From 52444cf3c88c00ab6aefb8791656c81c4e904e63 Mon Sep 17 00:00:00 2001 From: josebb Date: Thu, 2 Dec 2021 19:00:35 +0200 Subject: [PATCH] Support TLS endpoints in barbican This allows barbican to consume TLS openstack endpoints. Jobs consume openstack endpoints, typically identity endpoints. And barbican itself interact with other openstack services via endpoints. Change-Id: I890f909fc6466b696ee64aa7dfdd528934fccb2d --- barbican/Chart.yaml | 2 +- barbican/templates/deployment-api.yaml | 6 +++--- barbican/templates/job-bootstrap.yaml | 2 +- barbican/templates/job-ks-endpoints.yaml | 2 +- barbican/templates/job-ks-service.yaml | 2 +- barbican/templates/job-ks-user.yaml | 2 +- barbican/values.yaml | 5 +++++ barbican/values_overrides/tls-offloading.yaml | 12 ++++++++++++ releasenotes/notes/barbican.yaml | 1 + 9 files changed, 26 insertions(+), 8 deletions(-) create mode 100644 barbican/values_overrides/tls-offloading.yaml diff --git a/barbican/Chart.yaml b/barbican/Chart.yaml index 2f346cb491..d3c5be8e14 100644 --- a/barbican/Chart.yaml +++ b/barbican/Chart.yaml @@ -14,7 +14,7 @@ apiVersion: v1 appVersion: v1.0.0 description: OpenStack-Helm Barbican name: barbican -version: 0.2.18 +version: 0.2.19 home: https://docs.openstack.org/barbican/latest/ icon: https://www.openstack.org/themes/openstack/images/project-mascots/Barbican/OpenStack_Project_Barbican_vertical.png sources: diff --git a/barbican/templates/deployment-api.yaml b/barbican/templates/deployment-api.yaml index 6bb7dd05f2..4e281d9104 100644 --- a/barbican/templates/deployment-api.yaml +++ b/barbican/templates/deployment-api.yaml @@ -65,7 +65,7 @@ spec: - /tmp/barbican.sh - start env: -{{- if .Values.manifests.certificates }} +{{- if or .Values.manifests.certificates .Values.tls.identity }} - name: REQUESTS_CA_BUNDLE value: "/etc/barbican/certs/ca.crt" {{- end }} @@ -119,7 +119,7 @@ spec: subPath: barbican.sh readOnly: true {{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal "path" "/etc/mysql/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }} -{{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.key_manager.api.internal "path" "/etc/barbican/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }} +{{- dict "enabled" (or .Values.manifests.certificates .Values.tls.identity) "name" .Values.secrets.tls.key_manager.api.internal "path" "/etc/barbican/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }} {{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal "path" "/etc/rabbitmq/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }} {{ if $mounts_barbican_api.volumeMounts }}{{ toYaml $mounts_barbican_api.volumeMounts | indent 12 }}{{ end }} @@ -137,7 +137,7 @@ spec: name: barbican-bin defaultMode: 0555 {{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }} -{{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.key_manager.api.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }} +{{- dict "enabled" (or .Values.manifests.certificates .Values.tls.identity) "name" .Values.secrets.tls.key_manager.api.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }} {{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }} {{ if $mounts_barbican_api.volumes }}{{ toYaml $mounts_barbican_api.volumes | indent 8 }}{{ end }} diff --git a/barbican/templates/job-bootstrap.yaml b/barbican/templates/job-bootstrap.yaml index 7555aec912..da4392daf6 100644 --- a/barbican/templates/job-bootstrap.yaml +++ b/barbican/templates/job-bootstrap.yaml @@ -24,7 +24,7 @@ helm.sh/hook-weight: "5" {{- if .Values.pod.tolerations.barbican.enabled -}} {{- $_ := set $bootstrapJob "tolerationsEnabled" true -}} {{- end -}} -{{- if .Values.manifests.certificates -}} +{{- if or .Values.manifests.certificates .Values.tls.identity -}} {{- $_ := set $bootstrapJob "tlsSecret" .Values.secrets.tls.key_manager.api.internal -}} {{- end -}} {{ $bootstrapJob | include "helm-toolkit.manifests.job_bootstrap" }} diff --git a/barbican/templates/job-ks-endpoints.yaml b/barbican/templates/job-ks-endpoints.yaml index 248a54f3a4..cd5d9bc85a 100644 --- a/barbican/templates/job-ks-endpoints.yaml +++ b/barbican/templates/job-ks-endpoints.yaml @@ -24,7 +24,7 @@ helm.sh/hook-weight: "-2" {{- if .Values.pod.tolerations.barbican.enabled -}} {{- $_ := set $ksServiceJob "tolerationsEnabled" true -}} {{- end -}} -{{- if .Values.manifests.certificates -}} +{{- if or .Values.manifests.certificates .Values.tls.identity -}} {{- $_ := set $ksServiceJob "tlsSecret" .Values.secrets.tls.key_manager.api.internal -}} {{- end -}} {{ $ksServiceJob | include "helm-toolkit.manifests.job_ks_endpoints" }} diff --git a/barbican/templates/job-ks-service.yaml b/barbican/templates/job-ks-service.yaml index 7a05e53311..08a93d0ba0 100644 --- a/barbican/templates/job-ks-service.yaml +++ b/barbican/templates/job-ks-service.yaml @@ -24,7 +24,7 @@ helm.sh/hook-weight: "-3" {{- if .Values.pod.tolerations.barbican.enabled -}} {{- $_ := set $ksServiceJob "tolerationsEnabled" true -}} {{- end -}} -{{- if .Values.manifests.certificates -}} +{{- if or .Values.manifests.certificates .Values.tls.identity -}} {{- $_ := set $ksServiceJob "tlsSecret" .Values.secrets.tls.key_manager.api.internal -}} {{- end -}} {{ $ksServiceJob | include "helm-toolkit.manifests.job_ks_service" }} diff --git a/barbican/templates/job-ks-user.yaml b/barbican/templates/job-ks-user.yaml index 6900013164..c74bf31d32 100644 --- a/barbican/templates/job-ks-user.yaml +++ b/barbican/templates/job-ks-user.yaml @@ -24,7 +24,7 @@ helm.sh/hook-weight: "-1" {{- if .Values.pod.tolerations.barbican.enabled -}} {{- $_ := set $ksUserJob "tolerationsEnabled" true -}} {{- end -}} -{{- if .Values.manifests.certificates -}} +{{- if or .Values.manifests.certificates .Values.tls.identity -}} {{- $_ := set $ksUserJob "tlsSecret" .Values.secrets.tls.key_manager.api.internal -}} {{- end -}} {{ $ksUserJob | include "helm-toolkit.manifests.job_ks_user" }} diff --git a/barbican/values.yaml b/barbican/values.yaml index 0e0a45c78d..93b7661fa5 100644 --- a/barbican/values.yaml +++ b/barbican/values.yaml @@ -677,6 +677,11 @@ endpoints: ingress: default: 80 +tls: + identity: false + oslo_messaging: false + oslo_db: false + manifests: certificates: false configmap_bin: true diff --git a/barbican/values_overrides/tls-offloading.yaml b/barbican/values_overrides/tls-offloading.yaml new file mode 100644 index 0000000000..99fbe5a412 --- /dev/null +++ b/barbican/values_overrides/tls-offloading.yaml @@ -0,0 +1,12 @@ +--- +endpoints: + identity: + auth: + admin: + cacert: /etc/ssl/certs/openstack-helm.crt + barbican: + cacert: /etc/ssl/certs/openstack-helm.crt + +tls: + identity: true +... diff --git a/releasenotes/notes/barbican.yaml b/releasenotes/notes/barbican.yaml index bd576cd5ee..2b5b682c95 100644 --- a/releasenotes/notes/barbican.yaml +++ b/releasenotes/notes/barbican.yaml @@ -22,4 +22,5 @@ barbican: - 0.2.16 Distinguish between port number of internal endpoint and binding port number - 0.2.17 Use HTTP probe instead of TCP probe - 0.2.18 Support TLS for ks jobs + - 0.2.19 Support SSL offloading at reverse proxy for internal and admin endpoints ...