Skip to content

Bug 1769879: allow CA Cert bundles to be trusted #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-robot merged 1 commit into from
Jan 13, 2020
Merged

Bug 1769879: allow CA Cert bundles to be trusted #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions pkg/apis/openstackproviderconfig/v1alpha1/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,9 @@ type OpenstackProviderSpec struct {
// The name of the cloud to use from the clouds secret
CloudName string `json:"cloudName"`

// A plaintext string of PEM(s)
CertBundle string `json:"caCert,omitempty"`

// The flavor reference for the flavor for your server instance.
Flavor string `json:"flavor"`

Expand Down
36 changes: 29 additions & 7 deletions pkg/cloud/openstack/clients/machineservice.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,11 @@ limitations under the License.
package clients

import (
"crypto/tls"
"crypto/x509"
"encoding/base64"
"fmt"
"net/http"
"time"

"github.com/gophercloud/gophercloud/openstack/networking/v2/extensions/security/groups"
Expand Down Expand Up @@ -166,17 +169,16 @@ func NewInstanceServiceFromMachine(kubeClient kubernetes.Interface, machine *mac
return nil, fmt.Errorf("Failed to get cloud from secret (clients/machienservice.go 150): %v", err)
}
}
return NewInstanceServiceFromCloud(cloud)
return NewInstanceServiceFromCloud(cloud, []byte(machineSpec.CertBundle))
}

func NewInstanceService() (*InstanceService, error) {
cloud := clientconfig.Cloud{}
return NewInstanceServiceFromCloud(cloud)
return NewInstanceServiceFromCloud(cloud, nil)
}

func NewInstanceServiceFromCloud(cloud clientconfig.Cloud) (*InstanceService, error) {
func NewInstanceServiceFromCloud(cloud clientconfig.Cloud, cert []byte) (*InstanceService, error) {
clientOpts := new(clientconfig.ClientOpts)
var opts *gophercloud.AuthOptions

if cloud.AuthInfo != nil {
clientOpts.AuthInfo = cloud.AuthInfo
Expand All @@ -186,16 +188,36 @@ func NewInstanceServiceFromCloud(cloud clientconfig.Cloud) (*InstanceService, er
}

opts, err := clientconfig.AuthOptions(clientOpts)

if err != nil {
return nil, err
}

opts.AllowReauth = true
Copy link
Member

@mandre mandre Jan 10, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any reason to drop this option?

According to the documentation:

	// AllowReauth should be set to true if you grant permission for Gophercloud to
	// cache your credentials in memory, and to allow Gophercloud to attempt to
	// re-authenticate automatically if/when your token expires.  If you set it to
	// false, it will not cache these settings, but re-authentication will not be
	// possible.  This setting defaults to false.
	//
	// NOTE: The reauth function will try to re-authenticate endlessly if left
	// unchecked. The way to limit the number of attempts is to provide a custom
	// HTTP client to the provider client and provide a transport that implements
	// the RoundTripper interface and stores the number of failed retries. For an
	// example of this, see here:
	// https://github.com/rackspace/rack/blob/1.0.0/auth/clients.go#L311

Copy link
Author

@iamemilio iamemilio Jan 10, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oops, that was an oversight


provider, err := openstack.AuthenticatedClient(*opts)
provider, err := openstack.NewClient(opts.IdentityEndpoint)
if err != nil {
return nil, fmt.Errorf("Create new provider client failed: %v", err)
}

if cert != nil {
certPool, err := x509.SystemCertPool()
if err != nil {
return nil, fmt.Errorf("Create system cert pool failed: %v", err)
}
certPool.AppendCertsFromPEM(cert)
client := http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{
RootCAs: certPool,
},
},
}
provider.HTTPClient = client
}

err = openstack.Authenticate(provider, *opts)
if err != nil {
return nil, fmt.Errorf("Create providerClient err: %v", err)
return nil, fmt.Errorf("Failed to authenticate provider client: %v", err)
}

identityClient, err := openstack.NewIdentityV3(provider, gophercloud.EndpointOpts{
Expand Down