Skip to content

Commit e77b9a6

Browse files
GrigoryPervakovGrigoryPervakov
authored
feat: do not set caBundle from certificate by default, only with explicit setting (#237)
1 parent 6e96f8e commit e77b9a6

22 files changed

Lines changed: 158 additions & 82 deletions

‎api/v1alpha1/clickhousecluster_types.go‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -158,10 +158,6 @@ func (s *ClickHouseClusterSpec) WithDefaults() {
158158
}
159159
}
160160

161-
if s.Settings.TLS.CABundle != nil && s.Settings.TLS.CABundle.Key == "" {
162-
s.Settings.TLS.CABundle.Key = "ca.crt"
163-
}
164-
165161
if s.DataVolumeClaimSpec != nil && len(s.DataVolumeClaimSpec.AccessModes) == 0 {
166162
s.DataVolumeClaimSpec.AccessModes = []corev1.PersistentVolumeAccessMode{DefaultAccessMode}
167163
}

‎api/v1alpha1/common.go‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -324,17 +324,27 @@ type ClusterTLSSpec struct {
324324
// +kubebuilder:default:=false
325325
// +optional
326326
Required bool `json:"required,omitempty"`
327-
// ServerCertSecretRef is a reference to a TLS Secret containing the server certificate.
327+
// ServerCertSecret is a reference to a TLS Secret containing the server certificate.
328328
// It is expected that the Secret has the same structure as certificates generated by cert-manager,
329329
// with the certificate and private key stored under "tls.crt" and "tls.key" keys respectively.
330330
// +optional
331331
ServerCertSecret *corev1.LocalObjectReference `json:"serverCertSecret,omitempty"`
332-
// CABundle is a reference to a TLS Secret containing the CA bundle.
333-
// If empty and ServerCertSecret is specified, the CA bundle from certificate will be used.
334-
// Otherwise, system trusted CA bundle will be used.
332+
// CABundle is a reference to a Secret key holding a CA bundle used to verify peer certificates.
333+
// If empty, the system trusted CA bundle is used.
335334
// Key is defaulted to "ca.crt" if not specified.
336335
// +optional
337-
CABundle *SecretKeySelector `json:"caBundle,omitempty"`
336+
CABundle *CABundleSelector `json:"caBundle,omitempty"`
337+
}
338+
339+
// CABundleSelector selects a key holding a CA bundle from a Secret in the cluster's namespace.
340+
type CABundleSelector struct {
341+
// The name of the secret in the cluster's namespace to select from.
342+
// +kubebuilder:validation:Required
343+
Name string `json:"name,omitempty"`
344+
// The key of the secret to select from. Must be a valid secret key.
345+
// +kubebuilder:default:="ca.crt"
346+
// +optional
347+
Key string `json:"key,omitempty"`
338348
}
339349

340350
// Validate validates the ClusterTLSSpec configuration.

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 16 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ LABEL operators.operatorframework.io.bundle.mediatype.v1=registry+v1
55
LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
66
LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
77
LABEL operators.operatorframework.io.bundle.package.v1=clickhouse-operator
8-
LABEL operators.operatorframework.io.bundle.channels.v1=stable
8+
LABEL operators.operatorframework.io.bundle.channels.v1=stable,fast
99
LABEL operators.operatorframework.io.bundle.channel.default.v1=stable
1010
LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.42.2
1111
LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1

‎config/crd/bases/clickhouse.com_clickhouseclusters.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6460,12 +6460,12 @@ spec:
64606460
properties:
64616461
caBundle:
64626462
description: |-
6463-
CABundle is a reference to a TLS Secret containing the CA bundle.
6464-
If empty and ServerCertSecret is specified, the CA bundle from certificate will be used.
6465-
Otherwise, system trusted CA bundle will be used.
6463+
CABundle is a reference to a Secret key holding a CA bundle used to verify peer certificates.
6464+
If empty, the system trusted CA bundle is used.
64666465
Key is defaulted to "ca.crt" if not specified.
64676466
properties:
64686467
key:
6468+
default: ca.crt
64696469
description: The key of the secret to select from. Must
64706470
be a valid secret key.
64716471
type: string
@@ -6474,7 +6474,6 @@ spec:
64746474
to select from.
64756475
type: string
64766476
required:
6477-
- key
64786477
- name
64796478
type: object
64806479
enabled:
@@ -6489,7 +6488,7 @@ spec:
64896488
type: boolean
64906489
serverCertSecret:
64916490
description: |-
6492-
ServerCertSecretRef is a reference to a TLS Secret containing the server certificate.
6491+
ServerCertSecret is a reference to a TLS Secret containing the server certificate.
64936492
It is expected that the Secret has the same structure as certificates generated by cert-manager,
64946493
with the certificate and private key stored under "tls.crt" and "tls.key" keys respectively.
64956494
properties:

‎config/crd/bases/clickhouse.com_keeperclusters.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6110,12 +6110,12 @@ spec:
61106110
properties:
61116111
caBundle:
61126112
description: |-
6113-
CABundle is a reference to a TLS Secret containing the CA bundle.
6114-
If empty and ServerCertSecret is specified, the CA bundle from certificate will be used.
6115-
Otherwise, system trusted CA bundle will be used.
6113+
CABundle is a reference to a Secret key holding a CA bundle used to verify peer certificates.
6114+
If empty, the system trusted CA bundle is used.
61166115
Key is defaulted to "ca.crt" if not specified.
61176116
properties:
61186117
key:
6118+
default: ca.crt
61196119
description: The key of the secret to select from. Must
61206120
be a valid secret key.
61216121
type: string
@@ -6124,7 +6124,6 @@ spec:
61246124
to select from.
61256125
type: string
61266126
required:
6127-
- key
61286127
- name
61296128
type: object
61306129
enabled:
@@ -6139,7 +6138,7 @@ spec:
61396138
type: boolean
61406139
serverCertSecret:
61416140
description: |-
6142-
ServerCertSecretRef is a reference to a TLS Secret containing the server certificate.
6141+
ServerCertSecret is a reference to a TLS Secret containing the server certificate.
61436142
It is expected that the Secret has the same structure as certificates generated by cert-manager,
61446143
with the certificate and private key stored under "tls.crt" and "tls.key" keys respectively.
61456144
properties:

‎config/manifests/bases/clickhouse-operator.clusterserviceversion.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ spec:
137137
every replica.
138138
displayName: Stateful Set Revision
139139
path: statefulSetRevision
140-
- description: CurrentRevision indicates latest requested KeeperCluster spec
140+
- description: UpdateRevision indicates latest requested KeeperCluster spec
141141
revision.
142142
displayName: Update Revision
143143
path: updateRevision
@@ -146,6 +146,7 @@ spec:
146146
path: version
147147
- description: |-
148148
VersionProbeRevision is the image hash of the last successful version probe.
149+
149150
Deprecated: Keeper version probe Jobs are not used; this field is retained for backward compatibility.
150151
displayName: Version Probe Revision
151152
path: versionProbeRevision

‎dist/chart/templates/crd/clickhouseclusters.clickhouse.com.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6463,12 +6463,12 @@ spec:
64636463
properties:
64646464
caBundle:
64656465
description: |-
6466-
CABundle is a reference to a TLS Secret containing the CA bundle.
6467-
If empty and ServerCertSecret is specified, the CA bundle from certificate will be used.
6468-
Otherwise, system trusted CA bundle will be used.
6466+
CABundle is a reference to a Secret key holding a CA bundle used to verify peer certificates.
6467+
If empty, the system trusted CA bundle is used.
64696468
Key is defaulted to "ca.crt" if not specified.
64706469
properties:
64716470
key:
6471+
default: ca.crt
64726472
description: The key of the secret to select from. Must
64736473
be a valid secret key.
64746474
type: string
@@ -6477,7 +6477,6 @@ spec:
64776477
to select from.
64786478
type: string
64796479
required:
6480-
- key
64816480
- name
64826481
type: object
64836482
enabled:
@@ -6492,7 +6491,7 @@ spec:
64926491
type: boolean
64936492
serverCertSecret:
64946493
description: |-
6495-
ServerCertSecretRef is a reference to a TLS Secret containing the server certificate.
6494+
ServerCertSecret is a reference to a TLS Secret containing the server certificate.
64966495
It is expected that the Secret has the same structure as certificates generated by cert-manager,
64976496
with the certificate and private key stored under "tls.crt" and "tls.key" keys respectively.
64986497
properties:

‎dist/chart/templates/crd/keeperclusters.clickhouse.com.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6113,12 +6113,12 @@ spec:
61136113
properties:
61146114
caBundle:
61156115
description: |-
6116-
CABundle is a reference to a TLS Secret containing the CA bundle.
6117-
If empty and ServerCertSecret is specified, the CA bundle from certificate will be used.
6118-
Otherwise, system trusted CA bundle will be used.
6116+
CABundle is a reference to a Secret key holding a CA bundle used to verify peer certificates.
6117+
If empty, the system trusted CA bundle is used.
61196118
Key is defaulted to "ca.crt" if not specified.
61206119
properties:
61216120
key:
6121+
default: ca.crt
61226122
description: The key of the secret to select from. Must
61236123
be a valid secret key.
61246124
type: string
@@ -6127,7 +6127,6 @@ spec:
61276127
to select from.
61286128
type: string
61296129
required:
6130-
- key
61316130
- name
61326131
type: object
61336132
enabled:
@@ -6142,7 +6141,7 @@ spec:
61426141
type: boolean
61436142
serverCertSecret:
61446143
description: |-
6145-
ServerCertSecretRef is a reference to a TLS Secret containing the server certificate.
6144+
ServerCertSecret is a reference to a TLS Secret containing the server certificate.
61466145
It is expected that the Secret has the same structure as certificates generated by cert-manager,
61476146
with the certificate and private key stored under "tls.crt" and "tls.key" keys respectively.
61486147
properties:

‎docs/guides/configuration.mdx‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -365,10 +365,9 @@ spec:
365365

366366
### SSL certificate secret format {#ssl-certificate-secret-format}
367367

368-
It is expected that the Secret contains the following keys:
368+
It is expected that the Secret contains the server keypair:
369369
- `tls.crt` - PEM encoded server certificate
370370
- `tls.key` - PEM encoded private key
371-
- `ca.crt` - PEM encoded CA certificate chain
372371

373372
<Note>
374373
This format is compatible with cert-manager generated certificates.
@@ -378,10 +377,9 @@ This format is compatible with cert-manager generated certificates.
378377

379378
If KeeperCluster has TLS enabled, ClickHouseCluster would use secure connection to Keeper nodes automatically.
380379

381-
ClickHouseCluster should be able to verify Keeper nodes certificates.
382-
If ClickHouseCluster has TLS enabled, is uses `ca.crt` bundle for verification. Otherwise, default CA bundle is used.
380+
ClickHouseCluster verifies Keeper node certificates against the system trust store, plus any `caBundle` you configure.
383381

384-
User may provide a custom CA bundle reference:
382+
To trust a private CA (for example, a self-signed or internal CA), provide a custom CA bundle reference:
385383

386384
```yaml
387385
spec:

0 commit comments

Comments
 (0)