clair: Consume CA certs provided in configBundleSecret (PROJQUAY-3589)

- Add CA cert to mounted secret in clair config - This is required to connect to external db behind custom tls - Include cluster-trusted-ca in Quay, Clair, Mirror, and Editor pods
quay · Apr 19, 2022 · e7011f7 · e7011f7
1 parent 622c25a
commit e7011f7
Show file tree

Hide file tree

Showing 6 changed files with 30 additions and 8 deletions.
diff --git a/.gitignore b/.gitignore
@@ -1,4 +1,5 @@
 bin
 tmp
 cover.out
-kubeconfig
+kubeconfig
+.DS_Store
diff --git a/kustomize/base/config.deployment.yaml b/kustomize/base/config.deployment.yaml
@@ -25,8 +25,12 @@ spec:
             - secret: 
                 name: quay-config-tls
         - name: extra-ca-certs
-          configMap:
-            name: cluster-service-ca
+          projected:
+            sources:
+              - configMap:
+                  name: cluster-service-ca
+              - configMap:
+                  name: cluster-trusted-ca
       containers:
         - name: quay-config-editor
           image: quay.io/projectquay/quay@sha256:5660d7174218e1cb21bf6ef406602dbe8c01c878c630a9f310fe3e5560d4c2cd

diff --git a/kustomize/base/quay.deployment.yaml b/kustomize/base/quay.deployment.yaml
@@ -25,8 +25,12 @@ spec:
             - secret:
                 name: quay-config-tls
         - name: extra-ca-certs
-          configMap:
-            name: cluster-service-ca
+          projected:
+            sources:
+              - configMap:
+                  name: cluster-service-ca
+              - configMap:
+                  name: cluster-trusted-ca
       containers:
         - name: quay-app
           image: quay.io/projectquay/quay@sha256:5660d7174218e1cb21bf6ef406602dbe8c01c878c630a9f310fe3e5560d4c2cd

diff --git a/kustomize/components/clair/clair.deployment.yaml b/kustomize/components/clair/clair.deployment.yaml
@@ -40,6 +40,8 @@ spec:
                 secretKeyRef:
                   name: quay-proxy-config
                   key: NO_PROXY
+            - name: SSL_CERT_DIR
+              value: $SSL_CERT_DIR:/clair/
           ports:
             - containerPort: 8080
               name: clair-http
@@ -93,4 +95,6 @@ spec:
                   name: quay-config-tls
               - configMap: 
                   name: cluster-service-ca
+              - configMap:
+                  name: cluster-trusted-ca
 
diff --git a/kustomize/components/mirror/mirror.deployment.yaml b/kustomize/components/mirror/mirror.deployment.yaml
@@ -31,8 +31,8 @@ spec:
             sources:
               - configMap:
                   name: cluster-service-ca
-              - secret:
-                  name: quay-config-tls
+              - configMap:
+                  name: cluster-trusted-ca
       initContainers:
         - name: quay-mirror-init
           image: quay.io/projectquay/quay@sha256:5660d7174218e1cb21bf6ef406602dbe8c01c878c630a9f310fe3e5560d4c2cd

diff --git a/pkg/kustomize/secrets.go b/pkg/kustomize/secrets.go
@@ -337,6 +337,8 @@ func componentConfigFilesFor(log logr.Logger, qctx *quaycontext.QuayRegistryCont
 			"database-root-password": []byte(databaseRootPassword),
 		}, nil
 	case v1.ComponentClair:
+		cfgFiles := make(map[string][]byte)
+
 		quayHostname := ""
 		if v1.ComponentIsManaged(quay.Spec.Components, "route") {
 			config := decode(configFiles["route.config.yaml"])
@@ -350,6 +352,12 @@ func componentConfigFilesFor(log logr.Logger, qctx *quaycontext.QuayRegistryCont
 			}
 		}
 
+		for key, val := range configFiles {
+			if strings.HasPrefix(key, "clair_extra_ca_cert_") {
+				cfgFiles[strings.TrimPrefix(key, "clair_extra_ca_cert_")] = val
+			}
+		}
+
 		if quayHostname == "" {
 			return nil, fmt.Errorf("cannot configure managed security scanner, `SERVER_HOSTNAME` is not set anywhere")
 		}
@@ -364,8 +372,9 @@ func componentConfigFilesFor(log logr.Logger, qctx *quaycontext.QuayRegistryCont
 		if err != nil {
 			return nil, err
 		}
+		cfgFiles["config.yaml"] = cfg
 
-		return map[string][]byte{"config.yaml": cfg}, nil
+		return cfgFiles, nil
 	default:
 		return nil, nil
 	}