Skip to content

Commit df48e12

Browse files
fghanmifghanmi
committed
updates-1
1 parent 7092e63 commit df48e12

16 files changed

+48
-94
lines changed

‎api/v1alpha1/common.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@ type CtlogService struct {
4040
//+optional
4141
Address string `json:"address,omitempty"`
4242
// Port of Ctlog Log Server End point
43-
//+kubebuilder:validation:Minimum:=1
43+
//+kubebuilder:validation:Minimum:=0
4444
//+kubebuilder:validation:Maximum:=65535
45-
//+kubebuilder:default:=80
45+
//+kubebuilder:default:=0
4646
//+optional
4747
Port *int32 `json:"port,omitempty"`
4848
}

‎api/v1alpha1/fulcio_types.go

-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ type FulcioSpec struct {
1414
ExternalAccess ExternalAccess `json:"externalAccess,omitempty"`
1515
// Ctlog service configuration
1616
//+optional
17-
//+kubebuilder:default:={port: 80}
1817
Ctlog CtlogService `json:"ctlog,omitempty"`
1918
// Fulcio Configuration
2019
//+required

‎bundle/manifests/rhtas-operator.clusterserviceversion.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ metadata:
192192
]
193193
capabilities: Seamless Upgrades
194194
containerImage: registry.redhat.io/rhtas/rhtas-rhel9-operator@sha256:a21f7128694a64989bf0d84a7a7da4c1ffc89edf62d594dc8bea7bcfe9ac08d3
195-
createdAt: "2024-07-04T14:29:12Z"
195+
createdAt: "2024-08-03T09:05:31Z"
196196
features.operators.openshift.io/cnf: "false"
197197
features.operators.openshift.io/cni: "false"
198198
features.operators.openshift.io/csi: "false"

‎bundle/manifests/rhtas.redhat.com_fulcios.yaml

+2-4
Original file line numberDiff line numberDiff line change
@@ -222,19 +222,17 @@ spec:
222222
rule: (has(self.OIDCIssuers) && (size(self.OIDCIssuers) > 0)) ||
223223
(has(self.MetaIssuers) && (size(self.MetaIssuers) > 0))
224224
ctlog:
225-
default:
226-
port: 80
227225
description: Ctlog service configuration
228226
properties:
229227
address:
230228
description: Address to Ctlog Log Server End point
231229
type: string
232230
port:
233-
default: 80
231+
default: 0
234232
description: Port of Ctlog Log Server End point
235233
format: int32
236234
maximum: 65535
237-
minimum: 1
235+
minimum: 0
238236
type: integer
239237
type: object
240238
externalAccess:

‎bundle/manifests/rhtas.redhat.com_securesigns.yaml

+2-4
Original file line numberDiff line numberDiff line change
@@ -399,19 +399,17 @@ spec:
399399
rule: (has(self.OIDCIssuers) && (size(self.OIDCIssuers) > 0))
400400
|| (has(self.MetaIssuers) && (size(self.MetaIssuers) > 0))
401401
ctlog:
402-
default:
403-
port: 80
404402
description: Ctlog service configuration
405403
properties:
406404
address:
407405
description: Address to Ctlog Log Server End point
408406
type: string
409407
port:
410-
default: 80
408+
default: 0
411409
description: Port of Ctlog Log Server End point
412410
format: int32
413411
maximum: 65535
414-
minimum: 1
412+
minimum: 0
415413
type: integer
416414
type: object
417415
externalAccess:

‎config/crd/bases/rhtas.redhat.com_fulcios.yaml

+2-4
Original file line numberDiff line numberDiff line change
@@ -222,19 +222,17 @@ spec:
222222
rule: (has(self.OIDCIssuers) && (size(self.OIDCIssuers) > 0)) ||
223223
(has(self.MetaIssuers) && (size(self.MetaIssuers) > 0))
224224
ctlog:
225-
default:
226-
port: 80
227225
description: Ctlog service configuration
228226
properties:
229227
address:
230228
description: Address to Ctlog Log Server End point
231229
type: string
232230
port:
233-
default: 80
231+
default: 0
234232
description: Port of Ctlog Log Server End point
235233
format: int32
236234
maximum: 65535
237-
minimum: 1
235+
minimum: 0
238236
type: integer
239237
type: object
240238
externalAccess:

‎config/crd/bases/rhtas.redhat.com_securesigns.yaml

+2-4
Original file line numberDiff line numberDiff line change
@@ -399,19 +399,17 @@ spec:
399399
rule: (has(self.OIDCIssuers) && (size(self.OIDCIssuers) > 0))
400400
|| (has(self.MetaIssuers) && (size(self.MetaIssuers) > 0))
401401
ctlog:
402-
default:
403-
port: 80
404402
description: Ctlog service configuration
405403
properties:
406404
address:
407405
description: Address to Ctlog Log Server End point
408406
type: string
409407
port:
410-
default: 80
408+
default: 0
411409
description: Port of Ctlog Log Server End point
412410
format: int32
413411
maximum: 65535
414-
minimum: 1
412+
minimum: 0
415413
type: integer
416414
type: object
417415
externalAccess:

‎internal/controller/constants/images.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,15 @@ var (
88
// TODO: remove and check the DB pod status
99
TrillianNetcatImage = "registry.redhat.io/openshift4/ose-tools-rhel8@sha256:486b4d2dd0d10c5ef0212714c94334e04fe8a3d36cf619881986201a50f123c7"
1010

11-
FulcioServerImage = "registry.redhat.io/rhtas/fulcio-rhel9@sha256:c4abc6342b39701d237ab3f0f25b75b677214b3ede00540b2488f524ad112179"
12-
11+
FulcioServerImage = "quay.io/securesign/fulcio-server@sha256:67495de82e2fcd2ab4ad0e53442884c392da1aa3f5dd56d9488a1ed5df97f513"
1312
RekorRedisImage = "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:5f0630c7aa29eeee28668f7ad451f129c9fb2feb86ec21b6b1b0b5cc42b44f4a"
1413
RekorServerImage = "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:d4ea970447f3b4c18c309d2f0090a5d02260dd5257a0d41f87fefc4f014a9526"
1514
RekorSearchUiImage = "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:5eabf561c0549d81862e521ddc1f0ab91a3f2c9d99dcd83ab5a2cf648a95dd19"
1615
BackfillRedisImage = "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:5c7460ab3cd13b2ecf2b979f5061cb384174d6714b7630879e53d063e4cb69d2"
1716

1817
TufImage = "registry.redhat.io/rhtas/tuf-server-rhel9@sha256:8c229e2c7f9d6cc0ebf4f23dd944373d497be2ed31960f0383b1bb43f16de0db"
1918

20-
CTLogImage = "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:44906b1e52b0b5e324f23cae088837caf15444fd34679e6d2f3cc018d4e093fe"
19+
CTLogImage = "quay.io/securesign/certificate-transparency-go@sha256:a0c7d71fc8f4cb7530169a6b54dc3a67215c4058a45f84b87bb04fc62e6e8141"
2120

2221
ClientServerImage = "registry.access.redhat.com/ubi9/httpd-24@sha256:7874b82335a80269dcf99e5983c2330876f5fe8bdc33dc6aa4374958a2ffaaee"
2322
ClientServerImage_cg = "registry.redhat.io/rhtas/client-server-cg-rhel9@sha256:046029a9a2028efa9dcbf8eff9b41fe5ac4e9ad64caf0241f5680a5cb36bf36b"

‎internal/controller/ctlog/actions/config_map.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func (i configMapAction) Name() string {
2929
func (i configMapAction) CanHandle(ctx context.Context, instance *rhtasv1alpha1.CTlog) bool {
3030
c := meta.FindStatusCondition(instance.Status.Conditions, constants.Ready)
3131
cm, _ := k8sutils.GetConfigMap(ctx, i.Client, instance.Namespace, "ca-configmap")
32-
return c.Reason == constants.Creating || c.Reason == constants.Ready && cm == nil
32+
return (c.Reason == constants.Creating || c.Reason == constants.Ready) && cm == nil && instance.Spec.TLSCertificate.CACertRef == nil
3333
}
3434

3535
func (i configMapAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog) *action.Result {

‎internal/controller/ctlog/actions/deployment.go

+5-4
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog)
4040

4141
labels := constants.LabelsFor(ComponentName, DeploymentName, instance.Name)
4242

43-
dp, err := utils.CreateDeployment(instance, DeploymentName, RBACName, labels)
43+
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
44+
useHTTPS := (instance.Spec.TLSCertificate.CertRef != nil && instance.Spec.TLSCertificate.CACertRef != nil) || (signingKeySecret != nil)
45+
dp, err := utils.CreateDeployment(instance, DeploymentName, RBACName, labels, useHTTPS)
4446
if err != nil {
4547
if err != nil {
4648
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
@@ -54,7 +56,6 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog)
5456
}
5557

5658
// TLS certificate
57-
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
5859
if instance.Spec.TLSCertificate.CertRef != nil && instance.Spec.TLSCertificate.CACertRef != nil {
5960
dp.Spec.Template.Spec.Volumes = append(dp.Spec.Template.Spec.Volumes,
6061
corev1.Volume{
@@ -116,7 +117,7 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog)
116117
{
117118
Secret: &corev1.SecretProjection{
118119
LocalObjectReference: corev1.LocalObjectReference{
119-
Name: instance.Name + "-tls-secret",
120+
Name: instance.Name + "-ctlog-tls-secret",
120121
},
121122
},
122123
},
@@ -150,7 +151,7 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog)
150151
})
151152
dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--tls_certificate", "/etc/ssl/certs/tls.crt")
152153
dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--tls_key", "/etc/ssl/certs/tls.key")
153-
dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--trillian_tls_ca_cert_file", "/etc/ssl/certs/ca.crt")
154+
// dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--trillian_tls_ca_cert_file", "/etc/ssl/certs/ca.crt")
154155
}
155156

156157
if err = controllerutil.SetControllerReference(instance, dp, i.Client.Scheme()); err != nil {

‎internal/controller/ctlog/actions/service.go

+11-4
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,19 @@ func (i serviceAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog
4141

4242
labels := constants.LabelsFor(ComponentName, ComponentName, instance.Name)
4343

44+
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
45+
var port int32
46+
if instance.Spec.TLSCertificate.CertRef != nil || signingKeySecret != nil {
47+
port = int32(443)
48+
} else {
49+
port = int32(80)
50+
}
51+
portName := fmt.Sprintf("%d-tcp", port)
4452
svc := kubernetes.CreateService(instance.Namespace, ComponentName, MetricsPortName, MetricsPort, labels)
4553
svc.Spec.Ports = append(svc.Spec.Ports, corev1.ServicePort{
46-
Name: "80-tcp",
54+
Name: portName,
4755
Protocol: corev1.ProtocolTCP,
48-
Port: 80,
56+
Port: port,
4957
TargetPort: intstr.FromInt32(6962),
5058
})
5159
if err = controllerutil.SetControllerReference(instance, svc, i.Client.Scheme()); err != nil {
@@ -62,12 +70,11 @@ func (i serviceAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog
6270
}
6371

6472
//TLS: Annotate service
65-
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
6673
if signingKeySecret != nil && instance.Spec.TLSCertificate.CertRef == nil {
6774
if svc.Annotations == nil {
6875
svc.Annotations = make(map[string]string)
6976
}
70-
svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = instance.Name + "-tls-secret"
77+
svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = instance.Name + "-ctlog-tls-secret"
7178
err := i.Client.Update(ctx, svc)
7279
if err != nil {
7380
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not annotate service: %w", err), instance)

‎internal/controller/ctlog/ctlog_controller_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,7 @@ var _ = Describe("CTlog controller", func() {
175175
return k8sClient.Get(ctx, types.NamespacedName{Name: actions.ComponentName, Namespace: Namespace}, service)
176176
}).Should(Succeed())
177177
Expect(service.Spec.Ports[0].Port).Should(Equal(int32(6963)))
178-
Expect(service.Spec.Ports[1].Port).Should(Equal(int32(80)))
178+
Expect(service.Spec.Ports[1].Port).Should(Equal(int32(443)))
179179

180180
By("Move to Ready phase")
181181
// Workaround to succeed condition for Ready phase

‎internal/controller/ctlog/utils/ctlog_deployment.go

+11-5
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,15 @@ import (
1212
"k8s.io/apimachinery/pkg/util/intstr"
1313
)
1414

15-
func CreateDeployment(instance *v1alpha1.CTlog, deploymentName string, sa string, labels map[string]string) (*appsv1.Deployment, error) {
15+
func CreateDeployment(instance *v1alpha1.CTlog, deploymentName string, sa string, labels map[string]string, useHTTPS bool) (*appsv1.Deployment, error) {
1616
if instance.Status.ServerConfigRef == nil {
1717
return nil, errors.New("server config name not specified")
1818
}
1919
replicas := int32(1)
20+
scheme := corev1.URISchemeHTTP
21+
if useHTTPS {
22+
scheme = corev1.URISchemeHTTPS
23+
}
2024
// Define a new Deployment object
2125
dep := &appsv1.Deployment{
2226
ObjectMeta: metav1.ObjectMeta{
@@ -48,8 +52,9 @@ func CreateDeployment(instance *v1alpha1.CTlog, deploymentName string, sa string
4852
LivenessProbe: &corev1.Probe{
4953
ProbeHandler: corev1.ProbeHandler{
5054
HTTPGet: &corev1.HTTPGetAction{
51-
Path: "/healthz",
52-
Port: intstr.FromInt32(6962),
55+
Path: "/healthz",
56+
Port: intstr.FromInt32(6962),
57+
Scheme: scheme,
5358
},
5459
},
5560
InitialDelaySeconds: 10,
@@ -61,8 +66,9 @@ func CreateDeployment(instance *v1alpha1.CTlog, deploymentName string, sa string
6166
ReadinessProbe: &corev1.Probe{
6267
ProbeHandler: corev1.ProbeHandler{
6368
HTTPGet: &corev1.HTTPGetAction{
64-
Path: "/healthz",
65-
Port: intstr.FromInt32(6962),
69+
Path: "/healthz",
70+
Port: intstr.FromInt32(6962),
71+
Scheme: scheme,
6672
},
6773
},
6874
InitialDelaySeconds: 10,

‎internal/controller/fulcio/actions/config_map.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func (i configMapAction) Name() string {
2929
func (i configMapAction) CanHandle(ctx context.Context, instance *rhtasv1alpha1.Fulcio) bool {
3030
c := meta.FindStatusCondition(instance.Status.Conditions, constants.Ready)
3131
cm, _ := k8sutils.GetConfigMap(ctx, i.Client, instance.Namespace, "ca-configmap")
32-
return c.Reason == constants.Creating || c.Reason == constants.Ready && cm == nil
32+
return (c.Reason == constants.Creating || c.Reason == constants.Ready) && cm == nil && instance.Spec.TLSCertificate.CACertRef == nil
3333
}
3434

3535
func (i configMapAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Fulcio) *action.Result {

‎internal/controller/fulcio/actions/deployment.go

+5-41
Original file line numberDiff line numberDiff line change
@@ -41,18 +41,17 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Fulcio
4141
labels := constants.LabelsFor(ComponentName, DeploymentName, instance.Name)
4242

4343
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
44-
switch {
45-
case instance.Spec.Ctlog.Address == "":
44+
if instance.Spec.Ctlog.Address == "" {
4645
if instance.Spec.TLSCertificate.CACertRef != nil || signingKeySecret != nil {
4746
instance.Spec.Ctlog.Address = fmt.Sprintf("https://ctlog.%s.svc", instance.Namespace)
4847
} else {
4948
instance.Spec.Ctlog.Address = fmt.Sprintf("http://ctlog.%s.svc", instance.Namespace)
5049
}
51-
case instance.Spec.Ctlog.Port == nil:
50+
}
51+
if instance.Spec.Ctlog.Port == nil || *instance.Spec.Ctlog.Port == 0 {
5252
var port int32
5353
if instance.Spec.TLSCertificate.CACertRef != nil || signingKeySecret != nil {
5454
port = int32(443)
55-
5655
} else {
5756
port = int32(80)
5857
}
@@ -72,39 +71,13 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Fulcio
7271
}
7372

7473
// TLS certificate
75-
if instance.Spec.TLSCertificate.CertRef != nil && instance.Spec.TLSCertificate.CACertRef != nil {
74+
if instance.Spec.TLSCertificate.CACertRef != nil {
7675
dp.Spec.Template.Spec.Volumes = append(dp.Spec.Template.Spec.Volumes,
7776
corev1.Volume{
7877
Name: "tls-cert",
7978
VolumeSource: corev1.VolumeSource{
8079
Projected: &corev1.ProjectedVolumeSource{
8180
Sources: []corev1.VolumeProjection{
82-
{
83-
Secret: &corev1.SecretProjection{
84-
LocalObjectReference: corev1.LocalObjectReference{
85-
Name: instance.Spec.TLSCertificate.CertRef.Name,
86-
},
87-
Items: []corev1.KeyToPath{
88-
{
89-
Key: instance.Spec.TLSCertificate.CertRef.Key,
90-
Path: "tls.crt",
91-
},
92-
},
93-
},
94-
},
95-
{
96-
Secret: &corev1.SecretProjection{
97-
LocalObjectReference: corev1.LocalObjectReference{
98-
Name: instance.Spec.TLSCertificate.PrivateKeyRef.Name,
99-
},
100-
Items: []corev1.KeyToPath{
101-
{
102-
Key: instance.Spec.TLSCertificate.PrivateKeyRef.Key,
103-
Path: "tls.key",
104-
},
105-
},
106-
},
107-
},
10881
{
10982
ConfigMap: &corev1.ConfigMapProjection{
11083
LocalObjectReference: corev1.LocalObjectReference{
@@ -130,13 +103,6 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Fulcio
130103
VolumeSource: corev1.VolumeSource{
131104
Projected: &corev1.ProjectedVolumeSource{
132105
Sources: []corev1.VolumeProjection{
133-
{
134-
Secret: &corev1.SecretProjection{
135-
LocalObjectReference: corev1.LocalObjectReference{
136-
Name: instance.Name + "-tls-secret",
137-
},
138-
},
139-
},
140106
{
141107
ConfigMap: &corev1.ConfigMapProjection{
142108
LocalObjectReference: corev1.LocalObjectReference{
@@ -166,9 +132,7 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Fulcio
166132
ReadOnly: true,
167133
})
168134

169-
dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--grpc-tls-certificate", "/etc/ssl/certs/tls.crt")
170-
dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--grpc-tls-key", "/etc/ssl/certs/tls.key")
171-
dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--tls-ca-cert", "/etc/ssl/certs/ca.crt")
135+
dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--ct-log.tls-ca-cert", "/etc/ssl/certs/ca.crt")
172136
}
173137

174138
if err = controllerutil.SetControllerReference(instance, dp, i.Client.Scheme()); err != nil {

‎internal/controller/fulcio/actions/service.go

-14
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import (
77
rhtasv1alpha1 "github.com/securesign/operator/api/v1alpha1"
88
"github.com/securesign/operator/internal/controller/common/action"
99
"github.com/securesign/operator/internal/controller/common/utils/kubernetes"
10-
k8sutils "github.com/securesign/operator/internal/controller/common/utils/kubernetes"
1110
"github.com/securesign/operator/internal/controller/constants"
1211
corev1 "k8s.io/api/core/v1"
1312
"k8s.io/apimachinery/pkg/api/meta"
@@ -67,19 +66,6 @@ func (i serviceAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Fulci
6766
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not create service: %w", err), instance)
6867
}
6968

70-
//TLS: Annotate service
71-
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
72-
if signingKeySecret != nil && instance.Spec.TLSCertificate.CertRef == nil {
73-
if svc.Annotations == nil {
74-
svc.Annotations = make(map[string]string)
75-
}
76-
svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = instance.Name + "-tls-secret"
77-
err := i.Client.Update(ctx, svc)
78-
if err != nil {
79-
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not annotate service: %w", err), instance)
80-
}
81-
}
82-
8369
if updated {
8470
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{Type: constants.Ready,
8571
Status: metav1.ConditionFalse, Reason: constants.Creating, Message: "Service created"})

0 commit comments

Comments
 (0)