLS.CaBundleSecretName = instance.Status.TLS.CaBundleSecretName + if placementAPI.Status.Conditions.IsTrue(condition.ExposeServiceReadyCondition) { svcs, err := service.GetServicesListWithLabel( ctx, @@ -75,7 +81,7 @@ func ReconcilePlacementAPI(ctx context.Context, instance *corev1beta1.OpenStackC instance.Spec.Placement.Template.Override.Service, instance.Spec.Placement.APIOverride, corev1beta1.OpenStackControlPlaneExposePlacementAPIReadyCondition, - true, // TODO: (mschuppert) disable TLS for now until implemented + false, // TODO (mschuppert) could be removed when all integrated service support TLS ) if err != nil { return ctrlResult, err @@ -84,6 +90,10 @@ func ReconcilePlacementAPI(ctx context.Context, instance *corev1beta1.OpenStackC } instance.Spec.Placement.Template.Override.Service = endpointDetails.GetEndpointServiceOverrides() + + // update TLS settings with cert secret + instance.Spec.Placement.Template.TLS.API.Public.SecretName = endpointDetails.GetEndptCertSecret(service.EndpointPublic) + instance.Spec.Placement.Template.TLS.API.Internal.SecretName = endpointDetails.GetEndptCertSecret(service.EndpointInternal) } Log.Info("Reconciling PlacementAPI", "PlacementAPI.Namespace", instance.Namespace, "PlacementAPI.Name", "placement")