Skip to content

Commit 3e7a7f8

Browse files
fghanmifghanmi
committed
updates
1 parent 9b2a289 commit 3e7a7f8

File tree

14 files changed

+15
-250
lines changed

14 files changed

+15
-250
lines changed

‎api/v1alpha1/common.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@ type CtlogService struct {
4040
//+optional
4141
Address string `json:"address,omitempty"`
4242
// Port of Ctlog Log Server End point
43-
//+kubebuilder:validation:Minimum:=1
43+
//+kubebuilder:validation:Minimum:=0
4444
//+kubebuilder:validation:Maximum:=65535
45-
//+kubebuilder:default:=80
45+
//+kubebuilder:default:=0
4646
//+optional
4747
Port *int32 `json:"port,omitempty"`
4848
}

‎api/v1alpha1/trillian_types.go

-6
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,6 @@ type TrillianSpec struct {
2929
Db TrillianDB `json:"database,omitempty"`
3030
//+optional
3131
TrillianServer TrillianServer `json:"server,omitempty"`
32-
//+optional
33-
TrillianSigner TrillianSigner `json:"signer,omitempty"`
3432
// Enable Monitoring for Logsigner and Logserver
3533
Monitoring MonitoringConfig `json:"monitoring,omitempty"`
3634
}
@@ -57,10 +55,6 @@ type TrillianServer struct {
5755
// Secret with TLS server certificate, private key and CA certificate
5856
TLSCertificate TLSCert `json:"tls"`
5957
}
60-
type TrillianSigner struct {
61-
// Secret with TLS server certificate, private key and CA certificate
62-
TLSCertificate TLSCert `json:"tls"`
63-
}
6458

6559
// TrillianStatus defines the observed state of Trillian
6660
type TrillianStatus struct {

‎api/v1alpha1/trillian_types_test.go

-12
Original file line numberDiff line numberDiff line change
@@ -169,18 +169,6 @@ var _ = Describe("Trillian", func() {
169169
},
170170
},
171171
},
172-
TrillianSigner: TrillianSigner{
173-
TLSCertificate: TLSCert{
174-
CertRef: &SecretKeySelector{
175-
Key: "cert",
176-
LocalObjectReference: LocalObjectReference{Name: "signer-secret"},
177-
},
178-
PrivateKeyRef: &SecretKeySelector{
179-
Key: "key",
180-
LocalObjectReference: LocalObjectReference{Name: "signer-secret"},
181-
},
182-
},
183-
},
184172
},
185173
}
186174

‎api/v1alpha1/zz_generated.deepcopy.go

-17
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/rhtas.redhat.com_securesigns.yaml

-61
Original file line numberDiff line numberDiff line change
@@ -795,67 +795,6 @@ spec:
795795
required:
796796
- tls
797797
type: object
798-
signer:
799-
properties:
800-
tls:
801-
description: Secret with TLS server certificate, private key
802-
and CA certificate
803-
properties:
804-
caCertRef:
805-
description: Reference to CA certificate
806-
properties:
807-
name:
808-
description: |-
809-
Name of the referent.
810-
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
811-
type: string
812-
required:
813-
- name
814-
type: object
815-
x-kubernetes-map-type: atomic
816-
certRef:
817-
description: Reference to service certificate
818-
properties:
819-
key:
820-
description: The key of the secret to select from.
821-
Must be a valid secret key.
822-
pattern: ^[-._a-zA-Z0-9]+$
823-
type: string
824-
name:
825-
description: |-
826-
Name of the referent.
827-
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
828-
type: string
829-
required:
830-
- key
831-
- name
832-
type: object
833-
x-kubernetes-map-type: atomic
834-
privateKeyRef:
835-
description: Reference to the private key
836-
properties:
837-
key:
838-
description: The key of the secret to select from.
839-
Must be a valid secret key.
840-
pattern: ^[-._a-zA-Z0-9]+$
841-
type: string
842-
name:
843-
description: |-
844-
Name of the referent.
845-
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
846-
type: string
847-
required:
848-
- key
849-
- name
850-
type: object
851-
x-kubernetes-map-type: atomic
852-
type: object
853-
x-kubernetes-validations:
854-
- message: privateKeyRef cannot be empty
855-
rule: (!has(self.certRef) || has(self.privateKeyRef))
856-
required:
857-
- tls
858-
type: object
859798
type: object
860799
tuf:
861800
default:

‎config/crd/bases/rhtas.redhat.com_trillians.yaml

-61
Original file line numberDiff line numberDiff line change
@@ -195,67 +195,6 @@ spec:
195195
required:
196196
- tls
197197
type: object
198-
signer:
199-
properties:
200-
tls:
201-
description: Secret with TLS server certificate, private key and
202-
CA certificate
203-
properties:
204-
caCertRef:
205-
description: Reference to CA certificate
206-
properties:
207-
name:
208-
description: |-
209-
Name of the referent.
210-
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
211-
type: string
212-
required:
213-
- name
214-
type: object
215-
x-kubernetes-map-type: atomic
216-
certRef:
217-
description: Reference to service certificate
218-
properties:
219-
key:
220-
description: The key of the secret to select from. Must
221-
be a valid secret key.
222-
pattern: ^[-._a-zA-Z0-9]+$
223-
type: string
224-
name:
225-
description: |-
226-
Name of the referent.
227-
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
228-
type: string
229-
required:
230-
- key
231-
- name
232-
type: object
233-
x-kubernetes-map-type: atomic
234-
privateKeyRef:
235-
description: Reference to the private key
236-
properties:
237-
key:
238-
description: The key of the secret to select from. Must
239-
be a valid secret key.
240-
pattern: ^[-._a-zA-Z0-9]+$
241-
type: string
242-
name:
243-
description: |-
244-
Name of the referent.
245-
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
246-
type: string
247-
required:
248-
- key
249-
- name
250-
type: object
251-
x-kubernetes-map-type: atomic
252-
type: object
253-
x-kubernetes-validations:
254-
- message: privateKeyRef cannot be empty
255-
rule: (!has(self.certRef) || has(self.privateKeyRef))
256-
required:
257-
- tls
258-
type: object
259198
type: object
260199
status:
261200
description: TrillianStatus defines the observed state of Trillian

‎config/manager/kustomization.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@ resources:
33
apiVersion: kustomize.config.k8s.io/v1beta1
44
kind: Kustomization
55
images:
6-
- digest: sha256:a21f7128694a64989bf0d84a7a7da4c1ffc89edf62d594dc8bea7bcfe9ac08d3
7-
name: controller
8-
newName: registry.redhat.io/rhtas/rhtas-rhel9-operator
6+
- name: controller
7+
newName: quay.io/fghanmi/my_operator
8+
newTag: v3.8.0

‎config/samples/rhtas_v1alpha1_securesign.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ spec:
2323
config:
2424
OIDCIssuers:
2525
- ClientID: "trusted-artifact-signer"
26-
IssuerURL: "https://your-oidc-issuer-url"
27-
Issuer: "https://your-oidc-issuer-url"
26+
IssuerURL: "https://keycloak-keycloak-system.apps.rosa.av42p-79zot-u82.x8pi.p3.openshiftapps.com/auth/realms/trusted-artifact-signer"
27+
Issuer: "https://keycloak-keycloak-system.apps.rosa.av42p-79zot-u82.x8pi.p3.openshiftapps.com/auth/realms/trusted-artifact-signer"
2828
Type: "email"
2929
certificate:
3030
organizationName: Red Hat

‎internal/controller/constants/images.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,9 @@ var (
1010

1111
FulcioServerImage = "registry.redhat.io/rhtas/fulcio-rhel9@sha256:c4abc6342b39701d237ab3f0f25b75b677214b3ede00540b2488f524ad112179"
1212

13-
RekorRedisImage = "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:5f0630c7aa29eeee28668f7ad451f129c9fb2feb86ec21b6b1b0b5cc42b44f4a"
14-
RekorServerImage = "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:d4ea970447f3b4c18c309d2f0090a5d02260dd5257a0d41f87fefc4f014a9526"
13+
RekorRedisImage = "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:5f0630c7aa29eeee28668f7ad451f129c9fb2feb86ec21b6b1b0b5cc42b44f4a"
14+
// RekorServerImage = "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:d4ea970447f3b4c18c309d2f0090a5d02260dd5257a0d41f87fefc4f014a9526"
15+
RekorServerImage = "quay.io/securesign/rekor-server_test:latest"
1516
RekorSearchUiImage = "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:5eabf561c0549d81862e521ddc1f0ab91a3f2c9d99dcd83ab5a2cf648a95dd19"
1617
BackfillRedisImage = "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:5c7460ab3cd13b2ecf2b979f5061cb384174d6714b7630879e53d063e4cb69d2"
1718

‎internal/controller/rekor/actions/server/config_map.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,9 @@ func (i configMapAction) Name() string {
3030
func (i configMapAction) CanHandle(ctx context.Context, instance *rhtasv1alpha1.Rekor) bool {
3131
c := meta.FindStatusCondition(instance.Status.Conditions, constants.Ready)
3232
cm, _ := k8sutils.GetConfigMap(ctx, i.Client, instance.Namespace, "ca-configmap")
33-
// signingKeySecret: OCP related
33+
// signingKeySecret: OCP
3434
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
35-
return c.Reason == constants.Creating || c.Reason == constants.Ready && cm == nil && signingKeySecret != nil
35+
return (c.Reason == constants.Creating || c.Reason == constants.Ready) && cm == nil && signingKeySecret != nil && instance.Spec.TLSCertificate.CACertRef == nil
3636
}
3737

3838
func (i configMapAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Rekor) *action.Result {

‎internal/controller/trillian/actions/logserver/deployment.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package logserver
33
import (
44
"context"
55
"fmt"
6+
67
"github.com/securesign/operator/internal/controller/common/utils"
78

89
"github.com/securesign/operator/internal/controller/common/action"
@@ -115,7 +116,7 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Trilli
115116
Name: "tls-cert",
116117
VolumeSource: corev1.VolumeSource{
117118
Secret: &corev1.SecretVolumeSource{
118-
SecretName: "log-server-" + instance.Name + "-tls-secret",
119+
SecretName: instance.Name + "-trillian-log-server-tls-secret",
119120
},
120121
},
121122
})

‎internal/controller/trillian/actions/logserver/service.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ func (i createServiceAction) Handle(ctx context.Context, instance *rhtasv1alpha1
7979
if logserverService.Annotations == nil {
8080
logserverService.Annotations = make(map[string]string)
8181
}
82-
logserverService.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = "log-server-" + instance.Name + "-tls-secret"
82+
logserverService.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = instance.Name + "-trillian-log-server-tls-secret"
8383
err := i.Client.Update(ctx, logserverService)
8484
if err != nil {
8585
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not annotate logserver service: %w", err), instance)

‎internal/controller/trillian/actions/logsigner/deployment.go

-67
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,6 @@ import (
1414
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
1515

1616
rhtasv1alpha1 "github.com/securesign/operator/api/v1alpha1"
17-
k8sutils "github.com/securesign/operator/internal/controller/common/utils/kubernetes"
18-
corev1 "k8s.io/api/core/v1"
1917
)
2018

2119
func NewDeployAction() action.Action[*rhtasv1alpha1.Trillian] {
@@ -64,71 +62,6 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Trilli
6462
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not create Trillian LogSigner: %w", err), instance)
6563
}
6664

67-
// TLS certificate
68-
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
69-
if instance.Spec.TrillianSigner.TLSCertificate.CertRef != nil {
70-
signer.Spec.Template.Spec.Volumes = append(signer.Spec.Template.Spec.Volumes,
71-
corev1.Volume{
72-
Name: "tls-cert",
73-
VolumeSource: corev1.VolumeSource{
74-
Projected: &corev1.ProjectedVolumeSource{
75-
Sources: []corev1.VolumeProjection{
76-
{
77-
Secret: &corev1.SecretProjection{
78-
LocalObjectReference: corev1.LocalObjectReference{
79-
Name: instance.Spec.TrillianSigner.TLSCertificate.CertRef.Name,
80-
},
81-
Items: []corev1.KeyToPath{
82-
{
83-
Key: instance.Spec.TrillianSigner.TLSCertificate.CertRef.Key,
84-
Path: "tls.crt",
85-
},
86-
},
87-
},
88-
},
89-
{
90-
Secret: &corev1.SecretProjection{
91-
LocalObjectReference: corev1.LocalObjectReference{
92-
Name: instance.Spec.TrillianSigner.TLSCertificate.PrivateKeyRef.Name,
93-
},
94-
Items: []corev1.KeyToPath{
95-
{
96-
Key: instance.Spec.TrillianSigner.TLSCertificate.PrivateKeyRef.Key,
97-
Path: "tls.key",
98-
},
99-
},
100-
},
101-
},
102-
},
103-
},
104-
},
105-
})
106-
} else if signingKeySecret != nil {
107-
i.Logger.V(1).Info("TLS: Using secrets/signing-key secret")
108-
signer.Spec.Template.Spec.Volumes = append(signer.Spec.Template.Spec.Volumes,
109-
corev1.Volume{
110-
Name: "tls-cert",
111-
VolumeSource: corev1.VolumeSource{
112-
Secret: &corev1.SecretVolumeSource{
113-
SecretName: "log-signer-" + instance.Name + "-tls-secret",
114-
},
115-
},
116-
})
117-
} else {
118-
i.Logger.V(1).Info("Communication between services is insecure")
119-
}
120-
121-
if instance.Spec.TrillianSigner.TLSCertificate.CertRef != nil || signingKeySecret != nil {
122-
signer.Spec.Template.Spec.Containers[0].VolumeMounts = append(signer.Spec.Template.Spec.Containers[0].VolumeMounts,
123-
corev1.VolumeMount{
124-
Name: "tls-cert",
125-
MountPath: "/etc/ssl/certs",
126-
ReadOnly: true,
127-
})
128-
signer.Spec.Template.Spec.Containers[0].Args = append(signer.Spec.Template.Spec.Containers[0].Args, "--tls_cert_file", "/etc/ssl/certs/tls.crt")
129-
signer.Spec.Template.Spec.Containers[0].Args = append(signer.Spec.Template.Spec.Containers[0].Args, "--tls_key_file", "/etc/ssl/certs/tls.key")
130-
}
131-
13265
if err = controllerutil.SetControllerReference(instance, signer, i.Client.Scheme()); err != nil {
13366
return i.Failed(fmt.Errorf("could not set controller reference for LogSigner deployment: %w", err))
13467
}

‎internal/controller/trillian/actions/logsigner/service.go

-13
Original file line numberDiff line numberDiff line change
@@ -66,19 +66,6 @@ func (i createServiceAction) Handle(ctx context.Context, instance *rhtasv1alpha1
6666
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not create logsigner Service: %w", err), instance)
6767
}
6868

69-
//TLS: Annotate service
70-
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
71-
if signingKeySecret != nil && instance.Spec.TrillianSigner.TLSCertificate.CertRef == nil {
72-
if logsignerService.Annotations == nil {
73-
logsignerService.Annotations = make(map[string]string)
74-
}
75-
logsignerService.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = "log-signer-" + instance.Name + "-tls-secret"
76-
err := i.Client.Update(ctx, logsignerService)
77-
if err != nil {
78-
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not annotate logserver service: %w", err), instance)
79-
}
80-
}
81-
8269
if updated {
8370
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
8471
Type: actions.ServerCondition,

0 commit comments

Comments
 (0)