Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

store openstack external cloud controller ca.cert in a k8s secret instead of the host filesystem #7603

Merged
merged 1 commit into from
May 26, 2021
Merged

store openstack external cloud controller ca.cert in a k8s secret instead of the host filesystem #7603

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 7 additions & 19 deletions roles/kubernetes-apps/external_cloud_controller/openstack/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,31 +2,19 @@
- include_tasks: openstack-credential-check.yml
tags: external-openstack

- name: External OpenStack Cloud Controller | Write cacert file
include_tasks: openstack-write-cacert.yml
run_once: true
loop: "{{ groups['k8s_cluster'] }}"
loop_control:
loop_var: delegate_host_to_write_cacert
- name: External OpenStack Cloud Controller | Get base64 cacert
slurp:
src: "{{ external_openstack_cacert }}"
register: external_openstack_cacert_b64
when:
- inventory_hostname in groups['k8s_cluster']
- inventory_hostname == groups['k8s_control_plane'][0]
- external_openstack_cacert is defined
- external_openstack_cacert | length > 0
tags: external-openstack

- name: External OpenStack Cloud Controller | Write External OpenStack cloud-config
template:
src: "external-openstack-cloud-config.j2"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can't we remove this template file external-openstack-cloud-config.j2 with this pull request?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this actually needs a bit of rethought now that you pointed it out. The external-openstack-cloud-config is rendered onto the first tube controller then it is slurp'ed up and put into the secret, so the answer to your question is no, we cannot remove that file, but I should have not deleted this task in the first place. I pushed a fix for this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@oomichi I modified the logic to avoid writing the external-openstack-cloud-config to any node and write it directly in the Kubernetes secret.

dest: "{{ kube_config_dir }}/external_openstack_cloud_config"
group: "{{ kube_cert_group }}"
mode: 0640
when: inventory_hostname == groups['kube_control_plane'][0]
tags: external-openstack

- name: External OpenStack Cloud Controller | Get base64 cloud-config
slurp:
src: "{{ kube_config_dir }}/external_openstack_cloud_config"
register: external_openstack_cloud_config_secret
set_fact:
external_openstack_cloud_config_secret: "{{ lookup('template', 'external-openstack-cloud-config.j2') | b64encode }}"
when: inventory_hostname == groups['kube_control_plane'][0]
tags: external-openstack

Expand Down
12 changes: 0 additions & 12 deletions roles/kubernetes-apps/external_cloud_controller/openstack/tasks/openstack-write-cacert.yml
View file
Open in desktop

This file was deleted.

1 change: 1 addition & 0 deletions ...ternal_cloud_controller/openstack/templates/external-openstack-cloud-config-secret.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,4 @@ metadata:
namespace: kube-system
data:
cloud.conf: {{ external_openstack_cloud_config_secret.content }}
ca.cert: {{ external_openstack_cacert_b64.content | default("") }}
14 changes: 4 additions & 10 deletions ...loud_controller/openstack/templates/external-openstack-cloud-controller-manager-ds.yml.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,14 +61,14 @@ spec:
- mountPath: /etc/ssl/certs
name: ca-certs
readOnly: true
- mountPath: /etc/config
- mountPath: /etc/config/cloud.conf
name: cloud-config-volume
readOnly: true
{% if external_openstack_cacert is defined and external_openstack_cacert != "" %}
subPath: cloud.conf
- mountPath: {{ kube_config_dir }}/external-openstack-cacert.pem
name: openstack-cacert
name: cloud-config-volume
readOnly: true
{% endif %}
subPath: ca.cert
{% if kubelet_flexvolumes_plugins_dir is defined %}
- mountPath: /usr/libexec/kubernetes/kubelet-plugins/volume/exec
name: flexvolume-dir
Expand Down Expand Up @@ -98,9 +98,3 @@ spec:
- name: cloud-config-volume
secret:
secretName: external-openstack-cloud-config
{% if external_openstack_cacert is defined and external_openstack_cacert != "" %}
- hostPath:
path: {{ kube_config_dir }}/external-openstack-cacert.pem
type: FileOrCreate
name: openstack-cacert
{% endif %}