Skip to content

Commit e98e1dc

Browse files
awgreeneawgreene
committed
OLM mounts CA Certs where Kubebuilder expects
Problem: OLM does not mount the Generated CA Certs to the deployment at the default location defined by Kubebuilder and the Operator-SDK. Solution: OLM will ensure backwards compatibility by mounting the generated CA Certs at the existing location as well as the default location defined by the Operator-SDK and Kubebuilder.
1 parent 24aee33 commit e98e1dc

File tree

2 files changed

+52
-128
lines changed

2 files changed

+52
-128
lines changed

‎pkg/controller/install/certresources.go

Lines changed: 50 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -497,13 +497,25 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
497497
} else {
498498
return nil, nil, err
499499
}
500+
AddDefaultCertVolumeAndVolumeMounts(&depSpec, secret.GetName())
500501

502+
// Setting the olm hash label forces a rollout and ensures that the new secret
503+
// is used by the apiserver if not hot reloading.
504+
depSpec.Template.ObjectMeta.SetAnnotations(map[string]string{OLMCAHashAnnotationKey: caHash})
505+
506+
return &depSpec, caPEM, nil
507+
}
508+
509+
// AddDefaultCertVolumeAndVolumeMounts mounts the CA Cert generated by OLM to the location that OLM expects
510+
// APIService certs to be as well as the location that the Operator-SDK and Kubebuilder expect webhook
511+
// certs to be.
512+
func AddDefaultCertVolumeAndVolumeMounts(depSpec *appsv1.DeploymentSpec, secretName string) {
501513
// Update deployment with secret volume mount.
502514
volume := corev1.Volume{
503515
Name: "apiservice-cert",
504516
VolumeSource: corev1.VolumeSource{
505517
Secret: &corev1.SecretVolumeSource{
506-
SecretName: secret.GetName(),
518+
SecretName: secretName,
507519
Items: []corev1.KeyToPath{
508520
{
509521
Key: "tls.crt",
@@ -518,6 +530,39 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
518530
},
519531
}
520532

533+
mount := corev1.VolumeMount{
534+
Name: volume.Name,
535+
MountPath: "/apiserver.local.config/certificates",
536+
}
537+
538+
addCertVolumeAndVolumeMount(depSpec, volume, mount)
539+
540+
volume = corev1.Volume{
541+
Name: "webhook-cert",
542+
VolumeSource: corev1.VolumeSource{
543+
Secret: &corev1.SecretVolumeSource{
544+
SecretName: secretName,
545+
Items: []corev1.KeyToPath{
546+
{
547+
Key: "tls.crt",
548+
Path: "tls.crt",
549+
},
550+
{
551+
Key: "tls.key",
552+
Path: "tls.key",
553+
},
554+
},
555+
},
556+
},
557+
}
558+
559+
mount = corev1.VolumeMount{
560+
Name: volume.Name,
561+
MountPath: "/tmp/k8s-webhook-server/serving-certs",
562+
}
563+
addCertVolumeAndVolumeMount(depSpec, volume, mount)
564+
}
565+
func addCertVolumeAndVolumeMount(depSpec *appsv1.DeploymentSpec, volume corev1.Volume, volumeMount corev1.VolumeMount) {
521566
replaced := false
522567
for i, v := range depSpec.Template.Spec.Volumes {
523568
if v.Name == volume.Name {
@@ -530,35 +575,25 @@ func (i *StrategyDeploymentInstaller) installCertRequirementsForDeployment(deplo
530575
depSpec.Template.Spec.Volumes = append(depSpec.Template.Spec.Volumes, volume)
531576
}
532577

533-
mount := corev1.VolumeMount{
534-
Name: volume.Name,
535-
MountPath: "/apiserver.local.config/certificates",
536-
}
537578
for i, container := range depSpec.Template.Spec.Containers {
538579
found := false
539580
for j, m := range container.VolumeMounts {
540-
if m.Name == mount.Name {
581+
if m.Name == volumeMount.Name {
541582
found = true
542583
break
543584
}
544585

545586
// Replace if mounting to the same location.
546-
if m.MountPath == mount.MountPath {
547-
container.VolumeMounts[j] = mount
587+
if m.MountPath == volumeMount.MountPath {
588+
container.VolumeMounts[j] = volumeMount
548589
found = true
549590
break
550591
}
551592
}
552593
if !found {
553-
container.VolumeMounts = append(container.VolumeMounts, mount)
594+
container.VolumeMounts = append(container.VolumeMounts, volumeMount)
554595
}
555596

556597
depSpec.Template.Spec.Containers[i] = container
557598
}
558-
559-
// Setting the olm hash label forces a rollout and ensures that the new secret
560-
// is used by the apiserver if not hot reloading.
561-
depSpec.Template.ObjectMeta.SetAnnotations(map[string]string{OLMCAHashAnnotationKey: caHash})
562-
563-
return &depSpec, caPEM, nil
564599
}

‎pkg/controller/operators/olm/apiservices.go

Lines changed: 2 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66

77
log "github.com/sirupsen/logrus"
88
appsv1 "k8s.io/api/apps/v1"
9-
corev1 "k8s.io/api/core/v1"
109
rbacv1 "k8s.io/api/rbac/v1"
1110
k8serrors "k8s.io/apimachinery/pkg/api/errors"
1211
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -344,62 +343,7 @@ func (a *Operator) updateDeploymentSpecsWithApiServiceData(csv *v1alpha1.Cluster
344343
return nil, fmt.Errorf("Unable to get secret %s", install.SecretName(install.ServiceName(desc.DeploymentName)))
345344
}
346345

347-
volume := corev1.Volume{
348-
Name: "apiservice-cert",
349-
VolumeSource: corev1.VolumeSource{
350-
Secret: &corev1.SecretVolumeSource{
351-
SecretName: secret.GetName(),
352-
Items: []corev1.KeyToPath{
353-
{
354-
Key: "tls.crt",
355-
Path: "apiserver.crt",
356-
},
357-
{
358-
Key: "tls.key",
359-
Path: "apiserver.key",
360-
},
361-
},
362-
},
363-
},
364-
}
365-
366-
replaced := false
367-
for i, v := range depSpec.Template.Spec.Volumes {
368-
if v.Name == volume.Name {
369-
depSpec.Template.Spec.Volumes[i] = volume
370-
replaced = true
371-
break
372-
}
373-
}
374-
if !replaced {
375-
depSpec.Template.Spec.Volumes = append(depSpec.Template.Spec.Volumes, volume)
376-
}
377-
378-
mount := corev1.VolumeMount{
379-
Name: volume.Name,
380-
MountPath: "/apiserver.local.config/certificates",
381-
}
382-
for i, container := range depSpec.Template.Spec.Containers {
383-
found := false
384-
for j, m := range container.VolumeMounts {
385-
if m.Name == mount.Name {
386-
found = true
387-
break
388-
}
389-
390-
// Replace if mounting to the same location.
391-
if m.MountPath == mount.MountPath {
392-
container.VolumeMounts[j] = mount
393-
found = true
394-
break
395-
}
396-
}
397-
if !found {
398-
container.VolumeMounts = append(container.VolumeMounts, mount)
399-
}
400-
401-
depSpec.Template.Spec.Containers[i] = container
402-
}
346+
install.AddDefaultCertVolumeAndVolumeMounts(&depSpec, secret.GetName())
403347
depSpec.Template.ObjectMeta.SetAnnotations(map[string]string{install.OLMCAHashAnnotationKey: caHash})
404348
depSpecs[desc.DeploymentName] = depSpec
405349
}
@@ -421,63 +365,8 @@ func (a *Operator) updateDeploymentSpecsWithApiServiceData(csv *v1alpha1.Cluster
421365
if err != nil {
422366
return nil, fmt.Errorf("Unable to get secret %s", install.SecretName(install.ServiceName(desc.DeploymentName)))
423367
}
368+
install.AddDefaultCertVolumeAndVolumeMounts(&depSpec, secret.GetName())
424369

425-
volume := corev1.Volume{
426-
Name: "apiservice-cert",
427-
VolumeSource: corev1.VolumeSource{
428-
Secret: &corev1.SecretVolumeSource{
429-
SecretName: secret.GetName(),
430-
Items: []corev1.KeyToPath{
431-
{
432-
Key: "tls.crt",
433-
Path: "apiserver.crt",
434-
},
435-
{
436-
Key: "tls.key",
437-
Path: "apiserver.key",
438-
},
439-
},
440-
},
441-
},
442-
}
443-
444-
replaced := false
445-
for i, v := range depSpec.Template.Spec.Volumes {
446-
if v.Name == volume.Name {
447-
depSpec.Template.Spec.Volumes[i] = volume
448-
replaced = true
449-
break
450-
}
451-
}
452-
if !replaced {
453-
depSpec.Template.Spec.Volumes = append(depSpec.Template.Spec.Volumes, volume)
454-
}
455-
456-
mount := corev1.VolumeMount{
457-
Name: volume.Name,
458-
MountPath: "/apiserver.local.config/certificates",
459-
}
460-
for i, container := range depSpec.Template.Spec.Containers {
461-
found := false
462-
for j, m := range container.VolumeMounts {
463-
if m.Name == mount.Name {
464-
found = true
465-
break
466-
}
467-
468-
// Replace if mounting to the same location.
469-
if m.MountPath == mount.MountPath {
470-
container.VolumeMounts[j] = mount
471-
found = true
472-
break
473-
}
474-
}
475-
if !found {
476-
container.VolumeMounts = append(container.VolumeMounts, mount)
477-
}
478-
479-
depSpec.Template.Spec.Containers[i] = container
480-
}
481370
depSpec.Template.ObjectMeta.SetAnnotations(map[string]string{install.OLMCAHashAnnotationKey: caHash})
482371
depSpecs[desc.DeploymentName] = depSpec
483372
}

0 commit comments

Comments
 (0)