Skip to content

Commit b823d9a

Browse files
Kirill-GarbarKirill-Garbar
committed
change mounting spec completely
1 parent c80175a commit b823d9a

File tree

9 files changed

+566
-262
lines changed

9 files changed

+566
-262
lines changed

‎AUTH-DESIGN-2.md‎

Lines changed: 315 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,315 @@
1+
### Peer.ca
2+
| Option | Description |
3+
| ------ | ----------- |
4+
| secretName | Secret name of user-provided secret. If not specified then operator generates certificate by the spec below |
5+
| metadata | Metadata of generated secret. |
6+
| duration | Expiration time of generated secret. |
7+
| renewBefore | Time period before expiration time when certificate will be reissued. |
8+
| privateKey | Private key configuration: algorithm and key size. |
9+
10+
### Peer.cert
11+
| Option | Description |
12+
| ------ | ----------- |
13+
| secretName | Secret name of user-provided secret. If not specified then operator generates certificate by the spec below. If peer.ca.secretName is provided, then this certificate is generated from the CA that was provided by the user. You can't define the secret name in this section and do not define peer.ca.secretName. |
14+
| metadata | Metadata of generated secret. |
15+
| duration | Expiration time of generated secret. |
16+
| renewBefore | Time period before expiration time when certificate will be reissued. |
17+
| privateKey | Private key configuration: algorithm, key size and boolean parameter is it necessary to rotate private key when certificate is expired |
18+
19+
### ClientServer section has the same fields as peer section.
20+
21+
### Rbac
22+
| Option | Description |
23+
| ------ | ----------- |
24+
| enabled | Enables role-based access control: creates root user in etcd, gives him root role and enables authentication in etcd. |
25+
26+
```yaml
27+
spec:
28+
security:
29+
peer:
30+
enabled: true # optional
31+
ca:
32+
# if not defined, then operator generates CA by the spec below
33+
secretName: ext-peer-ca-tls-secret
34+
secretTemplate:
35+
metadata:
36+
name: peer-ca-tls-secret # optional
37+
annotations: {} # optional
38+
labels: {} # optional
39+
duration: 86400h # optional
40+
renewBefore: 720h # optional
41+
privateKey:
42+
algorithm: RSA # optional
43+
size: 4096 # optional
44+
cert:
45+
secretName: ext-peer-tls-secret
46+
secretTemplate:
47+
metadata:
48+
name: peer-tls-secret # optional
49+
annotations: {} # optional
50+
labels: {} # optional
51+
duration: 720h
52+
renewBefore: 180h
53+
privateKey:
54+
rotate: true # optional
55+
algorithm: RSA
56+
size: 4096
57+
clientServer:
58+
enabled: true
59+
ca:
60+
secretName: ext-server-ca-tls-secret
61+
secretTemplate:
62+
metadata:
63+
name: server-ca-tls-secret
64+
annotations: {} # optional
65+
labels: {} # optional
66+
duration: 86400h
67+
renewBefore: 720h
68+
privateKey:
69+
algorithm: RSA
70+
size: 4096
71+
cert:
72+
secretName: ext-server-tls-secret
73+
secretTemplate:
74+
metadata:
75+
name: server-tls-secret
76+
annotations: {} # optional
77+
labels: {} # optional
78+
extraSans: []
79+
duration: 720h
80+
renewBefore: 180h
81+
privateKey:
82+
rotate: true
83+
algorithm: RSA
84+
size: 4096
85+
rootClientCert:
86+
secretName: ext-client-tls-secret
87+
secretTemplate:
88+
metadata:
89+
name: client-tls-secret
90+
annotations: {} # optional
91+
labels: {} # optional
92+
duration: 720h
93+
renewBefore: 180h
94+
privateKey:
95+
rotate: true
96+
algorithm: RSA
97+
size: 4096
98+
rbac:
99+
enabled: true # optional
100+
```
101+
102+
Important points:
103+
* If field has a value and it is optional, then this value is a default.
104+
* peer:
105+
* If ca.secretName is not defined, operator generates its own CA.
106+
* If ca.secretName is defined, then every field under secretName should not be defined.
107+
* If cert.secretName id not defined, then certificate is generate by operator from the CA defined in the section above (user-managed or operator-managed).
108+
* User must define ca.secretName if cert.secretName is defined.
109+
* Algorithm is a list of the values. NOTE: look into the lib that generates certs what values exist (or to cert-manager).
110+
* clientServer:
111+
* See peer logic.
112+
* RootClientCert uses server ca and has the same logic as server.cert.
113+
* Rbac.enabled enables role-based access control: creates root user in etcd, gives him root role and enables authentication in etcd.
114+
115+
116+
117+
security:
118+
peerCertificate: {}
119+
peerTrustedCACertficate: {}
120+
clientCertificate: {}
121+
serverCertificate: {}
122+
trustedCACertificate: {}
123+
124+
```yaml
125+
spec:
126+
security:
127+
disableClientAuth: false
128+
peerCertificate:
129+
secretName: ext-peer-tls-secret
130+
secretTemplate:
131+
metadata:
132+
name: peer-tls-secret
133+
annotations: {}
134+
labels: {}
135+
duration: 720h
136+
renewBefore: 180h
137+
privateKey:
138+
rotate: true # optional
139+
algorithm: RSA
140+
size: 4096
141+
peerTrustedCaCertficate:
142+
# if not defined, then operator generates CA by the spec below
143+
secretName: ext-peer-ca-tls-secret
144+
secretTemplate:
145+
metadata:
146+
name: peer-ca-tls-secret
147+
annotations: {} # optional
148+
labels: {} # optional
149+
duration: 86400h # optional
150+
renewBefore: 720h # optional
151+
privateKey:
152+
algorithm: RSA # optional
153+
size: 4096 # optional
154+
serverCertificate:
155+
secretName: ext-server-tls-secret
156+
secretTemplate:
157+
metadata:
158+
name: server-tls-secret
159+
annotations: {}
160+
labels: {}
161+
extraClientSans: []
162+
duration: 720h
163+
renewBefore: 180h
164+
privateKey:
165+
rotate: true
166+
algorithm: RSA
167+
size: 4096
168+
trustedCaCertificate:
169+
secretName: ext-server-ca-tls-secret
170+
secretTemplate:
171+
metadata:
172+
name: server-ca-tls-secret
173+
annotations: {}
174+
labels: {}
175+
duration: 86400h
176+
renewBefore: 720h
177+
privateKey:
178+
algorithm: RSA
179+
size: 4096
180+
clientCertificate:
181+
secretName: ext-client-tls-secret
182+
secretTemplate:
183+
metadata:
184+
name: client-tls-secret
185+
annotations: {}
186+
labels: {}
187+
duration: 720h
188+
renewBefore: 180h
189+
privateKey:
190+
rotate: true
191+
algorithm: RSA
192+
size: 4096
193+
```
194+
195+
196+
197+
198+
199+
200+
### Peer.ca
201+
| Option | Description |
202+
| ------ | ----------- |
203+
| secretName | Secret name of user-provided secret. If not specified then operator generates certificate by the spec below |
204+
| metadata | Metadata of generated secret. |
205+
| duration | Expiration time of generated secret. |
206+
| renewBefore | Time period before expiration time when certificate will be reissued. |
207+
| privateKey | Private key configuration: algorithm and key size. |
208+
209+
### Peer.cert
210+
| Option | Description |
211+
| ------ | ----------- |
212+
| secretName | Secret name of user-provided secret. If not specified then operator generates certificate by the spec below. If peer.ca.secretName is provided, then this certificate is generated from the CA that was provided by the user. You can't define the secret name in this section and do not define peer.ca.secretName. |
213+
| metadata | Metadata of generated secret. |
214+
| duration | Expiration time of generated secret. |
215+
| renewBefore | Time period before expiration time when certificate will be reissued. |
216+
| privateKey | Private key configuration: algorithm, key size and boolean parameter is it necessary to rotate private key when certificate is expired |
217+
218+
### ClientServer section has the same fields as peer section.
219+
220+
### Rbac
221+
| Option | Description |
222+
| ------ | ----------- |
223+
| enabled | Enables role-based access control: creates root user in etcd, gives him root role and enables authentication in etcd. |
224+
225+
```yaml
226+
spec:
227+
security:
228+
peer:
229+
enabled: true # optional
230+
ca:
231+
# if not defined, then operator generates CA by the spec below
232+
secretName: ext-peer-ca-tls-secret # oneof secretName or secretTemplate
233+
secretTemplate: # oneof secretName or secretTemplate
234+
annotations: {} # optional
235+
labels: {} # optional
236+
duration: 86400h # optional
237+
renewBefore: 720h # optional
238+
privateKey:
239+
algorithm: RSA # optional
240+
size: 4096 # optional
241+
cert:
242+
secretName: ext-peer-tls-secret
243+
secretTemplate:
244+
annotations: {}
245+
labels: {}
246+
duration: 720h
247+
renewBefore: 180h
248+
privateKey:
249+
rotate: true # optional
250+
algorithm: RSA
251+
size: 4096
252+
server:
253+
enabled: true
254+
ca:
255+
secretName: ext-server-ca-tls-secret
256+
secretTemplate:
257+
annotations: {}
258+
labels: {}
259+
duration: 86400h
260+
renewBefore: 720h
261+
privateKey:
262+
algorithm: RSA
263+
size: 4096
264+
cert:
265+
secretName: ext-server-tls-secret
266+
secretTemplate:
267+
annotations: {}
268+
labels: {}
269+
extraSANs: []
270+
duration: 720h
271+
renewBefore: 180h
272+
privateKey:
273+
rotate: true
274+
algorithm: RSA
275+
size: 4096
276+
client:
277+
enabled: true
278+
ca:
279+
secretName: ext-server-ca-tls-secret
280+
secretTemplate:
281+
annotations: {}
282+
labels: {}
283+
duration: 86400h
284+
renewBefore: 720h
285+
privateKey:
286+
algorithm: RSA
287+
size: 4096
288+
cert:
289+
secretName: ext-client-tls-secret
290+
secretTemplate:
291+
annotations: {}
292+
labels: {}
293+
duration: 720h
294+
renewBefore: 180h
295+
privateKey:
296+
rotate: true
297+
algorithm: RSA
298+
size: 4096
299+
auth:
300+
enabled: true # optional
301+
```
302+
303+
Important points:
304+
* If field has a value and it is optional, then this value is a default.
305+
* peer:
306+
* If ca.secretName is not defined, operator generates its own CA.
307+
* If ca.secretName is defined, then every field under secretName should not be defined.
308+
* If cert.secretName id not defined, then certificate is generate by operator from the CA defined in the section above (user-managed or operator-managed).
309+
* User must define ca.secretName if cert.secretName is defined.
310+
* Algorithm is a list of the values. NOTE: look into the lib that generates certs what values exist (or to cert-manager).
311+
* clientServer:
312+
* See peer logic.
313+
* RootClientCert uses server ca and has the same logic as server.cert.
314+
* Rbac.enabled enables role-based access control: creates root user in etcd, gives him root role and enables authentication in etcd.
315+

‎api/v1alpha1/etcdcluster_types.go‎

Lines changed: 15 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -206,36 +206,29 @@ type StorageSpec struct {
206206
// SecuritySpec defines security settings for etcd.
207207
// +k8s:openapi-gen=true
208208
type SecuritySpec struct {
209+
// Section for user-managed tls certificates
209210
// +optional
210-
Peer *PeerSpec `json:"peer,omitempty"`
211-
// +optional
212-
ClientServer *ClientServerSpec `json:"clientServer,omitempty"`
211+
TLS TLSSpec `json:"tls,omitempty"`
213212
}
214213

215-
type PeerSpec struct {
214+
// TLSSpec defines user-managed certificates names.
215+
type TLSSpec struct {
216+
// Trusted CA certificate secret to secure peer-to-peer communication between etcd nodes. It is expected to have tls.crt field in the secret.
216217
// +optional
217-
Ca SecretSpec `json:"ca,omitempty"`
218+
PeerTrustedCASecret string `json:"peerTrustedCASecret,omitempty"`
219+
// Certificate secret to secure peer-to-peer communication between etcd nodes. It is expected to have tls.crt and tls.key fields in the secret.
218220
// +optional
219-
Cert SecretSpec `json:"cert,omitempty"`
220-
}
221-
222-
type ClientServerSpec struct {
221+
PeerSecret string `json:"peerSecret,omitempty"`
222+
// Server certificate secret to secure client-server communication. Is provided to the client who connects to etcd by client port (2379 by default).
223+
// It is expected to have tls.crt and tls.key fields in the secret.
223224
// +optional
224-
Ca SecretSpec `json:"ca,omitempty"`
225+
ServerSecret string `json:"serverSecret,omitempty"`
226+
// Trusted CA for client certificates that are provided by client to etcd. It is expected to have tls.crt field in the secret.
225227
// +optional
226-
ServerCert SecretSpec `json:"serverCert,omitempty"`
227-
// +optional
228-
RootClientCert SecretSpec `json:"rootClientCert,omitempty"`
229-
}
230-
231-
type SecretSpec struct {
232-
// +optional
233-
SecretName string `json:"secretName,omitempty"`
234-
}
235-
236-
type RbacSpec struct {
228+
ClientTrustedCASecret string `json:"clientTrustedCASecret,omitempty"`
229+
// Client certificate for etcd-operator to do maintenance. It is expected to have tls.crt and tls.key fields in the secret.
237230
// +optional
238-
Enabled bool `json:"enabled,omitempty"`
231+
ClientSecret string `json:"clientSecret,omitempty"`
239232
}
240233

241234
// EmbeddedPersistentVolumeClaim is an embedded version of k8s.io/api/core/v1.PersistentVolumeClaim.

0 commit comments

Comments
 (0)