Inject operator's trust store with trusted-ca-bundle

Author: stlaz

manifests/03_configmap.yaml

@@ -10,6 +10,16 @@ data:
 ---
 apiVersion: v1
 kind: ConfigMap
+metadata:
+  namespace: openshift-authentication-operator
+  name: trusted-ca-bundle
+  annotations:
+    release.openshift.io/create-only: "true"
+  labels:
+    config.openshift.io/inject-trusted-cabundle: "true"
+---
+apiVersion: v1
+kind: ConfigMap
 metadata:
   namespace: openshift-authentication
   name: v4-0-config-trusted-ca-bundle

manifests/07_deployment.yaml

@@ -36,6 +36,9 @@ spec:
           name: config
         - mountPath: /var/run/secrets/serving-cert
           name: serving-cert
+        - mountPath: /var/run/configmaps/trusted-ca-bundle
+          name: trusted-ca-bundle
+          readOnly: true
         env:
         - name: IMAGE
           value: quay.io/openshift/origin-oauth-server:v4.2
@@ -53,6 +56,10 @@ spec:
         configMap:
           defaultMode: 440
           name: authentication-operator-config
+      - name: trusted-ca-bundle
+        configMap:
+          name: trusted-ca-bundle
+          optional: true
       - name: serving-cert
         secret:
           secretName: serving-cert

pkg/operator2/idp.go

@@ -3,10 +3,13 @@ package operator2
 import (
 	"encoding/json"
 	"fmt"
+	"io/ioutil"
 	"net/http"
 	"net/url"
 	"strings"
 
+	"k8s.io/klog"
+
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -293,7 +296,7 @@ func (c *authOperator) discoverOpenIDURLs(issuer, key string, ca configv1.Config
 
 func (c *authOperator) transportForCARef(ca configv1.ConfigMapNameReference, key string) (http.RoundTripper, error) {
 	if len(ca.Name) == 0 {
-		return transportFor("", nil, nil, nil)
+		return transportFor("", trustedCABytes(), nil, nil)
 	}
 	cm, err := c.configMaps.ConfigMaps(userConfigNamespace).Get(ca.Name, metav1.GetOptions{})
 	if err != nil {
@@ -343,3 +346,12 @@ func encodeOrDie(obj runtime.Object) []byte {
 	}
 	return bytes
 }
+
+func trustedCABytes() []byte {
+	caData, err := ioutil.ReadFile(operatorTrustedCAFile)
+	if err != nil {
+		klog.Infof("could not read %s, it won't be used in transport", operatorTrustedCAFile)
+		return nil
+	}
+	return caData
+}

pkg/operator2/operator.go

@@ -62,9 +62,8 @@ const (
 	kasServiceAndEndpointName = "kubernetes"
 	kasServiceFullName        = kasServiceAndEndpointName + "." + corev1.NamespaceDefault + ".svc"
 
-	rootCAFile = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
-
-	systemTrustStoreDirPath = "/etc/pki/ca-trust/extracted/pem"
+	rootCAFile            = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+	operatorTrustedCAFile = "/var/run/configmaps/trusted-ca-bundle/ca-bundle.crt"
 
 	systemConfigPath           = "/var/config/system"
 	systemConfigPathConfigMaps = systemConfigPath + "/configmaps"
@@ -114,7 +113,7 @@ const (
 	// trustedCABundleName part of manifests, if changing this, need to change that, too
 	trustedCABundleName      = systemConfigPrefix + "trusted-ca-bundle"
 	trustedCABundleKey       = "ca-bundle.crt"
-	trustedCABundleMountDir  = systemTrustStoreDirPath
+	trustedCABundleMountDir  = "/etc/pki/ca-trust/extracted/pem"
 	trustedCABundleMountFile = "tls-ca-bundle.pem"
 
 	ocpBrandingSecretName   = systemConfigPrefix + "ocp-branding-template"
@@ -533,7 +532,8 @@ func (c *authOperator) checkDeploymentReady(deployment *appsv1.Deployment, opera
 func (c *authOperator) checkRouteHealthy(route *routev1.Route, routerSecret *corev1.Secret, ingress *configv1.Ingress) (ready bool, msg, reason string, err error) {
 	caData := routerSecretToCA(route, routerSecret, ingress)
 
-	rt, err := transportFor("", caData, nil, nil)
+	// merge trustedCA data with router cert in case TLS intercept proxy is in place
+	rt, err := transportFor("", append(caData, trustedCABytes()...), nil, nil)
 	if err != nil {
 		return false, "", "FailedTransport", fmt.Errorf("failed to build transport for route: %v", err)
 	}