kbsLocalCertCacheSpec mountPath is optional

Signed-off-by: Leonardo Milleri <[email protected]>

Author: lmilleri

api/v1alpha1/kbsconfig_types.go

@@ -55,6 +55,8 @@ type KbsLocalCertCacheEntry struct {
 	// SecretName is the name of the secret that maps to a local directory containing the certificates
 	SecretName string `json:"secretName"`
 	// MountPath is the destination path in the trustee file system
+	// The default path is "/etc/kbs/certs" if not specified by the user
+	// +optional
 	MountPath string `json:"mountPath"`
 }
 

bundle/manifests/confidentialcontainers.org_kbsconfigs.yaml

@@ -114,15 +114,15 @@ spec:
                         cache entry with secret and mount path
                       properties:
                         mountPath:
-                          description: MountPath is the destination path in the trustee
-                            file system
+                          description: |-
+                            MountPath is the destination path in the trustee file system
+                            The default path is "/etc/kbs/certs" if not specified by the user
                           type: string
                         secretName:
                           description: SecretName is the name of the secret that maps
                             to a local directory containing the certificates
                           type: string
                       required:
-                      - mountPath
                       - secretName
                       type: object
                     type: array

config/crd/bases/confidentialcontainers.org_kbsconfigs.yaml

@@ -114,15 +114,15 @@ spec:
                         cache entry with secret and mount path
                       properties:
                         mountPath:
-                          description: MountPath is the destination path in the trustee
-                            file system
+                          description: |-
+                            MountPath is the destination path in the trustee file system
+                            The default path is "/etc/kbs/certs" if not specified by the user
                           type: string
                         secretName:
                           description: SecretName is the name of the secret that maps
                             to a local directory containing the certificates
                           type: string
                       required:
-                      - mountPath
                       - secretName
                       type: object
                     type: array

docs/disconnected.md

@@ -38,6 +38,7 @@ spec:
 ```
 
 The `VCEK.crt` certificate will be mounted in the trustee `mountPath` directory.
+The `mountPath` directory defaults to `/etc/kbs/certs` if not provided by the user.
 
 ### Multiple Certificates
 
@@ -54,12 +55,12 @@ spec:
   # ...
   kbsLocalCertCacheSpec:
     secrets:
-    - secretName: vcek-secret
-      mountPath: "/etc/kbs/snp/ek"
-    - secretName: ca-certs-secret
-      mountPath: "/etc/ssl/certs"
-    - secretName: client-certs-secret
-      mountPath: "/etc/ssl/client-certs"
+    - secretName: vcek-milan
+      mountPath: "/etc/kbs/snp/ek/milan"
+    - secretName: vcek-genoa
+      mountPath: "/etc/kbs/snp/ek/genoa"
+    - secretName: vcek-turin
+      mountPath: "/etc/kbs/snp/ek/turin"
 ```
 
 Each secret will be mounted to its specified `mountPath` in the trustee file system.

internal/controller/common.go

@@ -76,6 +76,9 @@ const (
 
 	// default attestation policy filename for cpu
 	defaultAttestationCpuPolicy = "default_cpu.rego"
+
+	// default directory for locally cached certificates
+	kbsDefaultLocalCacheDir = "/etc/kbs/certs"
 )
 
 func contains(list []string, s string) bool {

internal/controller/kbsconfig_controller.go

@@ -427,6 +427,9 @@ func (r *KbsConfigReconciler) newKbsDeployment(ctx context.Context) (*appsv1.Dep
 			return nil, err
 		}
 		volumes = append(volumes, *volume)
+		if certCacheEntry.MountPath == "" {
+			certCacheEntry.MountPath = kbsDefaultLocalCacheDir
+		}
 		volumeMount = createVolumeMount(volume.Name, certCacheEntry.MountPath)
 		kbsVM = append(kbsVM, volumeMount)
 	}