Skip to content

Commit 4c797bc

Browse files
hawkowlhawkowl
committed
move over TLS applying, as well as some clienthelper work
1 parent 78feafb commit 4c797bc

File tree

5 files changed

+69
-62
lines changed

5 files changed

+69
-62
lines changed

‎pkg/cluster/apply.go

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
package cluster
2+
3+
// Copyright (c) Microsoft Corporation.
4+
// Licensed under the Apache License 2.0.
5+
6+
import (
7+
"context"
8+
"crypto/x509"
9+
"encoding/pem"
10+
11+
corev1 "k8s.io/api/core/v1"
12+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
13+
"k8s.io/apimachinery/pkg/types"
14+
15+
"github.com/Azure/ARO-RP/pkg/env"
16+
"github.com/Azure/ARO-RP/pkg/util/clienthelper"
17+
utilpem "github.com/Azure/ARO-RP/pkg/util/pem"
18+
)
19+
20+
func EnsureTLSSecretFromKeyvault(ctx context.Context, env env.Interface, ch clienthelper.Interface, target types.NamespacedName, certificateName string) error {
21+
bundle, err := env.ClusterKeyvault().GetSecret(ctx, certificateName)
22+
if err != nil {
23+
return err
24+
}
25+
26+
key, certs, err := utilpem.Parse([]byte(*bundle.Value))
27+
if err != nil {
28+
return err
29+
}
30+
31+
b, err := x509.MarshalPKCS8PrivateKey(key)
32+
if err != nil {
33+
return err
34+
}
35+
36+
var cb []byte
37+
for _, cert := range certs {
38+
cb = append(cb, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})...)
39+
}
40+
41+
secret := &corev1.Secret{
42+
ObjectMeta: metav1.ObjectMeta{
43+
Name: target.Name,
44+
Namespace: target.Namespace,
45+
},
46+
Data: map[string][]byte{
47+
corev1.TLSCertKey: cb,
48+
corev1.TLSPrivateKeyKey: pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: b}),
49+
},
50+
Type: corev1.SecretTypeTLS,
51+
}
52+
53+
return ch.Ensure(ctx, secret)
54+
}

‎pkg/cluster/cluster.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ import (
2323
extensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
2424
"k8s.io/client-go/dynamic"
2525
"k8s.io/client-go/kubernetes"
26-
"sigs.k8s.io/controller-runtime/pkg/client"
2726

2827
"github.com/Azure/ARO-RP/pkg/api"
2928
"github.com/Azure/ARO-RP/pkg/cluster/graph"
@@ -43,6 +42,7 @@ import (
4342
"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/network"
4443
"github.com/Azure/ARO-RP/pkg/util/azureclient/mgmt/privatedns"
4544
"github.com/Azure/ARO-RP/pkg/util/billing"
45+
"github.com/Azure/ARO-RP/pkg/util/clienthelper"
4646
"github.com/Azure/ARO-RP/pkg/util/dns"
4747
"github.com/Azure/ARO-RP/pkg/util/encryption"
4848
utilgraph "github.com/Azure/ARO-RP/pkg/util/graph"
@@ -105,7 +105,7 @@ type manager struct {
105105
graph graph.Manager
106106
rpBlob azblob.Manager
107107

108-
client client.Client
108+
ch clienthelper.Interface
109109
kubernetescli kubernetes.Interface
110110
dynamiccli dynamic.Interface
111111
extensionscli extensionsclient.Interface

‎pkg/cluster/install.go

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"github.com/Azure/ARO-RP/pkg/database"
2828
aroclient "github.com/Azure/ARO-RP/pkg/operator/clientset/versioned"
2929
"github.com/Azure/ARO-RP/pkg/operator/deploy"
30+
"github.com/Azure/ARO-RP/pkg/util/clienthelper"
3031
utilgenerics "github.com/Azure/ARO-RP/pkg/util/generics"
3132
"github.com/Azure/ARO-RP/pkg/util/restconfig"
3233
"github.com/Azure/ARO-RP/pkg/util/steps"
@@ -534,16 +535,18 @@ func (m *manager) initializeKubernetesClients(ctx context.Context) error {
534535
return err
535536
}
536537

537-
m.client, err = client.New(restConfig, client.Options{
538+
client, err := client.New(restConfig, client.Options{
538539
Mapper: mapper,
539540
})
541+
542+
m.ch = clienthelper.NewWithClient(m.log, client)
540543
return err
541544
}
542545

543546
// initializeKubernetesClients initializes clients which are used
544547
// once the cluster is up later on in the install process.
545548
func (m *manager) initializeOperatorDeployer(ctx context.Context) (err error) {
546-
m.aroOperatorDeployer, err = deploy.New(m.log, m.env, m.doc.OpenShiftCluster, m.arocli, m.client, m.extensionscli, m.kubernetescli, m.operatorcli)
549+
m.aroOperatorDeployer, err = deploy.New(m.log, m.env, m.doc.OpenShiftCluster, m.arocli, m.ch.Client(), m.extensionscli, m.kubernetescli, m.operatorcli)
547550
return
548551
}
549552

‎pkg/cluster/tls.go

Lines changed: 3 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,16 @@ package cluster
55

66
import (
77
"context"
8-
"crypto/x509"
9-
"encoding/pem"
108

119
configv1 "github.com/openshift/api/config/v1"
1210
corev1 "k8s.io/api/core/v1"
13-
kerrors "k8s.io/apimachinery/pkg/api/errors"
1411
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
15-
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
12+
"k8s.io/apimachinery/pkg/types"
1613
"k8s.io/client-go/util/retry"
1714

1815
"github.com/Azure/ARO-RP/pkg/env"
1916
"github.com/Azure/ARO-RP/pkg/util/dns"
2017
"github.com/Azure/ARO-RP/pkg/util/keyvault"
21-
utilpem "github.com/Azure/ARO-RP/pkg/util/pem"
2218
)
2319

2420
func (m *manager) createCertificates(ctx context.Context) error {
@@ -69,57 +65,6 @@ func (m *manager) createCertificates(ctx context.Context) error {
6965
return nil
7066
}
7167

72-
func (m *manager) ensureSecret(ctx context.Context, secrets corev1client.SecretInterface, certificateName string) error {
73-
bundle, err := m.env.ClusterKeyvault().GetSecret(ctx, certificateName)
74-
if err != nil {
75-
return err
76-
}
77-
78-
key, certs, err := utilpem.Parse([]byte(*bundle.Value))
79-
if err != nil {
80-
return err
81-
}
82-
83-
b, err := x509.MarshalPKCS8PrivateKey(key)
84-
if err != nil {
85-
return err
86-
}
87-
88-
var cb []byte
89-
for _, cert := range certs {
90-
cb = append(cb, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})...)
91-
}
92-
93-
_, err = secrets.Create(ctx, &corev1.Secret{
94-
ObjectMeta: metav1.ObjectMeta{
95-
Name: certificateName,
96-
},
97-
Data: map[string][]byte{
98-
corev1.TLSCertKey: cb,
99-
corev1.TLSPrivateKeyKey: pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: b}),
100-
},
101-
Type: corev1.SecretTypeTLS,
102-
}, metav1.CreateOptions{})
103-
if kerrors.IsAlreadyExists(err) {
104-
err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
105-
s, err := secrets.Get(ctx, certificateName, metav1.GetOptions{})
106-
if err != nil {
107-
return err
108-
}
109-
110-
s.Data = map[string][]byte{
111-
corev1.TLSCertKey: cb,
112-
corev1.TLSPrivateKeyKey: pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: b}),
113-
}
114-
s.Type = corev1.SecretTypeTLS
115-
116-
_, err = secrets.Update(ctx, s, metav1.UpdateOptions{})
117-
return err
118-
})
119-
}
120-
return err
121-
}
122-
12368
func (m *manager) configureAPIServerCertificate(ctx context.Context) error {
12469
if m.env.FeatureIsSet(env.FeatureDisableSignedCertificates) {
12570
return nil
@@ -135,7 +80,7 @@ func (m *manager) configureAPIServerCertificate(ctx context.Context) error {
13580
}
13681

13782
for _, namespace := range []string{"openshift-config", "openshift-azure-operator"} {
138-
err = m.ensureSecret(ctx, m.kubernetescli.CoreV1().Secrets(namespace), m.doc.ID+"-apiserver")
83+
err = EnsureTLSSecretFromKeyvault(ctx, m.env, m.ch, types.NamespacedName{Name: m.doc.ID + "-apiserver", Namespace: namespace}, m.doc.ID+"-apiserver")
13984
if err != nil {
14085
return err
14186
}
@@ -178,7 +123,7 @@ func (m *manager) configureIngressCertificate(ctx context.Context) error {
178123
}
179124

180125
for _, namespace := range []string{"openshift-ingress", "openshift-azure-operator"} {
181-
err = m.ensureSecret(ctx, m.kubernetescli.CoreV1().Secrets(namespace), m.doc.ID+"-ingress")
126+
err = EnsureTLSSecretFromKeyvault(ctx, m.env, m.ch, types.NamespacedName{Namespace: namespace, Name: m.doc.ID + "-ingress"}, m.doc.ID+"-ingress")
182127
if err != nil {
183128
return err
184129
}

‎pkg/util/clienthelper/clienthelper.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ type Interface interface {
3838
EnsureDeleted(ctx context.Context, gvk schema.GroupVersionKind, key types.NamespacedName) error
3939
Ensure(ctx context.Context, objs ...kruntime.Object) error
4040
GetOne(ctx context.Context, key types.NamespacedName, obj kruntime.Object) error
41+
Client() client.Client
4142
}
4243

4344
type clientHelper struct {
@@ -66,6 +67,10 @@ func NewWithClient(log *logrus.Entry, client client.Client) Interface {
6667
}
6768
}
6869

70+
func (ch *clientHelper) Client() client.Client {
71+
return ch.client
72+
}
73+
6974
func (ch *clientHelper) EnsureDeleted(ctx context.Context, gvk schema.GroupVersionKind, key types.NamespacedName) error {
7075
a := meta.AsPartialObjectMetadata(&metav1.ObjectMeta{
7176
Name: key.Name,

0 commit comments

Comments
 (0)