Skip to content

Fix association with custom cert without CA #5314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thbkrkr merged 5 commits into from
Feb 16, 2022
Merged

Fix association with custom cert without CA #5314

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8fb1935
Setup CA config setting if `GetCACertProvided` instead of `CAIsConfig…
thbkrkr Feb 9, 2022
eb11a77
Setup FleetCA env var for Agent only if `GetCACertProvided`
thbkrkr Feb 9, 2022
60c480a
Update `WriteAssocsToConfigHash` to use `GetCACertProvided` instead o…
thbkrkr Feb 9, 2022
695ad4c
Reuse `WriteAssocsToConfigHash` for APM|ENT|EMS->x associations
thbkrkr Feb 9, 2022
83155d9
Merge remote-tracking branch 'upstream/main' into fix-assoc-with-cust…
thbkrkr Feb 16, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Reuse WriteAssocsToConfigHash for APM|ENT|EMS->x associations
  • Loading branch information
@thbkrkr
thbkrkr committed Feb 9, 2022
commit 695ad4cd7fbaca5f854f49fd7bf2e445ef59afb8
24 changes: 9 additions & 15 deletions pkg/controller/apmserver/deployment.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ import (
"k8s.io/apimachinery/pkg/types"

apmv1 "github.com/elastic/cloud-on-k8s/pkg/apis/apm/v1"
"github.com/elastic/cloud-on-k8s/pkg/controller/common/association"
"github.com/elastic/cloud-on-k8s/pkg/controller/common/certificates"
"github.com/elastic/cloud-on-k8s/pkg/controller/common/deployment"
"github.com/elastic/cloud-on-k8s/pkg/controller/common/keystore"
Expand Down Expand Up @@ -100,23 +101,16 @@ func (r *ReconcileApmServer) deploymentParams(
_, _ = configChecksum.Write([]byte(params.keystoreResources.Version))
}

for _, association := range as.GetAssociations() {
if association.AssociationConf().CAIsConfigured() {
caSecretName := association.AssociationConf().GetCASecretName()

var publicCASecret corev1.Secret
key := types.NamespacedName{Namespace: as.Namespace, Name: caSecretName}
if err := r.Get(context.Background(), key, &publicCASecret); err != nil {
return deployment.Params{}, err
}
if certPem, ok := publicCASecret.Data[certificates.CertFileName]; ok {
_, _ = configChecksum.Write(certPem)
}
if err := association.WriteAssocsToConfigHash(r.Client, as.GetAssociations(), configChecksum); err != nil {
return deployment.Params{}, err
}

for _, assoc := range as.GetAssociations() {
if assoc.AssociationConf().CAIsConfigured() {
caVolume := volume.NewSecretVolumeWithMountPath(
caSecretName,
fmt.Sprintf("%s-certs", association.AssociationType()),
filepath.Join(ApmBaseDir, certificatesDir(association.AssociationType())),
assoc.AssociationConf().GetCASecretName(),
fmt.Sprintf("%s-certs", assoc.AssociationType()),
filepath.Join(ApmBaseDir, certificatesDir(assoc.AssociationType())),
)
podSpec.Spec.Volumes = append(podSpec.Spec.Volumes, caVolume.Volume())

Expand Down
15 changes: 9 additions & 6 deletions pkg/controller/apmserver/deployment_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -262,7 +262,8 @@ func TestReconcileApmServer_deploymentParams(t *testing.T) {
name: "associated Elasticsearch CA influences checksum and volumes",
args: args{
as: withAssociations(apmFixture.DeepCopy(), &commonv1.AssociationConf{
CASecretName: "es-ca",
CACertProvided: true,
CASecretName: "es-ca",
}, nil),
podSpecParams: defaultPodSpecParams,
initialObjects: []runtime.Object{
Expand All @@ -276,7 +277,7 @@ func TestReconcileApmServer_deploymentParams(t *testing.T) {
Name: "es-ca",
},
Data: map[string][]byte{
certificates.CertFileName: []byte("es-ca-cert"),
certificates.CAFileName: []byte("es-ca-cert"),
},
},
},
Expand Down Expand Up @@ -304,10 +305,12 @@ func TestReconcileApmServer_deploymentParams(t *testing.T) {
args: args{
as: withAssociations(apmFixture.DeepCopy(),
&commonv1.AssociationConf{
CASecretName: "es-ca",
CACertProvided: true,
CASecretName: "es-ca",
},
&commonv1.AssociationConf{
CASecretName: "kb-ca",
CACertProvided: true,
CASecretName: "kb-ca",
}),
podSpecParams: defaultPodSpecParams,
initialObjects: []runtime.Object{
Expand All @@ -321,15 +324,15 @@ func TestReconcileApmServer_deploymentParams(t *testing.T) {
Name: "es-ca",
},
Data: map[string][]byte{
certificates.CertFileName: []byte("es-ca-cert"),
certificates.CAFileName: []byte("es-ca-cert"),
},
},
&corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: "kb-ca",
},
Data: map[string][]byte{
certificates.CertFileName: []byte("kb-ca-cert"),
certificates.CAFileName: []byte("kb-ca-cert"),
},
},
},
Expand Down
14 changes: 4 additions & 10 deletions pkg/controller/enterprisesearch/enterprisesearch_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ import (
entv1 "github.com/elastic/cloud-on-k8s/pkg/apis/enterprisesearch/v1"
"github.com/elastic/cloud-on-k8s/pkg/controller/association"
"github.com/elastic/cloud-on-k8s/pkg/controller/common"
commonassociation "github.com/elastic/cloud-on-k8s/pkg/controller/common/association"
"github.com/elastic/cloud-on-k8s/pkg/controller/common/certificates"
"github.com/elastic/cloud-on-k8s/pkg/controller/common/defaults"
"github.com/elastic/cloud-on-k8s/pkg/controller/common/driver"
Expand Down Expand Up @@ -331,16 +332,9 @@ func buildConfigHash(c k8s.Client, ent entv1.EnterpriseSearch, configSecret core
}
}

// - in the Elasticsearch TLS certificates
if ent.AssociationConf().CAIsConfigured() {
var esPublicCASecret corev1.Secret
key := types.NamespacedName{Namespace: ent.Namespace, Name: ent.AssociationConf().GetCASecretName()}
if err := c.Get(context.Background(), key, &esPublicCASecret); err != nil {
return "", err
}
if certPem, ok := esPublicCASecret.Data[certificates.CAFileName]; ok {
_, _ = configHash.Write(certPem)
}
// - in the associated Elasticsearch TLS certificates
if err := commonassociation.WriteAssocsToConfigHash(c, ent.GetAssociations(), configHash); err != nil {
return "", err
}

return fmt.Sprint(configHash.Sum32()), nil
Expand Down
14 changes: 4 additions & 10 deletions pkg/controller/maps/controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ import (
emsv1alpha1 "github.com/elastic/cloud-on-k8s/pkg/apis/maps/v1alpha1"
"github.com/elastic/cloud-on-k8s/pkg/controller/association"
"github.com/elastic/cloud-on-k8s/pkg/controller/common"
commonassociation "github.com/elastic/cloud-on-k8s/pkg/controller/common/association"
"github.com/elastic/cloud-on-k8s/pkg/controller/common/certificates"
"github.com/elastic/cloud-on-k8s/pkg/controller/common/defaults"
"github.com/elastic/cloud-on-k8s/pkg/controller/common/deployment"
Expand Down Expand Up @@ -307,16 +308,9 @@ func buildConfigHash(c k8s.Client, ems emsv1alpha1.ElasticMapsServer, configSecr
}
}

// - in the Elasticsearch TLS certificates
if ems.AssociationConf().CAIsConfigured() {
var esPublicCASecret corev1.Secret
key := types.NamespacedName{Namespace: ems.Namespace, Name: ems.AssociationConf().GetCASecretName()}
if err := c.Get(context.Background(), key, &esPublicCASecret); err != nil {
return "", err
}
if certPem, ok := esPublicCASecret.Data[certificates.CAFileName]; ok {
_, _ = configHash.Write(certPem)
}
// - in the associated Elasticsearch TLS certificates
if err := commonassociation.WriteAssocsToConfigHash(c, ems.GetAssociations(), configHash); err != nil {
return "", err
}

return fmt.Sprint(configHash.Sum32()), nil
Expand Down
3 changes: 2 additions & 1 deletion pkg/controller/maps/controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,7 +347,8 @@ func Test_buildConfigHash(t *testing.T) {
ems: emsWithAssoc,
configSecret: cfgFixture,
},
wantErr: true,
want: "3032871734",
wantErr: false,
},
}
for _, tt := range tests {
Expand Down