Skip to content

Commit 112e1f1

Browse files
bouskaJbouskaJ
committed
[SECURESIGN-1393] Migrate trillian logserver
1 parent ac743de commit 112e1f1

File tree

8 files changed

+212
-435
lines changed

8 files changed

+212
-435
lines changed

‎internal/controller/common/utils/kubernetes/deployment.go

+10
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,16 @@ func FindContainerByNameOrCreate(podSpec *corev1.PodSpec, containerName string)
128128
return &podSpec.Containers[len(podSpec.Containers)-1]
129129
}
130130

131+
func FindInitContainerByNameOrCreate(podSpec *corev1.PodSpec, containerName string) *corev1.Container {
132+
for i, c := range podSpec.InitContainers {
133+
if c.Name == containerName {
134+
return &podSpec.InitContainers[i]
135+
}
136+
}
137+
podSpec.InitContainers = append(podSpec.InitContainers, corev1.Container{Name: containerName})
138+
return &podSpec.InitContainers[len(podSpec.InitContainers)-1]
139+
}
140+
131141
func FindVolumeByNameOrCreate(podSpec *corev1.PodSpec, volumeName string) *corev1.Volume {
132142
for i, v := range podSpec.Volumes {
133143
if v.Name == volumeName {

‎internal/controller/common/utils/kubernetes/ensure/deployment.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
const (
1212
CaTrustVolumeName = "ca-trust"
1313
TLSVolumeName = "tls-cert"
14+
CATRustMountPath = "/var/run/configs/tas/ca-trust"
1415

1516
TLSVolumeMount = "/var/run/secrets/tas"
1617

@@ -32,10 +33,10 @@ func TrustedCA(lor *v1alpha1.LocalObjectReference) func(dp *v1.Deployment) error
3233
template := &dp.Spec.Template
3334
for i := range template.Spec.Containers {
3435
env := kubernetes.FindEnvByNameOrCreate(&template.Spec.Containers[i], "SSL_CERT_DIR")
35-
env.Value = "/var/run/configs/tas/ca-trust:/var/run/secrets/kubernetes.io/serviceaccount"
36+
env.Value = CATRustMountPath + ":/var/run/secrets/kubernetes.io/serviceaccount"
3637

3738
volumeMount := kubernetes.FindVolumeMountByNameOrCreate(&template.Spec.Containers[i], CaTrustVolumeName)
38-
volumeMount.MountPath = "/var/run/configs/tas/ca-trust"
39+
volumeMount.MountPath = CATRustMountPath
3940
volumeMount.ReadOnly = true
4041

4142
}

‎internal/controller/trillian/actions/db/deployment.go

+17-2
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import (
44
"context"
55
"errors"
66
"fmt"
7+
"slices"
78

89
"github.com/securesign/operator/internal/controller/common/action"
910
"github.com/securesign/operator/internal/controller/common/utils"
@@ -258,9 +259,23 @@ func (i *deployAction) ensureTLS(instance *rhtasv1alpha1.Trillian) func(deployme
258259

259260
container.LivenessProbe.Exec.Command = []string{"bash", "-c", livenessCommand + " --ssl"}
260261

261-
container.Args = append(container.Args, "--ssl-cert", ensure.TLSCertPath)
262-
container.Args = append(container.Args, "--ssl-key", ensure.TLSKeyPath)
262+
if i := slices.Index(container.Args, "--ssl-cert"); i == -1 {
263+
container.Args = append(container.Args, "--ssl-cert", ensure.TLSCertPath)
264+
} else {
265+
if len(container.Args)-1 < i+1 {
266+
container.Args = append(container.Args, ensure.TLSCertPath)
267+
}
268+
container.Args[i+1] = ensure.TLSCertPath
269+
}
263270

271+
if i := slices.Index(container.Args, "--ssl-key"); i == -1 {
272+
container.Args = append(container.Args, "--ssl-key", ensure.TLSKeyPath)
273+
} else {
274+
if len(container.Args)-1 < i+1 {
275+
container.Args = append(container.Args, ensure.TLSKeyPath)
276+
}
277+
container.Args[i+1] = ensure.TLSKeyPath
278+
}
264279
return nil
265280
}
266281
}

‎internal/controller/trillian/actions/logserver/deployment.go

+45-41
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,14 @@ import (
66

77
"github.com/securesign/operator/internal/controller/common/action"
88
"github.com/securesign/operator/internal/controller/common/utils"
9+
"github.com/securesign/operator/internal/controller/common/utils/kubernetes"
10+
"github.com/securesign/operator/internal/controller/common/utils/kubernetes/ensure"
911
"github.com/securesign/operator/internal/controller/constants"
1012
"github.com/securesign/operator/internal/controller/labels"
1113
"github.com/securesign/operator/internal/controller/trillian/actions"
1214
trillianUtils "github.com/securesign/operator/internal/controller/trillian/utils"
15+
"golang.org/x/exp/maps"
16+
apps "k8s.io/api/apps/v1"
1317
"k8s.io/apimachinery/pkg/api/meta"
1418
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1519
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -36,60 +40,40 @@ func (i deployAction) CanHandle(_ context.Context, instance *rhtasv1alpha1.Trill
3640

3741
func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Trillian) *action.Result {
3842
var (
39-
err error
40-
updated bool
43+
err error
44+
result controllerutil.OperationResult
4145
)
4246

4347
labels := labels.For(actions.LogServerComponentName, actions.LogserverDeploymentName, instance.Name)
44-
server, err := trillianUtils.CreateLogServerDeployment(ctx, i.Client, instance, constants.TrillianServerImage, actions.LogserverDeploymentName, actions.RBACName, labels)
45-
if err != nil {
46-
return i.Failed(err)
47-
}
48-
49-
caTrustRef := utils.TrustedCAAnnotationToReference(instance.Annotations)
50-
// override if spec.trustedCA is defined
51-
if instance.Spec.TrustedCA != nil {
52-
caTrustRef = instance.Spec.TrustedCA
53-
}
54-
err = utils.SetTrustedCA(&server.Spec.Template, caTrustRef)
55-
56-
if err != nil {
57-
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
58-
Type: actions.ServerCondition,
59-
Status: metav1.ConditionFalse,
60-
Reason: constants.Failure,
61-
Message: err.Error(),
62-
})
63-
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
64-
Type: constants.Ready,
65-
Status: metav1.ConditionFalse,
66-
Reason: constants.Failure,
67-
Message: err.Error(),
68-
})
69-
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not create Trillian server: %w", err), instance)
70-
}
48+
insCopy := instance.DeepCopy()
7149

72-
if err = controllerutil.SetControllerReference(instance, server, i.Client.Scheme()); err != nil {
73-
return i.Failed(fmt.Errorf("could not set controller reference for server: %w", err))
50+
if insCopy.Spec.TrustedCA != nil {
51+
insCopy.Spec.TrustedCA = utils.TrustedCAAnnotationToReference(instance.Annotations)
7452
}
7553

76-
if updated, err = i.Ensure(ctx, server); err != nil {
77-
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
54+
if result, err = kubernetes.CreateOrUpdate(ctx, i.Client,
55+
&apps.Deployment{
56+
ObjectMeta: metav1.ObjectMeta{
57+
Name: actions.LogserverDeploymentName,
58+
Namespace: instance.Namespace,
59+
},
60+
},
61+
trillianUtils.EnsureServerDeployment(insCopy, constants.TrillianServerImage, actions.LogserverDeploymentName, actions.RBACName, labels),
62+
ensure.ControllerReference[*apps.Deployment](insCopy, i.Client),
63+
ensure.Labels[*apps.Deployment](maps.Keys(labels), labels),
64+
ensure.Proxy(),
65+
ensure.TrustedCA(insCopy.Spec.TrustedCA),
66+
ensure.Optional(trillianUtils.UseTLS(insCopy), i.withTlsDB(ctx, insCopy)),
67+
); err != nil {
68+
return i.Error(ctx, fmt.Errorf("could not create Trillian server: %w", err), instance, metav1.Condition{
7869
Type: actions.ServerCondition,
7970
Status: metav1.ConditionFalse,
8071
Reason: constants.Failure,
8172
Message: err.Error(),
8273
})
83-
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
84-
Type: constants.Ready,
85-
Status: metav1.ConditionFalse,
86-
Reason: constants.Failure,
87-
Message: err.Error(),
88-
})
89-
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not create Trillian server: %w", err), instance)
9074
}
9175

92-
if updated {
76+
if result != controllerutil.OperationResultNone {
9377
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
9478
Type: actions.ServerCondition,
9579
Status: metav1.ConditionFalse,
@@ -101,3 +85,23 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Trilli
10185
return i.Continue()
10286
}
10387
}
88+
89+
func (i deployAction) withTlsDB(ctx context.Context, instance *rhtasv1alpha1.Trillian) func(deployment *apps.Deployment) error {
90+
return func(dp *apps.Deployment) error {
91+
caPath, err := trillianUtils.CAPath(ctx, i.Client, instance)
92+
if err != nil {
93+
return fmt.Errorf("failed to get CA path: %w", err)
94+
}
95+
96+
c := kubernetes.FindContainerByNameOrCreate(&dp.Spec.Template.Spec, actions.LogserverDeploymentName)
97+
c.Args = append(c.Args, "--mysql_tls_ca", caPath)
98+
99+
mysqlServerName := "$(MYSQL_HOSTNAME)." + instance.Namespace + ".svc"
100+
if !*instance.Spec.Db.Create {
101+
mysqlServerName = "$(MYSQL_HOSTNAME)"
102+
}
103+
c.Args = append(c.Args, "--mysql_server_name", mysqlServerName)
104+
return nil
105+
}
106+
107+
}

‎internal/controller/trillian/actions/logsigner/deployment.go

+21-39
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,14 @@ import (
66

77
"github.com/securesign/operator/internal/controller/common/action"
88
"github.com/securesign/operator/internal/controller/common/utils"
9+
"github.com/securesign/operator/internal/controller/common/utils/kubernetes"
10+
"github.com/securesign/operator/internal/controller/common/utils/kubernetes/ensure"
911
"github.com/securesign/operator/internal/controller/constants"
1012
"github.com/securesign/operator/internal/controller/labels"
1113
"github.com/securesign/operator/internal/controller/trillian/actions"
1214
trillianUtils "github.com/securesign/operator/internal/controller/trillian/utils"
15+
"golang.org/x/exp/maps"
16+
apps "k8s.io/api/apps/v1"
1317
"k8s.io/apimachinery/pkg/api/meta"
1418
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1519
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -36,62 +40,40 @@ func (i deployAction) CanHandle(_ context.Context, instance *rhtasv1alpha1.Trill
3640

3741
func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Trillian) *action.Result {
3842
var (
39-
err error
40-
updated bool
43+
err error
44+
result controllerutil.OperationResult
4145
)
4246

4347
labels := labels.For(actions.LogSignerComponentName, actions.LogsignerDeploymentName, instance.Name)
44-
signer, err := trillianUtils.CreateLogServerDeployment(ctx, i.Client, instance, constants.TrillianLogSignerImage, actions.LogsignerDeploymentName, actions.RBACName, labels)
45-
if err != nil {
46-
return i.Failed(err)
47-
}
48-
49-
signer.Spec.Template.Spec.Containers[0].Args = append(signer.Spec.Template.Spec.Containers[0].Args, "--force_master=true")
5048

5149
caTrustRef := utils.TrustedCAAnnotationToReference(instance.Annotations)
5250
// override if spec.trustedCA is defined
5351
if instance.Spec.TrustedCA != nil {
5452
caTrustRef = instance.Spec.TrustedCA
5553
}
56-
err = utils.SetTrustedCA(&signer.Spec.Template, caTrustRef)
5754

58-
if err != nil {
59-
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
55+
if result, err = kubernetes.CreateOrUpdate(ctx, i.Client,
56+
&apps.Deployment{
57+
ObjectMeta: metav1.ObjectMeta{
58+
Name: actions.LogsignerDeploymentName,
59+
Namespace: instance.Namespace,
60+
},
61+
},
62+
trillianUtils.EnsureServerDeployment(instance, constants.TrillianLogSignerImage, actions.LogsignerDeploymentName, actions.RBACName, labels, "--force_master=true"),
63+
ensure.ControllerReference[*apps.Deployment](instance, i.Client),
64+
ensure.Labels[*apps.Deployment](maps.Keys(labels), labels),
65+
ensure.Proxy(),
66+
ensure.TrustedCA(caTrustRef),
67+
); err != nil {
68+
return i.Error(ctx, fmt.Errorf("could not create Trillian LogSigner: %w", err), instance, metav1.Condition{
6069
Type: actions.SignerCondition,
6170
Status: metav1.ConditionFalse,
6271
Reason: constants.Failure,
6372
Message: err.Error(),
6473
})
65-
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
66-
Type: constants.Ready,
67-
Status: metav1.ConditionFalse,
68-
Reason: constants.Failure,
69-
Message: err.Error(),
70-
})
71-
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not create Trillian LogSigner: %w", err), instance)
72-
}
73-
74-
if err = controllerutil.SetControllerReference(instance, signer, i.Client.Scheme()); err != nil {
75-
return i.Failed(fmt.Errorf("could not set controller reference for LogSigner deployment: %w", err))
76-
}
77-
78-
if updated, err = i.Ensure(ctx, signer); err != nil {
79-
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
80-
Type: actions.SignerCondition,
81-
Status: metav1.ConditionFalse,
82-
Reason: constants.Failure,
83-
Message: err.Error(),
84-
})
85-
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
86-
Type: constants.Ready,
87-
Status: metav1.ConditionFalse,
88-
Reason: constants.Failure,
89-
Message: err.Error(),
90-
})
91-
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not create Trillian LogSigner deployment: %w", err), instance)
9274
}
9375

94-
if updated {
76+
if result != controllerutil.OperationResultNone {
9577
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
9678
Type: actions.SignerCondition,
9779
Status: metav1.ConditionFalse,

0 commit comments

Comments
 (0)