Skip to content

Commit e6469e4

Browse files
AleC-IXrmedina97
AleC-IX
authored and
rmedina97
committed
broker CRD no longer directly embeds secrets, fix liqoctl path in installation.sh, fix for Lint 1.64.2, fix liqoctl version in requirements.sh
1 parent 2a0098f commit e6469e4

File tree

13 files changed

+51
-221
lines changed

13 files changed

+51
-221
lines changed

‎.golangci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ linters-settings:
6868
dupl:
6969
threshold: 300
7070
gocyclo:
71-
min-complexity: 34
71+
min-complexity: 39
7272

7373
linters:
7474
disable-all: true

‎apis/network/v1alpha1/broker_status.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2022-2024 FLUIDOS Project
1+
// Copyright 2022-2025 FLUIDOS Project
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.

‎apis/network/v1alpha1/broker_types.go‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2022-2024 FLUIDOS Project
1+
// Copyright 2022-2025 FLUIDOS Project
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -15,19 +15,18 @@
1515
package v1alpha1
1616

1717
import (
18-
corev1 "k8s.io/api/core/v1"
1918
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2019
)
2120

2221
// BrokerSpec defines the desired state of Broker.
2322
type BrokerSpec struct {
2423

2524
// Address of the Broker.
26-
Address string `json:"address"`
27-
Name string `json:"name"`
28-
ClCert *corev1.Secret `json:"clcert"`
29-
CaCert *corev1.Secret `json:"cacert"`
30-
Role string `json:"role"`
25+
Address string `json:"address"`
26+
Name string `json:"name"`
27+
ClCert string `json:"clcert"`
28+
CaCert string `json:"cacert"`
29+
Role string `json:"role"`
3130
}
3231

3332
// BrokerStatus defines the observed state of Broker.

‎apis/network/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 1 addition & 12 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎deployments/node/crds/network.fluidos.eu_brokers.yaml‎

Lines changed: 2 additions & 146 deletions
Original file line numberDiff line numberDiff line change
@@ -46,153 +46,9 @@ spec:
4646
description: Address of the Broker.
4747
type: string
4848
cacert:
49-
description: |-
50-
Secret holds secret data of a certain type. The total bytes of the values in
51-
the Data field must be less than MaxSecretSize bytes.
52-
properties:
53-
apiVersion:
54-
description: |-
55-
APIVersion defines the versioned schema of this representation of an object.
56-
Servers should convert recognized schemas to the latest internal value, and
57-
may reject unrecognized values.
58-
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
59-
type: string
60-
data:
61-
additionalProperties:
62-
format: byte
63-
type: string
64-
description: |-
65-
Data contains the secret data. Each key must consist of alphanumeric
66-
characters, '-', '_' or '.'. The serialized form of the secret data is a
67-
base64 encoded string, representing the arbitrary (possibly non-string)
68-
data value here. Described in https://tools.ietf.org/html/rfc4648#section-4
69-
type: object
70-
immutable:
71-
description: |-
72-
Immutable, if set to true, ensures that data stored in the Secret cannot
73-
be updated (only object metadata can be modified).
74-
If not set to true, the field can be modified at any time.
75-
Defaulted to nil.
76-
type: boolean
77-
kind:
78-
description: |-
79-
Kind is a string value representing the REST resource this object represents.
80-
Servers may infer this from the endpoint the client submits requests to.
81-
Cannot be updated.
82-
In CamelCase.
83-
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
84-
type: string
85-
metadata:
86-
description: |-
87-
Standard object's metadata.
88-
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
89-
properties:
90-
annotations:
91-
additionalProperties:
92-
type: string
93-
type: object
94-
finalizers:
95-
items:
96-
type: string
97-
type: array
98-
labels:
99-
additionalProperties:
100-
type: string
101-
type: object
102-
name:
103-
type: string
104-
namespace:
105-
type: string
106-
type: object
107-
stringData:
108-
additionalProperties:
109-
type: string
110-
description: |-
111-
stringData allows specifying non-binary secret data in string form.
112-
It is provided as a write-only input field for convenience.
113-
All keys and values are merged into the data field on write, overwriting any existing values.
114-
The stringData field is never output when reading from the API.
115-
type: object
116-
type:
117-
description: |-
118-
Used to facilitate programmatic handling of secret data.
119-
More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
120-
type: string
121-
type: object
49+
type: string
12250
clcert:
123-
description: |-
124-
Secret holds secret data of a certain type. The total bytes of the values in
125-
the Data field must be less than MaxSecretSize bytes.
126-
properties:
127-
apiVersion:
128-
description: |-
129-
APIVersion defines the versioned schema of this representation of an object.
130-
Servers should convert recognized schemas to the latest internal value, and
131-
may reject unrecognized values.
132-
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
133-
type: string
134-
data:
135-
additionalProperties:
136-
format: byte
137-
type: string
138-
description: |-
139-
Data contains the secret data. Each key must consist of alphanumeric
140-
characters, '-', '_' or '.'. The serialized form of the secret data is a
141-
base64 encoded string, representing the arbitrary (possibly non-string)
142-
data value here. Described in https://tools.ietf.org/html/rfc4648#section-4
143-
type: object
144-
immutable:
145-
description: |-
146-
Immutable, if set to true, ensures that data stored in the Secret cannot
147-
be updated (only object metadata can be modified).
148-
If not set to true, the field can be modified at any time.
149-
Defaulted to nil.
150-
type: boolean
151-
kind:
152-
description: |-
153-
Kind is a string value representing the REST resource this object represents.
154-
Servers may infer this from the endpoint the client submits requests to.
155-
Cannot be updated.
156-
In CamelCase.
157-
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
158-
type: string
159-
metadata:
160-
description: |-
161-
Standard object's metadata.
162-
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
163-
properties:
164-
annotations:
165-
additionalProperties:
166-
type: string
167-
type: object
168-
finalizers:
169-
items:
170-
type: string
171-
type: array
172-
labels:
173-
additionalProperties:
174-
type: string
175-
type: object
176-
name:
177-
type: string
178-
namespace:
179-
type: string
180-
type: object
181-
stringData:
182-
additionalProperties:
183-
type: string
184-
description: |-
185-
stringData allows specifying non-binary secret data in string form.
186-
It is provided as a write-only input field for convenience.
187-
All keys and values are merged into the data field on write, overwriting any existing values.
188-
The stringData field is never output when reading from the API.
189-
type: object
190-
type:
191-
description: |-
192-
Used to facilitate programmatic handling of secret data.
193-
More info: https://kubernetes.io/docs/concepts/configuration/secret/#secret-types
194-
type: string
195-
type: object
51+
type: string
19652
name:
19753
type: string
19854
role:

‎deployments/node/samples/broker.yaml‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,5 @@ spec:
1212
# anything else both publisher AND subscriber
1313
role: both
1414
#secrets must be created from certificate and key provided by broker server
15-
cacert:
16-
apiVersion: v1
17-
kind: Secret
18-
metadata:
19-
name: broker-ca-secret
20-
namespace: fluidos
21-
clcert:
22-
apiVersion: v1
23-
kind: Secret
24-
metadata:
25-
name: broker-client-secret
26-
namespace: fluidos
15+
cacert: brokera-ca-xxxxx
16+
clcert: brokera-cl-yyyyy

‎pkg/network-manager/broker_client.go‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2022-2024 FLUIDOS Project
1+
// Copyright 2022-2025 FLUIDOS Project
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -116,15 +116,15 @@ func (bc *BrokerClient) SetupBrokerClient(cl client.Client, broker *networkv1alp
116116
bc.clientCert = &corev1.Secret{}
117117
bc.rootCert = &corev1.Secret{}
118118

119-
klog.Infof("Root Secret Name: %s\n", broker.Spec.CaCert.Name)
120-
klog.Infof("Client Secret Name: %s\n", broker.Spec.ClCert.Name)
119+
klog.Infof("Root Secret Name: %s\n", broker.Spec.CaCert)
120+
klog.Infof("Client Secret Name: %s\n", broker.Spec.ClCert)
121121
secretNamespace := "fluidos"
122122

123-
err = bc.extractSecret(cl, broker.Spec.ClCert.Name, secretNamespace, bc.clientCert)
123+
err = bc.extractSecret(cl, broker.Spec.ClCert, secretNamespace, bc.clientCert)
124124
if err != nil {
125125
return err
126126
}
127-
err = bc.extractSecret(cl, broker.Spec.CaCert.Name, secretNamespace, bc.rootCert)
127+
err = bc.extractSecret(cl, broker.Spec.CaCert, secretNamespace, bc.rootCert)
128128
if err != nil {
129129
return err
130130
}
@@ -148,21 +148,21 @@ func (bc *BrokerClient) SetupBrokerClient(cl client.Client, broker *networkv1alp
148148
// Load client cert and privKey.
149149
cert, err := tls.X509KeyPair(clientCert, clientKey)
150150
if err != nil {
151-
klog.Error("error X509KeyPair: %v", err)
151+
klog.Errorf("error X509KeyPair: %v", err)
152152
return err
153153
}
154154

155155
// Load root cert.
156156
caCertPool := x509.NewCertPool()
157157
ok = caCertPool.AppendCertsFromPEM(caCertData)
158158
if !ok {
159-
klog.Error("AppendCertsFromPEM error: %v", ok)
159+
klog.Errorf("AppendCertsFromPEM error: %v", ok)
160160
}
161161

162162
// Routing key for topic.
163163
bc.brokerConn.routingKey, err = extractCNfromCert(&clientCert)
164164
if err != nil {
165-
klog.Error("Common Name extraction error: %v", err)
165+
klog.Errorf("Common Name extraction error: %v", err)
166166
}
167167
bc.brokerConn.queueName = bc.brokerConn.routingKey
168168

@@ -219,7 +219,7 @@ func (bc *BrokerClient) publishOnBroker() {
219219
Expiration: "30000", // TTL ms
220220
})
221221
if err != nil {
222-
klog.Error("Error pub message: %v", err)
222+
klog.Errorf("Error pub message: %v", err)
223223
}
224224

225225
select {
@@ -295,7 +295,7 @@ func extractCNfromCert(certPEM *[]byte) (string, error) {
295295
// Parsing X.509
296296
cert, err = x509.ParseCertificate(block.Bytes)
297297
if err != nil {
298-
klog.Error("Error parsing certificate X.509 in CN extraction: %v", err)
298+
klog.Errorf("Error parsing certificate X.509 in CN extraction: %v", err)
299299
} else {
300300
CN = cert.Subject.CommonName
301301
}
@@ -317,14 +317,14 @@ func (bc *BrokerClient) brokerConnectionConfig(tlsConfig *tls.Config) error {
317317

318318
bc.brokerConn.amqpConn, err = amqp.DialConfig(serverURL, config)
319319
if err != nil {
320-
klog.Error("RabbitMQ connection error: %v", err)
320+
klog.Errorf("RabbitMQ connection error: %v", err)
321321
return err
322322
}
323323

324324
// Channel creation
325325
bc.brokerConn.amqpChan, err = bc.brokerConn.amqpConn.Channel()
326326
if err != nil {
327-
klog.Error("channel creation error: %v", err)
327+
klog.Errorf("channel creation error: %v", err)
328328
return err
329329
}
330330

@@ -339,13 +339,13 @@ func (bc *BrokerClient) brokerConnectionConfig(tlsConfig *tls.Config) error {
339339
nil, // Arguments
340340
)
341341
if err != nil {
342-
klog.Error("Error subscribing queue: %s", err)
342+
klog.Errorf("Error subscribing queue: %s", err)
343343
return err
344344
}
345345

346346
// Write confirm broker
347347
if err := bc.brokerConn.amqpChan.Confirm(false); err != nil {
348-
klog.Error("Failed to enable publisher confirms: %v", err)
348+
klog.Errorf("Failed to enable publisher confirms: %v", err)
349349
return err
350350
}
351351

@@ -363,7 +363,7 @@ func (bc *BrokerClient) extractSecret(cl client.Client, secretName, secretNamesp
363363
Namespace: secretNamespace,
364364
}, secretDest)
365365
if err != nil {
366-
klog.Error("Error retrieving Secret: %v\n", err)
366+
klog.Errorf("Error retrieving Secret: %v\n", err)
367367
return err
368368
}
369369
return nil

0 commit comments

Comments
 (0)