Skip to content

Commit 5450aa9

Browse files
John ZakrzewskiJohn Zakrzewski
John Zakrzewski
authored and
John Zakrzewski
committed
feat: configure rest components for tls
Signed-off-by: John Zakrzewski <[email protected]> configuring diskpool operator to speak tls Signed-off-by: John Zakrzewski <[email protected]> debugging rest api and cert configuration Signed-off-by: John Zakrzewski <[email protected]> tidying up Signed-off-by: John Zakrzewski <[email protected]> resolving comments Signed-off-by: John Zakrzewski <[email protected]> fix: running linter Signed-off-by: John Zakrzewski <[email protected]> fix: address failed tests, rely on cert-manager for certs Signed-off-by: John Zakrzewski <[email protected]> fix: addressing comments Signed-off-by: John Zakrzewski <[email protected]>
1 parent 1524559 commit 5450aa9

File tree

5 files changed

+109
-16
lines changed

5 files changed

+109
-16
lines changed

‎control-plane/csi-driver/src/bin/controller/client.rs‎

Lines changed: 43 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -123,16 +123,49 @@ impl RestApiClient {
123123
let url = clients::tower::Url::parse(endpoint)
124124
.map_err(|error| anyhow!("Invalid API endpoint URL {}: {:?}", endpoint, error))?;
125125
let concurrency_limit = cfg.create_volume_limit() * 2;
126-
let tower = clients::tower::Configuration::builder()
127-
.with_timeout(cfg.io_timeout())
128-
.with_concurrency_limit(Some(concurrency_limit))
129-
.build_url(url)
130-
.map_err(|error| {
131-
anyhow::anyhow!(
132-
"Failed to create openapi configuration, Error: '{:?}'",
133-
error
134-
)
135-
})?;
126+
let ca_certificate_path = cfg.ca_certificate_path();
127+
let cert = match ca_certificate_path {
128+
Some(path) => {
129+
let cert = std::fs::read(path).map_err(|error| {
130+
anyhow::anyhow!(
131+
"Failed to create openapi configuration at path {}, Error: '{:?}'",
132+
path.display(),
133+
error
134+
)
135+
})?;
136+
Some(cert)
137+
}
138+
None => None,
139+
};
140+
let tower = match (url.scheme(), cert) {
141+
("https", Some(cert)) => clients::tower::Configuration::builder()
142+
.with_timeout(Some(cfg.io_timeout()))
143+
.with_concurrency_limit(Some(concurrency_limit))
144+
.with_certificate(cert.as_slice())
145+
.build_url(url)
146+
.map_err(|error| {
147+
anyhow::anyhow!(
148+
"Failed to create openapi configuration, Error: '{:?}'",
149+
error
150+
)
151+
})?,
152+
("https", None) => {
153+
anyhow::bail!("HTTPS endpoint requires a CA certificate path");
154+
}
155+
(_, Some(_path)) => {
156+
anyhow::bail!("CA certificate path is only supported for HTTPS endpoints");
157+
}
158+
_ => clients::tower::Configuration::builder()
159+
.with_timeout(Some(cfg.io_timeout()))
160+
.with_concurrency_limit(Some(concurrency_limit))
161+
.build_url(url)
162+
.map_err(|error| {
163+
anyhow::anyhow!(
164+
"Failed to create openapi configuration, Error: '{:?}'",
165+
error
166+
)
167+
})?,
168+
};
136169

137170
REST_CLIENT.get_or_init(|| Self {
138171
rest_client: clients::tower::ApiClient::new(tower.clone()),

‎control-plane/csi-driver/src/bin/controller/config.rs‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
use anyhow::Context;
22
use clap::ArgMatches;
33
use once_cell::sync::OnceCell;
4-
use std::{collections::HashMap, time::Duration};
4+
use std::{
5+
collections::HashMap,
6+
path::{Path, PathBuf},
7+
time::Duration,
8+
};
59

610
static CONFIG: OnceCell<CsiControllerConfig> = OnceCell::new();
711

@@ -17,6 +21,8 @@ pub(crate) struct CsiControllerConfig {
1721
create_volume_limit: usize,
1822
/// Force unstage volume.
1923
force_unstage_volume: bool,
24+
/// Path to the CA certificate file.
25+
ca_certificate_path: Option<PathBuf>,
2026
}
2127

2228
impl CsiControllerConfig {
@@ -50,14 +56,17 @@ impl CsiControllerConfig {
5056
tracing::warn!(
5157
"Force unstage volume is disabled, can trigger potential data corruption!"
5258
);
53-
}
59+
};
60+
61+
let ca_certificate_path: Option<&PathBuf> = args.get_one::<PathBuf>("tls-client-ca-path");
5462

5563
CONFIG.get_or_init(|| Self {
5664
rest_endpoint: rest_endpoint.into(),
5765
io_timeout: io_timeout.into(),
5866
node_selector,
5967
create_volume_limit,
6068
force_unstage_volume,
69+
ca_certificate_path: ca_certificate_path.cloned(),
6170
});
6271
Ok(())
6372
}
@@ -92,4 +101,9 @@ impl CsiControllerConfig {
92101
pub(crate) fn force_unstage_volume(&self) -> bool {
93102
self.force_unstage_volume
94103
}
104+
105+
/// Path to the CA certificate file.
106+
pub(crate) fn ca_certificate_path(&self) -> Option<&Path> {
107+
self.ca_certificate_path.as_deref()
108+
}
95109
}

‎control-plane/csi-driver/src/bin/controller/main.rs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,11 @@ async fn main() -> anyhow::Result<()> {
131131
.value_parser(clap::value_parser!(bool))
132132
.help("Enable force unstage volume feature")
133133
)
134+
.arg(
135+
Arg::new("tls-client-ca-path")
136+
.long("tls-client-ca-path")
137+
.help("path to the CA certificate file")
138+
)
134139
.get_matches();
135140

136141
utils::print_package_info!();

‎control-plane/rest/service/src/main.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -185,6 +185,7 @@ fn load_certificates<R: std::io::Read>(
185185
.map_err(|_| {
186186
anyhow::anyhow!("Failed to retrieve the rsa private keys from the key file",)
187187
})?;
188+
188189
if keys.is_empty() {
189190
anyhow::bail!("No keys found in the keys file");
190191
}

‎k8s/operators/src/pool/main.rs‎

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -129,14 +129,49 @@ async fn pool_controller(args: ArgMatches) -> anyhow::Result<()> {
129129
.expect("timeout value is invalid")
130130
.into();
131131

132-
let cfg = clients::tower::Configuration::new(url, timeout, None, None, true, None).map_err(
133-
|error| {
132+
let ca_certificate_path: Option<&str> = args
133+
.get_one::<String>("tls-client-ca-path")
134+
.map(|x| x.as_str());
135+
// take in cert path and make pem file
136+
let cert = match ca_certificate_path {
137+
Some(path) => {
138+
let cert = std::fs::read(path).map_err(|error| {
139+
anyhow::anyhow!("Failed to read certificate file, Error: '{:?}'", error)
140+
})?;
141+
Some(cert)
142+
}
143+
None => None,
144+
};
145+
let cfg = match (url.scheme(), cert) {
146+
("https", Some(cert)) => clients::tower::Configuration::new(
147+
url,
148+
timeout,
149+
None,
150+
Some(cert.as_slice()),
151+
true,
152+
None,
153+
)
154+
.map_err(|error| {
134155
anyhow::anyhow!(
135156
"Failed to create openapi configuration, Error: '{:?}'",
136157
error
137158
)
138-
},
139-
)?;
159+
})?,
160+
("https", None) => {
161+
anyhow::bail!("HTTPS endpoint requires a CA certificate path");
162+
}
163+
(_, Some(_path)) => {
164+
anyhow::bail!("CA certificate path is only supported for HTTPS endpoints");
165+
}
166+
_ => clients::tower::Configuration::new(url, timeout, None, None, true, None).map_err(
167+
|error| {
168+
anyhow::anyhow!(
169+
"Failed to create openapi configuration, Error: '{:?}'",
170+
error
171+
)
172+
},
173+
)?,
174+
};
140175
let interval = args
141176
.get_one::<String>("interval")
142177
.unwrap()
@@ -243,6 +278,11 @@ async fn main() -> anyhow::Result<()> {
243278
.value_parser(clap::value_parser!(bool))
244279
.help("Enable ansi color for logs"),
245280
)
281+
.arg(
282+
Arg::new("tls-client-ca-path")
283+
.long("tls-client-ca-path")
284+
.help("path to the CA certificate file"),
285+
)
246286
.get_matches();
247287

248288
utils::print_package_info!();

0 commit comments

Comments
 (0)