Skip to content

Commit 00a298e

Browse files
lmillerilmilleri
authored
Merge pull request #105 from lmilleri/extend-cert-cache
Extend the KbsLocalCertCacheSpec structure
2 parents a36b948 + f6e2a9a commit 00a298e

File tree

8 files changed

+129
-34
lines changed

8 files changed

+129
-34
lines changed

‎api/v1alpha1/kbsconfig_types.go‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,14 +50,21 @@ type IbmSEConfigSpec struct {
5050
CertStorePvc string `json:"certStorePvc,omitempty"`
5151
}
5252

53-
// KbsLocalCertCacheSpec defines the configuration for mounting local certificates into trustee file system
54-
type KbsLocalCertCacheSpec struct {
53+
// KbsLocalCertCacheEntry defines a single certificate cache entry with secret and mount path
54+
type KbsLocalCertCacheEntry struct {
5555
// SecretName is the name of the secret that maps to a local directory containing the certificates
56-
// +optional
57-
SecretName string `json:"secretName,omitempty"`
56+
SecretName string `json:"secretName"`
5857
// MountPath is the destination path in the trustee file system
58+
// The default path is "/etc/kbs/certs" if not specified by the user
59+
// +optional
60+
MountPath string `json:"mountPath"`
61+
}
62+
63+
// KbsLocalCertCacheSpec defines the configuration for mounting local certificates into trustee file system
64+
type KbsLocalCertCacheSpec struct {
65+
// Secrets is a list of certificate cache entries, each containing a secret name and mount path
5966
// +optional
60-
MountPath string `json:"mountPath,omitempty"`
67+
Secrets []KbsLocalCertCacheEntry `json:"secrets,omitempty"`
6168
}
6269

6370
// KbsDeploymentSpec defines the configuration for trustee deployment

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 21 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/manifests/confidentialcontainers.org_kbsconfigs.yaml‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -106,14 +106,26 @@ spec:
106106
description: KbsLocalCertCacheSpec is the struct for mounting local
107107
certificates into trustee file system
108108
properties:
109-
mountPath:
110-
description: MountPath is the destination path in the trustee
111-
file system
112-
type: string
113-
secretName:
114-
description: SecretName is the name of the secret that maps to
115-
a local directory containing the certificates
116-
type: string
109+
secrets:
110+
description: Secrets is a list of certificate cache entries, each
111+
containing a secret name and mount path
112+
items:
113+
description: KbsLocalCertCacheEntry defines a single certificate
114+
cache entry with secret and mount path
115+
properties:
116+
mountPath:
117+
description: |-
118+
MountPath is the destination path in the trustee file system
119+
The default path is "/etc/kbs/certs" if not specified by the user
120+
type: string
121+
secretName:
122+
description: SecretName is the name of the secret that maps
123+
to a local directory containing the certificates
124+
type: string
125+
required:
126+
- secretName
127+
type: object
128+
type: array
117129
type: object
118130
kbsResourcePolicyConfigMapName:
119131
description: KbsResourcePolicyConfigMapName is the name of the configmap

‎config/crd/bases/confidentialcontainers.org_kbsconfigs.yaml‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -106,14 +106,26 @@ spec:
106106
description: KbsLocalCertCacheSpec is the struct for mounting local
107107
certificates into trustee file system
108108
properties:
109-
mountPath:
110-
description: MountPath is the destination path in the trustee
111-
file system
112-
type: string
113-
secretName:
114-
description: SecretName is the name of the secret that maps to
115-
a local directory containing the certificates
116-
type: string
109+
secrets:
110+
description: Secrets is a list of certificate cache entries, each
111+
containing a secret name and mount path
112+
items:
113+
description: KbsLocalCertCacheEntry defines a single certificate
114+
cache entry with secret and mount path
115+
properties:
116+
mountPath:
117+
description: |-
118+
MountPath is the destination path in the trustee file system
119+
The default path is "/etc/kbs/certs" if not specified by the user
120+
type: string
121+
secretName:
122+
description: SecretName is the name of the secret that maps
123+
to a local directory containing the certificates
124+
type: string
125+
required:
126+
- secretName
127+
type: object
128+
type: array
117129
type: object
118130
kbsResourcePolicyConfigMapName:
119131
description: KbsResourcePolicyConfigMapName is the name of the configmap

‎docs/disconnected.md‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,35 @@ spec:
3232
# omitted all the rest of config
3333
# ...
3434
kbsLocalCertCacheSpec:
35-
secretName: vcek-secret
36-
mountPath: "/etc/kbs/snp/ek"
35+
secrets:
36+
- secretName: vcek-secret
37+
mountPath: "/etc/kbs/snp/ek"
3738
```
3839
39-
The `VCEK.crt` certificate will be mounted in the trustee `mountPath` directoty.
40+
The `VCEK.crt` certificate will be mounted in the trustee `mountPath` directory.
41+
The `mountPath` directory defaults to `/etc/kbs/certs` if not provided by the user.
42+
43+
### Multiple Certificates
44+
45+
You can also mount multiple certificate secrets by adding more entries to the `secrets` list:
46+
47+
```yaml
48+
apiVersion: confidentialcontainers.org/v1alpha1
49+
kind: KbsConfig
50+
metadata:
51+
name: kbsconfig-sample
52+
namespace: trustee-operator-system
53+
spec:
54+
# omitted all the rest of config
55+
# ...
56+
kbsLocalCertCacheSpec:
57+
secrets:
58+
- secretName: vcek-milan
59+
mountPath: "/etc/kbs/snp/ek/milan"
60+
- secretName: vcek-genoa
61+
mountPath: "/etc/kbs/snp/ek/genoa"
62+
- secretName: vcek-turin
63+
mountPath: "/etc/kbs/snp/ek/turin"
64+
```
65+
66+
Each secret will be mounted to its specified `mountPath` in the trustee file system.

‎internal/controller/common.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,9 @@ const (
7676

7777
// default attestation policy filename for cpu
7878
defaultAttestationCpuPolicy = "default_cpu.rego"
79+
80+
// default directory for locally cached certificates
81+
kbsDefaultLocalCacheDir = "/etc/kbs/certs"
7982
)
8083

8184
func contains(list []string, s string) bool {

‎internal/controller/kbsconfig_controller.go‎

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -420,14 +420,17 @@ func (r *KbsConfigReconciler) newKbsDeployment(ctx context.Context) (*appsv1.Dep
420420
volumeMount = createVolumeMount(volume.Name, filepath.Join(kbsDefaultConfigPath, volume.Name))
421421
kbsVM = append(kbsVM, volumeMount)
422422

423-
// Mount local directory into a secret
424-
if r.kbsConfig.Spec.KbsLocalCertCacheSpec.SecretName != "" {
425-
volume, err = r.createSecretVolume(ctx, r.kbsConfig.Spec.KbsLocalCertCacheSpec.SecretName, r.kbsConfig.Spec.KbsLocalCertCacheSpec.SecretName)
423+
// Mount local directories into secrets
424+
for _, certCacheEntry := range r.kbsConfig.Spec.KbsLocalCertCacheSpec.Secrets {
425+
volume, err = r.createSecretVolume(ctx, certCacheEntry.SecretName, certCacheEntry.SecretName)
426426
if err != nil {
427427
return nil, err
428428
}
429429
volumes = append(volumes, *volume)
430-
volumeMount = createVolumeMount(volume.Name, r.kbsConfig.Spec.KbsLocalCertCacheSpec.MountPath)
430+
if certCacheEntry.MountPath == "" {
431+
certCacheEntry.MountPath = kbsDefaultLocalCacheDir
432+
}
433+
volumeMount = createVolumeMount(volume.Name, certCacheEntry.MountPath)
431434
kbsVM = append(kbsVM, volumeMount)
432435
}
433436

@@ -802,11 +805,21 @@ func secretToKbsConfigMapper(c client.Client, log logr.Logger) (handler.MapFunc,
802805

803806
var requests []reconcile.Request
804807
for _, kbsConfig := range kbsConfigList.Items {
805-
if kbsConfig.Spec.KbsAuthSecretName == secret.Name ||
806-
kbsConfig.Spec.KbsLocalCertCacheSpec.SecretName == secret.Name ||
808+
// Check if secret matches any of the known secret references
809+
secretMatches := kbsConfig.Spec.KbsAuthSecretName == secret.Name ||
807810
kbsConfig.Spec.KbsHttpsKeySecretName == secret.Name ||
808811
kbsConfig.Spec.KbsHttpsCertSecretName == secret.Name ||
809-
kbsConfig.Spec.KbsSecretResources != nil && contains(kbsConfig.Spec.KbsSecretResources, secret.Name) {
812+
(kbsConfig.Spec.KbsSecretResources != nil && contains(kbsConfig.Spec.KbsSecretResources, secret.Name))
813+
814+
// Check if secret matches any of the local cert cache secrets
815+
for _, certCacheEntry := range kbsConfig.Spec.KbsLocalCertCacheSpec.Secrets {
816+
if certCacheEntry.SecretName == secret.Name {
817+
secretMatches = true
818+
break
819+
}
820+
}
821+
822+
if secretMatches {
810823
requests = append(requests, reconcile.Request{
811824
NamespacedName: types.NamespacedName{
812825
Namespace: kbsConfig.Namespace,

‎tests/e2e/sample-attester/08-kbsconfig_sample.yaml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,9 @@ spec:
2121
KbsEnvVars:
2222
RUST_LOG: debug
2323
kbsLocalCertCacheSpec:
24-
secretName: vcek-secret
25-
mountPath: "/etc/kbs/snp/ek"
24+
secrets:
25+
- secretName: vcek-secret
26+
mountPath: "/etc/kbs/snp/ek"
2627
KbsDeploymentSpec:
2728
replicas: 2
2829

0 commit comments

Comments
 (0)