Skip to content

Commit d7d156f

Browse files
pooknullhors
pooknull
and
hors
authored
K8SPS-792: add .spec.backup.storages.*.s3.caBundle field (#1516)
* K8SPS-792: add `.spec.backup.storages.*.s3.caBundle` field https://perconadev.atlassian.net/browse/K8SPS-792 * remove `exec "$@"` from s3 certs script * `make manifests` --------- Co-authored-by: Viacheslav Sarzhan <slava.sarzhan@percona.com>
1 parent 2a0b2b6 commit d7d156f

48 files changed

Lines changed: 1313 additions & 63 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎api/v1/perconaservermysql_types.go‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -430,6 +430,17 @@ type EncryptionKeySecretSelector struct {
430430
Key string `json:"key,omitempty"`
431431
}
432432

433+
const DefaultCABundleKey = "ca.crt"
434+
435+
type CABundleSecretSelector struct {
436+
// +kubebuilder:validation:Required
437+
Name string `json:"name"`
438+
439+
// +kubebuilder:validation:Optional
440+
// +kubebuilder:default:=ca.crt
441+
Key string `json:"key,omitempty"`
442+
}
443+
433444
type BackupSpec struct {
434445
Enabled bool `json:"enabled,omitempty"`
435446
SourcePod string `json:"sourcePod,omitempty"`
@@ -590,6 +601,9 @@ type BackupStorageS3Spec struct {
590601
CredentialsSecret string `json:"credentialsSecret"`
591602
Region string `json:"region,omitempty"`
592603
EndpointURL string `json:"endpointUrl,omitempty"`
604+
// CABundle selects a custom CA certificate bundle for TLS connections to the S3 endpoint.
605+
// +optional
606+
CABundle *CABundleSecretSelector `json:"caBundle,omitempty"`
593607
}
594608

595609
// BucketAndPrefix returns bucket name and backup prefix from Bucket concatenated with Prefix.
@@ -1185,6 +1199,16 @@ func (cr *PerconaServerMySQL) CheckNSetDefaults(_ context.Context, serverVersion
11851199
if cr.Spec.Backup == nil {
11861200
cr.Spec.Backup = new(BackupSpec)
11871201
}
1202+
for _, storage := range cr.Spec.Backup.Storages {
1203+
if storage != nil && storage.S3 != nil && storage.S3.CABundle != nil && storage.S3.CABundle.Key == "" {
1204+
storage.S3.CABundle.Key = DefaultCABundleKey
1205+
}
1206+
}
1207+
if binlogServer := cr.Spec.Backup.PiTR.BinlogServer; binlogServer != nil &&
1208+
binlogServer.Storage.S3 != nil && binlogServer.Storage.S3.CABundle != nil &&
1209+
binlogServer.Storage.S3.CABundle.Key == "" {
1210+
binlogServer.Storage.S3.CABundle.Key = DefaultCABundleKey
1211+
}
11881212

11891213
if cr.Spec.Backup.Enabled {
11901214
if len(cr.Spec.Backup.Image) == 0 {
@@ -1749,6 +1773,9 @@ func (s *BackupStorageSpec) Equals(other *BackupStorageSpec) bool {
17491773
}
17501774

17511775
func (s *BackupStorageS3Spec) equals(other *BackupStorageS3Spec) bool {
1776+
if s == nil || other == nil {
1777+
return s == other
1778+
}
17521779
if s.Bucket != other.Bucket {
17531780
return false
17541781
}
@@ -1761,6 +1788,12 @@ func (s *BackupStorageS3Spec) equals(other *BackupStorageS3Spec) bool {
17611788
if s.EndpointURL != other.EndpointURL {
17621789
return false
17631790
}
1791+
if (s.CABundle == nil) != (other.CABundle == nil) {
1792+
return false
1793+
}
1794+
if s.CABundle != nil && *s.CABundle != *other.CABundle {
1795+
return false
1796+
}
17641797
return true
17651798
}
17661799

‎api/v1/perconaservermysql_types_test.go‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,37 @@ func TestCheckNSetDefaults(t *testing.T) {
149149
err := cr.CheckNSetDefaults(t.Context(), nil)
150150
assert.NoError(t, err)
151151
})
152+
t.Run("S3 CA bundle keys are defaulted", func(t *testing.T) {
153+
cr := new(PerconaServerMySQL)
154+
cr.Spec.MySQL.VolumeSpec = &VolumeSpec{
155+
PersistentVolumeClaim: &corev1.PersistentVolumeClaimSpec{
156+
Resources: corev1.VolumeResourceRequirements{
157+
Requests: corev1.ResourceList{corev1.ResourceStorage: resource.MustParse("1G")},
158+
},
159+
},
160+
}
161+
cr.Spec.Backup = &BackupSpec{
162+
Storages: map[string]*BackupStorageSpec{
163+
"default": {
164+
S3: &BackupStorageS3Spec{CABundle: &CABundleSecretSelector{Name: "default-ca"}},
165+
},
166+
"explicit": {
167+
S3: &BackupStorageS3Spec{CABundle: &CABundleSecretSelector{Name: "explicit-ca", Key: "root.pem"}},
168+
},
169+
},
170+
PiTR: PiTRSpec{BinlogServer: &BinlogServerSpec{
171+
Storage: BinlogServerStorageSpec{S3: &BackupStorageS3Spec{
172+
CABundle: &CABundleSecretSelector{Name: "binlog-ca"},
173+
}},
174+
}},
175+
}
176+
177+
err := cr.CheckNSetDefaults(t.Context(), nil)
178+
assert.NoError(t, err)
179+
assert.Equal(t, DefaultCABundleKey, cr.Spec.Backup.Storages["default"].S3.CABundle.Key)
180+
assert.Equal(t, "root.pem", cr.Spec.Backup.Storages["explicit"].S3.CABundle.Key)
181+
assert.Equal(t, DefaultCABundleKey, cr.Spec.Backup.PiTR.BinlogServer.Storage.S3.CABundle.Key)
182+
})
152183
t.Run("without backup image, with volume spec", func(t *testing.T) {
153184
cr := new(PerconaServerMySQL)
154185
cr.Spec.MySQL.VolumeSpec = &VolumeSpec{

‎api/v1/zz_generated.deepcopy.go‎

Lines changed: 22 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎build/Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ COPY build/orc-add_mysql_nodes.sh /opt/percona-server-mysql-operator/orc-add_mys
9494
COPY build/ps-init-entrypoint.sh /opt/percona-server-mysql-operator/ps-init-entrypoint.sh
9595
COPY build/run-backup.sh /opt/percona-server-mysql-operator/run-backup.sh
9696
COPY build/run-restore.sh /opt/percona-server-mysql-operator/run-restore.sh
97+
COPY build/prepare-s3-certs.sh /opt/percona-server-mysql-operator/prepare-s3-certs.sh
9798
COPY build/haproxy-entrypoint.sh /opt/percona-server-mysql-operator/haproxy-entrypoint.sh
9899
COPY build/haproxy_add_mysql_nodes.sh /opt/percona-server-mysql-operator/haproxy_add_mysql_nodes.sh
99100
COPY build/haproxy_check_primary.sh /opt/percona-server-mysql-operator/haproxy_check_primary.sh

‎build/prepare-s3-certs.sh‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
INPUT_DIR="/etc/s3/certs-in"
6+
OUTPUT_FILE="/etc/s3/certs/ca-bundle.crt"
7+
SYSTEM_CA_FILE="/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
8+
9+
echo -n >"${OUTPUT_FILE}"
10+
if [ -f "${SYSTEM_CA_FILE}" ]; then
11+
cat "${SYSTEM_CA_FILE}" >>"${OUTPUT_FILE}"
12+
echo >>"${OUTPUT_FILE}"
13+
fi
14+
for cert in "${INPUT_DIR}"/*.crt; do
15+
if [ -f "${cert}" ]; then
16+
cat "${cert}" >>"${OUTPUT_FILE}"
17+
echo >>"${OUTPUT_FILE}"
18+
fi
19+
done

‎build/ps-init-entrypoint.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "${OPERATORDIR}/mysql-state-monit
2929

3030
install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "${OPERATORDIR}/run-backup.sh" "${BINDIR}/run-backup.sh"
3131
install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "${OPERATORDIR}/run-restore.sh" "${BINDIR}/run-restore.sh"
32+
install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "${OPERATORDIR}/prepare-s3-certs.sh" "${BINDIR}/prepare-s3-certs.sh"
3233

3334
install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "${OPERATORDIR}/haproxy-entrypoint.sh" "${BINDIR}/haproxy-entrypoint.sh"
3435
install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "${OPERATORDIR}/haproxy_add_mysql_nodes.sh" "${BINDIR}/haproxy_add_mysql_nodes.sh"
@@ -46,3 +47,7 @@ install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "${OPERATORDIR}/binlog-server-ent
4647
install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "${OPERATORDIR}/pitr" "${BINDIR}/pitr"
4748
install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "${OPERATORDIR}/run-pitr-restore.sh" "${BINDIR}/run-pitr-restore.sh"
4849
install -o "$(id -u)" -g "$(id -g)" -m 0755 -D "${OPERATORDIR}/run-prepare-restore.sh" "${BINDIR}/run-prepare-restore.sh"
50+
51+
if [[ -d /etc/s3/certs-in && -d /etc/s3/certs ]]; then
52+
"${BINDIR}/prepare-s3-certs.sh"
53+
fi

‎build/run-backup.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ request_data() {
1515
{
1616
"destination": "$(json_escape "${BACKUP_DEST}")",
1717
"type": "$(json_escape "${STORAGE_TYPE}")",
18+
"caCert": "$(json_escape "${SSL_CERT_FILE:-}")",
1819
"containerOptions": ${CONTAINER_OPTIONS},
1920
"verifyTLS": $(json_escape "${VERIFY_TLS}"),
2021
"incrementalLsn": "$(json_escape "${INCREMENTAL_LSN}")",

‎build/run-restore.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ XBCLOUD_ARGS="--curl-retriable-errors=7 --parallel=${PARALLEL} ${XBCLOUD_EXTRA_A
1212
if [ -n "$VERIFY_TLS" ] && [[ $VERIFY_TLS == "false" ]]; then
1313
XBCLOUD_ARGS="${XBCLOUD_ARGS} --insecure"
1414
fi
15+
if [[ -n "${SSL_CERT_FILE:-}" ]]; then
16+
XBCLOUD_ARGS="${XBCLOUD_ARGS} --cacert=${SSL_CERT_FILE}"
17+
fi
1518

1619
download() {
1720
local dest=$1

‎cmd/example-gen/main.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,10 @@ func printRestore() error {
176176
CredentialsSecret: fmt.Sprintf("%s-s3-credentials", defaults.NameCluster),
177177
Region: "us-west-2",
178178
EndpointURL: "https://s3.amazonaws.com",
179+
CABundle: &apiv1.CABundleSecretSelector{
180+
Name: "minio-ca-bundle",
181+
Key: "ca.crt",
182+
},
179183
},
180184
},
181185
ServerID: 101,
@@ -210,6 +214,10 @@ func printRestore() error {
210214
CredentialsSecret: fmt.Sprintf("%s-s3-credentials", defaults.NameCluster),
211215
Region: "us-west-2",
212216
EndpointURL: "https://s3.amazonaws.com",
217+
CABundle: &apiv1.CABundleSecretSelector{
218+
Name: "minio-ca-bundle",
219+
Key: "ca.crt",
220+
},
213221
},
214222
},
215223
},

‎cmd/example-gen/pkg/defaults/manual.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,10 @@ func backupDefaults(spec *apiv1.BackupSpec) {
160160
CredentialsSecret: fmt.Sprintf("%s-s3-credentials", NameCluster),
161161
Region: "us-west-2",
162162
EndpointURL: "https://s3.amazonaws.com",
163+
CABundle: &apiv1.CABundleSecretSelector{
164+
Name: "minio-ca-bundle",
165+
Key: "ca.crt",
166+
},
163167
},
164168
Encryption: &apiv1.BinlogServerStorageEncryptionSpec{
165169
KekID: "alpha",
@@ -239,6 +243,10 @@ func backupDefaults(spec *apiv1.BackupSpec) {
239243
CredentialsSecret: fmt.Sprintf("%s-s3-credentials", NameCluster),
240244
Region: "us-west-2",
241245
EndpointURL: "https://s3.amazonaws.com",
246+
CABundle: &apiv1.CABundleSecretSelector{
247+
Name: "minio-ca-bundle",
248+
Key: "ca.crt",
249+
},
242250
},
243251
Annotations: map[string]string{
244252
"testName": "scheduled-backup",

0 commit comments

Comments
 (0)