Merge pull request #234 from olliewalsh/ovn_tls

OVN TLS support
openstack-k8s-operators · Mar 7, 2024 · 826f326 · 826f326
2 parents 3abd273 + fb78131
commit 826f326
Show file tree

Hide file tree

Showing 47 changed files with 1,839 additions and 108 deletions.
diff --git a/api/bases/ovn.openstack.org_ovncontrollers.yaml b/api/bases/ovn.openstack.org_ovncontrollers.yaml
@@ -149,6 +149,17 @@ spec:
                       More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                     type: object
                 type: object
+              tls:
+                description: TLS - Parameters related to TLS
+                properties:
+                  caBundleSecretName:
+                    description: CaBundleSecretName - holding the CA certs in a pre-created
+                      bundle file
+                    type: string
+                  secretName:
+                    description: SecretName - holding the cert, key for the service
+                    type: string
+                type: object
             required:
             - ovnContainerImage
             - ovsContainerImage

diff --git a/api/bases/ovn.openstack.org_ovndbclusters.yaml b/api/bases/ovn.openstack.org_ovndbclusters.yaml
@@ -151,6 +151,17 @@ spec:
               storageRequest:
                 description: StorageRequest
                 type: string
+              tls:
+                description: TLS - Parameters related to TLS
+                properties:
+                  caBundleSecretName:
+                    description: CaBundleSecretName - holding the CA certs in a pre-created
+                      bundle file
+                    type: string
+                  secretName:
+                    description: SecretName - holding the cert, key for the service
+                    type: string
+                type: object
             required:
             - containerImage
             - dbType

diff --git a/api/bases/ovn.openstack.org_ovnnorthds.yaml b/api/bases/ovn.openstack.org_ovnnorthds.yaml
@@ -123,6 +123,17 @@ spec:
                       More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                     type: object
                 type: object
+              tls:
+                description: TLS - Parameters related to TLS
+                properties:
+                  caBundleSecretName:
+                    description: CaBundleSecretName - holding the CA certs in a pre-created
+                      bundle file
+                    type: string
+                  secretName:
+                    description: SecretName - holding the cert, key for the service
+                    type: string
+                type: object
             required:
             - containerImage
             type: object

diff --git a/api/v1beta1/ovncontroller_types.go b/api/v1beta1/ovncontroller_types.go
@@ -18,6 +18,7 @@ package v1beta1
 
 import (
 	"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -33,6 +34,9 @@ const (
 	OvnControllerOvsContainerImage = "quay.io/podified-antelope-centos9/openstack-ovn-base:current-podified"
 	// OvnControllerContainerImage is the fall-back container image for OVNController ovn-controller
 	OvnControllerContainerImage = "quay.io/podified-antelope-centos9/openstack-ovn-controller:current-podified"
+
+	// ServiceNameOvnController - ovn-controller service name
+	ServiceNameOvnController = "ovn-controller"
 )
 
 // OVNControllerSpec defines the desired state of OVNController
@@ -78,6 +82,11 @@ type OVNControllerSpecCore struct {
 	// If present, the IP of the attachment named "tenant", will be used as the OvnEncapIP.
 
 	NetworkAttachments []string `json:"networkAttachments,omitempty"`
+
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	// TLS - Parameters related to TLS
+	TLS tls.SimpleService `json:"tls,omitempty"`
 }
 
 // OVNControllerStatus defines the observed state of OVNController

diff --git a/api/v1beta1/ovndbcluster_types.go b/api/v1beta1/ovndbcluster_types.go
@@ -20,16 +20,19 @@ import (
 	"fmt"
 
 	"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 const (
 	// NBDBType - Northbound database type
-	NBDBType = "NB"
+	NBDBType      = "NB"
+	ServiceNameNB = "ovsdbserver-nb"
 	// SBDBType - Southbound database type
-	SBDBType = "SB"
+	SBDBType      = "SB"
+	ServiceNameSB = "ovsdbserver-sb"
 
 	// ServiceHeadlessType - Constant to identify Headless services
 	ServiceHeadlessType = "headless"
@@ -114,6 +117,11 @@ type OVNDBClusterSpecCore struct {
 	// NetworkAttachment is a NetworkAttachment resource name to expose the service to the given network.
 	// If specified the IP address of this network is used as the dbAddress connection.
 	NetworkAttachment string `json:"networkAttachment"`
+
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	// TLS - Parameters related to TLS
+	TLS tls.SimpleService `json:"tls,omitempty"`
 }
 
 // OVNDBClusterStatus defines the observed state of OVNDBCluster

diff --git a/api/v1beta1/ovnnorthd_types.go b/api/v1beta1/ovnnorthd_types.go
@@ -18,6 +18,7 @@ package v1beta1
 
 import (
 	"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
+	"github.com/openstack-k8s-operators/lib-common/modules/common/tls"
 
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -28,6 +29,8 @@ const (
 
 	// OvnNorthdContainerImage is the fall-back container image for OVNNorthd
 	OvnNorthdContainerImage = "quay.io/podified-antelope-centos9/openstack-ovn-northd:current-podified"
+	// ServiceNameOvnNorthd -
+	ServiceNameOvnNorthd = "ovn-northd"
 )
 
 // OVNNorthdSpec defines the desired state of OVNNorthd
@@ -67,6 +70,11 @@ type OVNNorthdSpecCore struct {
 	// NetworkAttachment is a NetworkAttachment resource name to expose the service to the given network.
 	// If specified the IP address of this network is used as the dbAddress connection.
 	NetworkAttachment string `json:"networkAttachment"`
+
+	// +kubebuilder:validation:Optional
+	// +operator-sdk:csv:customresourcedefinitions:type=spec
+	// TLS - Parameters related to TLS
+	TLS tls.SimpleService `json:"tls,omitempty"`
 }
 
 // OVNNorthdStatus defines the observed state of OVNNorthd

diff --git a/api/v1beta1/zz_generated.deepcopy.go b/api/v1beta1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/ovn.openstack.org_ovncontrollers.yaml b/config/crd/bases/ovn.openstack.org_ovncontrollers.yaml
@@ -149,6 +149,17 @@ spec:
                       More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                     type: object
                 type: object
+              tls:
+                description: TLS - Parameters related to TLS
+                properties:
+                  caBundleSecretName:
+                    description: CaBundleSecretName - holding the CA certs in a pre-created
+                      bundle file
+                    type: string
+                  secretName:
+                    description: SecretName - holding the cert, key for the service
+                    type: string
+                type: object
             required:
             - ovnContainerImage
             - ovsContainerImage

diff --git a/config/crd/bases/ovn.openstack.org_ovndbclusters.yaml b/config/crd/bases/ovn.openstack.org_ovndbclusters.yaml
@@ -151,6 +151,17 @@ spec:
               storageRequest:
                 description: StorageRequest
                 type: string
+              tls:
+                description: TLS - Parameters related to TLS
+                properties:
+                  caBundleSecretName:
+                    description: CaBundleSecretName - holding the CA certs in a pre-created
+                      bundle file
+                    type: string
+                  secretName:
+                    description: SecretName - holding the cert, key for the service
+                    type: string
+                type: object
             required:
             - containerImage
             - dbType

diff --git a/config/crd/bases/ovn.openstack.org_ovnnorthds.yaml b/config/crd/bases/ovn.openstack.org_ovnnorthds.yaml
@@ -123,6 +123,17 @@ spec:
                       More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                     type: object
                 type: object
+              tls:
+                description: TLS - Parameters related to TLS
+                properties:
+                  caBundleSecretName:
+                    description: CaBundleSecretName - holding the CA certs in a pre-created
+                      bundle file
+                    type: string
+                  secretName:
+                    description: SecretName - holding the cert, key for the service
+                    type: string
+                type: object
             required:
             - containerImage
             type: object

diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -94,6 +94,18 @@ rules:
   verbs:
   - get
   - list
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - ""
   resources:

diff --git a/controllers/ovn_common.go b/controllers/ovn_common.go
@@ -0,0 +1,30 @@
+/*
+Copyright 2024.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package controllers
+
+// fields to index to reconcile when changed
+const (
+	tlsField                = ".spec.tls.secretName"
+	caBundleSecretNameField = ".spec.tls.caBundleSecretName"
+)
+
+var (
+	allWatchFields = []string{
+		caBundleSecretNameField,
+		tlsField,
+	}
+)