Skip to content

OCPBUGS-27238: Use both the OCP cluster trusted certs and user certs #6649

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 2 commits into from
Aug 9, 2024
Merged

OCPBUGS-27238: Use both the OCP cluster trusted certs and user certs #6649

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
536a409
Use both the OCP cluster trusted certs and user certs
carbonin Jul 25, 2024
a9efb9b
Doc the new mirror registry CA bundle behavior
carbonin Aug 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions docs/operator.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,18 +246,18 @@ oc annotate --overwrite AgentServiceConfig agent unsupported.agent-install.opens

A ConfigMap can be used to configure assisted service to create installations using mirrored content. The ConfigMap contains two keys:

- *ca-bundle.crt* - This key contains the contents of the certificate for accessing the mirror registry, if necessary. It may be a certificate bundle and is defined as a single string.
- *registries.conf* - This key contains the contents of the registries.conf file that configures mappings to the mirror registry.
- `ca-bundle.crt` - This key contains the contents of the certificate for accessing the mirror registry, if necessary. It may be a certificate bundle and is defined as a single string.
- `registries.conf` - This key contains the contents of the registries.conf file that configures mappings to the mirror registry.

The mirror registry configuration changes the discovery image's ignition config, with *ca-bundle.crt* written out to */etc/pki/ca-trust/source/anchors/domain.crt* and with *registries.conf* written out to */etc/containers/registries.conf*.

The configuration also changes the *install-config.yaml* file used to install a new cluster, with the contents of *ca-bundle.crt* added to *additionalTrustBundle* and with the registries defined *registries.conf* added to *imageContentSources* as mirrors.
The assisted service pod also converts the registries.conf into an imageContentSourcesPolicy file, and use it with the --icsp flag in a few oc adm commands run against the release image (executed from within the assisted service pod itself).
Supplying this ConfigMap makes several changes to the installation flow and assisted-service deployment:
- Changes the discovery image's ignition config such that `ca-bundle.crt` is written out to `/etc/pki/ca-trust/source/anchors/domain.crt` and `registries.conf` is written out to `/etc/containers/registries.conf`.
- Changes the `install-config.yaml` file used to install a new cluster, with the contents of `ca-bundle.crt` added to `additionalTrustBundle` and with the registries defined `registries.conf` added to `imageContentSources` as mirrors.
- The assisted-service pod converts the registries.conf into an imageContentSourcesPolicy file, and use it with the --icsp flag in a few `oc adm` commands run against the release image (executed from within the assisted-service pod itself).
- The certificate bundle is added to the list of trusted certs provided by the cluster. A combined ConfigMap is created which includes the provided bundle. This is mounted into the assisted-service pod at path `/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem`

The ca-bundle.crt and registries.conf keys can be added individually or together.


1. To configure the mirror registry, first create and upload the ConfigMap containing the *ca-bundle.crt* and *registries.conf* keys.
1. To configure the mirror registry, first create and upload the ConfigMap containing the `ca-bundle.crt` and `registries.conf` keys.

``` bash
cat <<EOF | kubectl create -f -
Expand Down
108 changes: 89 additions & 19 deletions internal/controller/controllers/agentserviceconfig_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,8 @@ const (

defaultIngressCertCMName string = "default-ingress-cert"
defaultIngressCertCMNamespace string = "openshift-config-managed"
clusterCAConfigMapName string = "cluster-trusted-ca-bundle"
assistedCAConfigMapName string = "assisted-trusted-ca-bundle"

configmapAnnotation = "unsupported.agent-install.openshift.io/assisted-service-configmap"
imageServiceSkipVerifyTLSAnnotation = "unsupported.agent-install.openshift.io/assisted-image-service-skip-verify-tls"
Expand All @@ -96,6 +98,7 @@ const (

servingCertAnnotation = "service.beta.openshift.io/serving-cert-secret-name"
injectCABundleAnnotation = "service.beta.openshift.io/inject-cabundle"
injectTrustedCALabel = "config.openshift.io/inject-trusted-cabundle"

defaultNamespace = "default"
osImageDownloadTrustedCAFilename = "tls.crt"
Expand Down Expand Up @@ -381,6 +384,8 @@ func getComponents(spec *aiv1beta1.AgentServiceConfigSpec, isOpenshift bool) []c
component{"IngressCertConfigMap", aiv1beta1.ReasonIngressCertFailure, newIngressCertCM},
// this is only for mounting in the https certs
component{"ImageServiceConfigMap", aiv1beta1.ReasonConfigFailure, newImageServiceConfigMap},
component{"ClusterTrustedCAConfigMap", aiv1beta1.ReasonConfigFailure, newClusterTrustedCACM},
component{"AssistedTrustedCAConfigMap", aiv1beta1.ReasonConfigFailure, newAssistedTrustedCACM},
)
// Additional routes need to be synced if HTTP iPXE routes are exposed
if exposeIPXEHTTPRoute(spec) {
Expand Down Expand Up @@ -1038,6 +1043,70 @@ func newIngressCertCM(ctx context.Context, log logrus.FieldLogger, asc ASC) (cli
return cm, mutateFn, nil
}

func newClusterTrustedCACM(ctx context.Context, log logrus.FieldLogger, asc ASC) (client.Object, controllerutil.MutateFn, error) {
cm := &corev1.ConfigMap{
ObjectMeta: metav1.ObjectMeta{
Name: clusterCAConfigMapName,
Namespace: asc.namespace,
},
}

mutateFn := func() error {
if err := controllerutil.SetControllerReference(asc.Object, cm, asc.rec.Scheme); err != nil {
return err
}
metav1.SetMetaDataLabel(&cm.ObjectMeta, injectTrustedCALabel, "true")
return nil
}

return cm, mutateFn, nil
}

func newAssistedTrustedCACM(ctx context.Context, log logrus.FieldLogger, asc ASC) (client.Object, controllerutil.MutateFn, error) {
var b strings.Builder

clusterTrustedCACM := &corev1.ConfigMap{}
if err := asc.Client.Get(ctx, types.NamespacedName{Name: clusterCAConfigMapName, Namespace: asc.namespace}, clusterTrustedCACM); err != nil {
log.WithError(err).Error("Failed to get cluster trusted CA config map")
return nil, nil, err
}
if _, err := b.WriteString(clusterTrustedCACM.Data[caBundleKey]); err != nil {

@CrystalChun CrystalChun Aug 8, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you think we should validate if the key caBundleKey exists in the configmap or is that not necessary?

@carbonin carbonin Aug 8, 2024

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it doesn't exist this will be an empty string so I didn't think it was worth it, but I can if you think it's better to be explicit.

@CrystalChun CrystalChun Aug 8, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope, that's fine with me!

log.WithError(err).Error("Failed to get ca-bundle from cluster CA ConfigMap")
return nil, nil, err
}

if asc.spec.MirrorRegistryRef != nil {
mirrorCM := &corev1.ConfigMap{}
namespacedName := types.NamespacedName{Name: asc.spec.MirrorRegistryRef.Name, Namespace: asc.namespace}
if err := asc.Client.Get(ctx, namespacedName, mirrorCM); err != nil {
return nil, nil, err
}
if _, err := b.WriteString("\n" + mirrorCM.Data[mirrorRegistryRefCertKey]); err != nil {

@CrystalChun CrystalChun Aug 8, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar here: Do you think we should validate if the key mirrorRegistryRefCertKey exists in the configmap or is that not necessary?

log.WithError(err).Error("Failed to get ca-bundle from mirror registry CA ConfigMap")
return nil, nil, err
}
}

cm := &corev1.ConfigMap{
ObjectMeta: metav1.ObjectMeta{
Name: assistedCAConfigMapName,
Namespace: asc.namespace,
},
}

mutateFn := func() error {
if err := controllerutil.SetControllerReference(asc.Object, cm, asc.rec.Scheme); err != nil {
return err
}
cm.Data = map[string]string{
caBundleKey: b.String(),
}
return nil
}

return cm, mutateFn, nil
}

func newImageServiceConfigMap(ctx context.Context, log logrus.FieldLogger, asc ASC) (client.Object, controllerutil.MutateFn, error) {
cm := &corev1.ConfigMap{
ObjectMeta: metav1.ObjectMeta{
Expand Down Expand Up @@ -1748,10 +1817,30 @@ func newAssistedServiceDeployment(ctx context.Context, log logrus.FieldLogger, a
},
},
},
corev1.Volume{
Name: "trusted-ca-certs",

@CrystalChun CrystalChun Aug 8, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should "trusted-ca-certs" be a const?

@carbonin carbonin Aug 8, 2024

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think it matters too much since it's only being used in this function, but I don't feel strongly either way if you think we should change it.

@CrystalChun CrystalChun Aug 8, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope, that's fine with me

VolumeSource: corev1.VolumeSource{
ConfigMap: &corev1.ConfigMapVolumeSource{
Items: []corev1.KeyToPath{{
Key: caBundleKey,
Path: common.MirrorRegistriesCertificateFile,
}},
LocalObjectReference: corev1.LocalObjectReference{
Name: assistedCAConfigMapName,
},
DefaultMode: swag.Int32(420),
},
},
},
)
volumeMounts = append(volumeMounts,
corev1.VolumeMount{Name: "tls-certs", MountPath: "/etc/assisted-tls-config"},
corev1.VolumeMount{Name: "ingress-cert", MountPath: "/etc/assisted-ingress-cert"},
corev1.VolumeMount{
Name: "trusted-ca-certs",
MountPath: common.MirrorRegistriesCertificatePath,
SubPath: common.MirrorRegistriesCertificateFile,
},
)
healthCheckScheme = corev1.URISchemeHTTPS
} else {
Expand Down Expand Up @@ -1878,25 +1967,6 @@ func newAssistedServiceDeployment(ctx context.Context, log logrus.FieldLogger, a
},
)

if _, ok := cm.Data[mirrorRegistryRefCertKey]; ok {
volume.VolumeSource.ConfigMap.Items = append(
volume.VolumeSource.ConfigMap.Items,
corev1.KeyToPath{
Key: mirrorRegistryRefCertKey,
Path: common.MirrorRegistriesCertificateFile,
},
)

serviceContainer.VolumeMounts = append(
serviceContainer.VolumeMounts,
corev1.VolumeMount{
Name: mirrorRegistryConfigVolume,
MountPath: common.MirrorRegistriesCertificatePath,
SubPath: common.MirrorRegistriesCertificateFile,
},
)
}

// add our mirror registry config to volumes
volumes = append(volumes, volume)
}
Expand Down
99 changes: 96 additions & 3 deletions internal/controller/controllers/agentserviceconfig_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -745,6 +745,81 @@ var _ = Describe("agentserviceconfig_controller reconcile", func() {
Expect(condition.Status).To(Equal(corev1.ConditionFalse))
})

It("creates the cluster trusted CA cert config map", func() {
ascr = newTestReconciler(asc, ingressCM, route, imageRoute)
_, err := ascr.Reconcile(ctx, newAgentServiceConfigRequest(asc))
Expect(err).To(BeNil())

cm := corev1.ConfigMap{}
key := types.NamespacedName{
Name: clusterCAConfigMapName,
Namespace: ascr.Namespace,
}
Expect(ascr.Get(ctx, key, &cm)).To(Succeed())
Expect(cm.GetLabels()[injectTrustedCALabel]).To(Equal("true"))

})

It("copies the contents of the cluster trusted CA cert config map into the assisted cert config map", func() {
testClusterCert := "-----BEGIN CERTIFICATE-----\nMIIFNDCCAxygAwIBAgIUIuI4RrUYvTSrIKq0XPr9eZB42CEwDQYJKoZIhvcNAQEL\nBQAwFjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wHhcNMjQwNzIyMjAwMDA2WhcNMzQw\nNzIwMjAwMDA2WjAWMRQwEgYDVQQDDAtleGFtcGxlLmNvbTCCAiIwDQYJKoZIhvcN\nAQEBBQADggIPADCCAgoCggIBAMr6JdHm+2dYV486In1PKN7K2Bp2nbFt+JjE9UjN\nLy5spMEU1nBTTdQp7X2o5IrxcmQm2eWUZsQqRzsipWGLGY433cCHxozJSqincPIz\n3k5vU7nctt0vY8Gd+vX1KggmRVgfRatp2C0We56K3JzpnXk33/X/eI+PATS1LvU+\nJwz1zkoCURos9NJtVKmO/mZsdu1kn7lcA+OXxAkUVuhl4OQYDmhAqFn0HWCP/OYD\nVSKUBegf0TrelkmwqX/50hW1dWCiB39pJqhchLn1EZOrt69YUrfU2cEfw6SnMhaO\neSLBAf9d9krbrNNH8hBfOMxErz3OnHG4hMWnsuUpZlDQOgS5SFOPIVoY70izLDbv\nG6eoVSpC7+ZgotEEPxW3drEMHkzcCMgXCFD3uDJRScoKy2VbovOz8POvjCuYbB6H\nJDoy17w9h8Jk11fBWWG3jU9cgI8xaz7uZB+ctPhfTdV3YxdWvwuvrNPEyZ7QoSt1\nU06l0nnI24zMYnBK4Ogct/mqW4M10027wrTKiEi0PL7U8Rdnfy4Z6WK82uUdYfRC\nNMJw0uhxVyQTxDf0+kwDH82vprbjlAQkRsW+6CLfy2nVJYDkbAI4DnxFdlGnL3Mh\nHkMN7gSIIlI13uQnzPino/QuswV+kFHUSaoheAZlaGaORR3F5DIqf5t0H732X4Qn\nR731AgMBAAGjejB4MB0GA1UdDgQWBBRgPTn7qENgjkciUw2qrJBF3dgNUTAfBgNV\nHSMEGDAWgBRgPTn7qENgjkciUw2qrJBF3dgNUTAPBgNVHRMBAf8EBTADAQH/MCUG\nA1UdEQQeMByCC2V4YW1wbGUuY29tgg0qLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEB\nCwUAA4ICAQAc4YcvCHxaAVcN//4/lnxUKC1T7r2i+jGimgUWWqaER8WH1md2My77\n0HOa0gs4SKJLvxssmyOVaie+prJAl/hyV2T7N4E7fnIVvyBsRqYgrXdISS07/WHc\n1Nz1/qOx7iEt4pB2lVm8PGVZvos97YzYw1odzadMP+J6b3JbYdK/s5iRqULgFzL8\nTNUXM83jTpSTa5SKIyf+RZgdMYasLdla5rChKlc0mpWVvr+mvY+ziKjmZPp6RcKC\nRyddKecwHLClIXz1IuUK0Wdjrr5OwBXnMMy+eIuHFaYYIlt0IYsl3ecT1zRrSVT9\niMulnPLh3TRJ9DC6FcYmy0TXgC3OyAhGFB+hFbqzillqjN4tI6M4GipSAq63IVya\nOxms940SIHS/Jph/ynqncM9bPKuDeKR4BUikLPuOAhogmJ/2vnkQS7VP2TqVjFNZ\nmrxoNHE8eKl7QUJR0Bk6aLkc2wjlHPyqFpgUMhKU+TnRRSGUgmT0fRHkGHwEdsQ4\nqx2r18pk+1fUGqma9P4zDod44iVstpQHZ4iWMtZc/KAvG1fwDJVnEJzOOytoNrc0\nxRu491o2EAUIk2/mfDln5vg8gKNGqARuOc5PEAKGrGthYIluoz6JRSm92khf19fe\nQyFF2sYgIrz/h6L+kx4WTEPQPhQWkeJ/NIiCc687ZP1yNmJI/GcUdg==\n-----END CERTIFICATE-----\n"
clusterCM := &corev1.ConfigMap{
ObjectMeta: metav1.ObjectMeta{
Name: clusterCAConfigMapName,
Namespace: ascr.Namespace,
Labels: map[string]string{injectTrustedCALabel: "true"},
},
Data: map[string]string{caBundleKey: testClusterCert},
}
ascr = newTestReconciler(asc, ingressCM, route, imageRoute, clusterCM)
_, err := ascr.Reconcile(ctx, newAgentServiceConfigRequest(asc))
Expect(err).To(BeNil())

cm := corev1.ConfigMap{}
key := types.NamespacedName{
Name: assistedCAConfigMapName,
Namespace: ascr.Namespace,
}
Expect(ascr.Get(ctx, key, &cm)).To(Succeed())
Expect(cm.Data[caBundleKey]).To(Equal(testClusterCert))
})

It("combines the cluter trusted CA cert content with user mirror registry certs in the assissted cert config map", func() {
testClusterCert := "-----BEGIN CERTIFICATE-----\nMIIFNDCCAxygAwIBAgIUIuI4RrUYvTSrIKq0XPr9eZB42CEwDQYJKoZIhvcNAQEL\nBQAwFjEUMBIGA1UEAwwLZXhhbXBsZS5jb20wHhcNMjQwNzIyMjAwMDA2WhcNMzQw\nNzIwMjAwMDA2WjAWMRQwEgYDVQQDDAtleGFtcGxlLmNvbTCCAiIwDQYJKoZIhvcN\nAQEBBQADggIPADCCAgoCggIBAMr6JdHm+2dYV486In1PKN7K2Bp2nbFt+JjE9UjN\nLy5spMEU1nBTTdQp7X2o5IrxcmQm2eWUZsQqRzsipWGLGY433cCHxozJSqincPIz\n3k5vU7nctt0vY8Gd+vX1KggmRVgfRatp2C0We56K3JzpnXk33/X/eI+PATS1LvU+\nJwz1zkoCURos9NJtVKmO/mZsdu1kn7lcA+OXxAkUVuhl4OQYDmhAqFn0HWCP/OYD\nVSKUBegf0TrelkmwqX/50hW1dWCiB39pJqhchLn1EZOrt69YUrfU2cEfw6SnMhaO\neSLBAf9d9krbrNNH8hBfOMxErz3OnHG4hMWnsuUpZlDQOgS5SFOPIVoY70izLDbv\nG6eoVSpC7+ZgotEEPxW3drEMHkzcCMgXCFD3uDJRScoKy2VbovOz8POvjCuYbB6H\nJDoy17w9h8Jk11fBWWG3jU9cgI8xaz7uZB+ctPhfTdV3YxdWvwuvrNPEyZ7QoSt1\nU06l0nnI24zMYnBK4Ogct/mqW4M10027wrTKiEi0PL7U8Rdnfy4Z6WK82uUdYfRC\nNMJw0uhxVyQTxDf0+kwDH82vprbjlAQkRsW+6CLfy2nVJYDkbAI4DnxFdlGnL3Mh\nHkMN7gSIIlI13uQnzPino/QuswV+kFHUSaoheAZlaGaORR3F5DIqf5t0H732X4Qn\nR731AgMBAAGjejB4MB0GA1UdDgQWBBRgPTn7qENgjkciUw2qrJBF3dgNUTAfBgNV\nHSMEGDAWgBRgPTn7qENgjkciUw2qrJBF3dgNUTAPBgNVHRMBAf8EBTADAQH/MCUG\nA1UdEQQeMByCC2V4YW1wbGUuY29tgg0qLmV4YW1wbGUuY29tMA0GCSqGSIb3DQEB\nCwUAA4ICAQAc4YcvCHxaAVcN//4/lnxUKC1T7r2i+jGimgUWWqaER8WH1md2My77\n0HOa0gs4SKJLvxssmyOVaie+prJAl/hyV2T7N4E7fnIVvyBsRqYgrXdISS07/WHc\n1Nz1/qOx7iEt4pB2lVm8PGVZvos97YzYw1odzadMP+J6b3JbYdK/s5iRqULgFzL8\nTNUXM83jTpSTa5SKIyf+RZgdMYasLdla5rChKlc0mpWVvr+mvY+ziKjmZPp6RcKC\nRyddKecwHLClIXz1IuUK0Wdjrr5OwBXnMMy+eIuHFaYYIlt0IYsl3ecT1zRrSVT9\niMulnPLh3TRJ9DC6FcYmy0TXgC3OyAhGFB+hFbqzillqjN4tI6M4GipSAq63IVya\nOxms940SIHS/Jph/ynqncM9bPKuDeKR4BUikLPuOAhogmJ/2vnkQS7VP2TqVjFNZ\nmrxoNHE8eKl7QUJR0Bk6aLkc2wjlHPyqFpgUMhKU+TnRRSGUgmT0fRHkGHwEdsQ4\nqx2r18pk+1fUGqma9P4zDod44iVstpQHZ4iWMtZc/KAvG1fwDJVnEJzOOytoNrc0\nxRu491o2EAUIk2/mfDln5vg8gKNGqARuOc5PEAKGrGthYIluoz6JRSm92khf19fe\nQyFF2sYgIrz/h6L+kx4WTEPQPhQWkeJ/NIiCc687ZP1yNmJI/GcUdg==\n-----END CERTIFICATE-----\n"
clusterCM := &corev1.ConfigMap{
ObjectMeta: metav1.ObjectMeta{
Name: clusterCAConfigMapName,
Namespace: ascr.Namespace,
Labels: map[string]string{injectTrustedCALabel: "true"},
},
Data: map[string]string{caBundleKey: testClusterCert},
}

testUserCert := "-----BEGIN CERTIFICATE-----\nMIIFNDCCAxygAwIBAgIUdfm4+FGEMjiv2FGF6IqcNx4aSp8wDQYJKoZIhvcNAQEL\nBQAwFjEUMBIGA1UEAwwLZXhhbXBsZS5vcmcwHhcNMjQwNzE5MjA0MDI3WhcNMzQw\nNzE3MjA0MDI3WjAWMRQwEgYDVQQDDAtleGFtcGxlLm9yZzCCAiIwDQYJKoZIhvcN\nAQEBBQADggIPADCCAgoCggIBAO2DhLgDYi7zwhQXxJ0XWd9UHNE4dnHWX2f5zhXT\n8qrEm8ieXKFt87AUooZcyXn5WH5geiauO+sBQ6ksqvb8Jfuj26YbhCeyxAHoKnne\nU9zKpuNr5nM4GIHd7J8X5LATszdXYIr5ghZ2jwhKYKz4Q0g4kObASISGpDODfqKs\nR+ZjIXI3rWcnSWFTbd5ZkOw+xLvNE58f/K1W8ejCU0oFZ0npyfYgfrmteqfiB4Ra\nta9jXThwPgY8psVMAXF8JGl+4t7s1XWHmeIZm3Pjv84Rg2h/2rPcCT5LBBB2W2b8\n2vaHhhLihAFeyZ5D1XRC+wyVIVXpjSgEvWCaAIfjNZaOe1BWa93s10zmLKH4A1yC\nsJj/hmYY/X2MzgRz3vfKAXSEfcTl1hXSDt+NoXaEJDvPF+g4jO0z9/ajFEu4mb1v\nUhUIr3P7AWVaAyvhoORW0D4t3f9mm9QDT7hLetGDU/gEMa53QehC+mCoHbtWiN7y\n394pdXORm2mzNfXoKlBXF1aiDtUE60h+U+uBoK3sxSZVgJq6anqlOE6ILUQNxFZt\nCiMGPeOoyBQmIqiAfGE2Kkz8Jz/7YuNZLlG9jbQy3JwGMX2I12BvXWcG2ScbITqT\n7NhkUCYKQEzUEeOToIsE7nnnxKi2vKnCvtqPFCR/HX5TetHahFo3TTqO0KIx3KXh\nNUzVAgMBAAGjejB4MB0GA1UdDgQWBBQmtTZjMDEVuVrhdqNXmdMqwqlE9TAfBgNV\nHSMEGDAWgBQmtTZjMDEVuVrhdqNXmdMqwqlE9TAPBgNVHRMBAf8EBTADAQH/MCUG\nA1UdEQQeMByCC2V4YW1wbGUub3Jngg0qLmV4YW1wbGUub3JnMA0GCSqGSIb3DQEB\nCwUAA4ICAQAPQb35BXoOE8iWtADxz7hB2KfM98U7n6robrNt6OJ5mGWgt4KoFbCP\niqdDIGxXXPiecSN1vn3GjGJX5zSojMAAhnoAnxix+0G9E08a3YwJ/VFJqMcmxiX/\n6hXOIIRLHeHOSJaYxmtNZVDFuHeL/JbUcHfWyJsGAnkRNSORm0caU5fF/NyC11KR\nbv31SN61ssO/eKJuroa7jEjg6IhhsvXE749LVXZQj4dEoxd4NS1EZNOI0r6WhXgv\nldYN8k2Mup9HA/P89VPEhjr2NhuFDrQH+ReIOCHHQz4R7AzEzwZtdn9FMkzt13D2\n3pNZgjNBTt65la3PYEaKuPBoAEyhmiykPurp5zj+xLlINHU8lgnhtneUNU3RbX4j\nWFDA+HvhwN/67p6uDW8UwQS6NB5cWflElq3zOJXAK6eO2ZetAGJuDPEXMi52U0eU\neFRHqoksH0ThI8kEU+rRbhOrZjTe/4wbsCBitAjlaKM82RlMCT188d3Y706Bcdme\nZlXFPKksDzvRc8LyoZxT5RYXKdNSS/UF3VxP9aKW+hvHzE5Hr9jeVOhrdNvjhJ5r\nWqbHAubuIFOxYN+dzLqJfhq0ee5h9xcN4JSK7Tlyur4IOaLhR0wDJxVl4+lysAxe\nZNpw+0EhyM3IloGpckyWBQZ3vs3qp2evHqbie/F8gM2v0P5VrYPFZw==\n-----END CERTIFICATE-----\n"
mirrorCM := &corev1.ConfigMap{
ObjectMeta: metav1.ObjectMeta{
Name: "mirror-registries",
Namespace: ascr.Namespace,
},
Data: map[string]string{
mirrorRegistryRefCertKey: testUserCert,
mirrorRegistryRefRegistryConfKey: "someregistrieshere",
},
}
asc.Spec.MirrorRegistryRef = &corev1.LocalObjectReference{Name: "mirror-registries"}

ascr = newTestReconciler(asc, ingressCM, route, imageRoute, clusterCM, mirrorCM)
_, err := ascr.Reconcile(ctx, newAgentServiceConfigRequest(asc))
Expect(err).To(BeNil())

cm := corev1.ConfigMap{}
key := types.NamespacedName{
Name: assistedCAConfigMapName,
Namespace: ascr.Namespace,
}
Expect(ascr.Get(ctx, key, &cm)).To(Succeed())
Expect(cm.Data[caBundleKey]).To(Equal(testClusterCert + "\n" + testUserCert))
})

Context("IPXE routes", func() {
var (
imageServiceStatefulSet *appsv1.StatefulSet
Expand Down Expand Up @@ -1580,7 +1655,7 @@ var _ = Describe("ensureAssistedServiceDeployment", func() {

found := &appsv1.Deployment{}
Expect(ascr.Client.Get(ctx, types.NamespacedName{Name: serviceName, Namespace: testNamespace}, found)).To(Succeed())
Expect(found.Spec.Template.Spec.Volumes).To(HaveLen(5))
Expect(found.Spec.Template.Spec.Volumes).To(HaveLen(6))
Expect(found.Spec.Template.Spec.Containers[0].VolumeMounts).Should(ContainElement(
corev1.VolumeMount{
Name: mirrorRegistryConfigVolume,
Expand Down Expand Up @@ -1640,7 +1715,25 @@ var _ = Describe("ensureAssistedServiceDeployment", func() {

found := &appsv1.Deployment{}
Expect(ascr.Client.Get(ctx, types.NamespacedName{Name: serviceName, Namespace: testNamespace}, found)).To(Succeed())
Expect(found.Spec.Template.Spec.Volumes).To(HaveLen(5))
Expect(found.Spec.Template.Spec.Volumes).To(HaveLen(6))
Expect(found.Spec.Template.Spec.Volumes).To(ContainElement(
corev1.Volume{
Name: "trusted-ca-certs",
VolumeSource: corev1.VolumeSource{
ConfigMap: &corev1.ConfigMapVolumeSource{
Items: []corev1.KeyToPath{{
Key: caBundleKey,
Path: common.MirrorRegistriesCertificateFile,
}},
LocalObjectReference: corev1.LocalObjectReference{
Name: assistedCAConfigMapName,
},
DefaultMode: swag.Int32(420),
},
},
},
))

Expect(found.Spec.Template.Spec.Containers[0].VolumeMounts).Should(ContainElement(
corev1.VolumeMount{
Name: mirrorRegistryConfigVolume,
Expand All @@ -1649,7 +1742,7 @@ var _ = Describe("ensureAssistedServiceDeployment", func() {
)
Expect(found.Spec.Template.Spec.Containers[0].VolumeMounts).Should(ContainElement(
corev1.VolumeMount{
Name: mirrorRegistryConfigVolume,
Name: "trusted-ca-certs",
MountPath: common.MirrorRegistriesCertificatePath,
SubPath: common.MirrorRegistriesCertificateFile,
}),
Expand Down
3 changes: 2 additions & 1 deletion internal/controller/controllers/common.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,8 @@ import (
)

const (
mirrorRegistryRefCertKey = "ca-bundle.crt"
caBundleKey = "ca-bundle.crt"
mirrorRegistryRefCertKey = caBundleKey
mirrorRegistryRefRegistryConfKey = "registries.conf"
mirrorRegistryConfigVolume = "mirror-registry-config"
WatchResourceLabel = "agent-install.openshift.io/watch"
Expand Down