[certificates] install to ch directory

Author: notandy

charts/kvm-node-agent/templates/daemonset.yaml

@@ -86,6 +86,8 @@ spec:
           name: pki-libvirt
         - mountPath: /pki/qemu
           name: pki-qemu
+        - mountPath: /pki/ch
+          name: pki-ch
       initContainers:
       - command:
         - sh
@@ -138,6 +140,10 @@ spec:
           path: /etc/pki/qemu
           type: DirectoryOrCreate
         name: pki-qemu
+      - hostPath:
+          path: /var/lib/libvirt/pki/ch
+          type: DirectoryOrCreate
+        name: pki-ch
       - hostPath:
           path: /
         name: host

config/manager/manager.yaml

@@ -129,6 +129,8 @@ spec:
           name: pki-libvirt
         - mountPath: /pki/qemu
           name: pki-qemu
+        - mountPath: /pki/ch
+          name: pki-ch
       serviceAccountName: controller-manager
       terminationGracePeriodSeconds: 10
       volumes:
@@ -156,6 +158,10 @@ spec:
         hostPath:
           path: /etc/pki/qemu
           type: DirectoryOrCreate
+      - name: pki-ch
+        hostPath:
+          path: /var/lib/libvirt/pki/ch
+          type: DirectoryOrCreate
       - name: host
         hostPath:
           path: /

internal/certificates/manage_libvirt.go

@@ -125,16 +125,16 @@ func EnsureCertificate(ctx context.Context, c client.Client, host string) error
 }
 
 var secretToFileMap = map[string][]string{
-	"ca.crt":  {"CA/cacert.pem", "qemu/ca-cert.pem"},
-	"tls.crt": {"libvirt/servercert.pem", "qemu/server-cert.pem"},
-	"tls.key": {"libvirt/private/serverkey.pem", "qemu/server-key.pem"},
+	"ca.crt":  {"CA/cacert.pem", "qemu/ca-cert.pem", "ch/ca-cert.pem"},
+	"tls.crt": {"libvirt/servercert.pem", "qemu/server-cert.pem", "ch/server-cert.pem"},
+	"tls.key": {"libvirt/private/serverkey.pem", "qemu/server-key.pem", "ch/server-key.pem"},
 }
 
 var symLinkMap = map[string][]string{
 	"servercert.pem":  {"libvirt/clientcert.pem"},
 	"serverkey.pem":   {"libvirt/private/clientkey.pem"},
-	"server-cert.pem": {"qemu/client-cert.pem"},
-	"server-key.pem":  {"qemu/client-key.pem"},
+	"server-cert.pem": {"qemu/client-cert.pem", "ch/client-cert.pem"},
+	"server-key.pem":  {"qemu/client-key.pem", "ch/client-key.pem"},
 }
 
 func UpdateTLSCertificate(ctx context.Context, data map[string][]byte) error {