[tlse] tls for PlacementAPI pod configuration #92

Deydra71 · 2023-10-13T10:01:37Z

Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs get direct mounted to the appropriate place in etc/pki/tls/certs/%s.crt|key and a CA bundle to
/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem . Job deployments for bootstrap/cron get the CA bundle added if configured.

Depends-On: openstack-k8s-operators/lib-common#428

Jira: OSPRH-2368

openshift-ci · 2023-10-13T10:01:42Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

Deydra71 · 2023-10-13T10:24:08Z

templates/placementapi/config/placement-api-config.json

+            "optional": true
+        },
+        {
+            "source": "/var/lib/config-data/ca-trust",


@stuggi
Since we will be using one CA bundle file created by openstack-operator, we can specify the individual file instead the general folder (?)

yes lets do that

SeanMooney · 2023-10-13T10:41:18Z

this PR should contian updates to the samples and kuttl and even tests to test it
before it can be merged

Deydra71 · 2023-10-13T10:44:27Z

this PR should contian updates to the samples and kuttl and even tests to test it before it can be merged

It's in the draft state still ^^

SeanMooney · 2023-10-13T10:48:47Z

yes i know just wanted to call that out
apparently the patches that added the service override functionality did not add that coverage so i don't want use to continue to extend this functionality uhntil that gap is closed

stuggi · 2023-10-13T13:08:21Z

yes i know just wanted to call that out apparently the patches that added the service override functionality did not add that coverage so i don't want use to continue to extend this functionality uhntil that gap is closed

I had added envtest coverage in serviceoverride PR https://github.com/openstack-k8s-operators/placement-operator/blob/main/tests/functional/placementapi_controller_test.go#L452 / https://github.com/openstack-k8s-operators/placement-operator/blob/main/tests/functional/placementapi_controller_test.go#L537

gibizer

The general direction looks good to me

Deydra71 · 2023-10-23T06:26:17Z

@gibizer Could you please review, and give ok to test label if sufficient? I still need to make updates to kuttl and functional test, but otherwise the general TLS support is set from major part.

stuggi · 2023-10-24T07:24:38Z

api/bases/placement.openstack.org_placementapis.yaml

+                    properties:
+                      disableNonTLSListeners:
+                        type: boolean
+                      secretName:


I just realized that this is probably not enough. we create two services per api, public and internal to allow to use different service types (also LoadBalancer types if you do not use routes for public). With the current tls struct here, we only allow passing in one secret for the service operator.

I mean this is not a blocker for this PR since its main focus is to get the cacert bundle in so that it can validate e.g. tls connection to db/rabbit. the second step would be to enable the tls for placement itself. just something we have to enhance.

I see, updating the Service struct could bring more mess as it's already being used in other's implementations. I suggest keeping this PR focused on CA bundle support and then in next implement the support for the public and internal service type.

Deydra71 · 2023-11-01T10:39:46Z

On hold until the agreed changes of the TLS structure are implemented in the lib-common.

bogdando · 2024-01-19T15:17:46Z

tests/kuttl/common/tls_certificates.yaml

+metadata:
+  name: cert-public-svc
+  labels:
+     service: placement


controllers/placementapi_controller.go

gibizer · 2024-01-22T12:11:33Z

/test placement-operator-build-deploy-kuttl

Warning: Push failed, retrying in 5s ...
Registry server Address: 
Registry server User Name: openstack-k8s-operators+cirobot
Registry server Email: 
Registry server Password: <<non-empty>>
error: build error: Failed to push image: trying to reuse blob sha256:07a64a71e01156f8f99039bc246149925c6d1480d3957de78510bbec6ec68f7a at destination: pinging container registry quay.rdoproject.org: Get "https://quay.rdoproject.org/v2/": net/http: TLS handshake timeout

gibizer

I'm happy with this. So

api/go.mod

controllers/placementapi_controller.go

Public/Internal service cert secrets and the CA bundle secret can be passed to configure httpd virtual hosts for tls termination. The certs are mounted to in var/lib/config-data/tls/certs/%s.crt|key and a CA bundle to /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem. Server cert and key are intended to be moved by kolla to /etc/pki/tls/certs|private. Depends-On: openstack-k8s-operators/lib-common#428 Signed-off-by: Veronika Fisarova <[email protected]>

gibizer

Looks good to me. I assume it was tested together with openstack-k8s-operators/openstack-operator#625 and works.

openshift-ci · 2024-01-25T08:54:42Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Deydra71, gibizer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [gibizer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Creates certs for k8s service of the service operator when spec.tls.endpoint.internal.enabled: true For a service like nova which talks to multiple service internal endpoints, this has to be set for each of them for, like: ~~~ customServiceConfig: | [keystone_authtoken] insecure = true [placement] insecure = true [neutron] insecure = true [glance] insecure = true [cinder] insecure = true ~~~ Depends-On: openstack-k8s-operators/lib-common#428 Depends-On: openstack-k8s-operators#620 Depends-On: openstack-k8s-operators/placement-operator#92 Jira: OSPRH-2368

openshift-ci bot added the do-not-merge/work-in-progress label Oct 13, 2023

Deydra71 force-pushed the tls-support branch from 8b9fa50 to 8bc3a86 Compare October 13, 2023 10:20

Deydra71 commented Oct 13, 2023

View reviewed changes

SeanMooney added requires-envtest This pr requires envtest coverage before it merges requires-kuttl This PR requires kuttl tests before it can merge requires-samples This PR requires samples to be updated before it can merge labels Oct 13, 2023

gibizer reviewed Oct 17, 2023

View reviewed changes

Deydra71 force-pushed the tls-support branch 7 times, most recently from 030e9ef to 2cc67b3 Compare October 22, 2023 07:57

Deydra71 requested a review from gibizer October 23, 2023 06:26

stuggi reviewed Oct 24, 2023

View reviewed changes

Deydra71 force-pushed the tls-support branch 3 times, most recently from 7157889 to 0e75c13 Compare October 26, 2023 09:00

Deydra71 added the do-not-merge/hold label Nov 1, 2023

Deydra71 force-pushed the tls-support branch from 0e75c13 to 7e98cb3 Compare December 11, 2023 13:29

Deydra71 changed the title ~~[TLS] Add support for the TLS configuration~~ [tlse] tls for PlacementAPI pod configuration Dec 11, 2023

Deydra71 force-pushed the tls-support branch from 7e98cb3 to 28dfcf4 Compare December 11, 2023 13:39

bogdando reviewed Jan 19, 2024

View reviewed changes

controllers/placementapi_controller.go Show resolved Hide resolved

bogdando reviewed Jan 19, 2024

View reviewed changes

controllers/placementapi_controller.go Show resolved Hide resolved

gibizer requested changes Jan 19, 2024

View reviewed changes

controllers/placementapi_controller.go Show resolved Hide resolved

openshift-ci bot removed the approved label Jan 19, 2024

Deydra71 force-pushed the tls-support branch 3 times, most recently from d578b11 to 6779da3 Compare January 22, 2024 09:07

gibizer reviewed Jan 22, 2024

View reviewed changes

api/go.mod Outdated Show resolved Hide resolved

controllers/placementapi_controller.go Show resolved Hide resolved

Deydra71 force-pushed the tls-support branch from 6779da3 to ad77f77 Compare January 22, 2024 12:32

bogdando requested changes Jan 22, 2024

View reviewed changes

controllers/placementapi_controller.go Show resolved Hide resolved

openshift-ci bot assigned bogdando Jan 22, 2024

gibizer mentioned this pull request Jan 22, 2024

[tlse] tls for NovaAPI, NovaMetadata and NovNoVNCProxy openstack-k8s-operators/nova-operator#646

Merged

Deydra71 force-pushed the tls-support branch from ad77f77 to e69f146 Compare January 23, 2024 11:14

Deydra71 force-pushed the tls-support branch from e69f146 to ce0f633 Compare January 23, 2024 12:59

Deydra71 requested review from gibizer and bogdando January 25, 2024 08:44

gibizer approved these changes Jan 25, 2024

View reviewed changes

openshift-ci bot added the lgtm label Jan 25, 2024

openshift-ci bot added the approved label Jan 25, 2024

Deydra71 removed the do-not-merge/hold label Jan 25, 2024

openshift-merge-bot bot merged commit 72883dc into openstack-k8s-operators:main Jan 25, 2024
6 checks passed

bogdando mentioned this pull request Jan 29, 2024

Avoid multiple calls to k8s apiserver where things could use a single call as well #142

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[tlse] tls for PlacementAPI pod configuration #92

[tlse] tls for PlacementAPI pod configuration #92

Deydra71 commented Oct 13, 2023 •

edited

Loading

openshift-ci bot commented Oct 13, 2023

Deydra71 Oct 13, 2023

stuggi Oct 13, 2023

SeanMooney commented Oct 13, 2023

Deydra71 commented Oct 13, 2023 •

edited

Loading

SeanMooney commented Oct 13, 2023

stuggi commented Oct 13, 2023

gibizer left a comment

Deydra71 commented Oct 23, 2023

stuggi Oct 24, 2023

stuggi Oct 24, 2023

Deydra71 Oct 24, 2023

Deydra71 commented Nov 1, 2023

bogdando Jan 19, 2024

gibizer commented Jan 22, 2024

gibizer left a comment

gibizer left a comment

openshift-ci bot commented Jan 25, 2024

[tlse] tls for PlacementAPI pod configuration #92

[tlse] tls for PlacementAPI pod configuration #92

Conversation

Deydra71 commented Oct 13, 2023 • edited Loading

openshift-ci bot commented Oct 13, 2023

Deydra71 Oct 13, 2023

Choose a reason for hiding this comment

stuggi Oct 13, 2023

Choose a reason for hiding this comment

SeanMooney commented Oct 13, 2023

Deydra71 commented Oct 13, 2023 • edited Loading

SeanMooney commented Oct 13, 2023

stuggi commented Oct 13, 2023

gibizer left a comment

Choose a reason for hiding this comment

Deydra71 commented Oct 23, 2023

stuggi Oct 24, 2023

Choose a reason for hiding this comment

stuggi Oct 24, 2023

Choose a reason for hiding this comment

Deydra71 Oct 24, 2023

Choose a reason for hiding this comment

Deydra71 commented Nov 1, 2023

bogdando Jan 19, 2024

Choose a reason for hiding this comment

gibizer commented Jan 22, 2024

gibizer left a comment

Choose a reason for hiding this comment

gibizer left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Jan 25, 2024

Deydra71 commented Oct 13, 2023 •

edited

Loading

Deydra71 commented Oct 13, 2023 •

edited

Loading