Skip to content

Commit 4df07c1

Browse files
pjuarezdpjuarezd
authored
Reload certificates in operator-ca-tls secrets (#2133)
* Listen for secret changes in the operator namespace and trust TLS certificates stored in secrets with the prefix "operator-ca-tls." * No longer copy the secret `operator-ca-tls` from the operator namespace to the tenants namespace: Since [PR #1847](#1847), the secret `operator-ca-tls` is no longer mounted in the tenant, so there is no need to keep a copy. * `queue.NewNamedRateLimitingQueue` is deprecated and has been replaced with the recommended `queue.NewRateLimitingQueueWithConfig`. * Remove the duplicated method `getTLSSecret` and invoke `getCertificateSecret` instead. * Rename [generateTLSCert](https://github.com/minio/operator/blob/1c2fa4f402cc2c91c9903e6da6e9a693c92b65e4/pkg/controller/tls.go#L108) to `generateTLSCertificateForService` for better understanding. * Remove duplicated constants for 'public.crt', 'tls.crt', and 'ca.crt' in the `github.com/minio/operator/pkg/common` namespace. * Replace hardcoded strings 'public.crt', 'tls.crt', and 'ca.crt' with constants in the `github.com/minio/operator/pkg/certs` namespace. Signed-off-by: pjuarezd <[email protected]> --------- Signed-off-by: pjuarezd <[email protected]>
1 parent fdb7232 commit 4df07c1

File tree

17 files changed

+322
-309
lines changed

17 files changed

+322
-309
lines changed

‎pkg/apis/minio.min.io/v2/helper.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ import (
3737
"text/template"
3838
"time"
3939

40+
"github.com/minio/operator/pkg/certs"
41+
4042
"github.com/miekg/dns"
4143

4244
appsv1 "k8s.io/api/apps/v1"
@@ -102,7 +104,7 @@ var (
102104
// GetPodCAFromFile assumes the operator is running inside a k8s pod and extract the
103105
// current ca certificate from /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
104106
func GetPodCAFromFile() []byte {
105-
cert, err := os.ReadFile("/var/run/secrets/kubernetes.io/serviceaccount/ca.crt")
107+
cert, err := os.ReadFile(fmt.Sprintf("/var/run/secrets/kubernetes.io/serviceaccount/%s", certs.CAPublicCertFile))
106108
if err != nil {
107109
return nil
108110
}
@@ -120,7 +122,7 @@ func GetOpenshiftServiceCAFromFile() []byte {
120122

121123
// GetOpenshiftCSRSignerCAFromFile extracts the tls.crt certificate in Openshift deployments coming from the mounted secret openshift-csr-signer-ca
122124
func GetOpenshiftCSRSignerCAFromFile() []byte {
123-
cert, err := os.ReadFile("/tmp/csr-signer-ca/tls.crt")
125+
cert, err := os.ReadFile(fmt.Sprintf("/tmp/csr-signer-ca/%s", certs.TLSCertFile))
124126
if err != nil {
125127
return nil
126128
}
@@ -129,13 +131,13 @@ func GetOpenshiftCSRSignerCAFromFile() []byte {
129131

130132
// GetPublicCertFilePath return the path to the certificate file based for the serviceName
131133
func GetPublicCertFilePath(serviceName string) string {
132-
publicCertPath := fmt.Sprintf("/tmp/%s/public.crt", serviceName)
134+
publicCertPath := fmt.Sprintf("/tmp/%s/%s", serviceName, certs.PublicCertFile)
133135
return publicCertPath
134136
}
135137

136138
// GetPrivateKeyFilePath return the path to the key file based for the serviceName
137139
func GetPrivateKeyFilePath(serviceName string) string {
138-
privateKey := fmt.Sprintf("/tmp/%s/private.key", serviceName)
140+
privateKey := fmt.Sprintf("/tmp/%s/%s", serviceName, certs.PrivateKeyFile)
139141
return privateKey
140142
}
141143

‎pkg/certs/const.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,9 @@ const (
3535
// PrivateKeyFile Private key file for HTTPS.
3636
PrivateKeyFile = "private.key"
3737

38+
// CAPublicCertFile Public certificate file for Certificate authority.
39+
CAPublicCertFile = "ca.crt"
40+
3841
// TLSKeyFile Private key file for HTTPS.
3942
TLSKeyFile = "tls.key"
4043
)

‎pkg/common/const.go

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -36,15 +36,6 @@ const (
3636
OperatorRuntimeOpenshift Runtime = "OPENSHIFT"
3737
// OperatorRuntimeRancher is the Rancher runtime flag
3838
OperatorRuntimeRancher Runtime = "RANCHER"
39-
40-
// TLSCRT is name of the field containing tls certificate in secret
41-
TLSCRT = "tls.crt"
42-
43-
// CACRT name of the field containing ca certificate in secret
44-
CACRT = "ca.crt"
45-
46-
// PublicCRT name of the field containing public certificate in secret
47-
PublicCRT = "public.crt"
4839
)
4940

5041
// Runtimes is a map of the supported Kubernetes runtimes

‎pkg/controller/console.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,12 +100,12 @@ func (c *Controller) checkConsoleSvc(ctx context.Context, tenant *miniov2.Tenant
100100

101101
// generateConsoleTLSCert Issues the Operator Console TLS Certificate
102102
func (c *Controller) generateConsoleTLSCert() (*string, *string) {
103-
return c.generateTLSCert("console", OperatorConsoleTLSSecretName, getConsoleDeploymentName())
103+
return c.generateTLSCertificateForService("console", OperatorConsoleTLSSecretName, getConsoleDeploymentName())
104104
}
105105

106106
func (c *Controller) recreateOperatorConsoleCertsIfRequired(ctx context.Context) error {
107107
namespace := miniov2.GetNSFromFile()
108-
operatorConsoleTLSSecret, err := c.getTLSSecret(ctx, namespace, OperatorConsoleTLSSecretName)
108+
operatorConsoleTLSSecret, err := c.getCertificateSecret(ctx, namespace, OperatorConsoleTLSSecretName)
109109
if err != nil {
110110
if k8serrors.IsNotFound(err) {
111111
klog.V(2).Info("TLS certificate not found. Generating one.")

‎pkg/controller/controller.go

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -148,6 +148,7 @@ func StartOperator(kubeconfig string) {
148148
klog.Infof("Watching only namespaces: %s", strings.Join(namespaces.ToSlice(), ","))
149149
}
150150

151+
kubeInformerFactoryInOperatorNamespace := kubeinformers.NewSharedInformerFactoryWithOptions(kubeClient, time.Hour*1, kubeinformers.WithNamespace(v2.GetNSFromFile()))
151152
kubeInformerFactory := kubeinformers.NewSharedInformerFactory(kubeClient, time.Second*30)
152153
minioInformerFactory := informers.NewSharedInformerFactory(controllerClient, time.Second*30)
153154
podName := os.Getenv(HostnameEnv)
@@ -163,20 +164,18 @@ func StartOperator(kubeconfig string) {
163164
k8sClient,
164165
controllerClient,
165166
promClient,
166-
kubeInformerFactory.Apps().V1().StatefulSets(),
167-
kubeInformerFactory.Apps().V1().Deployments(),
168-
kubeInformerFactory.Core().V1().Pods(),
169-
minioInformerFactory.Minio().V2().Tenants(),
170-
minioInformerFactory.Sts().V1beta1().PolicyBindings(),
171-
kubeInformerFactory.Core().V1().Services(),
172167
hostsTemplate,
173168
pkg.Version,
169+
kubeInformerFactory,
170+
minioInformerFactory.Minio().V2().Tenants(),
171+
minioInformerFactory.Sts().V1beta1().PolicyBindings(),
174172
minioInformerFactory.Job().V1alpha1().MinIOJobs(),
175-
kubeInformerFactory.Batch().V1().Jobs(),
173+
kubeInformerFactoryInOperatorNamespace,
176174
)
177175

178176
go kubeInformerFactory.Start(stopCh)
179177
go minioInformerFactory.Start(stopCh)
178+
go kubeInformerFactoryInOperatorNamespace.Start(stopCh)
180179

181180
if err = mainController.Start(2, stopCh); err != nil {
182181
klog.Fatalf("Error running mainController: %s", err.Error())

‎pkg/controller/csr.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@ import (
2929
"syscall"
3030
"time"
3131

32+
"github.com/minio/operator/pkg/certs"
33+
3234
"github.com/minio/operator/pkg/controller/certificates"
3335

3436
certificatesV1 "k8s.io/api/certificates/v1"
@@ -257,8 +259,8 @@ func (c *Controller) createSecret(ctx context.Context, tenant *miniov2.Tenant, l
257259
},
258260
},
259261
Data: map[string][]byte{
260-
"private.key": pkBytes,
261-
"public.crt": certBytes,
262+
certs.PrivateKeyFile: pkBytes,
263+
certs.PublicCertFile: certBytes,
262264
},
263265
}
264266
_, err := c.kubeClientSet.CoreV1().Secrets(tenant.Namespace).Create(ctx, secret, metav1.CreateOptions{})

‎pkg/controller/custom.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,17 @@ import (
2424
"math"
2525
"time"
2626

27+
"github.com/minio/operator/pkg/certs"
28+
2729
miniov2 "github.com/minio/operator/pkg/apis/minio.min.io/v2"
2830
corev1 "k8s.io/api/core/v1"
2931
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3032
)
3133

3234
var secretTypePublicKeyNameMap = map[string]string{
33-
"kubernetes.io/tls": "tls.crt",
34-
"cert-manager.io/v1": "tls.crt",
35-
"cert-manager.io/v1alpha2": "tls.crt",
35+
"kubernetes.io/tls": certs.TLSCertFile,
36+
"cert-manager.io/v1": certs.TLSCertFile,
37+
"cert-manager.io/v1alpha2": certs.TLSCertFile,
3638
// Add newer secretTypes and their corresponding values in future
3739
}
3840

@@ -51,7 +53,7 @@ func (c *Controller) getCustomCertificates(ctx context.Context, tenant *miniov2.
5153

5254
for certType, secrets := range secretsMap {
5355
certificates = nil
54-
publicKey := "public.crt"
56+
publicKey := certs.PublicCertFile
5557
// Iterate over TLS secrets and build array of CertificateInfo structure
5658
// that will be used to display information about certs
5759
for _, secret := range secrets {

‎pkg/controller/kes.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ import (
2626
"errors"
2727
"fmt"
2828

29+
"github.com/minio/operator/pkg/certs"
30+
2931
"github.com/minio/operator/pkg/controller/certificates"
3032

3133
corev1 "k8s.io/api/core/v1"
@@ -326,9 +328,9 @@ func (c *Controller) getCertIdentity(ns string, cert *miniov2.LocalCertificateRe
326328
}
327329
// Store the Identity to be used later during KES container creation
328330
if secret.Type == "kubernetes.io/tls" || secret.Type == "cert-manager.io/v1alpha2" || secret.Type == "cert-manager.io/v1" {
329-
certbytes = secret.Data["tls.crt"]
331+
certbytes = secret.Data[certs.TLSCertFile]
330332
} else {
331-
certbytes = secret.Data["public.crt"]
333+
certbytes = secret.Data[certs.PublicCertFile]
332334
}
333335

334336
// parse the certificate here to generate the identity for this certifcate.

0 commit comments

Comments
 (0)