Skip to content

Commit f1a77ef

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #820 from securesign/migrate_trillian
Migrate trillian
2 parents 1ab8019 + e250155 commit f1a77ef

File tree

14 files changed

+546
-743
lines changed

14 files changed

+546
-743
lines changed

‎internal/controller/common/utils/kubernetes/deployment.go

+10
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,16 @@ func FindContainerByNameOrCreate(podSpec *corev1.PodSpec, containerName string)
128128
return &podSpec.Containers[len(podSpec.Containers)-1]
129129
}
130130

131+
func FindInitContainerByNameOrCreate(podSpec *corev1.PodSpec, containerName string) *corev1.Container {
132+
for i, c := range podSpec.InitContainers {
133+
if c.Name == containerName {
134+
return &podSpec.InitContainers[i]
135+
}
136+
}
137+
podSpec.InitContainers = append(podSpec.InitContainers, corev1.Container{Name: containerName})
138+
return &podSpec.InitContainers[len(podSpec.InitContainers)-1]
139+
}
140+
131141
func FindVolumeByNameOrCreate(podSpec *corev1.PodSpec, volumeName string) *corev1.Volume {
132142
for i, v := range podSpec.Volumes {
133143
if v.Name == volumeName {

‎internal/controller/common/utils/kubernetes/ensure/deployment.go

+64-4
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,44 @@
11
package ensure
22

33
import (
4+
"slices"
5+
46
"github.com/securesign/operator/api/v1alpha1"
57
"github.com/securesign/operator/internal/controller/common/utils"
68
"github.com/securesign/operator/internal/controller/common/utils/kubernetes"
79
v1 "k8s.io/api/apps/v1"
810
corev1 "k8s.io/api/core/v1"
911
)
1012

13+
const (
14+
CaTrustVolumeName = "ca-trust"
15+
TLSVolumeName = "tls-cert"
16+
CATRustMountPath = "/var/run/configs/tas/ca-trust"
17+
18+
TLSVolumeMount = "/var/run/secrets/tas"
19+
20+
TLSKeyPath = TLSVolumeMount + "/tls.key"
21+
TLSCertPath = TLSVolumeMount + "/tls.crt"
22+
)
23+
1124
func Proxy() func(*v1.Deployment) error {
1225
return func(dp *v1.Deployment) error {
1326
utils.SetProxyEnvs(dp)
1427
return nil
1528
}
1629
}
1730

18-
const CaTrustVolumeName = "ca-trust"
19-
2031
// TrustedCA mount config map with trusted CA bundle to all deployment's containers.
2132
func TrustedCA(lor *v1alpha1.LocalObjectReference) func(dp *v1.Deployment) error {
2233
return func(dp *v1.Deployment) error {
2334

2435
template := &dp.Spec.Template
2536
for i := range template.Spec.Containers {
2637
env := kubernetes.FindEnvByNameOrCreate(&template.Spec.Containers[i], "SSL_CERT_DIR")
27-
env.Value = "/var/run/configs/tas/ca-trust:/var/run/secrets/kubernetes.io/serviceaccount"
38+
env.Value = CATRustMountPath + ":/var/run/secrets/kubernetes.io/serviceaccount"
2839

2940
volumeMount := kubernetes.FindVolumeMountByNameOrCreate(&template.Spec.Containers[i], CaTrustVolumeName)
30-
volumeMount.MountPath = "/var/run/configs/tas/ca-trust"
41+
volumeMount.MountPath = CATRustMountPath
3142
volumeMount.ReadOnly = true
3243

3344
}
@@ -52,3 +63,52 @@ func TrustedCA(lor *v1alpha1.LocalObjectReference) func(dp *v1.Deployment) error
5263
return nil
5364
}
5465
}
66+
67+
// TLS mount secret with tls cert to all deployment's containers.
68+
func TLS(tls v1alpha1.TLS, containerNames ...string) func(dp *v1.Deployment) error {
69+
return func(dp *v1.Deployment) error {
70+
template := &dp.Spec.Template
71+
72+
for i, c := range template.Spec.Containers {
73+
if slices.Contains(containerNames, c.Name) {
74+
volumeMount := kubernetes.FindVolumeMountByNameOrCreate(&template.Spec.Containers[i], TLSVolumeName)
75+
volumeMount.MountPath = TLSVolumeMount
76+
volumeMount.ReadOnly = true
77+
}
78+
}
79+
80+
volume := kubernetes.FindVolumeByNameOrCreate(&template.Spec, TLSVolumeName)
81+
if volume.Projected == nil {
82+
volume.Projected = &corev1.ProjectedVolumeSource{}
83+
}
84+
volume.Projected.Sources = []corev1.VolumeProjection{
85+
{
86+
Secret: &corev1.SecretProjection{
87+
LocalObjectReference: corev1.LocalObjectReference{
88+
Name: tls.CertRef.Name,
89+
},
90+
Items: []corev1.KeyToPath{
91+
{
92+
Key: tls.CertRef.Key,
93+
Path: "tls.crt",
94+
},
95+
},
96+
},
97+
},
98+
{
99+
Secret: &corev1.SecretProjection{
100+
LocalObjectReference: corev1.LocalObjectReference{
101+
Name: tls.PrivateKeyRef.Name,
102+
},
103+
Items: []corev1.KeyToPath{
104+
{
105+
Key: tls.PrivateKeyRef.Key,
106+
Path: "tls.key",
107+
},
108+
},
109+
},
110+
},
111+
}
112+
return nil
113+
}
114+
}

‎internal/controller/common/utils/kubernetes/ensure/deployment_test.go

+77
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"testing"
66

77
"github.com/onsi/gomega"
8+
"github.com/securesign/operator/api/v1alpha1"
89
"github.com/securesign/operator/internal/controller/annotations"
910
"github.com/securesign/operator/internal/controller/common/utils"
1011
"github.com/securesign/operator/internal/controller/common/utils/kubernetes"
@@ -63,3 +64,79 @@ func TestEnsureTrustedCAFromAnnotations(t *testing.T) {
6364

6465
})
6566
}
67+
68+
func TestEnsureTLS(t *testing.T) {
69+
gomega.RegisterTestingT(t)
70+
t.Run("update existing object", func(t *testing.T) {
71+
72+
ctx := context.TODO()
73+
c := testAction.FakeClientBuilder().
74+
WithObjects(&v1.Deployment{
75+
ObjectMeta: v2.ObjectMeta{Name: name, Namespace: "default"},
76+
Spec: v1.DeploymentSpec{
77+
Template: v3.PodTemplateSpec{
78+
Spec: v3.PodSpec{
79+
Containers: []v3.Container{
80+
{Name: name, Image: "test"},
81+
{Name: "doNotUpdate", Image: "test"},
82+
},
83+
},
84+
},
85+
},
86+
}).
87+
Build()
88+
89+
result, err := kubernetes.CreateOrUpdate(ctx, c,
90+
&v1.Deployment{ObjectMeta: v2.ObjectMeta{Name: name, Namespace: "default"}},
91+
TLS(v1alpha1.TLS{
92+
PrivateKeyRef: &v1alpha1.SecretKeySelector{
93+
LocalObjectReference: v1alpha1.LocalObjectReference{
94+
Name: "testSecret",
95+
},
96+
Key: "key",
97+
},
98+
CertRef: &v1alpha1.SecretKeySelector{
99+
LocalObjectReference: v1alpha1.LocalObjectReference{
100+
Name: "testSecret",
101+
},
102+
Key: "cert",
103+
},
104+
}, name),
105+
)
106+
gomega.Expect(err).ToNot(gomega.HaveOccurred())
107+
108+
gomega.Expect(result).To(gomega.Equal(controllerutil.OperationResultUpdated))
109+
110+
existing := &v1.Deployment{}
111+
gomega.Expect(c.Get(ctx, client.ObjectKey{Namespace: "default", Name: name}, existing)).To(gomega.Succeed())
112+
113+
gomega.Expect(existing.Spec.Template.Spec.Containers[0].VolumeMounts).To(gomega.HaveLen(1))
114+
gomega.Expect(existing.Spec.Template.Spec.Containers[0].VolumeMounts[0].Name).To(gomega.Equal(TLSVolumeName))
115+
gomega.Expect(existing.Spec.Template.Spec.Containers[0].VolumeMounts[0].MountPath).To(gomega.Equal("/var/run/secrets/tas"))
116+
117+
gomega.Expect(existing.Spec.Template.Spec.Containers[1].VolumeMounts).To(gomega.BeEmpty())
118+
119+
gomega.Expect(existing.Spec.Template.Spec.Volumes).To(gomega.HaveLen(1))
120+
gomega.Expect(existing.Spec.Template.Spec.Volumes[0].Name).To(gomega.Equal(TLSVolumeName))
121+
gomega.Expect(existing.Spec.Template.Spec.Volumes[0].Projected.Sources).To(gomega.HaveLen(2))
122+
gomega.Expect(existing.Spec.Template.Spec.Volumes[0].Projected.Sources).To(gomega.ContainElements(
123+
gomega.And(
124+
gomega.WithTransform(func(s v3.VolumeProjection) string {
125+
return s.Secret.Name
126+
}, gomega.Equal("testSecret")),
127+
gomega.WithTransform(func(s v3.VolumeProjection) string {
128+
return s.Secret.Items[0].Key
129+
}, gomega.Equal("key")),
130+
),
131+
gomega.And(
132+
gomega.WithTransform(func(s v3.VolumeProjection) string {
133+
return s.Secret.Name
134+
}, gomega.Equal("testSecret")),
135+
gomega.WithTransform(func(s v3.VolumeProjection) string {
136+
return s.Secret.Items[0].Key
137+
}, gomega.Equal("cert")),
138+
),
139+
))
140+
141+
})
142+
}

‎internal/controller/common/utils/set_tls.go

-64
This file was deleted.

‎internal/controller/trillian/actions/constants.go

+7
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,11 @@ const (
2222
ServerPortName = "grpc"
2323
MetricsPort = 8090
2424
MetricsPortName = "metrics"
25+
26+
SecretRootPassword = "mysql-root-password"
27+
SecretPassword = "mysql-password"
28+
SecretDatabaseName = "mysql-database"
29+
SecretUser = "mysql-user"
30+
SecretPort = "mysql-port"
31+
SecretHost = "mysql-host"
2532
)

0 commit comments

Comments
 (0)