Skip to content

Commit

Permalink
add ownership for unshared secrets and configmaps
Browse files Browse the repository at this point in the history
  • Loading branch information
@deads2k
deads2k committed Oct 27, 2023
1 parent df8d9d0 commit 41b9b86
Show file tree
Hide file tree
Showing 8 changed files with 62 additions and 23 deletions.
2 changes: 2 additions & 0 deletions bindata/v4.0.0/controller/signing-cabundle.yaml
View file
Expand Up @@ -3,5 +3,7 @@ kind: ConfigMap
metadata:
namespace: openshift-service-ca
name: signing-cabundle
annotations:
openshift.io/owning-component: service-ca
data:
ca-bundle.crt:
2 changes: 2 additions & 0 deletions bindata/v4.0.0/controller/signing-secret.yaml
View file
Expand Up @@ -3,6 +3,8 @@ kind: Secret
metadata:
namespace: openshift-service-ca
name: signing-key
annotations:
openshift.io/owning-component: service-ca
type: kubernetes.io/tls
data:
tls.crt:
Expand Down
3 changes: 3 additions & 0 deletions pkg/controller/api/api.go
View file
Expand Up @@ -13,6 +13,9 @@ const (
// IntermediateDataKey is the key used to identify the post-rotation
// trust-bridging certificate in the signing secret.
IntermediateDataKey = "intermediate-ca.crt"

// OwningJiraComponent is the name of the jira component owns the operator, operand, and the resource its creating
OwningJiraComponent = "service-ca"
)

// Constants for CA bundle injection
Expand Down
6 changes: 6 additions & 0 deletions pkg/controller/cabundleinjector/configmap.go
View file
Expand Up @@ -10,6 +10,7 @@ import (
listers "k8s.io/client-go/listers/core/v1"
"k8s.io/klog/v2"

apiannotations "github.com/openshift/api/annotations"
"github.com/openshift/library-go/pkg/controller/factory"
"github.com/openshift/service-ca-operator/pkg/controller/api"
)
Expand Down Expand Up @@ -109,6 +110,11 @@ func (bi *configMapCABundleInjector) Sync(ctx context.Context, syncCtx factory.S
// make a copy to avoid mutating cache state
configMapCopy := configMap.DeepCopy()
configMapCopy.Data = map[string]string{api.InjectionDataKey: bi.caBundle}
// set the owning-component unless someone else has claimed it.
if len(configMapCopy.Annotations[apiannotations.OpenShiftComponent]) == 0 {
configMapCopy.Annotations[apiannotations.OpenShiftComponent] = api.OwningJiraComponent
}

_, err = bi.client.ConfigMaps(configMapCopy.Namespace).Update(ctx, configMapCopy, metav1.UpdateOptions{})
return err
}
12 changes: 8 additions & 4 deletions pkg/controller/servingcert/controller/secret_creating_controller.go
View file
Expand Up @@ -22,6 +22,7 @@ import (
"k8s.io/client-go/util/cert"
"k8s.io/klog/v2"

apiannotations "github.com/openshift/api/annotations"
"github.com/openshift/library-go/pkg/controller"
"github.com/openshift/library-go/pkg/controller/factory"
"github.com/openshift/library-go/pkg/crypto"
Expand Down Expand Up @@ -327,8 +328,9 @@ func toBaseSecret(service *corev1.Service) *corev1.Secret {
Name: service.Annotations[api.ServingCertSecretAnnotation],
Namespace: service.Namespace,
Annotations: map[string]string{
api.ServiceUIDAnnotation: string(service.UID),
api.ServiceNameAnnotation: service.Name,
api.ServiceUIDAnnotation: string(service.UID),
api.ServiceNameAnnotation: service.Name,
apiannotations.OpenShiftComponent: api.OwningJiraComponent,
},
},
Type: corev1.SecretTypeTLS,
Expand All @@ -340,8 +342,9 @@ func toBaseSecret(service *corev1.Service) *corev1.Secret {
Name: service.Annotations[api.AlphaServingCertSecretAnnotation],
Namespace: service.Namespace,
Annotations: map[string]string{
api.AlphaServiceUIDAnnotation: string(service.UID),
api.AlphaServiceNameAnnotation: service.Name,
api.AlphaServiceUIDAnnotation: string(service.UID),
api.AlphaServiceNameAnnotation: service.Name,
apiannotations.OpenShiftComponent: api.OwningJiraComponent,
},
},
Type: corev1.SecretTypeTLS,
Expand Down Expand Up @@ -407,6 +410,7 @@ func toRequiredSecret(dnsSuffix string, ca *crypto.CA, intermediateCACert *x509.

secretCopy.Annotations[api.AlphaServingCertExpiryAnnotation] = servingCert.Certs[0].NotAfter.Format(time.RFC3339)
secretCopy.Annotations[api.ServingCertExpiryAnnotation] = servingCert.Certs[0].NotAfter.Format(time.RFC3339)
secretCopy.Annotations[apiannotations.OpenShiftComponent] = api.OwningJiraComponent

controller.EnsureOwnerRef(secretCopy, ownerRef(service))

Expand Down
46 changes: 28 additions & 18 deletions pkg/controller/servingcert/controller/secret_creating_controller_test.go
View file
Expand Up @@ -23,6 +23,7 @@ import (
"k8s.io/client-go/util/workqueue"
kubediff "k8s.io/utils/diff"

apiannotations "github.com/openshift/api/annotations"
"github.com/openshift/library-go/pkg/controller/factory"
"github.com/openshift/library-go/pkg/crypto"
"github.com/openshift/library-go/pkg/operator/events"
Expand Down Expand Up @@ -145,8 +146,9 @@ func TestServiceServingCertControllerSync(t *testing.T) {
api.ServingCertCreatedByAnnotation: signerName,
},
expectedSecretAnnotations: map[string]string{
api.AlphaServiceUIDAnnotation: testServiceUID,
api.AlphaServiceNameAnnotation: testServiceName,
api.AlphaServiceUIDAnnotation: testServiceUID,
api.AlphaServiceNameAnnotation: testServiceName,
apiannotations.OpenShiftComponent: api.OwningJiraComponent,
},
updateSecret: true,
updateService: true,
Expand All @@ -162,8 +164,9 @@ func TestServiceServingCertControllerSync(t *testing.T) {
api.ServingCertCreatedByAnnotation: signerName,
},
expectedSecretAnnotations: map[string]string{
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
apiannotations.OpenShiftComponent: api.OwningJiraComponent,
},
updateSecret: true,
updateService: true,
Expand All @@ -180,8 +183,9 @@ func TestServiceServingCertControllerSync(t *testing.T) {
api.ServingCertCreatedByAnnotation: signerName,
},
expectedSecretAnnotations: map[string]string{
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
apiannotations.OpenShiftComponent: api.OwningJiraComponent,
},
updateSecret: true,
updateService: true,
Expand All @@ -201,8 +205,9 @@ func TestServiceServingCertControllerSync(t *testing.T) {
api.ServingCertCreatedByAnnotation: signerName,
},
expectedSecretAnnotations: map[string]string{
api.AlphaServiceUIDAnnotation: testServiceUID,
api.AlphaServiceNameAnnotation: testServiceName,
api.AlphaServiceUIDAnnotation: testServiceUID,
api.AlphaServiceNameAnnotation: testServiceName,
apiannotations.OpenShiftComponent: api.OwningJiraComponent,
},
updateSecret: true,
updateService: true,
Expand All @@ -222,8 +227,9 @@ func TestServiceServingCertControllerSync(t *testing.T) {
api.ServingCertCreatedByAnnotation: signerName,
},
expectedSecretAnnotations: map[string]string{
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
apiannotations.OpenShiftComponent: api.OwningJiraComponent,
},
updateSecret: true,
updateService: true,
Expand Down Expand Up @@ -312,8 +318,9 @@ func TestServiceServingCertControllerSync(t *testing.T) {
},
secretData: generateServerCertPemForCA(t, ca, false),
expectedSecretAnnotations: map[string]string{
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
apiannotations.OpenShiftComponent: api.OwningJiraComponent,
},
expectedServiceAnnotations: map[string]string{
api.ServingCertSecretAnnotation: testSecretName,
Expand All @@ -331,8 +338,9 @@ func TestServiceServingCertControllerSync(t *testing.T) {
},
secretData: generateServerCertPemForCA(t, ca, true),
expectedSecretAnnotations: map[string]string{
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
apiannotations.OpenShiftComponent: api.OwningJiraComponent,
},
expectedServiceAnnotations: map[string]string{
api.ServingCertSecretAnnotation: testSecretName,
Expand All @@ -354,8 +362,9 @@ func TestServiceServingCertControllerSync(t *testing.T) {
api.ServingCertCreatedByAnnotation: signerName,
},
expectedSecretAnnotations: map[string]string{
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
apiannotations.OpenShiftComponent: api.OwningJiraComponent,
},
updateService: true,
updateSecret: true,
Expand All @@ -377,8 +386,9 @@ func TestServiceServingCertControllerSync(t *testing.T) {
api.ServingCertCreatedByAnnotation: signerName,
},
expectedSecretAnnotations: map[string]string{
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
api.ServiceUIDAnnotation: testServiceUID,
api.ServiceNameAnnotation: testServiceName,
apiannotations.OpenShiftComponent: api.OwningJiraComponent,
},
updateService: true,
updateSecret: true,
Expand Down
10 changes: 9 additions & 1 deletion pkg/controller/servingcert/controller/secret_updating_controller.go
View file
Expand Up @@ -16,6 +16,7 @@ import (
listers "k8s.io/client-go/listers/core/v1"
"k8s.io/klog/v2"

apiannotations "github.com/openshift/api/annotations"
ocontroller "github.com/openshift/library-go/pkg/controller"
"github.com/openshift/library-go/pkg/controller/factory"
"github.com/openshift/library-go/pkg/crypto"
Expand Down Expand Up @@ -207,7 +208,14 @@ func (sc *serviceServingCertUpdateController) ensureSecretData(service *v1.Servi
}
return true, nil
}
return update, nil

// set the owning-component unless someone else has claimed it.
if !update && len(secretCopy.Annotations[apiannotations.OpenShiftComponent]) == 0 {
secretCopy.Annotations[apiannotations.OpenShiftComponent] = api.OwningJiraComponent
update = true
}

return false, nil
}

func toServiceName(secret *v1.Secret) (string, bool) {
Expand Down
4 changes: 4 additions & 0 deletions pkg/operator/v4_00_assets/bindata.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit 41b9b86

Please sign in to comment.