Skip to content

Commit c190962

Browse files
ruivieiraruivieira
authored
Merge pull request #18 from trustyai-explainability/main
[cherry-pick] PR #259 and PR #268
2 parents 78c54dc + 91ba2c5 commit c190962

File tree

5 files changed

+63
-20
lines changed

5 files changed

+63
-20
lines changed

‎controllers/deployment.go

+15
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ type DeploymentConfig struct {
3838
CustomCertificatesBundle CustomCertificatesBundle
3939
Version string
4040
BatchSize int
41+
UseDBTLSCerts bool
4142
}
4243

4344
// createDeploymentObject returns a Deployment for the TrustyAI Service instance
@@ -70,6 +71,20 @@ func (r *TrustyAIServiceReconciler) createDeploymentObject(ctx context.Context,
7071
BatchSize: batchSize,
7172
}
7273

74+
if instance.Spec.Storage.IsStorageDatabase() {
75+
_, err := r.getSecret(ctx, instance.Name+"-db-tls", instance.Namespace)
76+
if err != nil {
77+
deploymentConfig.UseDBTLSCerts = false
78+
log.FromContext(ctx).Error(err, "Using insecure database connection. Certificates "+instance.Name+"-db-tls not found")
79+
} else {
80+
deploymentConfig.UseDBTLSCerts = true
81+
log.FromContext(ctx).Info("Using secure database connection with certificates " + instance.Name + "-db-tls")
82+
}
83+
} else {
84+
deploymentConfig.UseDBTLSCerts = false
85+
log.FromContext(ctx).Info("No need to check database secrets. Using PVC-mode.")
86+
}
87+
7388
var deployment *appsv1.Deployment
7489
deployment, err = templateParser.ParseResource[appsv1.Deployment](deploymentTemplatePath, deploymentConfig, reflect.TypeOf(&appsv1.Deployment{}))
7590
if err != nil {

‎controllers/inference_services.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ func (r *TrustyAIServiceReconciler) patchEnvVarsByLabelForDeployments(ctx contex
147147
}
148148

149149
// Build the payload processor endpoint
150-
url := generateServiceURL(crName, namespace) + "/consumer/kserve/v2"
150+
url := generateTLSServiceURL(crName, namespace) + "/consumer/kserve/v2"
151151

152152
// Patch environment variables for the Deployments
153153
if shouldContinue, err := r.patchEnvVarsForDeployments(ctx, instance, deployments, envVarName, url, remove); err != nil {
@@ -240,7 +240,7 @@ func (r *TrustyAIServiceReconciler) handleInferenceServices(ctx context.Context,
240240
// patchKServe adds a TrustyAI service as an InferenceLogger to a KServe InferenceService
241241
func (r *TrustyAIServiceReconciler) patchKServe(ctx context.Context, instance *trustyaiopendatahubiov1alpha1.TrustyAIService, infService kservev1beta1.InferenceService, namespace string, crName string, remove bool) error {
242242

243-
url := generateServiceURL(crName, namespace)
243+
url := generateNonTLSServiceURL(crName, namespace)
244244

245245
if remove {
246246
if infService.Spec.Predictor.Logger == nil || *infService.Spec.Predictor.Logger.URL != url {

‎controllers/secrets.go

+23-15
Original file line numberDiff line numberDiff line change
@@ -9,34 +9,42 @@ import (
99
"sigs.k8s.io/controller-runtime/pkg/client"
1010
)
1111

12+
// getSecret retrieves a secret if it exists, returns an error if not
13+
func (r *TrustyAIServiceReconciler) getSecret(ctx context.Context, name, namespace string) (*corev1.Secret, error) {
14+
secret := &corev1.Secret{}
15+
err := r.Get(ctx, client.ObjectKey{Name: name, Namespace: namespace}, secret)
16+
if err != nil {
17+
if errors.IsNotFound(err) {
18+
return nil, fmt.Errorf("secret %s not found in namespace %s: %w", name, namespace, err)
19+
}
20+
return nil, fmt.Errorf("failed to get secret %s in namespace %s: %w", name, namespace, err)
21+
}
22+
return secret, nil
23+
}
24+
1225
// findDatabaseSecret finds the DB configuration secret named (specified or default) in the same namespace as the CR
1326
func (r *TrustyAIServiceReconciler) findDatabaseSecret(ctx context.Context, instance *trustyaiopendatahubiov1alpha1.TrustyAIService) (*corev1.Secret, error) {
1427

1528
databaseConfigurationsName := instance.Spec.Storage.DatabaseConfigurations
1629
defaultDatabaseConfigurationsName := instance.Name + dbCredentialsSuffix
1730

18-
secret := &corev1.Secret{}
19-
2031
if databaseConfigurationsName != "" {
21-
secret := &corev1.Secret{}
22-
err := r.Get(ctx, client.ObjectKey{Name: databaseConfigurationsName, Namespace: instance.Namespace}, secret)
23-
if err == nil {
24-
return secret, nil
32+
secret, err := r.getSecret(ctx, databaseConfigurationsName, instance.Namespace)
33+
if err != nil {
34+
return nil, err
2535
}
26-
if !errors.IsNotFound(err) {
27-
return nil, fmt.Errorf("failed to get secret %s in namespace %s: %w", databaseConfigurationsName, instance.Namespace, err)
36+
if secret != nil {
37+
return secret, nil
2838
}
2939
} else {
3040
// If specified not found, try the default
31-
32-
err := r.Get(ctx, client.ObjectKey{Name: defaultDatabaseConfigurationsName, Namespace: instance.Namespace}, secret)
33-
if err == nil {
34-
return secret, nil
41+
secret, err := r.getSecret(ctx, defaultDatabaseConfigurationsName, instance.Namespace)
42+
if err != nil {
43+
return nil, err
3544
}
36-
if !errors.IsNotFound(err) {
37-
return nil, fmt.Errorf("failed to get secret %s in namespace %s: %w", defaultDatabaseConfigurationsName, instance.Namespace, err)
45+
if secret != nil {
46+
return secret, nil
3847
}
39-
4048
}
4149

4250
return nil, fmt.Errorf("neither secret %s nor %s found in namespace %s", databaseConfigurationsName, defaultDatabaseConfigurationsName, instance.Namespace)

‎controllers/templates/service/deployment.tmpl.yaml

+16-1
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,11 @@ spec:
9494
name: {{ .Instance.Spec.Storage.DatabaseConfigurations }}
9595
key: databasePort
9696
- name: QUARKUS_DATASOURCE_JDBC_URL
97+
{{ if .UseDBTLSCerts }}
98+
value: "jdbc:${QUARKUS_DATASOURCE_DB_KIND}://${DATABASE_SERVICE}:${DATABASE_PORT}/trustyai_database?sslMode=verify-ca&serverSslCert=/etc/tls/db/tls.crt"
99+
{{ else }}
97100
value: "jdbc:${QUARKUS_DATASOURCE_DB_KIND}://${DATABASE_SERVICE}:${DATABASE_PORT}/trustyai_database"
101+
{{ end }}
98102
- name: SERVICE_DATA_FORMAT
99103
value: "HIBERNATE"
100104
- name: QUARKUS_DATASOURCE_GENERATION
@@ -121,7 +125,12 @@ spec:
121125
- name: {{ .VolumeMountName }}
122126
mountPath: {{ .Instance.Spec.Storage.Folder }}
123127
readOnly: false
124-
{{ end }}
128+
{{ end }}
129+
{{ if .UseDBTLSCerts }}
130+
- name: db-tls-certs
131+
mountPath: /etc/tls/db
132+
readOnly: true
133+
{{ end }}
125134
- resources:
126135
limits:
127136
cpu: 100m
@@ -209,3 +218,9 @@ spec:
209218
secret:
210219
secretName: {{ .Instance.Name }}-internal
211220
defaultMode: 420
221+
{{ if .UseDBTLSCerts }}
222+
- name: db-tls-certs
223+
secret:
224+
secretName: {{ .Instance.Name }}-db-tls
225+
defaultMode: 420
226+
{{ end }}

‎controllers/utils.go

+7-2
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,12 @@ func (r *TrustyAIServiceReconciler) GetDeploymentsByLabel(ctx context.Context, n
6262
return deployments.Items, nil
6363
}
6464

65-
// generateServiceURL generates an internal URL for a TrustyAI service
66-
func generateServiceURL(crName string, namespace string) string {
65+
// generateTLSServiceURL generates an internal URL for a TLS-enabled TrustyAI service
66+
func generateTLSServiceURL(crName string, namespace string) string {
67+
return "https://" + crName + "." + namespace + ".svc"
68+
}
69+
70+
// generateNonTLSServiceURL generates an internal URL for a TrustyAI service
71+
func generateNonTLSServiceURL(crName string, namespace string) string {
6772
return "http://" + crName + "." + namespace + ".svc"
6873
}

0 commit comments

Comments
 (0)