Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[oadp-1.2] OADP-639: Pass custom CA configuration to volsync #958

Merged
merged 9 commits into from
Apr 13, 2023
Merged

[oadp-1.2] OADP-639: Pass custom CA configuration to volsync #958

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
ec5e81e
Create a custom CA secret for volsync.
mrnold Mar 13, 2023
7b6e318
Move custom CA secret to its own reconciler.
mrnold Mar 14, 2023
15b2f5c
Validate custom CA configuration earlier.
mrnold Mar 16, 2023
ea40feb
Revert "Validate custom CA configuration earlier."
mrnold Mar 24, 2023
c4e3ee3
Revert "Move custom CA secret to its own reconciler."
mrnold Mar 24, 2023
a917cb4
Revert "Create a custom CA secret for volsync."
mrnold Mar 24, 2023
14aeb1f
Put custom CA in existing restic secret.
mrnold Mar 24, 2023
9b8d48c
Pass along empty custom CA field.
mrnold Mar 24, 2023
f7df5a1
Avoid setting empty custom CA secret.
mrnold Apr 6, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
25 changes: 19 additions & 6 deletions controllers/datamover.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ import (
const (
ResticPassword = "RESTIC_PASSWORD"
ResticRepository = "RESTIC_REPOSITORY"
ResticCustomCAKey = "RESTIC_CUSTOM_CA"
ResticsecretName = "dm-credential"
ResticPruneInterval = "restic-prune-interval"

Expand Down Expand Up @@ -393,6 +394,7 @@ func (r *DPAReconciler) createResticSecretsPerBSL(dpa *oadpv1alpha1.DataProtecti
pruneInterval = strings.ReplaceAll(pruneInterval, `"`, "")
pruneInterval = strings.ReplaceAll(pruneInterval, `'`, "")
}
resticCustomCA := bsl.Spec.ObjectStorage.CACert
rsecret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: fmt.Sprintf("%s-volsync-restic", bsl.Name),
Expand All @@ -412,7 +414,7 @@ func (r *DPAReconciler) createResticSecretsPerBSL(dpa *oadpv1alpha1.DataProtecti
return err
}

return r.buildDataMoverResticSecretForAWS(rsecret, key, secret, bsl.Spec.Config[Region], pass, repo, pruneInterval)
return r.buildDataMoverResticSecretForAWS(rsecret, key, secret, bsl.Spec.Config[Region], pass, repo, pruneInterval, resticCustomCA)
})

if err != nil {
Expand Down Expand Up @@ -463,6 +465,7 @@ func (r *DPAReconciler) createResticSecretsPerBSL(dpa *oadpv1alpha1.DataProtecti
if len(dpa.Spec.Features.DataMover.PruneInterval) > 0 {
pruneInterval = dpa.Spec.Features.DataMover.PruneInterval
}
resticCustomCA := bsl.Spec.ObjectStorage.CACert
// We are done with checks no lets create the azure dm secret
rsecret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Expand All @@ -483,7 +486,7 @@ func (r *DPAReconciler) createResticSecretsPerBSL(dpa *oadpv1alpha1.DataProtecti
return err
}

return r.buildDataMoverResticSecretForAzure(rsecret, accountName, accountKey, pass, repo, pruneInterval)
return r.buildDataMoverResticSecretForAzure(rsecret, accountName, accountKey, pass, repo, pruneInterval, resticCustomCA)
})

if err != nil {
Expand Down Expand Up @@ -519,6 +522,7 @@ func (r *DPAReconciler) createResticSecretsPerBSL(dpa *oadpv1alpha1.DataProtecti
if len(dpa.Spec.Features.DataMover.PruneInterval) > 0 {
pruneInterval = dpa.Spec.Features.DataMover.PruneInterval
}
resticCustomCA := bsl.Spec.ObjectStorage.CACert
// We are done with checks no lets create the gcp dm secret
rsecret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Expand All @@ -539,7 +543,7 @@ func (r *DPAReconciler) createResticSecretsPerBSL(dpa *oadpv1alpha1.DataProtecti
return err
}

return r.buildDataMoverResticSecretForGCP(rsecret, gcpcreds.googleApplicationCredentials, pass, repo, pruneInterval)
return r.buildDataMoverResticSecretForGCP(rsecret, gcpcreds.googleApplicationCredentials, pass, repo, pruneInterval, resticCustomCA)
})

if err != nil {
Expand All @@ -560,7 +564,7 @@ func (r *DPAReconciler) createResticSecretsPerBSL(dpa *oadpv1alpha1.DataProtecti
}

//build data mover restic secret for given aws bsl
func (r *DPAReconciler) buildDataMoverResticSecretForAWS(rsecret *corev1.Secret, key string, secret string, region string, pass []byte, repo string, pruneInterval string) error {
func (r *DPAReconciler) buildDataMoverResticSecretForAWS(rsecret *corev1.Secret, key string, secret string, region string, pass []byte, repo string, pruneInterval string, resticCustomCA []byte) error {

// TODO: add gcp, azure support
rData := &corev1.Secret{
Expand All @@ -573,12 +577,15 @@ func (r *DPAReconciler) buildDataMoverResticSecretForAWS(rsecret *corev1.Secret,
ResticPruneInterval: []byte(pruneInterval),
},
}
if len(resticCustomCA) > 0 {
rData.Data[ResticCustomCAKey] = resticCustomCA
}
rsecret.Data = rData.Data
return nil
}

//build data mover restic secret for given bsl
func (r *DPAReconciler) buildDataMoverResticSecretForAzure(rsecret *corev1.Secret, accountName string, accountKey string, pass []byte, repo string, pruneInterval string) error {
func (r *DPAReconciler) buildDataMoverResticSecretForAzure(rsecret *corev1.Secret, accountName string, accountKey string, pass []byte, repo string, pruneInterval string, resticCustomCA []byte) error {

rData := &corev1.Secret{
Data: map[string][]byte{
Expand All @@ -589,12 +596,15 @@ func (r *DPAReconciler) buildDataMoverResticSecretForAzure(rsecret *corev1.Secre
ResticPruneInterval: []byte(pruneInterval),
},
}
if len(resticCustomCA) > 0 {
rData.Data[ResticCustomCAKey] = resticCustomCA
}
rsecret.Data = rData.Data
return nil
}

//build data mover restic secret for given gcp bsl
func (r *DPAReconciler) buildDataMoverResticSecretForGCP(rsecret *corev1.Secret, googleApplicationCredentials string, pass []byte, repo string, pruneInterval string) error {
func (r *DPAReconciler) buildDataMoverResticSecretForGCP(rsecret *corev1.Secret, googleApplicationCredentials string, pass []byte, repo string, pruneInterval string, resticCustomCA []byte) error {

rData := &corev1.Secret{
Data: map[string][]byte{
Expand All @@ -604,6 +614,9 @@ func (r *DPAReconciler) buildDataMoverResticSecretForGCP(rsecret *corev1.Secret,
ResticPruneInterval: []byte(pruneInterval),
},
}
if len(resticCustomCA) > 0 {
rData.Data[ResticCustomCAKey] = resticCustomCA
}
rsecret.Data = rData.Data
return nil
}
Expand Down