Skip to content

Commit f4688de

Browse files
teoincontattoteoincontatto
committed
Merge branch '2908-sgcluster-restore-from-backup-tls-verify-failed' into 'main-1.15'
fix: wal-g s3 CA not used on restore See merge request ongresinc/stackgres!1634
2 parents 572acc0 + 58f1d35 commit f4688de

7 files changed

Lines changed: 137 additions & 305 deletions

File tree

‎stackgres-k8s/e2e/spec/restore‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,13 @@ e2e_test_install() {
66
MINIO_NAME="$CLUSTER_NAME-backup-minio"
77
BUCKET_NAME="$CLUSTER_NAME-backup"
88
MINIO_NAMESPACE="$BACKUP_CLUSTER_NAMESPACE"
9-
install_minio
9+
install_minio \
10+
--set tls.enabled=true \
11+
--set-string tls.certSecret=restore-backup-minio-certs \
12+
--set-string tls.publicCrt=tls.crt \
13+
--set-string tls.privateKey=tls.key
1014

11-
BACKUP_ENDPOINT="http://restore-backup-minio.$BACKUP_CLUSTER_NAMESPACE:9000"
15+
BACKUP_ENDPOINT="https://restore-backup-minio.$BACKUP_CLUSTER_NAMESPACE:9000"
1216
create_or_replace_cluster_only "$BACKUP_CLUSTER_NAME" "$BACKUP_CLUSTER_NAMESPACE" 1 \
1317
-f "$SPEC_FILE.backup.values.yaml" \
1418
--set-string "cluster.postgres.version=$E2E_POSTGRES_VERSION" \
@@ -156,6 +160,9 @@ check_backup_can_be_copied_from_another_namespace() {
156160
kubectl get secret -n "$BACKUP_CLUSTER_NAMESPACE" "$MINIO_NAME" -o json \
157161
| jq ".metadata.namespace = \"$CLUSTER_NAMESPACE\"" \
158162
| kubectl create -f -
163+
kubectl get secret -n "$BACKUP_CLUSTER_NAMESPACE" "$MINIO_NAME"-certs -o json \
164+
| jq ".metadata.namespace = \"$CLUSTER_NAMESPACE\"" \
165+
| kubectl create -f -
159166
TMP_BACKUP="$(kubectl get sgbackups.stackgres.io -n "$BACKUP_CLUSTER_NAMESPACE" "$BACKUP_SOURCE_NAME" -o json \
160167
| jq ".metadata.namespace = \"$CLUSTER_NAMESPACE\" | .metadata.name = \"$BACKUP_NAME\"" \
161168
| jq ".spec.sgCluster = \"$BACKUP_CLUSTER_NAMESPACE.\" + .spec.sgCluster")"

‎stackgres-k8s/e2e/spec/restore.backup.values.yaml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,17 +6,20 @@ configurations:
66
create: true
77
s3Compatible:
88
bucket: restore-backup
9+
enablePathStyleAddressing: true
10+
endpoint: https://restore-backup-minio.restore-backup:9000
11+
region: k8s
912
awsCredentials:
1013
secretKeySelectors:
14+
caCertificate:
15+
key: tls.crt
16+
name: restore-backup-minio-certs
1117
accessKeyId:
1218
name: restore-backup-minio
1319
key: accesskey
1420
secretAccessKey:
1521
name: restore-backup-minio
1622
key: secretkey
17-
region: k8s
18-
enablePathStyleAddressing: true
19-
endpoint: http://restore-backup-minio.restore-backup:9000
2023
cluster:
2124
pods:
2225
persistentVolume:

‎stackgres-k8s/e2e/utils/minio‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,40 @@ install_minio() {
1818
MINIO_NAMESPACE="${MINIO_NAMESPACE:-$CLUSTER_NAMESPACE}"
1919
kubectl create namespace "$MINIO_NAMESPACE" || true
2020

21+
if printf %s "$*" | grep -qF 'tls.enabled=true'
22+
then
23+
cat << EOF > "$LOG_PATH/minio-cert.config"
24+
[req]
25+
distinguished_name = req_distinguished_name
26+
x509_extensions = v3_req
27+
prompt = no
28+
29+
[req_distinguished_name]
30+
C = US
31+
ST = VA
32+
L = Somewhere
33+
O = MyOrg
34+
OU = MyOU
35+
CN = MyServerName
36+
37+
[v3_req]
38+
subjectAltName = @alt_names
39+
40+
[ alt_names ]
41+
DNS.1 = ${MINIO_NAME}.${MINIO_NAMESPACE}
42+
DNS.2 = ${MINIO_NAME}
43+
EOF
44+
45+
openssl genrsa -out "$LOG_PATH/minio-cert.key" 2048
46+
openssl req -new -x509 -nodes \
47+
-keyout "$LOG_PATH/minio-cert.key" \
48+
-out "$LOG_PATH/minio-cert.crt" \
49+
-config "$LOG_PATH/minio-cert.config"
50+
kubectl create secret tls -n "$MINIO_NAMESPACE" "$MINIO_NAME"-certs \
51+
--cert="$LOG_PATH/minio-cert.crt" \
52+
--key="$LOG_PATH/minio-cert.key"
53+
fi
54+
2155
cat << EOF > "$LOG_PATH/minio.yaml"
2256
resources:
2357
requests:

‎stackgres-k8s/install/helm/stackgres-cluster/templates/sgobjectstorage.yaml‎

Lines changed: 8 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -28,92 +28,24 @@ spec:
2828
name: {{ .Release.Name }}-minio
2929
key: secretkey
3030
{{- end }}
31-
{{- if .Values.configurations.objectstorage.s3 }}
31+
{{- with .Values.configurations.objectstorage.s3 }}
3232
type: s3
3333
s3:
34-
bucket: "{{ .Values.configurations.objectstorage.s3.bucket }}"
35-
{{- if .Values.configurations.objectstorage.s3.path }}
36-
path: "{{ .Values.configurations.objectstorage.s3.path }}"
37-
{{- end }}
38-
awsCredentials:
39-
secretKeySelectors:
40-
accessKeyId:
41-
name: "{{ .Values.configurations.objectstorage.s3.awsCredentials.secretKeySelectors.accessKeyId.name }}"
42-
key: "{{ .Values.configurations.objectstorage.s3.awsCredentials.secretKeySelectors.accessKeyId.key }}"
43-
secretAccessKey:
44-
name: "{{ .Values.configurations.objectstorage.s3.awsCredentials.secretKeySelectors.secretAccessKey.name }}"
45-
key: "{{ .Values.configurations.objectstorage.s3.awsCredentials.secretKeySelectors.secretAccessKey.key }}"
46-
{{- if .Values.configurations.objectstorage.s3.region }}
47-
region: "{{ .Values.configurations.objectstorage.s3.region }}"
48-
{{- end }}
49-
{{- if .Values.configurations.objectstorage.s3.storageClass }}
50-
storageClass: "{{ .Values.configurations.objectstorage.s3.storageClass }}"
51-
{{- end }}
34+
{{- toYaml . | nindent 4 }}
5235
{{- end }}
53-
{{- if .Values.configurations.objectstorage.s3Compatible }}
36+
{{- with .Values.configurations.objectstorage.s3Compatible }}
5437
type: s3Compatible
5538
s3Compatible:
56-
bucket: "{{ .Values.configurations.objectstorage.s3Compatible.bucket }}"
57-
{{- if .Values.configurations.objectstorage.s3Compatible.path }}
58-
path: "{{ .Values.configurations.objectstorage.s3Compatible.path }}"
59-
{{- end }}
60-
awsCredentials:
61-
secretKeySelectors:
62-
accessKeyId:
63-
name: "{{ .Values.configurations.objectstorage.s3Compatible.awsCredentials.secretKeySelectors.accessKeyId.name }}"
64-
key: "{{ .Values.configurations.objectstorage.s3Compatible.awsCredentials.secretKeySelectors.accessKeyId.key }}"
65-
secretAccessKey:
66-
name: "{{ .Values.configurations.objectstorage.s3Compatible.awsCredentials.secretKeySelectors.secretAccessKey.name }}"
67-
key: "{{ .Values.configurations.objectstorage.s3Compatible.awsCredentials.secretKeySelectors.secretAccessKey.key }}"
68-
{{- if .Values.configurations.objectstorage.s3Compatible.awsCredentials.secretKeySelectors.caCerrtificate }}
69-
caCerrtificate:
70-
name: "{{ .Values.configurations.objectstorage.s3Compatible.awsCredentials.secretKeySelectors.caCerrtificate.name }}"
71-
key: "{{ .Values.configurations.objectstorage.s3Compatible.awsCredentials.secretKeySelectors.caCerrtificate.key }}"
72-
{{- end }}
73-
{{- if .Values.configurations.objectstorage.s3Compatible.region }}
74-
region: "{{ .Values.configurations.objectstorage.s3Compatible.region }}"
75-
{{- end }}
76-
{{- if .Values.configurations.objectstorage.s3Compatible.endpoint }}
77-
endpoint: "{{ .Values.configurations.objectstorage.s3Compatible.endpoint }}"
78-
{{- end }}
79-
{{- if .Values.configurations.objectstorage.s3Compatible.enablePathStyleAddressing }}
80-
enablePathStyleAddressing: {{ .Values.configurations.objectstorage.s3Compatible.enablePathStyleAddressing }}
81-
{{- end }}
82-
{{- if .Values.configurations.objectstorage.s3Compatible.storageClass }}
83-
storageClass: "{{ .Values.configurations.objectstorage.s3Compatible.storageClass }}"
84-
{{- end }}
39+
{{- toYaml . | nindent 4 }}
8540
{{- end }}
86-
{{- if .Values.configurations.objectstorage.gcs }}
41+
{{- with .Values.configurations.objectstorage.gcs }}
8742
type: gcs
8843
gcs:
89-
bucket: "{{ .Values.configurations.objectstorage.gcs.bucket }}"
90-
{{- if .Values.configurations.objectstorage.gcs.path }}
91-
path: "{{ .Values.configurations.objectstorage.gcs.path }}"
92-
{{- end }}
93-
gcpCredentials:
94-
{{- if .Values.configurations.objectstorage.gcs.gcpCredentials.fetchCredentialsFromMetadataService }}
95-
fetchCredentialsFromMetadataService: {{ .Values.configurations.objectstorage.gcs.gcpCredentials.fetchCredentialsFromMetadataService }}
96-
{{- else }}
97-
secretKeySelectors:
98-
serviceAccountJSON:
99-
name: "{{ .Values.configurations.objectstorage.gcs.gcpCredentials.secretKeySelectors.serviceAccountJSON.name }}"
100-
key: "{{ .Values.configurations.objectstorage.gcs.gcpCredentials.secretKeySelectors.serviceAccountJSON.key }}"
101-
{{- end }}
44+
{{- toYaml . | nindent 4 }}
10245
{{- end }}
103-
{{- if .Values.configurations.objectstorage.azureBlob }}
46+
{{- with .Values.configurations.objectstorage.azureBlob }}
10447
type: azureBlob
10548
azureBlob:
106-
bucket: "{{ .Values.configurations.objectstorage.azureBlob.bucket }}"
107-
{{- if .Values.configurations.objectstorage.azureBlob.path }}
108-
path: "{{ .Values.configurations.objectstorage.azureBlob.path }}"
109-
{{- end }}
110-
azureCredentials:
111-
secretKeySelectors:
112-
storageAccount:
113-
name: "{{ .Values.configurations.objectstorage.azureBlob.azureCredentials.secretKeySelectors.storageAccount.name }}"
114-
key: "{{ .Values.configurations.objectstorage.azureBlob.azureCredentials.secretKeySelectors.storageAccount.key }}"
115-
accessKey:
116-
name: "{{ .Values.configurations.objectstorage.azureBlob.azureCredentials.secretKeySelectors.accessKey.name }}"
117-
key: "{{ .Values.configurations.objectstorage.azureBlob.azureCredentials.secretKeySelectors.accessKey.key }}"
49+
{{- toYaml . | nindent 4 }}
11850
{{- end }}
11951
{{ end }}

0 commit comments

Comments
 (0)