Skip to content

HOSTEDCP-1256: control-plane-pki-operator: add an operator for managing PKI - #3193

Merged
openshift-merge-bot[bot] merged 4 commits into
openshift:mainfrom
stevekuznetsov:skuznets/pki-controller
Nov 30, 2023
Merged

HOSTEDCP-1256: control-plane-pki-operator: add an operator for managing PKI#3193
openshift-merge-bot[bot] merged 4 commits into
openshift:mainfrom
stevekuznetsov:skuznets/pki-controller

Conversation

@stevekuznetsov

@stevekuznetsov stevekuznetsov commented Nov 14, 2023 •
edited
Loading

Copy link
Copy Markdown
Contributor

go.mod: update vendors

Signed-off-by: Steve Kuznetsov skuznets@redhat.com

*: add a control-plane-pki-operator

In the future, we'd like to lean on the library-go approach for PKI
management to gain access to some of the features it provides as well as
increasing the number of engineers who are able to maintain PKI in
HyperShift as we'd no longer be using an in-house solution.

The first step in this process is adding a new controller to manage PKI
for the hosted control planes, and having it manage:

  • a new signer for customers' break-glass credentials
  • a trust bundle of active signers
  • a client certificate and key signed by the currently-valid signer
  • a total client CA bundle (which is, for now, the smae as 2)

The control-plane-operator consumes the total client CA and aggregates
it into the current KAS client CA flow.

Signed-off-by: Steve Kuznetsov skuznets@redhat.com

/assign @sjenning @deads2k

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Nov 14, 2023
@openshift-ci-robot

openshift-ci-robot commented Nov 14, 2023 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@stevekuznetsov: This pull request references HOSTEDCP-1256 which is a valid jira issue.

Details

In response to this:

go.mod: update vendors, bring in library-go

Signed-off-by: Steve Kuznetsov skuznets@redhat.com

control-plane-pki-operator: add an operator for managing PKI

Signed-off-by: Steve Kuznetsov skuznets@redhat.com

/assign @sjenning @deads2k

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

stevekuznetsov
stevekuznetsov commented Nov 14, 2023
View reviewed changes
Comment thread control-plane-pki-operator/certrotationcontroller/certrotationcontroller.go Outdated
Comment thread control-plane-pki-operator/certrotationcontroller/certrotationcontroller.go Outdated
Comment thread control-plane-pki-operator/operator.go
Comment thread control-plane-pki-operator/targetconfigcontroller/targetconfigcontroller.go Outdated
Comment thread control-plane-pki-operator/targetconfigcontroller/targetconfigcontroller.go Outdated
@openshift-ci
openshift-ci Bot requested review from csrwng and enxebre November 14, 2023 19:39
@openshift-ci openshift-ci Bot added area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release and removed do-not-merge/needs-area labels Nov 14, 2023
sjenning
sjenning reviewed Nov 15, 2023
View reviewed changes
Comment thread control-plane-pki-operator/certrotationcontroller/certrotationcontroller.go
certrotation.RotatedSigningCASecret{
Namespace: hostedControlPlane.Namespace,
Name: manifests.CustomerSystemAdminSigner(hostedControlPlane.Namespace).Name,
Validity: 7 * rotationDay,

@sjenning sjenning Nov 15, 2023

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my mind, I was thinking in the neighborhood of 1d validity and 12h rotation.

However, as long as we can adjust later, I'm not inclined to hold up the PR for consensus on this as long as we use something reasonable.

@stevekuznetsov
stevekuznetsov force-pushed the skuznets/pki-controller branch from a3fbeca to 43479e6 Compare November 15, 2023 17:02
@stevekuznetsov

stevekuznetsov commented Nov 15, 2023

Copy link
Copy Markdown
Contributor Author

Added management of the new PKI controller to hypershift-operator - need to add an e2e now.

@openshift-ci openshift-ci Bot added area/ci-tooling Indicates the PR includes changes for CI or tooling area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release labels Nov 15, 2023
@stevekuznetsov
stevekuznetsov force-pushed the skuznets/pki-controller branch from 43479e6 to 4778112 Compare November 15, 2023 17:26
@openshift-ci openshift-ci Bot added the area/testing Indicates the PR includes changes for e2e testing label Nov 15, 2023
@stevekuznetsov
stevekuznetsov force-pushed the skuznets/pki-controller branch 6 times, most recently from 87840de to eac9b6e Compare November 16, 2023 02:40
@netlify

netlify Bot commented Nov 16, 2023 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for hypershift-docs ready!

Name Link
🔨 Latest commit 2d50de6
🔍 Latest deploy log https://app.netlify.com/sites/hypershift-docs/deploys/656615f74d2f7900087fca10
😎 Deploy Preview https://deploy-preview-3193--hypershift-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

enxebre
enxebre reviewed Nov 16, 2023
View reviewed changes
Comment thread test/e2e/break_glass_credentials_test.go Outdated
enxebre
enxebre reviewed Nov 16, 2023
View reviewed changes
Comment thread control-plane-pki-operator/operator.go
enxebre
enxebre reviewed Nov 16, 2023
View reviewed changes
Comment thread control-plane-operator/controllers/hostedcontrolplane/manifests/pki.go Outdated
enxebre
enxebre reviewed Nov 16, 2023
View reviewed changes
Comment thread control-plane-pki-operator/targetconfigcontroller/targetconfigcontroller.go Outdated
enxebre
enxebre reviewed Nov 16, 2023
View reviewed changes
Comment thread test/e2e/break_glass_credentials_test.go Outdated
@enxebre

enxebre commented Nov 16, 2023

Copy link
Copy Markdown
Member

Nice, thanks! please let's make sure before merging we reuse existing e2e test for the new validation, squash commits and document in the PR desc and the operator code what it does concretely e.g. "Combines a CustomerSystemAdminSignerCA within the TotalKASClientCABundle and ensures creation and rotation of a signer and client certs that can be used to create a break glass kubeconfig"?

@stevekuznetsov
stevekuznetsov force-pushed the skuznets/pki-controller branch from 374ffee to 45c905b Compare November 20, 2023 22:03
@stevekuznetsov stevekuznetsov mentioned this pull request Nov 20, 2023
Merged
@stevekuznetsov
stevekuznetsov force-pushed the skuznets/pki-controller branch from 45c905b to cddfe64 Compare November 21, 2023 15:37
@stevekuznetsov

stevekuznetsov commented Nov 21, 2023

Copy link
Copy Markdown
Contributor Author

/retest

@stevekuznetsov

stevekuznetsov commented Nov 21, 2023

Copy link
Copy Markdown
Contributor Author

/test e2e-aws

@stevekuznetsov
stevekuznetsov force-pushed the skuznets/pki-controller branch from cddfe64 to c6db6df Compare November 22, 2023 02:42
sjenning
sjenning reviewed Nov 27, 2023
View reviewed changes
Comment thread hypershift-operator/controllers/hostedcluster/hostedcluster_controller.go Outdated
@hasueki

hasueki commented Nov 27, 2023

Copy link
Copy Markdown
Contributor

/test e2e-ibmcloud-roks
/test e2e-ibmcloud-iks

@stevekuznetsov
stevekuznetsov force-pushed the skuznets/pki-controller branch 2 times, most recently from 2d50de6 to ffcc993 Compare November 28, 2023 16:35
@stevekuznetsov
go.mod: update vendors
b31e91b 
Signed-off-by: Steve Kuznetsov <skuznets@redhat.com>
@stevekuznetsov
stevekuznetsov force-pushed the skuznets/pki-controller branch 3 times, most recently from e858504 to a594f1b Compare November 28, 2023 19:24
@stevekuznetsov
*: add a control-plane-pki-operator
13094ab 
In the future, we'd like to lean on the library-go approach for PKI
management to gain access to some of the features it provides as well as
increasing the number of engineers who are able to maintain PKI in
HyperShift as we'd no longer be using an in-house solution.

The first step in this process is adding a new controller to manage PKI
for the hosted control planes, and having it manage:

 - a new signer for customers' break-glass credentials
 - a trust bundle of active signers
 - a client certificate and key signed by the currently-valid signer
 - a total client CA bundle (which is, for now, the smae as 2)

The control-plane-operator consumes the total client CA and aggregates
it into the current KAS client CA flow.

Signed-off-by: Steve Kuznetsov <skuznets@redhat.com>
@stevekuznetsov
stevekuznetsov force-pushed the skuznets/pki-controller branch from a594f1b to 13094ab Compare November 28, 2023 19:28
@stevekuznetsov
go.mod: update library-go
6c790b9 
Signed-off-by: Steve Kuznetsov <skuznets@redhat.com>
enxebre
enxebre reviewed Nov 29, 2023
View reviewed changes
Comment thread control-plane-pki-operator/topology/detector.go Outdated
@stevekuznetsov
stevekuznetsov force-pushed the skuznets/pki-controller branch 2 times, most recently from fb18245 to 0c53faa Compare November 29, 2023 14:18
@stevekuznetsov
control-plane-pki-operator: added HCP topology detection
9d6c02a 
Signed-off-by: Steve Kuznetsov <skuznets@redhat.com>
@stevekuznetsov
stevekuznetsov force-pushed the skuznets/pki-controller branch from 0c53faa to 9d6c02a Compare November 29, 2023 14:20
@stevekuznetsov

stevekuznetsov commented Nov 29, 2023

Copy link
Copy Markdown
Contributor Author

/test all

@sjenning

sjenning commented Nov 29, 2023

Copy link
Copy Markdown
Contributor

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Nov 29, 2023
@openshift-ci-robot

openshift-ci-robot commented Nov 29, 2023

Copy link
Copy Markdown

/retest-required

Remaining retests: 0 against base HEAD c4685bf and 2 for PR HEAD 9d6c02a in total

@sjenning

sjenning commented Nov 29, 2023

Copy link
Copy Markdown
Contributor

/retest-required

1 similar comment
@stevekuznetsov

stevekuznetsov commented Nov 30, 2023

Copy link
Copy Markdown
Contributor Author

/retest-required

@openshift-merge-bot
openshift-merge-bot Bot merged commit 860031e into openshift:main Nov 30, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sjenning sjenning sjenning left review comments
@enxebre enxebre enxebre left review comments
@csrwng csrwng csrwng left review comments
@deads2k deads2k deads2k left review comments

Assignees

@sjenning sjenning

@deads2k deads2k

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. area/ci-tooling Indicates the PR includes changes for CI or tooling area/cli Indicates the PR includes changes for CLI area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release area/testing Indicates the PR includes changes for e2e testing jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@stevekuznetsov @openshift-ci-robot @enxebre @sjenning @hasueki @csrwng @deads2k @openshift-merge-robot