Skip to content

Commit 2e53b94

Browse files
fghanmifghanmi
committed
enhance useTLS
1 parent a6250f2 commit 2e53b94

File tree

8 files changed

+108
-36
lines changed

8 files changed

+108
-36
lines changed

‎bundle/manifests/rhtas-operator.clusterserviceversion.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -296,8 +296,8 @@ metadata:
296296
}
297297
]
298298
capabilities: Seamless Upgrades
299-
containerImage: registry.redhat.io/rhtas/rhtas-rhel9-operator@sha256:028b6eec7f821b18cf710237a7613ef76d2bacdeff56462368e4e186f26627cc
300-
createdAt: "2024-09-13T07:06:48Z"
299+
containerImage: registry.redhat.io/rhtas/rhtas-rhel9-operator@sha256:ce6a8fe1713af02979c429ca7315a0e981fa77d27c6b3bf2a858c05227d83ebf
300+
createdAt: "2024-09-17T15:49:52Z"
301301
features.operators.openshift.io/cnf: "false"
302302
features.operators.openshift.io/cni: "false"
303303
features.operators.openshift.io/csi: "false"

‎internal/controller/constants/images.go

+15-15
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,29 @@
11
package constants
22

33
var (
4-
TrillianLogSignerImage = "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:3a73910e112cb7b8ad04c4063e3840fb70f97ed07fc3eb907573a46b2f8f6b7b"
5-
TrillianServerImage = "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:23579db8db307a14cad37f5cb1bdf759611decd72d875241184549e31353387f"
6-
TrillianDbImage = "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:310ecbd9247a2af587dd6bca1b262cf5d753938409fb74c59a53622e22eb1c31"
4+
TrillianLogSignerImage = "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:b83d806de7d9653d4ce4cf2c1db7b5f8aa607f3888a99c4924477b5cfb48c930"
5+
TrillianServerImage = "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:3d017de5adf2ab58f5a87dcad5ccd38a2a40003834ef09d3bc17d8946387fa05"
6+
TrillianDbImage = "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:2f20f41d6646d3b3fe816663491a4fa86b362d1c42b8bd1968a6be301eeb11fe"
77

88
// TODO: remove and check the DB pod status
99
TrillianNetcatImage = "registry.redhat.io/openshift4/ose-tools-rhel8@sha256:486b4d2dd0d10c5ef0212714c94334e04fe8a3d36cf619881986201a50f123c7"
1010

11-
FulcioServerImage = "registry.redhat.io/rhtas/fulcio-rhel9@sha256:a384c19951fb77813cdefb8057bbe3670ef489eb61172d8fd2dde47b23aecebc"
11+
FulcioServerImage = "registry.redhat.io/rhtas/fulcio-rhel9@sha256:02dc2af135b4eaa16deec597187fc9c4eb1d7e395631d0566df80eb3e0aaa84e"
1212

13-
RekorRedisImage = "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:c936589847e5658e3be01bf7251da6372712bf98f4d100024a18ea59cfec5975"
14-
RekorServerImage = "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:96efc463b5f5fa631cca2e1a2195bb0abbd72da0c5083a9d90371d245d01387d"
15-
RekorSearchUiImage = "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:8ed9d49539e2305c2c41e2ad6b9f5763a53e93ab7590de1c413d846544091009"
16-
BackfillRedisImage = "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:22016378cf4a312ac7b15067e560ea42805c168ddf2ae64adb2fcc784bb9ba15"
13+
RekorRedisImage = "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:16ad1b2a0fc40792e26b3b84868315064469250b24321d5ffb7980c0e7b029da"
14+
RekorServerImage = "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:7f7ede4c0a51d3f8c459cc86bcd33c8858992764f910d4c882c55bf7bcbeb91f"
15+
RekorSearchUiImage = "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:9973ce7c5ceed4a6f5b45c69a22ba98f5c6ad324e212ba882415b85488528fc1"
16+
BackfillRedisImage = "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:02d409438a038007f831abaf9eac3cd86f203fbb6b6dece4d0f70dc1b52cd79c"
1717

18-
TufImage = "registry.redhat.io/rhtas/tuffer@sha256:fc0160028b0bcbc03c69156584ead3dfec6d517dab305386ee238cc0e87433de"
18+
TufImage = "registry.redhat.io/rhtas/tuffer@sha256:1beb250dfc24a0c094799afda075989cf6f7eb1212d655571fc9054f74961f89"
1919

20-
CTLogImage = "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:671c5ea4de7184f0dcdd6c6583d74dc8b0b039799c57efb5e8a31981cd9b415e"
20+
CTLogImage = "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:6fef78c77e6b2a926d7535d46d86e7bbda3e30ad9d5d6653bcb96698b56594fc"
2121

2222
HttpServerImage = "registry.access.redhat.com/ubi9/httpd-24@sha256:7874b82335a80269dcf99e5983c2330876f5fe8bdc33dc6aa4374958a2ffaaee"
23-
ClientServerImage_cg = "registry.redhat.io/rhtas/client-server-cg-rhel9@sha256:0469bef1617c60481beda30947f279a0b106d0e54c600e823064a2b5b89bc120"
24-
ClientServerImage_re = "registry.redhat.io/rhtas/client-server-re-rhel9@sha256:7990157e558dc5ff6e315c84a107bbadc7aeb3aaed39a9171e751671be5d89f0"
25-
ClientServerImage_f = "registry.redhat.io/rhtas/client-server-f-rhel9@sha256:aca918e6994ad5f95c71f725428fc3f2865299b1860c2740d1c18f03324cc3c9"
26-
SegmentBackupImage = "registry.redhat.io/rhtas/segment-reporting-rhel9@sha256:625b5beef8b97d0e9fdf1d92bacd31a51de6b8c172e9aac2c98167253738bb61"
27-
TimestampAuthorityImage = "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:788f298596b5c0c70e06ac210f8e68ce7bf3348c56b7f36eb6b84cdd85f0d01d"
23+
ClientServerImage_cg = "registry.redhat.io/rhtas/client-server-cg-rhel9@sha256:f0669481c6483c6025d925ec9ad64199acc44cee2aaf7ea6aab64e2bd5d85485"
24+
ClientServerImage_re = "registry.redhat.io/rhtas/client-server-re-rhel9@sha256:bde7470ea648ffd77fda2ea362858115b8086b92ffb8c2e3a74107f955f7c644"
25+
ClientServerImage_f = "registry.redhat.io/rhtas/client-server-f-rhel9@sha256:8c8c4bfcbc8728ee46a427a4179622e4437e3502aa4b29af7539bf2eee999ff6"
26+
SegmentBackupImage = "registry.redhat.io/rhtas/segment-reporting-rhel9@sha256:c7fa18f6dec1fdd308d5a6ed74f5f6bf2bd30d6759d7d2464875b6e80f269fb2"
27+
TimestampAuthorityImage = "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:d957041e1f10faf087333b9f1d39b2bb4b26edd37a812192e67771c423950def"
2828
CreateTreeImage = "registry.redhat.io/rhtas/trillian-createtree-rhel9@sha256:0a793e68b9398d73a47012cab0f9edf7b0b917060d59b4afdc9efc5e034595c8"
2929
)

‎internal/controller/ctlog/ctlog_controller_test.go

+7
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ import (
3232

3333
. "github.com/onsi/ginkgo/v2"
3434
. "github.com/onsi/gomega"
35+
rutils "github.com/securesign/operator/internal/controller/rekor/utils"
3536
appsv1 "k8s.io/api/apps/v1"
3637
corev1 "k8s.io/api/core/v1"
3738
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -82,6 +83,12 @@ var _ = Describe("CTlog controller", func() {
8283
})
8384

8485
It("should successfully reconcile a custom resource for CTlog", func() {
86+
87+
By("mocking UseTrillianTLS")
88+
rutils.MockUseTrillianTLS = func(ctx context.Context, serviceAddr string, tlsCACertFile string) (bool, error) {
89+
return false, nil
90+
}
91+
8592
By("creating the custom resource for the Kind CTlog")
8693
err := k8sClient.Get(ctx, typeNamespaceName, instance)
8794
if err != nil && errors.IsNotFound(err) {

‎internal/controller/ctlog/utils/ctlog_deployment.go

+12-5
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"github.com/securesign/operator/api/v1alpha1"
1010
"github.com/securesign/operator/internal/controller/common/utils"
1111
"github.com/securesign/operator/internal/controller/constants"
12+
rutils "github.com/securesign/operator/internal/controller/rekor/utils"
1213
appsv1 "k8s.io/api/apps/v1"
1314
corev1 "k8s.io/api/core/v1"
1415
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -124,12 +125,18 @@ func CreateDeployment(ctx context.Context, client client.Client, instance *v1alp
124125
},
125126
}
126127

127-
useTLS := UseTLS(instance)
128+
// TLS communication to Trillian logserver
129+
trillianSvc := fmt.Sprintf(instance.Spec.Trillian.Address+":%d", *instance.Spec.Trillian.Port)
130+
caPath, err := CAPath(ctx, client, instance)
131+
if err != nil {
132+
return nil, errors.New("failed to get CA path: " + err.Error())
133+
}
134+
135+
useTLS := false
136+
if useTLS, err = rutils.UseTrillianTLS(ctx, trillianSvc, caPath); err != nil {
137+
return nil, errors.New("failed to check TLS: " + err.Error())
138+
}
128139
if useTLS {
129-
caPath, err := CAPath(ctx, client, instance)
130-
if err != nil {
131-
return nil, errors.New("failed to get CA path: " + err.Error())
132-
}
133140
dep.Spec.Template.Spec.Containers[0].Args = append(dep.Spec.Template.Spec.Containers[0].Args, "--trillian_tls_ca_cert_file", caPath)
134141
}
135142

‎internal/controller/rekor/actions/server/deployment.go

-1
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,6 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Rekor)
7373
})
7474
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could create server Deployment: %w", err), instance)
7575
}
76-
7776
if err = controllerutil.SetControllerReference(instance, dp, i.Client.Scheme()); err != nil {
7877
return i.Failed(fmt.Errorf("could not set controller reference for Deployment: %w", err))
7978
}

‎internal/controller/rekor/rekor_controller_test.go

+7
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ import (
4141

4242
. "github.com/onsi/ginkgo/v2"
4343
. "github.com/onsi/gomega"
44+
utils2 "github.com/securesign/operator/internal/controller/rekor/utils"
4445
batchv1 "k8s.io/api/batch/v1"
4546
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
4647
"k8s.io/apimachinery/pkg/types"
@@ -96,6 +97,12 @@ var _ = Describe("Rekor controller", func() {
9697
})
9798

9899
It("should successfully reconcile a custom resource for Rekor", func() {
100+
101+
By("mocking UseTrillianTLS")
102+
utils2.MockUseTrillianTLS = func(ctx context.Context, serviceAddr string, tlsCACertFile string) (bool, error) {
103+
return false, nil
104+
}
105+
99106
By("creating the custom resource for the Kind Rekor")
100107
err := k8sClient.Get(ctx, typeNamespaceName, instance)
101108
if err != nil && errors.IsNotFound(err) {

‎internal/controller/rekor/utils/rekor_deployment.go

+11-6
Original file line numberDiff line numberDiff line change
@@ -205,12 +205,17 @@ func CreateRekorDeployment(ctx context.Context, client client.Client, instance *
205205
}
206206

207207
// TLS communication to Trillian logserver
208-
if UseTLS(instance) {
209-
caPath, err := CAPath(ctx, client, instance)
210-
if err != nil {
211-
return nil, errors.New("failed to get CA path: " + err.Error())
212-
}
213-
dep.Spec.Template.Spec.Containers[0].Args = append(dep.Spec.Template.Spec.Containers[0].Args, "--trillian_log_server.tls_ca_cert", caPath)
208+
trillianSvc := fmt.Sprintf(instance.Spec.Trillian.Address+":%d", *instance.Spec.Trillian.Port)
209+
caPath, err := CAPath(ctx, client, instance)
210+
if err != nil {
211+
return nil, errors.New("failed to get CA path: " + err.Error())
212+
}
213+
useTLS := false
214+
if useTLS, err = UseTrillianTLS(ctx, trillianSvc, caPath); err != nil {
215+
return nil, errors.New("failed to check TLS: " + err.Error())
216+
}
217+
if useTLS {
218+
dep.Spec.Template.Spec.Containers[0].Args = append(dep.Spec.Template.Spec.Containers[0].Args, "--trillian_log_server.tls=true")
214219
}
215220

216221
utils.SetProxyEnvs(dep)

‎internal/controller/rekor/utils/tls.go

+54-7
Original file line numberDiff line numberDiff line change
@@ -2,24 +2,71 @@ package utils
22

33
import (
44
"context"
5+
"crypto/tls"
6+
"crypto/x509"
57
"fmt"
8+
"os"
9+
"path/filepath"
10+
"strings"
11+
"time"
612

713
rhtasv1alpha1 "github.com/securesign/operator/api/v1alpha1"
814
"github.com/securesign/operator/internal/controller/common/utils/kubernetes"
15+
"google.golang.org/grpc"
16+
"google.golang.org/grpc/credentials"
917
"sigs.k8s.io/controller-runtime/pkg/client"
1018
)
1119

12-
func UseTLS(instance *rhtasv1alpha1.Rekor) bool {
20+
// Mock used in tests
21+
var MockUseTrillianTLS func(ctx context.Context, serviceAddr string, tlsCACertFile string) (bool, error)
1322

14-
if instance == nil {
15-
return false
23+
// checks if trillian-logserver service supports TLS
24+
func UseTrillianTLS(ctx context.Context, serviceAddr string, tlsCACertFile string) (bool, error) {
25+
26+
if MockUseTrillianTLS != nil {
27+
return MockUseTrillianTLS(ctx, serviceAddr, "")
28+
}
29+
30+
if kubernetes.IsOpenShift() {
31+
return true, nil
32+
}
33+
34+
timeout := 5 * time.Second
35+
ctx, cancel := context.WithTimeout(ctx, timeout)
36+
defer cancel()
37+
38+
hostname := serviceAddr
39+
if idx := strings.Index(serviceAddr, ":"); idx != -1 {
40+
hostname = serviceAddr[:idx]
41+
}
42+
43+
var creds credentials.TransportCredentials
44+
if tlsCACertFile != "" {
45+
tlsCaCert, err := os.ReadFile(filepath.Clean(tlsCACertFile))
46+
if err != nil {
47+
return false, fmt.Errorf("failed to load tls ca cert: %v", err)
48+
}
49+
certPool := x509.NewCertPool()
50+
if !certPool.AppendCertsFromPEM(tlsCaCert) {
51+
return false, fmt.Errorf("failed to append CA certificate to pool")
52+
}
53+
creds = credentials.NewTLS(&tls.Config{
54+
ServerName: hostname,
55+
RootCAs: certPool,
56+
MinVersion: tls.VersionTLS12,
57+
})
58+
}
59+
60+
conn, err := grpc.DialContext(ctx, serviceAddr, grpc.WithTransportCredentials(creds), grpc.WithBlock())
61+
if err != nil {
62+
fmt.Printf("gRPC service at %s is not TLS secured: %v\n", serviceAddr, err)
63+
return false, nil
1664
}
17-
// TLS enabled on Trillian logserver
18-
if instance.Spec.TrustedCA != nil || kubernetes.IsOpenShift() {
19-
return true
65+
if err := conn.Close(); err != nil {
66+
return false, fmt.Errorf("failed to close connection: %v", err)
2067
}
2168

22-
return false
69+
return true, nil
2370
}
2471

2572
func CAPath(ctx context.Context, cli client.Client, instance *rhtasv1alpha1.Rekor) (string, error) {

0 commit comments

Comments
 (0)