Skip to content

Commit 63e99e2

Browse files
John ZakrzewskiJohn Zakrzewski
John Zakrzewski
authored and
John Zakrzewski
committed
feat: cert manager install and configuring rest components for TLS
Signed-off-by: John Zakrzewski <[email protected]> configure tls for REST Signed-off-by: John Zakrzewski <[email protected]> update script to include DNS names Signed-off-by: John Zakrzewski <[email protected]> disable tls in values.yaml, remove cert-manager Signed-off-by: John Zakrzewski <[email protected]> adding readme Signed-off-by: John Zakrzewski <[email protected]> feat: cert-manager-install Signed-off-by: John Zakrzewski <[email protected]> feat: configure callhome for tls with restapi Signed-off-by: John Zakrzewski <[email protected]> chore: configuring cert ingestion for csi-node daemonset chore: add certificate job, clean up to enable tls successfully
1 parent ec7ae05 commit 63e99e2

File tree

12 files changed

+329
-10
lines changed

12 files changed

+329
-10
lines changed

‎call-home/src/bin/callhome/main.rs‎

Lines changed: 39 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,10 @@ struct CliArgs {
5252
/// The endpoint to fetch events stats.
5353
#[clap(long, short)]
5454
aggregator_url: Option<Url>,
55+
56+
/// The path to the TLS CA certificate
57+
#[clap(long, short)]
58+
tls_client_ca_path: Option<String>,
5559
}
5660
impl CliArgs {
5761
fn args() -> Self {
@@ -107,12 +111,42 @@ async fn run(logs: Arc<Mutex<VecDeque<LogEntry>>>) -> anyhow::Result<()> {
107111
anyhow::anyhow!("failed to generate metrics receiver client: {:?}", error)
108112
})?;
109113

114+
let ca_certificate_path = args.tls_client_ca_path;
115+
let cert = match ca_certificate_path {
116+
Some(path) => {
117+
let cert = std::fs::read(path).map_err(|error| {
118+
anyhow::anyhow!("Failed to read certificate file, Error: '{:?}'", error)
119+
})?;
120+
Some(cert)
121+
}
122+
None => None,
123+
};
124+
110125
// Generate Mayastor REST client.
111-
let config = Configuration::builder()
112-
.with_timeout(Duration::from_secs(30))
113-
.with_tracing(true)
114-
.build_url(endpoint)
115-
.map_err(|error| anyhow::anyhow!("failed to create openapi configuration: {:?}", error))?;
126+
let config = match (endpoint.scheme(), cert.as_deref()) {
127+
("https", Some(cert)) => Configuration::builder()
128+
.with_timeout(Duration::from_secs(30))
129+
.with_tracing(true)
130+
.with_certificate(cert)
131+
.build_url(endpoint)
132+
.map_err(|error| {
133+
anyhow::anyhow!("failed to create openapi configuration: {:?}", error)
134+
})?,
135+
("https", None) => {
136+
anyhow::bail!("HTTPS endpoint requires a CA certificate path");
137+
}
138+
(_, Some(_path)) => {
139+
anyhow::bail!("TLS certificate is only supported for HTTPS connection")
140+
}
141+
_ => Configuration::builder()
142+
.with_timeout(Duration::from_secs(30))
143+
.with_tracing(true)
144+
.build_url(endpoint)
145+
.map_err(|error| {
146+
anyhow::anyhow!("failed to create openapi configuration: {:?}", error)
147+
})?,
148+
};
149+
116150
let client = openapi::clients::tower::ApiClient::new(config);
117151

118152
loop {

‎chart/Chart.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ dependencies:
4848
version: 4.2.0
4949
repository: https://openebs.github.io/dynamic-localpv-provisioner
5050
condition: localpv-provisioner.enabled
51+
- name: cert-manager
52+
version: v1.12.10
53+
repository: https://charts.jetstack.io
54+
alias: cert-manager
55+
condition: cert-manager.enabled
5156
annotations:
5257
helm.sh/images: |
5358
- name: bats

‎chart/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ This removes all the Kubernetes components associated with the chart and deletes
5656
|------------|------|---------|
5757
| | crds | 0.0.0 |
5858
| https://charts.bitnami.com/bitnami | etcd | 8.6.0 |
59+
| https://charts.jetstack.io | cert-manager(cert-manager) | v1.17.0 |
5960
| https://grafana.github.io/helm-charts | loki-stack | 2.9.11 |
6061
| https://jaegertracing.github.io/helm-charts | jaeger-operator | 2.50.1 |
6162
| https://nats-io.github.io/k8s/helm/charts/ | nats | 0.19.14 |
@@ -119,6 +120,7 @@ This removes all the Kubernetes components associated with the chart and deletes
119120
| base.&ZeroWidthSpace;logging.&ZeroWidthSpace;format | Valid values for format are pretty, json and compact | `"pretty"` |
120121
| base.&ZeroWidthSpace;logging.&ZeroWidthSpace;silenceLevel | Silence specific module components | `nil` |
121122
| base.&ZeroWidthSpace;metrics.&ZeroWidthSpace;enabled | Enable the metrics exporter | `true` |
123+
| cert-manager.&ZeroWidthSpace;enabled | Enable cert-manager only if tls is enabled | `true` |
122124
| crds.&ZeroWidthSpace;csi.&ZeroWidthSpace;volumeSnapshots.&ZeroWidthSpace;enabled | Install Volume Snapshot CRDs | `true` |
123125
| crds.&ZeroWidthSpace;enabled | Disables the installation of all CRDs if set to false | `true` |
124126
| csi.&ZeroWidthSpace;controller.&ZeroWidthSpace;logLevel | Log level for the csi controller | `"info"` |

‎chart/templates/hooks/wait-for-cert-manager.yaml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
{{- if .Values.tls.enabled }}
2+
---
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
name: cert-manager-job-sa
7+
namespace: {{ .Release.Namespace }}
8+
---
9+
apiVersion: rbac.authorization.k8s.io/v1
10+
kind: Role
11+
metadata:
12+
name: cert-manager-job-role
13+
namespace: {{ .Release.Namespace }}
14+
rules:
15+
- apiGroups: ["cert-manager.io"]
16+
resources: ["issuers", "certificates"]
17+
verbs: ["create", "update", "patch", "delete", "get", "list", "watch"]
18+
---
19+
apiVersion: rbac.authorization.k8s.io/v1
20+
kind: RoleBinding
21+
metadata:
22+
name: cert-manager-job-rolebinding
23+
namespace: {{ .Release.Namespace }}
24+
subjects:
25+
- kind: ServiceAccount
26+
name: cert-manager-job-sa
27+
namespace: {{ .Release.Namespace }}
28+
roleRef:
29+
kind: Role
30+
name: cert-manager-job-role
31+
apiGroup: rbac.authorization.k8s.io
32+
---
33+
apiVersion: batch/v1
34+
kind: Job
35+
metadata:
36+
name: create-certificates
37+
namespace: {{ .Release.Namespace }}
38+
annotations:
39+
"helm.sh/hook": post-install,post-upgrade
40+
"helm.sh/hook-delete-policy": hook-succeeded,hook-failed
41+
spec:
42+
template:
43+
spec:
44+
serviceAccountName: cert-manager-job-sa
45+
containers:
46+
- name: create-certificates
47+
image: bitnami/kubectl:latest
48+
command:
49+
- /bin/sh
50+
- -c
51+
- |
52+
echo "Waiting for cert-manager-webhook to be available..."
53+
kubectl wait --for=condition=Available=True Deployment/{{ .Release.Namespace }}-cert-manager-webhook -n {{ .Release.Namespace }} --timeout=120s
54+
echo "Creating selfsigned-issuer..."
55+
kubectl apply -f - <<EOF
56+
apiVersion: cert-manager.io/v1
57+
kind: Issuer
58+
metadata:
59+
name: selfsigned-issuer
60+
namespace: {{ .Release.Namespace }}
61+
spec:
62+
selfSigned: {}
63+
EOF
64+
echo "Creating root-ca certificate..."
65+
kubectl apply -f - <<EOF
66+
apiVersion: cert-manager.io/v1
67+
kind: Certificate
68+
metadata:
69+
name: root-ca
70+
namespace: {{ .Release.Namespace }}
71+
spec:
72+
isCA: true
73+
duration: 175200h # 20 years
74+
commonName: root-ca
75+
secretName: ca-root-cert
76+
issuerRef:
77+
name: selfsigned-issuer
78+
kind: Issuer
79+
group: cert-manager.io
80+
EOF
81+
echo "Creating ca-issuer..."
82+
kubectl apply -f - <<EOF
83+
apiVersion: cert-manager.io/v1
84+
kind: Issuer
85+
metadata:
86+
name: ca-issuer
87+
namespace: {{ .Release.Namespace }}
88+
spec:
89+
ca:
90+
secretName: ca-root-cert
91+
EOF
92+
echo "Creating rest-api-server certificate..."
93+
kubectl apply -f - <<EOF
94+
apiVersion: cert-manager.io/v1
95+
kind: Certificate
96+
metadata:
97+
name: rest-api-server
98+
namespace: {{ .Release.Namespace }}
99+
spec:
100+
duration: 175200h
101+
isCA: false
102+
dnsNames:
103+
- {{ .Release.Name }}-api-rest.{{ .Release.Namespace }}.svc
104+
- {{ .Release.Name }}-api-rest.{{ .Release.Namespace }}.svc.cluster.local
105+
- {{ .Release.Name }}-api-rest
106+
issuerRef:
107+
name: ca-issuer
108+
kind: Issuer
109+
secretName: api-rest-tls
110+
EOF
111+
restartPolicy: OnFailure
112+
{{- end }}

‎chart/templates/mayastor/apis/api-rest-deployment.yaml‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ spec:
4545
image: "{{ .Values.image.registry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-api-rest:{{ default .Values.image.tag .Values.image.repoTags.controlPlane }}"
4646
imagePullPolicy: {{ .Values.image.pullPolicy }}
4747
args:
48-
- "--dummy-certificates"
4948
- "--no-auth"
5049
- "--http=[::]:8081"
5150
- "--request-timeout={{ .Values.base.default_req_timeout }}"{{ if .Values.base.jaeger.enabled }}
@@ -56,6 +55,22 @@ spec:
5655
{{- if .Values.apis.rest.healthProbes.readiness.enabled }}
5756
- "--core-health-freq={{ .Values.apis.rest.healthProbes.readiness.agentCoreProbeFreq }}"
5857
{{- end }}
58+
{{- if not .Values.tls.enabled }}
59+
- "--dummy-certificates"
60+
{{- else }}
61+
- --cert-file=/etc/tls/tls.crt
62+
- --key-file=/etc/tls/tls.key
63+
# - --tls-client-ca-path=/etc/client_cert/ca.crt # CA cert for client verification with core-agent
64+
volumeMounts:
65+
- name: certs
66+
mountPath: /etc/tls
67+
readOnly: true
68+
# - name: ca-cert
69+
# mountPath: /etc/client_cert/ca.crt
70+
# subPath: ca.crt
71+
# readOnly: true
72+
73+
{{- end }}
5974
ports:
6075
- containerPort: 8080
6176
- containerPort: 8081
@@ -86,3 +101,13 @@ spec:
86101
periodSeconds: {{ .Values.apis.rest.healthProbes.liveness.periodSeconds }}
87102
timeoutSeconds: {{ .Values.apis.rest.healthProbes.liveness.timeoutSeconds }}
88103
{{- end }}
104+
{{- if .Values.tls.enabled }}
105+
volumes:
106+
- name: certs
107+
secret:
108+
secretName: api-rest-tls
109+
# - name: ca-cert
110+
# secret:
111+
# defaultMode: 420
112+
# secretName: agent-core-server-cert
113+
{{- end }}

‎chart/templates/mayastor/csi/csi-controller-deployment.yaml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,14 +118,20 @@ spec:
118118
imagePullPolicy: {{ .Values.image.pullPolicy }}
119119
args:
120120
- "--csi-socket=/var/lib/csi/sockets/pluginproxy/csi.sock"
121-
- "--rest-endpoint=http://{{ .Release.Name }}-api-rest:8081"{{ if .Values.base.jaeger.enabled }}
121+
{{ if .Values.base.jaeger.enabled }}
122122
- "--jaeger={{ include "jaeger_url" . }}"{{ end }}
123123
{{- range $key, $val := .Values.csi.node.topology.segments }}
124124
- "--node-selector={{ $key }}={{ $val }}"
125125
{{- end }}
126126
- "--ansi-colors={{ .Values.base.logging.color }}"
127127
- "--fmt-style={{ include "logFormat" . }}"
128128
- "--create-volume-limit={{ .Values.csi.controller.maxCreateVolume }}"
129+
{{- if .Values.tls.enabled }}
130+
- "--rest-endpoint=https://{{ .Release.Name }}-api-rest:8080"
131+
- "--tls-client-ca-path=/etc/client_cert/ca.crt" # CA cert for client verification with rest
132+
{{- else }}
133+
- "--rest-endpoint=http://{{ .Release.Name }}-api-rest:8081"
134+
{{- end }}
129135
env:
130136
- name: RUST_LOG
131137
value: {{ .Values.csi.controller.logLevel }}
@@ -136,6 +142,18 @@ spec:
136142
volumeMounts:
137143
- name: socket-dir
138144
mountPath: /var/lib/csi/sockets/pluginproxy/
145+
{{- if .Values.tls.enabled }}
146+
- name: ca-cert
147+
mountPath: /etc/client_cert/ca.crt
148+
subPath: ca.crt
149+
readOnly: true
150+
{{- end }}
139151
volumes:
140152
- name: socket-dir
141153
emptyDir:
154+
{{- if .Values.tls.enabled }}
155+
- name: ca-cert
156+
secret:
157+
defaultMode: 420
158+
secretName: api-rest-tls
159+
{{- end }}

‎chart/templates/mayastor/csi/csi-node-daemonset.yaml‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,7 @@ spec:
8787
{{- end }}
8888
args:
8989
- "--csi-socket={{ default .Values.csi.node.pluginMountPath .Values.csi.node.pluginMounthPath }}/{{ .Values.csi.node.socketPath }}"
90-
- "--node-name=$(MY_NODE_NAME)"
91-
- "--rest-endpoint=http://{{ .Release.Name }}-api-rest:8081"{{ if .Values.csi.node.restClient.enabled }}
90+
- "--node-name=$(MY_NODE_NAME)"{{ if .Values.csi.node.restClient.enabled }}
9291
- "--enable-rest"{{ end }}
9392
- "--enable-registration"
9493
- "--grpc-ip=$(MY_POD_IP)"
@@ -107,6 +106,14 @@ spec:
107106
{{- end }}
108107
- "--fmt-style={{ include "logFormat" . }}"
109108
- "--ansi-colors={{ .Values.base.logging.color }}"
109+
{{- if .Values.tls.enabled }}
110+
- "--endpoint=https://{{ .Release.Name }}-api-rest:8080"
111+
- "--tls-client-ca-path=/etc/client_cert/ca.crt" # CA cert for client verification with rest
112+
{{- else }}
113+
- "--endpoint=http://{{ .Release.Name }}-api-rest:8081"
114+
{{- end }}
115+
command:
116+
- csi-node
110117
volumeMounts:
111118
- name: device
112119
mountPath: /dev
@@ -119,6 +126,12 @@ spec:
119126
- name: kubelet-dir
120127
mountPath: {{ .Values.csi.node.kubeletDir }}
121128
mountPropagation: "Bidirectional"
129+
{{- if .Values.tls.enabled }}
130+
- name: ca-cert
131+
mountPath: /etc/client_cert/ca.crt
132+
subPath: ca.crt
133+
readOnly: true
134+
{{- end }}
122135
resources:
123136
limits:
124137
cpu: {{ .Values.csi.node.resources.limits.cpu | quote }}
@@ -174,3 +187,9 @@ spec:
174187
hostPath:
175188
path: {{ .Values.csi.node.kubeletDir }}
176189
type: Directory
190+
{{- if .Values.tls.enabled }}
191+
- name: ca-cert
192+
secret:
193+
defaultMode: 420
194+
secretName: api-rest-tls
195+
{{- end }}

‎chart/templates/mayastor/obs/obs-callhome-deployment.yaml‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,19 +37,31 @@ spec:
3737
- name: obs-callhome
3838
image: "{{ .Values.image.registry }}/{{ .Values.image.repo }}/{{ include "image_prefix" . }}-obs-callhome:{{ default .Values.image.tag .Values.image.repoTags.extensions }}"
3939
args:
40-
- "-e http://{{ .Release.Name }}-api-rest:8081"
4140
- "-n {{ .Release.Namespace }}"{{ if .Values.eventing.enabled }}
4241
- "--aggregator-url=http://{{ .Release.Name }}-obs-callhome-stats:9090/stats"{{ end }}
4342
{{ if .Values.obs.callhome.sendReport }}
4443
- "--send-report"
4544
{{ end }}
45+
{{- if .Values.tls.enabled }}
46+
- "--endpoint=https://{{ .Release.Name }}-api-rest:8080"
47+
- "--tls-client-ca-path=/etc/client_cert/ca.crt" # CA cert for client verification with rest
48+
{{- else }}
49+
- "--endpoint=http://{{ .Release.Name }}-api-rest:8081"
50+
{{- end }}
4651
env:
4752
- name: RUST_LOG
4853
value: {{ .Values.obs.callhome.logLevel }}
4954
{{- if .Values.obs.callhome.productName }}
5055
- name: CALLHOME_PRODUCT_NAME
5156
value: {{ .Values.obs.callhome.productName | quote }}
5257
{{- end }}
58+
{{- if .Values.tls.enabled }}
59+
volumeMounts:
60+
- name: ca-cert
61+
mountPath: /etc/client_cert/ca.crt
62+
subPath: ca.crt
63+
readOnly: true
64+
{{- end }}
5365
imagePullPolicy: {{ .Values.image.pullPolicy }}
5466
resources:
5567
limits:
@@ -83,4 +95,11 @@ spec:
8395
cpu: {{ .Values.obs.stats.resources.requests.cpu | quote }}
8496
memory: {{ .Values.obs.stats.resources.requests.memory | quote }}
8597
{{- end }}
98+
volumes:
99+
{{- if .Values.tls.enabled }}
100+
- name: ca-cert
101+
secret:
102+
defaultMode: 420
103+
secretName: api-rest-tls
104+
{{- end }}
86105
{{- end }}

0 commit comments

Comments
 (0)