Skip to content
This repository was archived by the owner on Jul 11, 2023. It is now read-only.

Commit d9fd7c0

Browse files
jaelliojaellio
committed
Add NewCertificateManagerFromMRC instead of modifying options
Signed-off-by: jaellio <[email protected]>
1 parent b38fe51 commit d9fd7c0

16 files changed

+166
-126
lines changed

‎charts/osm/README.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,6 @@ The following table lists the configurable parameters of the osm chart and their
8888
| osm.enableDebugServer | bool | `false` | Enable the debug HTTP server on OSM controller |
8989
| osm.enableEgress | bool | `true` | Enable egress in the mesh |
9090
| osm.enableFluentbit | bool | `false` | Enable Fluent Bit sidecar deployment on OSM controller's pod |
91-
| osm.enableMeshRootCertificate | bool | `false` | Enable the unsupported MeshRootCertificate. Support and functionality are not guaranteed. |
9291
| osm.enablePermissiveTrafficPolicy | bool | `true` | Enable permissive traffic policy mode |
9392
| osm.enablePrivilegedInitContainer | bool | `false` | Run init container in privileged mode |
9493
| osm.enableReconciler | bool | `false` | Enable reconciler for OSM's CRDs and mutating webhook |
@@ -266,6 +265,8 @@ The following table lists the configurable parameters of the osm chart and their
266265
| osm.tracing.port | int | `9411` | Port of the tracing collector service |
267266
| osm.tracing.tolerations | list | `[]` | Node tolerations applied to control plane pods. The specified tolerations allow pods to schedule onto nodes with matching taints. |
268267
| osm.trustDomain | string | `"cluster.local"` | The trust domain to use as part of the common name when requesting new certificates. |
268+
| osm.unsafe | object | `{"enableMeshRootCertificate":false}` | Unsafe values. Behavior is not supported. |
269+
| osm.unsafe.enableMeshRootCertificate | bool | `false` | Enable the MeshRootCertificate to configure the OSM certificate provider. |
269270
| osm.validatorWebhook.webhookConfigurationName | string | `""` | Name of the ValidatingWebhookConfiguration |
270271
| osm.vault.host | string | `""` | Hashicorp Vault host/service - where Vault is installed |
271272
| osm.vault.port | int | `8200` | port to use to connect to Vault |

‎charts/osm/templates/osm-bootstrap-deployment.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ spec:
6161
"--osm-version", "{{ .Chart.AppVersion }}",
6262
"--ca-bundle-secret-name", "{{.Values.osm.caBundleSecretName}}",
6363
"--certificate-manager", "{{.Values.osm.certificateProvider.kind}}",
64-
"--enable-mesh-root-certificate", "{{.Values.osm.enableMeshRootCertificate}}",
64+
"--enable-mesh-root-certificate", "{{.Values.osm.unsafe.enableMeshRootCertificate}}",
6565
{{ if eq .Values.osm.certificateProvider.kind "vault" }}
6666
"--vault-host", "{{.Values.osm.vault.host}}",
6767
"--vault-port", "{{.Values.osm.vault.port}}",

‎charts/osm/templates/osm-deployment.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ spec:
6161
"--validator-webhook-config", "{{ include "osm.validatorWebhookConfigName" . }}",
6262
"--ca-bundle-secret-name", "{{.Values.osm.caBundleSecretName}}",
6363
"--certificate-manager", "{{.Values.osm.certificateProvider.kind}}",
64-
"--enable-mesh-root-certificate", "{{.Values.osm.enableMeshRootCertificate}}",
64+
"--enable-mesh-root-certificate", "{{.Values.osm.unsafe.enableMeshRootCertificate}}",
6565
{{ if eq .Values.osm.certificateProvider.kind "vault" }}
6666
"--vault-host", "{{ required "osm.vault.host is required when osm.certificateProvider.kind==vault" .Values.osm.vault.host }}",
6767
"--vault-port", "{{.Values.osm.vault.port}}",

‎charts/osm/templates/osm-injector-deployment.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ spec:
5858
"--webhook-timeout", "{{.Values.osm.injector.webhookTimeoutSeconds}}",
5959
"--ca-bundle-secret-name", "{{.Values.osm.caBundleSecretName}}",
6060
"--certificate-manager", "{{.Values.osm.certificateProvider.kind}}",
61-
"--enable-mesh-root-certificate", "{{.Values.osm.enableMeshRootCertificate}}",
61+
"--enable-mesh-root-certificate", "{{.Values.osm.unsafe.enableMeshRootCertificate}}",
6262
{{ if eq .Values.osm.certificateProvider.kind "vault" }}
6363
"--vault-host", "{{.Values.osm.vault.host}}",
6464
"--vault-port", "{{.Values.osm.vault.port}}",

‎charts/osm/templates/preset-mesh-config.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.osm.enableMeshRootCertificate }}
1+
{{- if .Values.osm.unsafe.enableMeshRootCertificate }}
22
apiVersion: v1
33
kind: ConfigMap
44
metadata:

‎charts/osm/values.schema.json

+14-5
Original file line numberDiff line numberDiff line change
@@ -438,11 +438,20 @@
438438
"envoyproxy/envoy-windows:v1.22.1@sha256:92733f8e5beae5c45df204a0e13edbd29e99adf962d1b1c7869b197d85c64bd0"
439439
]
440440
},
441-
"enableMeshRootCertificate": {
442-
"$id": "#/properties/osm/properties/enableMeshRootCertificate",
443-
"type": "boolean",
444-
"title": "Enable the unsupported MeshRootCertificate",
445-
"description": "Using the MeshRootCertificate to configure the OSM certificate provider is not supported on "
441+
"unsafe": {
442+
"$id": "#/properties/osm/properties/unsafe",
443+
"type": "object",
444+
"title": "The unsafe schema",
445+
"description": "Parameters that are unsupported by OSM",
446+
"additionalProperties": false,
447+
"properties": {
448+
"enableMeshRootCertificate": {
449+
"$id": "#/properties/osm/properties/enableMeshRootCertificate",
450+
"type": "boolean",
451+
"title": "Enable the MeshRootCertificate",
452+
"description": "Using the MeshRootCertificate to configure the OSM certificate provider is not supported on "
453+
}
454+
}
446455
},
447456
"trustDomain": {
448457
"$id": "#/properties/osm/properties/trustDomain",

‎charts/osm/values.yaml

+6-4
Original file line numberDiff line numberDiff line change
@@ -167,8 +167,10 @@ osm:
167167
# The specified tolerations allow pods to schedule onto nodes with matching taints.
168168
tolerations: []
169169

170-
# -- Enable the unsupported MeshRootCertificate. Support and functionality are not guaranteed.
171-
enableMeshRootCertificate: false
170+
# -- Unsafe values. Behavior is not supported.
171+
unsafe:
172+
# -- Enable the MeshRootCertificate to configure the OSM certificate provider.
173+
enableMeshRootCertificate: false
172174

173175
# -- The trust domain to use as part of the common name when requesting new certificates.
174176
trustDomain: cluster.local
@@ -551,7 +553,7 @@ osm:
551553

552554
#
553555
# -- OSM's preinstall hook parameters
554-
556+
555557
preinstall:
556558
## Affinity settings for pod assignment
557559
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
@@ -584,7 +586,7 @@ osm:
584586

585587
## Affinity settings for pod assignment
586588
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
587-
affinity:
589+
affinity:
588590
nodeAffinity:
589591
requiredDuringSchedulingIgnoredDuringExecution:
590592
nodeSelectorTerms:

‎cmd/cli/install_test.go

-8
Original file line numberDiff line numberDiff line change
@@ -290,14 +290,6 @@ var _ = Describe("Running the install command", func() {
290290
err := installCmd.run(config)
291291
Expect(err.Error()).To(ContainSubstring("osm.vault.host is required"))
292292
})
293-
294-
It("should error when token isn't set", func() {
295-
installCmd.setOptions = append(installCmd.setOptions,
296-
"osm.vault.host=my-host",
297-
)
298-
err := installCmd.run(config)
299-
Expect(err.Error()).To(ContainSubstring("osm.vault.token is required"))
300-
})
301293
})
302294

303295
Describe("with the cert-manager certificate manager", func() {

‎cmd/osm-bootstrap/osm-bootstrap.go

+19-12
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
"k8s.io/kubectl/pkg/util"
2929

3030
configv1alpha2 "github.com/openservicemesh/osm/pkg/apis/config/v1alpha2"
31+
"github.com/openservicemesh/osm/pkg/certificate"
3132
configClientset "github.com/openservicemesh/osm/pkg/gen/client/config/clientset/versioned"
3233
"github.com/openservicemesh/osm/pkg/health"
3334

@@ -120,19 +121,16 @@ func init() {
120121
}
121122

122123
// TODO(#4502): This function can be deleted once we get rid of cert options.
123-
func getCertOptions() (*providers.CertProviderOptions, error) {
124-
certOptions := &providers.CertProviderOptions{UseMeshRootCertificate: enableMeshRootCertificate}
124+
func getCertOptions() (providers.Options, error) {
125125
switch providers.Kind(certProviderKind) {
126126
case providers.TresorKind:
127127
tresorOptions.SecretName = caBundleSecretName
128-
certOptions.Option = tresorOptions
129-
return certOptions, nil
128+
return tresorOptions, nil
130129
case providers.VaultKind:
131-
certOptions.Option = vaultOptions
132-
return certOptions, nil
130+
vaultOptions.VaultTokenSecretNamespace = osmNamespace
131+
return vaultOptions, nil
133132
case providers.CertManagerKind:
134-
certOptions.Option = certManagerOptions
135-
return certOptions, nil
133+
return certManagerOptions, nil
136134
}
137135
return nil, fmt.Errorf("unknown certificate provider kind: %s", certProviderKind)
138136
}
@@ -224,10 +222,19 @@ func main() {
224222
log.Fatal().Err(err).Msg("Error getting certificate options")
225223
}
226224

227-
certManager, err := providers.NewCertificateManager(ctx, kubeClient, kubeConfig, cfg, osmNamespace, certOpts, msgBroker, informerCollection, 5*time.Second)
228-
if err != nil {
229-
events.GenericEventRecorder().FatalEvent(err, events.InvalidCertificateManager,
230-
"Error initializing certificate manager of kind %s", certProviderKind)
225+
var certManager *certificate.Manager
226+
if enableMeshRootCertificate {
227+
certManager, err = providers.NewCertificateManagerFromMRC(ctx, kubeClient, kubeConfig, cfg, osmNamespace, certOpts, msgBroker, informerCollection, 5*time.Second)
228+
if err != nil {
229+
events.GenericEventRecorder().FatalEvent(err, events.InvalidCertificateManager,
230+
"Error initializing certificate manager of kind %s from MRC", certProviderKind)
231+
}
232+
} else {
233+
certManager, err = providers.NewCertificateManager(ctx, kubeClient, kubeConfig, cfg, osmNamespace, certOpts, msgBroker, informerCollection, 5*time.Second)
234+
if err != nil {
235+
events.GenericEventRecorder().FatalEvent(err, events.InvalidCertificateManager,
236+
"Error initializing certificate manager of kind %s", certProviderKind)
237+
}
231238
}
232239

233240
// Initialize the crd conversion webhook server to support the conversion of OSM's CRDs

‎cmd/osm-controller/osm-controller.go

+20-14
Original file line numberDiff line numberDiff line change
@@ -129,19 +129,16 @@ func init() {
129129
}
130130

131131
// TODO(#4502): This function can be deleted once we get rid of cert options.
132-
func getCertOptions() (*providers.CertProviderOptions, error) {
133-
certOptions := &providers.CertProviderOptions{UseMeshRootCertificate: enableMeshRootCertificate}
132+
func getCertOptions() (providers.Options, error) {
134133
switch providers.Kind(certProviderKind) {
135134
case providers.TresorKind:
136135
tresorOptions.SecretName = caBundleSecretName
137-
certOptions.Option = tresorOptions
138-
return certOptions, nil
136+
return tresorOptions, nil
139137
case providers.VaultKind:
140-
certOptions.Option = vaultOptions
141-
return certOptions, nil
138+
vaultOptions.VaultTokenSecretNamespace = osmNamespace
139+
return vaultOptions, nil
142140
case providers.CertManagerKind:
143-
certOptions.Option = certManagerOptions
144-
return certOptions, nil
141+
return certManagerOptions, nil
145142
}
146143
return nil, fmt.Errorf("unknown certificate provider kind: %s", certProviderKind)
147144
}
@@ -215,12 +212,21 @@ func main() {
215212
}
216213

217214
// Intitialize certificate manager/provider
218-
certManager, err := providers.NewCertificateManager(ctx, kubeClient, kubeConfig, cfg, osmNamespace,
219-
certOpts, msgBroker, informerCollection, 5*time.Second)
220-
221-
if err != nil {
222-
events.GenericEventRecorder().FatalEvent(err, events.InvalidCertificateManager,
223-
"Error fetching certificate manager of kind %s", certProviderKind)
215+
var certManager *certificate.Manager
216+
if enableMeshRootCertificate {
217+
certManager, err = providers.NewCertificateManagerFromMRC(ctx, kubeClient, kubeConfig, cfg, osmNamespace,
218+
certOpts, msgBroker, informerCollection, 5*time.Second)
219+
if err != nil {
220+
events.GenericEventRecorder().FatalEvent(err, events.InvalidCertificateManager,
221+
"Error fetching certificate manager of kind %s from MRC", certProviderKind)
222+
}
223+
} else {
224+
certManager, err = providers.NewCertificateManager(ctx, kubeClient, kubeConfig, cfg, osmNamespace,
225+
certOpts, msgBroker, informerCollection, 5*time.Second)
226+
if err != nil {
227+
events.GenericEventRecorder().FatalEvent(err, events.InvalidCertificateManager,
228+
"Error fetching certificate manager of kind %s", certProviderKind)
229+
}
224230
}
225231

226232
kubeProvider := kube.NewClient(k8sClient, cfg)

‎cmd/osm-injector/osm-injector.go

+21-13
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
_ "k8s.io/client-go/plugin/pkg/client/auth/gcp"
2626
"k8s.io/client-go/tools/clientcmd"
2727

28+
"github.com/openservicemesh/osm/pkg/certificate"
2829
configClientset "github.com/openservicemesh/osm/pkg/gen/client/config/clientset/versioned"
2930
policyClientset "github.com/openservicemesh/osm/pkg/gen/client/policy/clientset/versioned"
3031
"github.com/openservicemesh/osm/pkg/health"
@@ -115,19 +116,16 @@ func init() {
115116
}
116117

117118
// TODO(#4502): This function can be deleted once we get rid of cert options.
118-
func getCertOptions() (*providers.CertProviderOptions, error) {
119-
certOptions := &providers.CertProviderOptions{UseMeshRootCertificate: enableMeshRootCertificate}
119+
func getCertOptions() (providers.Options, error) {
120120
switch providers.Kind(certProviderKind) {
121121
case providers.TresorKind:
122122
tresorOptions.SecretName = caBundleSecretName
123-
certOptions.Option = tresorOptions
124-
return certOptions, nil
123+
return tresorOptions, nil
125124
case providers.VaultKind:
126-
certOptions.Option = vaultOptions
127-
return certOptions, nil
125+
vaultOptions.VaultTokenSecretNamespace = osmNamespace
126+
return vaultOptions, nil
128127
case providers.CertManagerKind:
129-
certOptions.Option = certManagerOptions
130-
return certOptions, nil
128+
return certManagerOptions, nil
131129
}
132130
return nil, fmt.Errorf("unknown certificate provider kind: %s", certProviderKind)
133131
}
@@ -208,11 +206,21 @@ func main() {
208206
log.Fatal().Err(err).Msg("Error getting certificate options")
209207
}
210208
// Intitialize certificate manager/provider
211-
certManager, err := providers.NewCertificateManager(ctx, kubeClient, kubeConfig, cfg, osmNamespace,
212-
certOpts, msgBroker, informerCollection, 5*time.Second)
213-
if err != nil {
214-
events.GenericEventRecorder().FatalEvent(err, events.InvalidCertificateManager,
215-
"Error initializing certificate manager of kind %s", certProviderKind)
209+
var certManager *certificate.Manager
210+
if enableMeshRootCertificate {
211+
certManager, err = providers.NewCertificateManagerFromMRC(ctx, kubeClient, kubeConfig, cfg, osmNamespace,
212+
certOpts, msgBroker, informerCollection, 5*time.Second)
213+
if err != nil {
214+
events.GenericEventRecorder().FatalEvent(err, events.InvalidCertificateManager,
215+
"Error initializing certificate manager of kind %s from MRC", certProviderKind)
216+
}
217+
} else {
218+
certManager, err = providers.NewCertificateManager(ctx, kubeClient, kubeConfig, cfg, osmNamespace,
219+
certOpts, msgBroker, informerCollection, 5*time.Second)
220+
if err != nil {
221+
events.GenericEventRecorder().FatalEvent(err, events.InvalidCertificateManager,
222+
"Error initializing certificate manager of kind %s", certProviderKind)
223+
}
216224
}
217225

218226
// Initialize the sidecar injector webhook

0 commit comments

Comments
 (0)