Skip to content

Generate network config secrets for baremetal platform #5247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-robot merged 2 commits into from
Dec 6, 2021
Merged

Generate network config secrets for baremetal platform #5247

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
02e47c0
Bump baremetal-operator dependency to 20211201170610-92ffa60c683d
andfasano Dec 3, 2021
b42680f
baremetal: generate network config secrets
andfasano Sep 27, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 8 additions & 4 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,9 @@ require (
github.com/hashicorp/terraform-provider-kubernetes v1.13.3
github.com/hashicorp/terraform-provider-vsphere v1.24.3
github.com/libvirt/libvirt-go v5.10.0+incompatible
github.com/metal3-io/baremetal-operator v0.0.0-20210706141527-5240e42f012a
github.com/metal3-io/baremetal-operator v0.0.0-20211201170610-92ffa60c683d
github.com/metal3-io/baremetal-operator/apis v0.0.0
github.com/metal3-io/baremetal-operator/pkg/hardwareutils v0.0.0
github.com/metal3-io/cluster-api-provider-baremetal v0.0.0
github.com/mitchellh/cli v1.1.1
github.com/openshift-metal3/terraform-provider-ironic v0.2.6
Expand Down Expand Up @@ -197,6 +198,7 @@ require (
github.com/fatih/camelcase v1.0.0 // indirect
github.com/fatih/color v1.10.0 // indirect
github.com/form3tech-oss/jwt-go v3.2.3+incompatible // indirect
github.com/fsnotify/fsnotify v1.4.9 // indirect
github.com/gammazero/deque v0.0.0-20190130191400-2afb3858e9c7 // indirect
github.com/gammazero/workerpool v0.0.0-20190406235159-88d534f22b56 // indirect
github.com/go-errors/errors v1.0.1 // indirect
Expand Down Expand Up @@ -345,6 +347,7 @@ require (
golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac // indirect
golang.org/x/tools v0.1.2 // indirect
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
gomodules.xyz/jsonpatch/v2 v2.1.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/protobuf v1.27.1 // indirect
gopkg.in/go-playground/validator.v9 v9.31.0 // indirect
Expand All @@ -362,7 +365,7 @@ require (
k8s.io/kube-aggregator v0.22.0-rc.0 // indirect
k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e // indirect
k8s.io/kubectl v0.22.0 // indirect
sigs.k8s.io/controller-runtime v0.9.6 // indirect
sigs.k8s.io/controller-runtime v0.9.7 // indirect
sigs.k8s.io/kustomize/api v0.8.5 // indirect
sigs.k8s.io/kustomize/kyaml v0.10.15 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.1.2 // indirect
Expand All @@ -377,8 +380,9 @@ replace (
github.com/hashicorp/terraform => github.com/openshift/terraform v0.12.20-openshift-4 // Pin to fork with deduplicated rpc types v0.12.20-openshift-4
github.com/hashicorp/terraform-plugin-sdk => github.com/openshift/hashicorp-terraform-plugin-sdk v1.14.0-openshift // Pin to fork with public rpc types
github.com/hashicorp/terraform-provider-vsphere => github.com/openshift/terraform-provider-vsphere v1.24.3-openshift
github.com/metal3-io/baremetal-operator => github.com/openshift/baremetal-operator v0.0.0-20210706141527-5240e42f012a // Use OpenShift fork
github.com/metal3-io/baremetal-operator/apis => github.com/openshift/baremetal-operator/apis v0.0.0-20210706141527-5240e42f012a // Use OpenShift fork
github.com/metal3-io/baremetal-operator => github.com/openshift/baremetal-operator v0.0.0-20211201170610-92ffa60c683d // Use OpenShift fork
github.com/metal3-io/baremetal-operator/apis => github.com/openshift/baremetal-operator/apis v0.0.0-20211201170610-92ffa60c683d // Use OpenShift fork
github.com/metal3-io/baremetal-operator/pkg/hardwareutils => github.com/openshift/baremetal-operator/pkg/hardwareutils v0.0.0-20211201170610-92ffa60c683d // Use OpenShift fork
github.com/metal3-io/cluster-api-provider-baremetal => github.com/openshift/cluster-api-provider-baremetal v0.0.0-20190821174549-a2a477909c1d // Pin OpenShift fork
github.com/openshift/client-go => github.com/openshift/client-go v0.0.0-20200929181438-91d71ef2122c // Pin client-go
github.com/openshift/machine-config-operator => github.com/openshift/machine-config-operator v0.0.1-0.20201009041932-4fe8559913b8 // Pin MCO so it doesn't get downgraded
Expand Down
65 changes: 11 additions & 54 deletions go.sum
View file
Open in desktop

Large diffs are not rendered by default.

23 changes: 23 additions & 0 deletions pkg/asset/machines/baremetal/hosts.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,23 @@ type HostSettings struct {
// Secrets holds the credential information for communicating with
// the management controllers on the hosts.
Secrets []corev1.Secret
// NetworkConfigSecrets holds the networking configuration defined
// on the host.
NetworkConfigSecrets []corev1.Secret
}

func createNetworkConfigSecret(host *baremetal.Host) corev1.Secret {
return corev1.Secret{
TypeMeta: metav1.TypeMeta{
APIVersion: "v1",
Kind: "Secret",
},
ObjectMeta: metav1.ObjectMeta{
Name: fmt.Sprintf("%s-network-config-secret", host.Name),
Namespace: "openshift-machine-api",
},
Data: map[string][]byte{"nmstate": []byte(host.NetworkConfig)},
}
}

func createSecret(host *baremetal.Host) (*corev1.Secret, baremetalhost.BMCDetails) {
Expand Down Expand Up @@ -103,6 +120,12 @@ func Hosts(config *types.InstallConfig, machines []machineapi.Machine) (*HostSet
}
newHost := createBaremetalHost(host, bmc)

if host.NetworkConfig != "" {
networkConfigSecret := createNetworkConfigSecret(host)
settings.NetworkConfigSecrets = append(settings.NetworkConfigSecrets, networkConfigSecret)
newHost.Spec.PreprovisioningNetworkDataName = networkConfigSecret.Name
}

if !host.IsWorker() && numMasters < numRequiredMasters {
// Setting ExternallyProvisioned to true and adding a
// ConsumerRef without setting Image associates the host
Expand Down
111 changes: 79 additions & 32 deletions pkg/asset/machines/baremetal/hosts_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ func TestHosts(t *testing.T) {
Config: configHosts(hostType("master-0").bmc("usr0", "pwd0").role("master")),

ExpectedSetting: settings().
secrets(secret("master-0-bmc-secret").data("usr0", "pwd0")).
secrets(secret("master-0-bmc-secret").creds("usr0", "pwd0")).
hosts(host("master-0").consumerRef("machine-0").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned()).build(),
},
{
Expand All @@ -56,9 +56,27 @@ func TestHosts(t *testing.T) {
Config: configHosts(hostType("master-0").bmc("usr0", "pwd0")),

ExpectedSetting: settings().
secrets(secret("master-0-bmc-secret").data("usr0", "pwd0")).
secrets(secret("master-0-bmc-secret").creds("usr0", "pwd0")).
hosts(host("master-0").consumerRef("machine-0").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned()).build(),
},
{
Scenario: "network-config",
Machines: machines(machine("machine-0")),
Config: configHosts(
hostType("master-0").
bmc("usr0", "pwd0").
networkConfig("interface:")),

ExpectedSetting: settings().
secrets(secret("master-0-bmc-secret").creds("usr0", "pwd0")).
networkConfigSecrets(secret("master-0-network-config-secret").nmstate("interface:")).
hosts(
host("master-0").
consumerRef("machine-0").
annotation("baremetalhost.metal3.io/paused", "").
preprovisioningNetworkDataName("master-0-network-config-secret").
externallyProvisioned()).build(),
},
{
Scenario: "3-hosts-3-machines-norole-all",
Machines: machines(
Expand All @@ -72,9 +90,9 @@ func TestHosts(t *testing.T) {

ExpectedSetting: settings().
secrets(
secret("master-0-bmc-secret").data("usr0", "pwd0"),
secret("master-1-bmc-secret").data("usr1", "pwd1"),
secret("master-2-bmc-secret").data("usr2", "pwd2")).
secret("master-0-bmc-secret").creds("usr0", "pwd0"),
secret("master-1-bmc-secret").creds("usr1", "pwd1"),
secret("master-2-bmc-secret").creds("usr2", "pwd2")).
hosts(
host("master-0").consumerRef("machine-0").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
host("master-1").consumerRef("machine-1").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
Expand All @@ -94,10 +112,10 @@ func TestHosts(t *testing.T) {

ExpectedSetting: settings().
secrets(
secret("master-0-bmc-secret").data("usr0", "pwd0"),
secret("master-1-bmc-secret").data("usr1", "pwd1"),
secret("master-2-bmc-secret").data("usr2", "pwd2"),
secret("master-3-bmc-secret").data("usr3", "pwd3")).
secret("master-0-bmc-secret").creds("usr0", "pwd0"),
secret("master-1-bmc-secret").creds("usr1", "pwd1"),
secret("master-2-bmc-secret").creds("usr2", "pwd2"),
secret("master-3-bmc-secret").creds("usr3", "pwd3")).
hosts(
host("master-0").consumerRef("machine-0").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
host("master-1").consumerRef("machine-1").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
Expand All @@ -118,10 +136,10 @@ func TestHosts(t *testing.T) {

ExpectedSetting: settings().
secrets(
secret("master-0-bmc-secret").data("usr0", "pwd0"),
secret("master-1-bmc-secret").data("usr1", "pwd1"),
secret("master-2-bmc-secret").data("usr2", "pwd2"),
secret("worker-0-bmc-secret").data("wrk0", "pwd0")).
secret("master-0-bmc-secret").creds("usr0", "pwd0"),
secret("master-1-bmc-secret").creds("usr1", "pwd1"),
secret("master-2-bmc-secret").creds("usr2", "pwd2"),
secret("worker-0-bmc-secret").creds("wrk0", "pwd0")).
hosts(
host("master-0").consumerRef("machine-0").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
host("master-1").consumerRef("machine-1").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
Expand All @@ -143,11 +161,11 @@ func TestHosts(t *testing.T) {

ExpectedSetting: settings().
secrets(
secret("master-0-bmc-secret").data("usr0", "pwd0"),
secret("master-1-bmc-secret").data("usr1", "pwd1"),
secret("master-2-bmc-secret").data("usr2", "pwd2"),
secret("worker-0-bmc-secret").data("wrk0", "pwd0"),
secret("worker-1-bmc-secret").data("wrk1", "pwd1")).
secret("master-0-bmc-secret").creds("usr0", "pwd0"),
secret("master-1-bmc-secret").creds("usr1", "pwd1"),
secret("master-2-bmc-secret").creds("usr2", "pwd2"),
secret("worker-0-bmc-secret").creds("wrk0", "pwd0"),
secret("worker-1-bmc-secret").creds("wrk1", "pwd1")).
hosts(
host("master-0").consumerRef("machine-0").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
host("master-1").consumerRef("machine-1").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
Expand All @@ -170,11 +188,11 @@ func TestHosts(t *testing.T) {

ExpectedSetting: settings().
secrets(
secret("master-1-bmc-secret").data("usr1", "pwd1"),
secret("worker-0-bmc-secret").data("wrk0", "pwd0"),
secret("worker-1-bmc-secret").data("wrk1", "pwd1"),
secret("master-0-bmc-secret").data("usr0", "pwd0"),
secret("master-2-bmc-secret").data("usr2", "pwd2")).
secret("master-1-bmc-secret").creds("usr1", "pwd1"),
secret("worker-0-bmc-secret").creds("wrk0", "pwd0"),
secret("worker-1-bmc-secret").creds("wrk1", "pwd1"),
secret("master-0-bmc-secret").creds("usr0", "pwd0"),
secret("master-2-bmc-secret").creds("usr2", "pwd2")).
hosts(
host("master-1").consumerRef("machine-0").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
host("worker-0"),
Expand All @@ -196,10 +214,10 @@ func TestHosts(t *testing.T) {

ExpectedSetting: settings().
secrets(
secret("worker-0-bmc-secret").data("wrk0", "pwd0"),
secret("master-0-bmc-secret").data("usr0", "pwd0"),
secret("master-1-bmc-secret").data("usr1", "pwd1"),
secret("master-2-bmc-secret").data("usr2", "pwd2")).
secret("worker-0-bmc-secret").creds("wrk0", "pwd0"),
secret("master-0-bmc-secret").creds("usr0", "pwd0"),
secret("master-1-bmc-secret").creds("usr1", "pwd1"),
secret("master-2-bmc-secret").creds("usr2", "pwd2")).
hosts(
host("worker-0"),
host("master-0").consumerRef("machine-0").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
Expand All @@ -220,10 +238,10 @@ func TestHosts(t *testing.T) {

ExpectedSetting: settings().
secrets(
secret("master-0-bmc-secret").data("usr0", "pwd0"),
secret("master-1-bmc-secret").data("usr1", "pwd1"),
secret("master-2-bmc-secret").data("usr2", "pwd2"),
secret("worker-0-bmc-secret").data("wrk0", "pwd0")).
secret("master-0-bmc-secret").creds("usr0", "pwd0"),
secret("master-1-bmc-secret").creds("usr1", "pwd1"),
secret("master-2-bmc-secret").creds("usr2", "pwd2"),
secret("worker-0-bmc-secret").creds("wrk0", "pwd0")).
hosts(
host("master-0").consumerRef("machine-0").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
host("master-1").consumerRef("machine-1").annotation("baremetalhost.metal3.io/paused", "").externallyProvisioned(),
Expand All @@ -248,6 +266,10 @@ func TestHosts(t *testing.T) {
for i, s := range tc.ExpectedSetting.Secrets {
assert.Equal(t, s, settings.Secrets[i], s.Name, fmt.Sprintf("%s and %s are not equal", s.Name, settings.Secrets[i].Name))
}

for i, s := range tc.ExpectedSetting.NetworkConfigSecrets {
assert.Equal(t, s, settings.NetworkConfigSecrets[i], s.Name, fmt.Sprintf("%s and %s are not equal", s.Name, settings.NetworkConfigSecrets[i].Name))
}
}
})
}
Expand Down Expand Up @@ -318,6 +340,11 @@ func (htb *hostTypeBuilder) bmc(user, password string) *hostTypeBuilder {
return htb
}

func (htb *hostTypeBuilder) networkConfig(config string) *hostTypeBuilder {
htb.NetworkConfig = config
return htb
}

type machineBuilder struct {
machineapi.Machine
}
Expand Down Expand Up @@ -409,6 +436,11 @@ func (hb *hostBuilder) consumerRef(name string) *hostBuilder {
return hb
}

func (hb *hostBuilder) preprovisioningNetworkDataName(secretName string) *hostBuilder {
hb.Spec.PreprovisioningNetworkDataName = secretName
return hb
}

type secretBuilder struct {
corev1.Secret
}
Expand All @@ -428,14 +460,21 @@ func secret(name string) *secretBuilder {
}
}

func (sb *secretBuilder) data(user, password string) *secretBuilder {
func (sb *secretBuilder) creds(user, password string) *secretBuilder {
sb.Data = map[string][]byte{
"username": []byte(user),
"password": []byte(password),
}
return sb
}

func (sb *secretBuilder) nmstate(config string) *secretBuilder {
sb.Data = map[string][]byte{
"nmstate": []byte(config),
}
return sb
}

func (sb *secretBuilder) build() *corev1.Secret {
return &sb.Secret
}
Expand All @@ -452,6 +491,14 @@ func (hsb *hostSettingsBuilder) secrets(builders ...*secretBuilder) *hostSetting
return hsb
}

func (hsb *hostSettingsBuilder) networkConfigSecrets(builders ...*secretBuilder) *hostSettingsBuilder {
hsb.Secrets = []corev1.Secret{}
for _, sb := range builders {
hsb.NetworkConfigSecrets = append(hsb.NetworkConfigSecrets, *sb.build())
}
return hsb
}

func (hsb *hostSettingsBuilder) hosts(builders ...*hostBuilder) *hostSettingsBuilder {
hsb.Hosts = []baremetalhost.BareMetalHost{}
for _, hb := range builders {
Expand Down
Loading