Skip to content

Commit

Permalink
Adding TLS options to the sign logic.
Browse files Browse the repository at this point in the history 
When checking if the `signed` image already exist or when pulling the
image to sign, we should be able to set some TLS options.

This flow follows the same logic we have for builds.

Signed-off-by: Yoni Bettan <yonibettan@gmail.com>
  • Loading branch information
@ybettan
ybettan committed Nov 24, 2022
1 parent 65421fe commit c8e6fcd
Show file tree
Hide file tree
Showing 9 changed files with 152 additions and 17 deletions.
4 changes: 4 additions & 0 deletions api/v1beta1/module_types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,10 @@ type Sign struct {
// Image to sign, ignored if a Build is present, required otherwise
UnsignedImage string `json:"unsignedImage,omitempty"`

// +optional
// UnsignedImageRegistryTLS contains settings determining how to access registries of the unsigned image.
UnsignedImageRegistryTLS TLSOptions `json:"baseImageRegistryTLS"`

// a secret containing the private key used to sign kernel modules for secureboot
KeySecret *v1.LocalObjectReference `json:"keySecret"`

Expand Down
1 change: 1 addition & 0 deletions api/v1beta1/zz_generated.deepcopy.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

32 changes: 32 additions & 0 deletions config/crd/bases/kmm.sigs.k8s.io_managedclustermodules.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2168,6 +2168,22 @@ spec:
description: Sign enables in-cluster signing for
this mapping
properties:
baseImageRegistryTLS:
description: UnsignedImageRegistryTLS contains
settings determining how to access registries
of the unsigned image.
properties:
insecure:
description: If Insecure is true, the operator
will be able to access a registry in an
insecure (plain HTTP) protocol.
type: boolean
insecureSkipTLSVerify:
description: If InsecureSkipTLSVerify, the
operator will accept any certificate provided
by the registry.
type: boolean
type: object
certSecret:
description: a secret containing the public
key used to sign kernel modules for secureboot
Expand Down Expand Up @@ -2301,6 +2317,22 @@ spec:
sign:
description: Sign provides default kmod signing settings
properties:
baseImageRegistryTLS:
description: UnsignedImageRegistryTLS contains settings
determining how to access registries of the unsigned
image.
properties:
insecure:
description: If Insecure is true, the operator
will be able to access a registry in an insecure
(plain HTTP) protocol.
type: boolean
insecureSkipTLSVerify:
description: If InsecureSkipTLSVerify, the operator
will accept any certificate provided by the
registry.
type: boolean
type: object
certSecret:
description: a secret containing the public key used
to sign kernel modules for secureboot
Expand Down
31 changes: 31 additions & 0 deletions config/crd/bases/kmm.sigs.k8s.io_modules.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2074,6 +2074,22 @@ spec:
description: Sign enables in-cluster signing for this
mapping
properties:
baseImageRegistryTLS:
description: UnsignedImageRegistryTLS contains settings
determining how to access registries of the unsigned
image.
properties:
insecure:
description: If Insecure is true, the operator
will be able to access a registry in an insecure
(plain HTTP) protocol.
type: boolean
insecureSkipTLSVerify:
description: If InsecureSkipTLSVerify, the operator
will accept any certificate provided by the
registry.
type: boolean
type: object
certSecret:
description: a secret containing the public key
used to sign kernel modules for secureboot
Expand Down Expand Up @@ -2206,6 +2222,21 @@ spec:
sign:
description: Sign provides default kmod signing settings
properties:
baseImageRegistryTLS:
description: UnsignedImageRegistryTLS contains settings
determining how to access registries of the unsigned
image.
properties:
insecure:
description: If Insecure is true, the operator will
be able to access a registry in an insecure (plain
HTTP) protocol.
type: boolean
insecureSkipTLSVerify:
description: If InsecureSkipTLSVerify, the operator
will accept any certificate provided by the registry.
type: boolean
type: object
certSecret:
description: a secret containing the public key used to
sign kernel modules for secureboot
Expand Down
6 changes: 4 additions & 2 deletions internal/sign/job/manager.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,15 +25,17 @@ func NewSignJobManager(signer Signer, helper sign.Helper, jobHelper utils.JobHel
}
}

func (jbm *signJobManager) Sync(ctx context.Context, mod kmmv1beta1.Module, m kmmv1beta1.KernelMapping, targetKernel string, imageToSign string, targetImage string, pushImage bool) (utils.Result, error) {
func (jbm *signJobManager) Sync(ctx context.Context, mod kmmv1beta1.Module, m kmmv1beta1.KernelMapping, targetKernel,
imageToSign, targetImage string, pushImage bool) (utils.Result, error) {
logger := log.FromContext(ctx)

logger.Info("Signing in-cluster")

signConfig := jbm.helper.GetRelevantSign(mod, m)
jobLabels := jbm.jobHelper.JobLabels(mod, targetKernel, "sign")

jobTemplate, err := jbm.signer.MakeJobTemplate(mod, signConfig, targetKernel, imageToSign, targetImage, jobLabels, pushImage)
jobTemplate, err := jbm.signer.MakeJobTemplate(mod, signConfig, targetKernel, imageToSign, targetImage,
jobLabels, pushImage, m.RegistryTLS)
if err != nil {
return utils.Result{}, fmt.Errorf("could not make Job template: %v", err)
}
Expand Down
18 changes: 12 additions & 6 deletions internal/sign/job/manager_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,8 @@ var _ = Describe("JobManager", func() {
helper.EXPECT().GetRelevantSign(mod, km).Return(km.Sign),

jobhelper.EXPECT().JobLabels(mod, kernelVersion, "sign").Return(labels),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage, labels, true).Return(&j, nil),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage,
labels, true, nil).Return(&j, nil),
jobhelper.EXPECT().GetModuleJobByKernel(ctx, mod, kernelVersion, utils.JobTypeSign).Return(&newJob, nil),
jobhelper.EXPECT().IsJobChanged(&j, &newJob).Return(false, nil),
jobhelper.EXPECT().GetJobStatus(&newJob).Return(r.Status, r.Requeue, joberr),
Expand Down Expand Up @@ -119,7 +120,8 @@ var _ = Describe("JobManager", func() {
gomock.InOrder(
helper.EXPECT().GetRelevantSign(mod, km).Return(km.Sign),
jobhelper.EXPECT().JobLabels(mod, kernelVersion, "sign").Return(labels),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage, labels, true).Return(nil, errors.New("random error")),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage,
labels, true, nil).Return(nil, errors.New("random error")),
)

mgr := NewSignJobManager(maker, helper, jobhelper)
Expand Down Expand Up @@ -147,7 +149,8 @@ var _ = Describe("JobManager", func() {
gomock.InOrder(
helper.EXPECT().GetRelevantSign(mod, km).Return(km.Sign),
jobhelper.EXPECT().JobLabels(mod, kernelVersion, "sign").Return(labels),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage, labels, true).Return(&j, nil),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage,
labels, true, nil).Return(&j, nil),
jobhelper.EXPECT().GetModuleJobByKernel(ctx, mod, kernelVersion, utils.JobTypeSign).Return(nil, errors.New("random error")),
)

Expand Down Expand Up @@ -176,7 +179,8 @@ var _ = Describe("JobManager", func() {
gomock.InOrder(
helper.EXPECT().GetRelevantSign(mod, km).Return(km.Sign),
jobhelper.EXPECT().JobLabels(mod, kernelVersion, "sign").Return(labels),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage, labels, true).Return(&j, nil),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage,
labels, true, nil).Return(&j, nil),
jobhelper.EXPECT().GetModuleJobByKernel(ctx, mod, kernelVersion, utils.JobTypeSign).Return(nil, utils.ErrNoMatchingJob),
jobhelper.EXPECT().CreateJob(ctx, &j).Return(errors.New("unable to create job")),
)
Expand Down Expand Up @@ -207,7 +211,8 @@ var _ = Describe("JobManager", func() {
gomock.InOrder(
helper.EXPECT().GetRelevantSign(mod, km).Return(km.Sign),
jobhelper.EXPECT().JobLabels(mod, kernelVersion, "sign").Return(labels),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage, labels, true).Return(&j, nil),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage,
labels, true, nil).Return(&j, nil),
jobhelper.EXPECT().GetModuleJobByKernel(ctx, mod, kernelVersion, utils.JobTypeSign).Return(nil, utils.ErrNoMatchingJob),
jobhelper.EXPECT().CreateJob(ctx, &j).Return(nil),
)
Expand Down Expand Up @@ -239,7 +244,8 @@ var _ = Describe("JobManager", func() {
gomock.InOrder(
helper.EXPECT().GetRelevantSign(mod, km).Return(km.Sign),
jobhelper.EXPECT().JobLabels(mod, kernelVersion, "sign").Return(labels),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage, labels, true).Return(&newJob, nil),
maker.EXPECT().MakeJobTemplate(mod, km.Sign, kernelVersion, previousImageName, km.ContainerImage,
labels, true, nil).Return(&newJob, nil),
jobhelper.EXPECT().GetModuleJobByKernel(ctx, mod, kernelVersion, utils.JobTypeSign).Return(&newJob, nil),
jobhelper.EXPECT().IsJobChanged(&newJob, &newJob).Return(true, nil),
jobhelper.EXPECT().DeleteJob(ctx, &newJob).Return(nil),
Expand Down
8 changes: 4 additions & 4 deletions internal/sign/job/mock_signer.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

25 changes: 23 additions & 2 deletions internal/sign/job/signer.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,8 @@ import (
//go:generate mockgen -source=signer.go -package=signjob -destination=mock_signer.go

type Signer interface {
MakeJobTemplate(mod kmmv1beta1.Module, signConfig *kmmv1beta1.Sign, targetKernel string, imageToSign string, targetImage string, labels map[string]string, pushImage bool) (*batchv1.Job, error)
MakeJobTemplate(mod kmmv1beta1.Module, signConfig *kmmv1beta1.Sign, targetKernel, imageToSign, targetImage string,
labels map[string]string, pushImage bool, registryTLS *kmmv1beta1.TLSOptions) (*batchv1.Job, error)
}

type signer struct {
Expand All @@ -28,7 +29,9 @@ func NewSigner(scheme *runtime.Scheme) Signer {
return &signer{scheme: scheme}
}

func (m *signer) MakeJobTemplate(mod kmmv1beta1.Module, signConfig *kmmv1beta1.Sign, targetKernel string, imageToSign string, targetImage string, labels map[string]string, pushImage bool) (*batchv1.Job, error) {
func (m *signer) MakeJobTemplate(mod kmmv1beta1.Module, signConfig *kmmv1beta1.Sign, targetKernel, imageToSign, targetImage string,
labels map[string]string, pushImage bool, registryTLS *kmmv1beta1.TLSOptions) (*batchv1.Job, error) {

var args []string

if pushImage {
Expand Down Expand Up @@ -66,6 +69,24 @@ func (m *signer) MakeJobTemplate(mod kmmv1beta1.Module, signConfig *kmmv1beta1.S
volumeMounts = append(volumeMounts, utils.MakeSecretVolumeMount(mod.Spec.ImageRepoSecret, "/docker_config"))
}

if signConfig.UnsignedImageRegistryTLS.Insecure {
args = append(args, "--insecure-pull")
}

if signConfig.UnsignedImageRegistryTLS.InsecureSkipTLSVerify {
args = append(args, "--skip-tls-verify-pull")
}

if registryTLS != nil {
if registryTLS.Insecure {
args = append(args, "--insecure")
}

if registryTLS.InsecureSkipTLSVerify {
args = append(args, "--skip-tls-verify")
}
}

job := &batchv1.Job{
ObjectMeta: metav1.ObjectMeta{
GenerateName: mod.Name + "-sign-",
Expand Down
44 changes: 41 additions & 3 deletions internal/sign/job/signer_test.go
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
package signjob

import (
"strings"

"github.com/golang/mock/gomock"
"github.com/google/go-cmp/cmp"
kmmv1beta1 "github.com/kubernetes-sigs/kernel-module-management/api/v1beta1"
Expand All @@ -11,7 +13,6 @@ import (
v1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/utils/pointer"
"strings"
)

var _ = Describe("MakeJobTemplate", func() {
Expand Down Expand Up @@ -184,7 +185,7 @@ var _ = Describe("MakeJobTemplate", func() {
mod := mod.DeepCopy()
mod.Spec.Selector = nodeSelector

actual, err := m.MakeJobTemplate(*mod, km.Sign, kernelVersion, unsignedImage, signedImage, labels, true)
actual, err := m.MakeJobTemplate(*mod, km.Sign, kernelVersion, unsignedImage, signedImage, labels, true, nil)
Expect(err).NotTo(HaveOccurred())

Expect(
Expand Down Expand Up @@ -212,7 +213,7 @@ var _ = Describe("MakeJobTemplate", func() {
FilesToSign: filelist,
}

actual, err := m.MakeJobTemplate(mod, signConfig, kernelVersion, "", signedImage, labels, pushFlag)
actual, err := m.MakeJobTemplate(mod, signConfig, kernelVersion, "", signedImage, labels, pushFlag, nil)
Expect(err).NotTo(HaveOccurred())
Expect(actual.Spec.Template.Spec.Containers[0].Args).To(ContainElement("-unsignedimage"))
Expect(actual.Spec.Template.Spec.Containers[0].Args).To(ContainElement("-pullsecret"))
Expand Down Expand Up @@ -246,4 +247,41 @@ var _ = Describe("MakeJobTemplate", func() {
false,
),
)

DescribeTable("should set correct kaniko TLS flags", func(registryTLS *kmmv1beta1.TLSOptions, s kmmv1beta1.Sign, kanikoFlag string) {

actual, err := m.MakeJobTemplate(mod, &s, kernelVersion, unsignedImage, signedImage, labels, false, registryTLS)
Expect(err).NotTo(HaveOccurred())
Expect(actual.Spec.Template.Spec.Containers[0].Args).To(ContainElement(kanikoFlag))

},
Entry(
"UnsignedImageRegistryTLS.Insecure",
nil,
kmmv1beta1.Sign{
UnsignedImageRegistryTLS: kmmv1beta1.TLSOptions{Insecure: true},
},
"--insecure-pull",
),
Entry(
"UnsignedImageRegistryTLS.InsecureSkipTLSVerify",
nil,
kmmv1beta1.Sign{
UnsignedImageRegistryTLS: kmmv1beta1.TLSOptions{InsecureSkipTLSVerify: true},
},
"--skip-tls-verify-pull",
),
Entry(
"RegistryTLS.Insecure",
&kmmv1beta1.TLSOptions{Insecure: true},
nil,
"--insecure",
),
Entry(
"RegistryTLS.InsecureSkipTLSVerify",
&kmmv1beta1.TLSOptions{InsecureSkipTLSVerify: true},
nil,
"--skip-tls-verify",
),
)
})

0 comments on commit c8e6fcd

Please sign in to comment.