Skip to content

Commit 83de7e3

Browse files
dtantsurdtantsur
committed
Accept a Secret or a ConfigMap for BMC CA and Trusted CA
Unfortunately, various CA providers are inconsistent in what they create (cert-manager creates secrets, OpenShift creates config maps). This change deprecates BMCCAName and TrustedCAName in favour of BMCCA and TrustedCA that contain a Kind. While here, also address the existing quirk of only supporting the first key of a ConfigMap: now a Key can also be provided. Generated-By: Claude Code (commertical license) Signed-off-by: Dmitry Tantsur <dtantsur@protonmail.com>
1 parent 4283473 commit 83de7e3

File tree

14 files changed

+766
-59
lines changed

14 files changed

+766
-59
lines changed

‎.golangci.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,12 @@ linters:
134134
- linters:
135135
- tagliatelle
136136
text: CA
137+
- linters:
138+
- staticcheck
139+
text: 'SA1019: tls\.(TrustedCAName|BMCCAName) is deprecated: .*'
140+
paths:
141+
- pkg/ironic/validation.go
142+
- pkg/ironic/utils.go
137143
paths:
138144
- zz_generated.*\.go$
139145
- .*conversion.*\.go$

‎api/v1alpha1/common.go‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,24 @@ var (
1818
IronicServiceLabel = IronicLabelPrefix + "/ironic"
1919
IronicVersionLabel = IronicLabelPrefix + "/version"
2020
)
21+
22+
// ResourceReference references a ConfigMap or Secret resource.
23+
type ResourceReference struct {
24+
// Name of the resource.
25+
Name string `json:"name"`
26+
27+
// Kind of the resource (ConfigMap or Secret).
28+
// +kubebuilder:validation:Enum=ConfigMap;Secret
29+
Kind string `json:"kind"`
30+
}
31+
32+
// ResourceReferenceWithKey references a ConfigMap or Secret resource and
33+
// targets a specific key from it.
34+
type ResourceReferenceWithKey struct {
35+
ResourceReference `json:",inline"`
36+
37+
// Key within the resource to use. If not specified and the resource contains multiple keys,
38+
// the first (alphabetically) key will be used and a warning will be logged for other keys.
39+
// +optional
40+
Key string `json:"key,omitempty"`
41+
}

‎api/v1alpha1/ironic_types.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,13 @@ import (
2121
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2222
)
2323

24+
const (
25+
// ResourceKindConfigMap is the kind for ConfigMap resources.
26+
ResourceKindConfigMap = "ConfigMap"
27+
// ResourceKindSecret is the kind for Secret resources.
28+
ResourceKindSecret = "Secret"
29+
)
30+
2431
var (
2532
VersionLatest = Version{}
2633
Version340 = Version{Major: 34, Minor: 0}
@@ -188,9 +195,17 @@ type DeployRamdisk struct {
188195

189196
// TLS defines the TLS settings.
190197
type TLS struct {
198+
// BMCCA is a reference to a ConfigMap or Secret containing the CA certificate(s)
199+
// to use when validating TLS connections to BMCs.
200+
// Supported in Ironic 32.0 or newer.
201+
// +optional
202+
BMCCA *ResourceReference `json:"bmcCA,omitempty"`
203+
191204
// BMCCAName is a reference to the secret with the CA certificate(s)
192205
// to use when validating TLS connections to BMC's.
193206
// Supported in Ironic 32.0 or newer.
207+
//
208+
// Deprecated: Use BMCCA instead. This field will be removed in a future release.
194209
// +optional
195210
BMCCAName string `json:"bmcCAName,omitempty"`
196211

@@ -199,11 +214,19 @@ type TLS struct {
199214
// +optional
200215
CertificateName string `json:"certificateName,omitempty"`
201216

217+
// TrustedCA is a reference to a ConfigMap or Secret containing the CA certificate(s)
218+
// to use when validating TLS connections to image servers and other services.
219+
// The resource should contain one or more CA certificates in PEM format.
220+
// +optional
221+
TrustedCA *ResourceReferenceWithKey `json:"trustedCA,omitempty"`
222+
202223
// TrustedCAName is a reference to the configmap with the CA certificate(s)
203224
// to use when validating TLS connections to image servers and other services.
204225
// The configmap should contain one or more CA certificates in PEM format.
205226
// If the configmap contains multiple keys, only the first key will be used and
206227
// a warning will be logged.
228+
//
229+
// Deprecated: Use TrustedCA instead. This field will be removed in a future release.
207230
// +optional
208231
TrustedCAName string `json:"trustedCAName,omitempty"`
209232

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 41 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/ironic.metal3.io_ironics.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3425,11 +3425,32 @@ spec:
34253425
description: TLS defines TLS-related settings for various network
34263426
interactions.
34273427
properties:
3428+
bmcCA:
3429+
description: |-
3430+
BMCCA is a reference to a ConfigMap or Secret containing the CA certificate(s)
3431+
to use when validating TLS connections to BMCs.
3432+
Supported in Ironic 32.0 or newer.
3433+
properties:
3434+
kind:
3435+
description: Kind of the resource (ConfigMap or Secret).
3436+
enum:
3437+
- ConfigMap
3438+
- Secret
3439+
type: string
3440+
name:
3441+
description: Name of the resource.
3442+
type: string
3443+
required:
3444+
- kind
3445+
- name
3446+
type: object
34283447
bmcCAName:
34293448
description: |-
34303449
BMCCAName is a reference to the secret with the CA certificate(s)
34313450
to use when validating TLS connections to BMC's.
34323451
Supported in Ironic 32.0 or newer.
3452+
3453+
Deprecated: Use BMCCA instead. This field will be removed in a future release.
34333454
type: string
34343455
certificateName:
34353456
description: |-
@@ -3449,13 +3470,39 @@ spec:
34493470
Has no effect when HighAvailability is false and requires the
34503471
HighAvailability feature gate to be set.
34513472
type: boolean
3473+
trustedCA:
3474+
description: |-
3475+
TrustedCA is a reference to a ConfigMap or Secret containing the CA certificate(s)
3476+
to use when validating TLS connections to image servers and other services.
3477+
The resource should contain one or more CA certificates in PEM format.
3478+
properties:
3479+
key:
3480+
description: |-
3481+
Key within the resource to use. If not specified and the resource contains multiple keys,
3482+
the first (alphabetically) key will be used and a warning will be logged for other keys.
3483+
type: string
3484+
kind:
3485+
description: Kind of the resource (ConfigMap or Secret).
3486+
enum:
3487+
- ConfigMap
3488+
- Secret
3489+
type: string
3490+
name:
3491+
description: Name of the resource.
3492+
type: string
3493+
required:
3494+
- kind
3495+
- name
3496+
type: object
34523497
trustedCAName:
34533498
description: |-
34543499
TrustedCAName is a reference to the configmap with the CA certificate(s)
34553500
to use when validating TLS connections to image servers and other services.
34563501
The configmap should contain one or more CA certificates in PEM format.
34573502
If the configmap contains multiple keys, only the first key will be used and
34583503
a warning will be logged.
3504+
3505+
Deprecated: Use TrustedCA instead. This field will be removed in a future release.
34593506
type: string
34603507
type: object
34613508
version:

‎docs/api.md‎

Lines changed: 108 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6889,12 +6889,23 @@ TLS defines TLS-related settings for various network interactions.
68896889
</tr>
68906890
</thead>
68916891
<tbody><tr>
6892+
<td><b><a href="#ironicspectlsbmcca">bmcCA</a></b></td>
6893+
<td>object</td>
6894+
<td>
6895+
BMCCA is a reference to a ConfigMap or Secret containing the CA certificate(s)
6896+
to use when validating TLS connections to BMCs.
6897+
Supported in Ironic 32.0 or newer.<br/>
6898+
</td>
6899+
<td>false</td>
6900+
</tr><tr>
68926901
<td><b>bmcCAName</b></td>
68936902
<td>string</td>
68946903
<td>
68956904
BMCCAName is a reference to the secret with the CA certificate(s)
68966905
to use when validating TLS connections to BMC's.
6897-
Supported in Ironic 32.0 or newer.<br/>
6906+
Supported in Ironic 32.0 or newer.
6907+
6908+
Deprecated: Use BMCCA instead. This field will be removed in a future release.<br/>
68986909
</td>
68996910
<td>false</td>
69006911
</tr><tr>
@@ -6924,6 +6935,15 @@ Has no effect when HighAvailability is false and requires the
69246935
HighAvailability feature gate to be set.<br/>
69256936
</td>
69266937
<td>false</td>
6938+
</tr><tr>
6939+
<td><b><a href="#ironicspectlstrustedca">trustedCA</a></b></td>
6940+
<td>object</td>
6941+
<td>
6942+
TrustedCA is a reference to a ConfigMap or Secret containing the CA certificate(s)
6943+
to use when validating TLS connections to image servers and other services.
6944+
The resource should contain one or more CA certificates in PEM format.<br/>
6945+
</td>
6946+
<td>false</td>
69276947
</tr><tr>
69286948
<td><b>trustedCAName</b></td>
69296949
<td>string</td>
@@ -6932,7 +6952,93 @@ HighAvailability feature gate to be set.<br/>
69326952
to use when validating TLS connections to image servers and other services.
69336953
The configmap should contain one or more CA certificates in PEM format.
69346954
If the configmap contains multiple keys, only the first key will be used and
6935-
a warning will be logged.<br/>
6955+
a warning will be logged.
6956+
6957+
Deprecated: Use TrustedCA instead. This field will be removed in a future release.<br/>
6958+
</td>
6959+
<td>false</td>
6960+
</tr></tbody>
6961+
</table>
6962+
6963+
6964+
### Ironic.spec.tls.bmcCA
6965+
<sup><sup>[↩ Parent](#ironicspectls)</sup></sup>
6966+
6967+
6968+
6969+
BMCCA is a reference to a ConfigMap or Secret containing the CA certificate(s)
6970+
to use when validating TLS connections to BMCs.
6971+
Supported in Ironic 32.0 or newer.
6972+
6973+
<table>
6974+
<thead>
6975+
<tr>
6976+
<th>Name</th>
6977+
<th>Type</th>
6978+
<th>Description</th>
6979+
<th>Required</th>
6980+
</tr>
6981+
</thead>
6982+
<tbody><tr>
6983+
<td><b>kind</b></td>
6984+
<td>enum</td>
6985+
<td>
6986+
Kind of the resource (ConfigMap or Secret).<br/>
6987+
<br/>
6988+
<i>Enum</i>: ConfigMap, Secret<br/>
6989+
</td>
6990+
<td>true</td>
6991+
</tr><tr>
6992+
<td><b>name</b></td>
6993+
<td>string</td>
6994+
<td>
6995+
Name of the resource.<br/>
6996+
</td>
6997+
<td>true</td>
6998+
</tr></tbody>
6999+
</table>
7000+
7001+
7002+
### Ironic.spec.tls.trustedCA
7003+
<sup><sup>[↩ Parent](#ironicspectls)</sup></sup>
7004+
7005+
7006+
7007+
TrustedCA is a reference to a ConfigMap or Secret containing the CA certificate(s)
7008+
to use when validating TLS connections to image servers and other services.
7009+
The resource should contain one or more CA certificates in PEM format.
7010+
7011+
<table>
7012+
<thead>
7013+
<tr>
7014+
<th>Name</th>
7015+
<th>Type</th>
7016+
<th>Description</th>
7017+
<th>Required</th>
7018+
</tr>
7019+
</thead>
7020+
<tbody><tr>
7021+
<td><b>kind</b></td>
7022+
<td>enum</td>
7023+
<td>
7024+
Kind of the resource (ConfigMap or Secret).<br/>
7025+
<br/>
7026+
<i>Enum</i>: ConfigMap, Secret<br/>
7027+
</td>
7028+
<td>true</td>
7029+
</tr><tr>
7030+
<td><b>name</b></td>
7031+
<td>string</td>
7032+
<td>
7033+
Name of the resource.<br/>
7034+
</td>
7035+
<td>true</td>
7036+
</tr><tr>
7037+
<td><b>key</b></td>
7038+
<td>string</td>
7039+
<td>
7040+
Key within the resource to use. If not specified and the resource contains multiple keys,
7041+
the first (alphabetically) key will be used and a warning will be logged for other keys.<br/>
69367042
</td>
69377043
<td>false</td>
69387044
</tr></tbody>

‎internal/controller/ironic_controller.go‎

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -166,17 +166,29 @@ func (r *IronicReconciler) handleIronic(cctx ironic.ControllerContext, ironicCon
166166
}
167167
}
168168

169-
var bmcSecret *corev1.Secret
170-
if bmcSecretName := ironicConf.Spec.TLS.BMCCAName; bmcSecretName != "" {
171-
bmcSecret, requeue, err = r.getAndUpdateSecret(cctx, ironicConf, bmcSecretName)
169+
var bmcCASecret *corev1.Secret
170+
var bmcCAConfigMap *corev1.ConfigMap
171+
if bmcCARef := ironic.GetBMCCA(&ironicConf.Spec.TLS); bmcCARef != nil {
172+
switch bmcCARef.Kind {
173+
case metal3api.ResourceKindSecret:
174+
bmcCASecret, requeue, err = r.getAndUpdateSecret(cctx, ironicConf, bmcCARef.Name)
175+
case metal3api.ResourceKindConfigMap:
176+
bmcCAConfigMap, requeue, err = r.getConfigMap(cctx, ironicConf, bmcCARef.Name)
177+
}
172178
if requeue || err != nil {
173179
return requeue, err
174180
}
175181
}
176182

183+
var trustedCASecret *corev1.Secret
177184
var trustedCAConfigMap *corev1.ConfigMap
178-
if trustedCAConfigMapName := ironicConf.Spec.TLS.TrustedCAName; trustedCAConfigMapName != "" {
179-
trustedCAConfigMap, requeue, err = r.getConfigMap(cctx, ironicConf, trustedCAConfigMapName)
185+
if trustedCARef := ironic.GetTrustedCA(&ironicConf.Spec.TLS); trustedCARef != nil {
186+
switch trustedCARef.Kind {
187+
case metal3api.ResourceKindSecret:
188+
trustedCASecret, requeue, err = r.getAndUpdateSecret(cctx, ironicConf, trustedCARef.Name)
189+
case metal3api.ResourceKindConfigMap:
190+
trustedCAConfigMap, requeue, err = r.getConfigMap(cctx, ironicConf, trustedCARef.Name)
191+
}
180192
if requeue || err != nil {
181193
return requeue, err
182194
}
@@ -186,7 +198,9 @@ func (r *IronicReconciler) handleIronic(cctx ironic.ControllerContext, ironicCon
186198
Ironic: ironicConf,
187199
APISecret: apiSecret,
188200
TLSSecret: tlsSecret,
189-
BMCCASecret: bmcSecret,
201+
BMCCASecret: bmcCASecret,
202+
BMCCAConfigMap: bmcCAConfigMap,
203+
TrustedCASecret: trustedCASecret,
190204
TrustedCAConfigMap: trustedCAConfigMap,
191205
}
192206

0 commit comments

Comments
 (0)