Skip to content

OSASINFRA-3732: openstack: Sync CA cert to new key #5702

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sjenning merged 2 commits into from
Apr 4, 2025
Merged

OSASINFRA-3732: openstack: Sync CA cert to new key #5702

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
35f6acd
openstack: Sync CA cert to new key
stephenfin Feb 20, 2025
89f8be1
openstack: Add TODOs to remove unused secrets, config maps
stephenfin Mar 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions control-plane-operator/controllers/hostedcontrolplane/cloud/openstack/providerconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,17 @@ func ReconcileCloudConfigSecret(platformSpec *hyperv1.OpenStackPlatformSpec, sec
}
config := getCloudConfig(platformSpec, credentialsSecret, caCertData, machineNetwork)
if caCertData != nil {
secret.Data[CASecretKey] = caCertData
// TODO(stephenfin): Both csi-operator (for Manila and Cinder CSI) and
// cluster-storage-operator now uses the certs from 'cacert', meaning
// this is no longer necessary. It is only kept here temporarily to
// ease upgrades. Remove in 4.20+
secret.Data[CABundleKey] = caCertData
Copy link
Copy Markdown
Contributor Author

@stephenfin stephenfin Feb 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed there are no references to this on a running HCP cluster:

❯ oc get -A pods -o yaml | grep --group-separator=$'\n---\n' -e '\bca-bundle.pem\b' -B 5 -A 2
        defaultMode: 420
        secretName: openstack-cinder-csi-driver-node-metrics-serving-cert
    - configMap:
        defaultMode: 420
        items:
        - key: ca-bundle.pem
          path: ca-bundle.pem
        name: cloud-conf
        optional: true

---

        secretName: serving-cert
    - configMap:
        defaultMode: 420
        items:
        - key: ca-bundle.crt
          path: tls-ca-bundle.pem
        name: trusted-ca
      name: trusted-ca

---

      name: service-ca
    - configMap:
        defaultMode: 420
        items:
        - key: ca-bundle.crt
          path: tls-ca-bundle.pem
        name: trusted-ca-bundle
      name: trusted-ca-bundle

---

      name: metrics-client-ca
    - configMap:
        defaultMode: 420
        items:
        - key: ca-bundle.crt
          path: tls-ca-bundle.pem
        name: alertmanager-trusted-ca-bundle
      name: alertmanager-trusted-ca-bundle

---

      name: prometheus-k8s-db
    - configMap:
        defaultMode: 420
        items:
        - key: ca-bundle.crt
          path: tls-ca-bundle.pem
        name: prometheus-trusted-ca-bundle
      name: prometheus-trusted-ca-bundle

---

      name: metrics-client-ca
    - configMap:
        defaultMode: 420
        items:
        - key: ca-bundle.crt
          path: tls-ca-bundle.pem
        name: telemeter-trusted-ca-bundle-56c9b9fa8d9gs
        optional: true

}
// TODO(stephenfin): Neither cinder nor manila CSI drivers (as deployed by
// csi-operator) consume configuration from this secret: cinder sources it
// from the config map, and manila does its own special thing. Remove in
// 4.20+
secret.Data[CloudConfigKey] = []byte(config)
Copy link
Copy Markdown
Contributor Author

@stephenfin stephenfin Feb 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto:

❯ oc get -A pods -o yaml | grep --group-separator=$'\n---\n' -e '\bcloud.conf\b' -B 5 -A 2                                                                                                                                                                                                                                                                                                                                                 
      - --v=2                                                                                                                                                                                                                                                                                                                                                                                                                              
      env:                                                                                                                                                                                                                                                                                                                                                                                                                                 
      - name: CSI_ENDPOINT                                                                                                                                                                                                                                                                                                                                                                                                                 
        value: unix://csi/csi.sock                                                                                                                                                                                                                                                                                                                                                                                                         
      - name: CLOUD_CONFIG                                                                                                                                                                                                                                                                                                                                                                                                                 
        value: /etc/kubernetes/config/cloud.conf                                                                                                                                                                                                                                                                                                                                                                                           
      image: registry.build11.ci.openshift.org/ci-ln-6gzd92b/stable@sha256:9ec419f3de22d194cabf4f24f160c5f5e75485e8fc58dca4178869e357463629                                                                                                                                                                                                                                                                                                
      imagePullPolicy: IfNotPresent                                                                                                                                                                                                                                                                                                                                                                                                        
                                                                                                                                                                                                                                                                                                                                                                                                                                           
---                                                                                                                                                                                                                                                                                                                                                                                                                                        
                                                                                                                                                                                                                                                                                                                                                                                                                                           
    - configMap:                                                                                                                                                                                                                                                                                                                                                                                                                           
        defaultMode: 420                                                                                                                                                                                                                                                                                                                                                                                                                   
        items:                                                                                                                                                                                                                                                                                                                                                                                                                             
        - key: ca-bundle.pem                                                                                                                                                                                                                                                                                                                                                                                                               
          path: ca-bundle.pem                                                                                                                                                                                                                                                                                                                                                                                                              
        name: cloud-conf                                                                                                                                                                                                                                                                                                                                                                                                                   
        optional: true                                                                                                                                                                                                                                                                                                                                                                                                                     
      name: cacert                                                                                                                                                                                                                                                                                                                                                                                                                         
    - configMap:                                                                                                                                                                                                                                                                                                                                                                                                                           
        defaultMode: 420                                                                                                                                                                                                                                                                                                                                                                                                                   
        items:                                                                                                                                                                                                                                                                                                                                                                                                                             
        - key: cloud.conf                                                                                                                                                                                                                                                                                                                                                                                                                  
          path: cloud.conf
        name: cloud-conf
      name: config-cinderplugin
    - name: secret-cinderplugin


return nil
Expand Down
7 changes: 7 additions & 0 deletions ...e-operator/controllers/hostedcontrolplane/v2/cloud_controller_manager/openstack/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,13 @@ func adaptConfig(cpContext component.WorkloadContext, cm *corev1.ConfigMap) erro

caCertData := GetCACertFromCredentialsSecret(credentialsSecret)
if caCertData != nil {
// NOTE(stephenfin): While we (OpenStack) would prefer that this used
// 'cacert' like everything else, CCCMO expects the CA cert to be found
// at 'ca-bundle.pem' since it will combine this cert with an optional
// cert bundle. This is done for more platforms that OpenStack so we
// don't want to change that. See the below for more information.
//
// https://github.com/openshift/cluster-cloud-controller-manager-operator/blob/master/docs/dev/trusted_ca_bundle_sync.md
cm.Data[CABundleKey] = string(caCertData)
}

Expand Down
4 changes: 2 additions & 2 deletions control-plane-operator/hostedclusterconfigoperator/controllers/resources/resources.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1569,9 +1569,9 @@ func (r *reconciler) reconcileCloudCredentialSecrets(ctx context.Context, hcp *h
caCertData := openstack.GetCACertFromCredentialsSecret(credentialsSecret)
errs = append(errs,
r.reconcileOpenStackCredentialsSecret(ctx, hcp.Spec.Platform.OpenStack, "openshift-cluster-csi-drivers", "openstack-cloud-credentials", credentialsSecret, caCertData, hcp.Spec.Networking.MachineNetwork),
r.reconcileOpenStackCredentialsSecret(ctx, hcp.Spec.Platform.OpenStack, "openshift-cluster-csi-drivers", "manila-cloud-credentials", credentialsSecret, caCertData, hcp.Spec.Networking.MachineNetwork),
r.reconcileOpenStackCredentialsSecret(ctx, hcp.Spec.Platform.OpenStack, "openshift-image-registry", "installer-cloud-credentials", credentialsSecret, caCertData, hcp.Spec.Networking.MachineNetwork),
r.reconcileOpenStackCredentialsSecret(ctx, hcp.Spec.Platform.OpenStack, "openshift-cloud-network-config-controller", "cloud-credentials", credentialsSecret, caCertData, hcp.Spec.Networking.MachineNetwork),
r.reconcileOpenStackCredentialsSecret(ctx, hcp.Spec.Platform.OpenStack, "openshift-cluster-csi-drivers", "manila-cloud-credentials", credentialsSecret, caCertData, hcp.Spec.Networking.MachineNetwork),
)
case hyperv1.PowerVSPlatform:
createPowerVSSecret := func(srcSecret, destSecret *corev1.Secret) error {
Expand Down Expand Up @@ -1649,7 +1649,7 @@ func (r *reconciler) reconcileCloudCredentialSecrets(ctx context.Context, hcp *h
return errs
}

// reconcileOpenStackCredentialsSecret is a wrapper used to reconcile the OpenStack cloud config secrets.
// reconcileOpenStackCredentialsSecret is a wrapper used to reconcile the OpenStack credentials secrets.
func (r *reconciler) reconcileOpenStackCredentialsSecret(ctx context.Context, platformSpec *hyperv1.OpenStackPlatformSpec, namespace, name string, credentialsSecret *corev1.Secret, caCertData []byte, machineNetwork []hyperv1.MachineNetworkEntry) error {
secret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Expand Down