Skip to content

Commit e9ef614

Browse files
fghanmifghanmi
committed
updates-1
1 parent 801158d commit e9ef614

16 files changed

+77
-84
lines changed

‎api/v1alpha1/common.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@ type CtlogService struct {
4040
//+optional
4141
Address string `json:"address,omitempty"`
4242
// Port of Ctlog Log Server End point
43-
//+kubebuilder:validation:Minimum:=1
43+
//+kubebuilder:validation:Minimum:=0
4444
//+kubebuilder:validation:Maximum:=65535
45-
//+kubebuilder:default:=80
45+
//+kubebuilder:default:=0
4646
//+optional
4747
Port *int32 `json:"port,omitempty"`
4848
}

‎api/v1alpha1/fulcio_types.go

-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ type FulcioSpec struct {
1414
ExternalAccess ExternalAccess `json:"externalAccess,omitempty"`
1515
// Ctlog service configuration
1616
//+optional
17-
//+kubebuilder:default:={port: 80}
1817
Ctlog CtlogService `json:"ctlog,omitempty"`
1918
// Fulcio Configuration
2019
//+required

‎bundle/manifests/rhtas-operator.clusterserviceversion.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,11 @@ metadata:
192192
]
193193
capabilities: Seamless Upgrades
194194
containerImage: registry.redhat.io/rhtas/rhtas-rhel9-operator@sha256:a21f7128694a64989bf0d84a7a7da4c1ffc89edf62d594dc8bea7bcfe9ac08d3
195+
<<<<<<< HEAD
195196
createdAt: "2024-07-30T13:51:04Z"
197+
=======
198+
createdAt: "2024-08-03T09:05:31Z"
199+
>>>>>>> df48e12 (updates-1)
196200
features.operators.openshift.io/cnf: "false"
197201
features.operators.openshift.io/cni: "false"
198202
features.operators.openshift.io/csi: "false"

‎bundle/manifests/rhtas.redhat.com_fulcios.yaml

+2-4
Original file line numberDiff line numberDiff line change
@@ -222,19 +222,17 @@ spec:
222222
rule: (has(self.OIDCIssuers) && (size(self.OIDCIssuers) > 0)) ||
223223
(has(self.MetaIssuers) && (size(self.MetaIssuers) > 0))
224224
ctlog:
225-
default:
226-
port: 80
227225
description: Ctlog service configuration
228226
properties:
229227
address:
230228
description: Address to Ctlog Log Server End point
231229
type: string
232230
port:
233-
default: 80
231+
default: 0
234232
description: Port of Ctlog Log Server End point
235233
format: int32
236234
maximum: 65535
237-
minimum: 1
235+
minimum: 0
238236
type: integer
239237
type: object
240238
externalAccess:

‎bundle/manifests/rhtas.redhat.com_securesigns.yaml

+2-4
Original file line numberDiff line numberDiff line change
@@ -415,19 +415,17 @@ spec:
415415
rule: (has(self.OIDCIssuers) && (size(self.OIDCIssuers) > 0))
416416
|| (has(self.MetaIssuers) && (size(self.MetaIssuers) > 0))
417417
ctlog:
418-
default:
419-
port: 80
420418
description: Ctlog service configuration
421419
properties:
422420
address:
423421
description: Address to Ctlog Log Server End point
424422
type: string
425423
port:
426-
default: 80
424+
default: 0
427425
description: Port of Ctlog Log Server End point
428426
format: int32
429427
maximum: 65535
430-
minimum: 1
428+
minimum: 0
431429
type: integer
432430
type: object
433431
externalAccess:

‎config/crd/bases/rhtas.redhat.com_fulcios.yaml

+2-4
Original file line numberDiff line numberDiff line change
@@ -222,19 +222,17 @@ spec:
222222
rule: (has(self.OIDCIssuers) && (size(self.OIDCIssuers) > 0)) ||
223223
(has(self.MetaIssuers) && (size(self.MetaIssuers) > 0))
224224
ctlog:
225-
default:
226-
port: 80
227225
description: Ctlog service configuration
228226
properties:
229227
address:
230228
description: Address to Ctlog Log Server End point
231229
type: string
232230
port:
233-
default: 80
231+
default: 0
234232
description: Port of Ctlog Log Server End point
235233
format: int32
236234
maximum: 65535
237-
minimum: 1
235+
minimum: 0
238236
type: integer
239237
type: object
240238
externalAccess:

‎config/crd/bases/rhtas.redhat.com_securesigns.yaml

+2-4
Original file line numberDiff line numberDiff line change
@@ -415,19 +415,17 @@ spec:
415415
rule: (has(self.OIDCIssuers) && (size(self.OIDCIssuers) > 0))
416416
|| (has(self.MetaIssuers) && (size(self.MetaIssuers) > 0))
417417
ctlog:
418-
default:
419-
port: 80
420418
description: Ctlog service configuration
421419
properties:
422420
address:
423421
description: Address to Ctlog Log Server End point
424422
type: string
425423
port:
426-
default: 80
424+
default: 0
427425
description: Port of Ctlog Log Server End point
428426
format: int32
429427
maximum: 65535
430-
minimum: 1
428+
minimum: 0
431429
type: integer
432430
type: object
433431
externalAccess:

‎internal/controller/constants/images.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -8,16 +8,15 @@ var (
88
// TODO: remove and check the DB pod status
99
TrillianNetcatImage = "registry.redhat.io/openshift4/ose-tools-rhel8@sha256:486b4d2dd0d10c5ef0212714c94334e04fe8a3d36cf619881986201a50f123c7"
1010

11-
FulcioServerImage = "registry.redhat.io/rhtas/fulcio-rhel9@sha256:c4abc6342b39701d237ab3f0f25b75b677214b3ede00540b2488f524ad112179"
12-
11+
FulcioServerImage = "quay.io/securesign/fulcio-server@sha256:67495de82e2fcd2ab4ad0e53442884c392da1aa3f5dd56d9488a1ed5df97f513"
1312
RekorRedisImage = "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:5f0630c7aa29eeee28668f7ad451f129c9fb2feb86ec21b6b1b0b5cc42b44f4a"
1413
RekorServerImage = "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:d4ea970447f3b4c18c309d2f0090a5d02260dd5257a0d41f87fefc4f014a9526"
1514
RekorSearchUiImage = "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:5eabf561c0549d81862e521ddc1f0ab91a3f2c9d99dcd83ab5a2cf648a95dd19"
1615
BackfillRedisImage = "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:5c7460ab3cd13b2ecf2b979f5061cb384174d6714b7630879e53d063e4cb69d2"
1716

1817
TufImage = "registry.redhat.io/rhtas/tuf-server-rhel9@sha256:8c229e2c7f9d6cc0ebf4f23dd944373d497be2ed31960f0383b1bb43f16de0db"
1918

20-
CTLogImage = "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:44906b1e52b0b5e324f23cae088837caf15444fd34679e6d2f3cc018d4e093fe"
19+
CTLogImage = "quay.io/securesign/certificate-transparency-go@sha256:a0c7d71fc8f4cb7530169a6b54dc3a67215c4058a45f84b87bb04fc62e6e8141"
2120

2221
ClientServerImage = "registry.access.redhat.com/ubi9/httpd-24@sha256:7874b82335a80269dcf99e5983c2330876f5fe8bdc33dc6aa4374958a2ffaaee"
2322
ClientServerImage_cg = "registry.redhat.io/rhtas/client-server-cg-rhel9@sha256:046029a9a2028efa9dcbf8eff9b41fe5ac4e9ad64caf0241f5680a5cb36bf36b"

‎internal/controller/ctlog/actions/config_map.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func (i configMapAction) Name() string {
2929
func (i configMapAction) CanHandle(ctx context.Context, instance *rhtasv1alpha1.CTlog) bool {
3030
c := meta.FindStatusCondition(instance.Status.Conditions, constants.Ready)
3131
cm, _ := k8sutils.GetConfigMap(ctx, i.Client, instance.Namespace, "ca-configmap")
32-
return c.Reason == constants.Creating || c.Reason == constants.Ready && cm == nil
32+
return (c.Reason == constants.Creating || c.Reason == constants.Ready) && cm == nil && instance.Spec.TLSCertificate.CACertRef == nil
3333
}
3434

3535
func (i configMapAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog) *action.Result {

‎internal/controller/ctlog/actions/deployment.go

+8-3
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,18 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog)
4343

4444
labels := constants.LabelsFor(ComponentName, DeploymentName, instance.Name)
4545

46+
<<<<<<< HEAD
4647
switch {
4748
case instance.Spec.Trillian.Address == "":
4849
instance.Spec.Trillian.Address = fmt.Sprintf("%s.%s.svc", trillian.LogserverDeploymentName, instance.Namespace)
4950
}
5051

5152
dp, err := utils.CreateDeployment(instance, DeploymentName, RBACName, labels, ServerTargetPort, MetricsPort)
53+
=======
54+
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
55+
useHTTPS := (instance.Spec.TLSCertificate.CertRef != nil && instance.Spec.TLSCertificate.CACertRef != nil) || (signingKeySecret != nil)
56+
dp, err := utils.CreateDeployment(instance, DeploymentName, RBACName, labels, useHTTPS)
57+
>>>>>>> df48e12 (updates-1)
5258
if err != nil {
5359
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
5460
Type: constants.Ready,
@@ -64,7 +70,6 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog)
6470
}
6571

6672
// TLS certificate
67-
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
6873
if instance.Spec.TLSCertificate.CertRef != nil && instance.Spec.TLSCertificate.CACertRef != nil {
6974
dp.Spec.Template.Spec.Volumes = append(dp.Spec.Template.Spec.Volumes,
7075
corev1.Volume{
@@ -126,7 +131,7 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog)
126131
{
127132
Secret: &corev1.SecretProjection{
128133
LocalObjectReference: corev1.LocalObjectReference{
129-
Name: instance.Name + "-tls-secret",
134+
Name: instance.Name + "-ctlog-tls-secret",
130135
},
131136
},
132137
},
@@ -160,7 +165,7 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog)
160165
})
161166
dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--tls_certificate", "/etc/ssl/certs/tls.crt")
162167
dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--tls_key", "/etc/ssl/certs/tls.key")
163-
dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--trillian_tls_ca_cert_file", "/etc/ssl/certs/ca.crt")
168+
// dp.Spec.Template.Spec.Containers[0].Args = append(dp.Spec.Template.Spec.Containers[0].Args, "--trillian_tls_ca_cert_file", "/etc/ssl/certs/ca.crt")
164169
}
165170

166171
if err = controllerutil.SetControllerReference(instance, dp, i.Client.Scheme()); err != nil {

‎internal/controller/ctlog/actions/service.go

+19-2
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ func (i serviceAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog
4141

4242
labels := constants.LabelsFor(ComponentName, ComponentName, instance.Name)
4343

44+
<<<<<<< HEAD
4445
svc := kubernetes.CreateService(instance.Namespace, ComponentName, ServerPortName, ServerPort, ServerTargetPort, labels)
4546
if instance.Spec.Monitoring.Enabled {
4647
svc.Spec.Ports = append(svc.Spec.Ports, corev1.ServicePort{
@@ -50,6 +51,23 @@ func (i serviceAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog
5051
TargetPort: intstr.FromInt32(MetricsPort),
5152
})
5253
}
54+
=======
55+
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
56+
var port int32
57+
if instance.Spec.TLSCertificate.CertRef != nil || signingKeySecret != nil {
58+
port = int32(443)
59+
} else {
60+
port = int32(80)
61+
}
62+
portName := fmt.Sprintf("%d-tcp", port)
63+
svc := kubernetes.CreateService(instance.Namespace, ComponentName, MetricsPortName, MetricsPort, labels)
64+
svc.Spec.Ports = append(svc.Spec.Ports, corev1.ServicePort{
65+
Name: portName,
66+
Protocol: corev1.ProtocolTCP,
67+
Port: port,
68+
TargetPort: intstr.FromInt32(6962),
69+
})
70+
>>>>>>> df48e12 (updates-1)
5371
if err = controllerutil.SetControllerReference(instance, svc, i.Client.Scheme()); err != nil {
5472
return i.Failed(fmt.Errorf("could not set controller reference for Service: %w", err))
5573
}
@@ -64,12 +82,11 @@ func (i serviceAction) Handle(ctx context.Context, instance *rhtasv1alpha1.CTlog
6482
}
6583

6684
//TLS: Annotate service
67-
signingKeySecret, _ := k8sutils.GetSecret(i.Client, "openshift-service-ca", "signing-key")
6885
if signingKeySecret != nil && instance.Spec.TLSCertificate.CertRef == nil {
6986
if svc.Annotations == nil {
7087
svc.Annotations = make(map[string]string)
7188
}
72-
svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = instance.Name + "-tls-secret"
89+
svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = instance.Name + "-ctlog-tls-secret"
7390
err := i.Client.Update(ctx, svc)
7491
if err != nil {
7592
return i.FailedWithStatusUpdate(ctx, fmt.Errorf("could not annotate service: %w", err), instance)

‎internal/controller/ctlog/ctlog_controller_test.go

+5
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,12 @@ var _ = Describe("CTlog controller", func() {
174174
Eventually(func() error {
175175
return k8sClient.Get(ctx, types.NamespacedName{Name: actions.ComponentName, Namespace: Namespace}, service)
176176
}).Should(Succeed())
177+
<<<<<<< HEAD
177178
Expect(service.Spec.Ports[0].Port).Should(Equal(int32(80)))
179+
=======
180+
Expect(service.Spec.Ports[0].Port).Should(Equal(int32(6963)))
181+
Expect(service.Spec.Ports[1].Port).Should(Equal(int32(443)))
182+
>>>>>>> df48e12 (updates-1)
178183

179184
By("Move to Ready phase")
180185
// Workaround to succeed condition for Ready phase

‎internal/controller/ctlog/utils/ctlog_deployment.go

+22
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ import (
1313
"k8s.io/apimachinery/pkg/util/intstr"
1414
)
1515

16+
<<<<<<< HEAD
1617
func CreateDeployment(instance *v1alpha1.CTlog, deploymentName string, sa string, labels map[string]string, serverPort, metricsPort int32) (*appsv1.Deployment, error) {
1718
switch {
1819
case instance.Status.ServerConfigRef == nil:
@@ -23,8 +24,17 @@ func CreateDeployment(instance *v1alpha1.CTlog, deploymentName string, sa string
2324
return nil, fmt.Errorf("CreateCTLogDeployment: %w", TrillianAddressNotSpecified)
2425
case instance.Spec.Trillian.Port == nil:
2526
return nil, fmt.Errorf("CreateCTLogDeployment: %w", TrillianPortNotSpecified)
27+
=======
28+
func CreateDeployment(instance *v1alpha1.CTlog, deploymentName string, sa string, labels map[string]string, useHTTPS bool) (*appsv1.Deployment, error) {
29+
if instance.Status.ServerConfigRef == nil {
30+
return nil, errors.New("server config name not specified")
31+
>>>>>>> df48e12 (updates-1)
2632
}
2733
replicas := int32(1)
34+
scheme := corev1.URISchemeHTTP
35+
if useHTTPS {
36+
scheme = corev1.URISchemeHTTPS
37+
}
2838
// Define a new Deployment object
2939

3040
containerPorts := []corev1.ContainerPort{
@@ -73,8 +83,14 @@ func CreateDeployment(instance *v1alpha1.CTlog, deploymentName string, sa string
7383
LivenessProbe: &corev1.Probe{
7484
ProbeHandler: corev1.ProbeHandler{
7585
HTTPGet: &corev1.HTTPGetAction{
86+
<<<<<<< HEAD
7687
Path: "/healthz",
7788
Port: intstr.FromInt32(serverPort),
89+
=======
90+
Path: "/healthz",
91+
Port: intstr.FromInt32(6962),
92+
Scheme: scheme,
93+
>>>>>>> df48e12 (updates-1)
7894
},
7995
},
8096
InitialDelaySeconds: 10,
@@ -86,8 +102,14 @@ func CreateDeployment(instance *v1alpha1.CTlog, deploymentName string, sa string
86102
ReadinessProbe: &corev1.Probe{
87103
ProbeHandler: corev1.ProbeHandler{
88104
HTTPGet: &corev1.HTTPGetAction{
105+
<<<<<<< HEAD
89106
Path: "/healthz",
90107
Port: intstr.FromInt32(serverPort),
108+
=======
109+
Path: "/healthz",
110+
Port: intstr.FromInt32(6962),
111+
Scheme: scheme,
112+
>>>>>>> df48e12 (updates-1)
91113
},
92114
},
93115
InitialDelaySeconds: 10,

‎internal/controller/fulcio/actions/config_map.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func (i configMapAction) Name() string {
2929
func (i configMapAction) CanHandle(ctx context.Context, instance *rhtasv1alpha1.Fulcio) bool {
3030
c := meta.FindStatusCondition(instance.Status.Conditions, constants.Ready)
3131
cm, _ := k8sutils.GetConfigMap(ctx, i.Client, instance.Namespace, "ca-configmap")
32-
return c.Reason == constants.Creating || c.Reason == constants.Ready && cm == nil
32+
return (c.Reason == constants.Creating || c.Reason == constants.Ready) && cm == nil && instance.Spec.TLSCertificate.CACertRef == nil
3333
}
3434

3535
func (i configMapAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Fulcio) *action.Result {

0 commit comments

Comments
 (0)