Skip to content

Commit 14c4502

Browse files
xekxek
committed
Revert "Add fernet key rotation cronjob"
This reverts commit bc7a60b.
1 parent f8f0cae commit 14c4502

7 files changed

Lines changed: 6 additions & 243 deletions

File tree

‎api/bases/keystone.openstack.org_keystoneapis.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -105,11 +105,6 @@ spec:
105105
days
106106
format: int32
107107
type: integer
108-
fernetRotationSchedule:
109-
default: 1 0 * * *
110-
description: FernetRotationSchedule - Schedule rotate fernet token
111-
keys
112-
type: string
113108
memcachedInstance:
114109
default: memcached
115110
description: Memcached instance name.

‎api/v1beta1/keystoneapi_types.go‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -130,11 +130,6 @@ type KeystoneAPISpecCore struct {
130130
// FernetRotationDays - Rotate fernet token keys every X days
131131
FernetRotationDays *int32 `json:"fernetRotationDays"`
132132

133-
// +kubebuilder:validation:Optional
134-
// +kubebuilder:default="1 0 * * *"
135-
// FernetRotationSchedule - Schedule rotate fernet token keys
136-
FernetRotationSchedule string `json:"fernetRotationSchedule"`
137-
138133
// +kubebuilder:validation:Optional
139134
// +kubebuilder:default=5
140135
// FernetMaxActiveKeys - Maximum number of fernet token keys after rotation
@@ -289,16 +284,6 @@ func (instance KeystoneAPI) RbacResourceName() string {
289284
return "keystone-" + instance.Name
290285
}
291286

292-
// KeystoneAPIFernet - used to create different role for fernet key rotation
293-
type KeystoneAPIFernet struct {
294-
*KeystoneAPI
295-
}
296-
297-
// RbacResourceName - return the name to be used for rbac objects used for fernet key rotation (serviceaccount, role, rolebinding)
298-
func (instance KeystoneAPIFernet) RbacResourceName() string {
299-
return "keystone-fernet-" + instance.Name
300-
}
301-
302287
// SetupDefaults - initializes any CRD field defaults based on environment variables (the defaulting mechanism itself is implemented via webhooks)
303288
func SetupDefaults() {
304289
// Acquire environmental defaults and initialize Keystone defaults with them

‎api/v1beta1/zz_generated.deepcopy.go‎

Lines changed: 0 additions & 20 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/keystone.openstack.org_keystoneapis.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -105,11 +105,6 @@ spec:
105105
days
106106
format: int32
107107
type: integer
108-
fernetRotationSchedule:
109-
default: 1 0 * * *
110-
description: FernetRotationSchedule - Schedule rotate fernet token
111-
keys
112-
type: string
113108
memcachedInstance:
114109
default: memcached
115110
description: Memcached instance name.

‎controllers/keystoneapi_controller.go‎

Lines changed: 4 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -469,29 +469,6 @@ func (r *KeystoneAPIReconciler) reconcileInit(
469469
return rbacResult, nil
470470
}
471471

472-
//
473-
// Service account, role, binding for fernet key rotation
474-
//
475-
fernetRbacRules := []rbacv1.PolicyRule{
476-
{
477-
APIGroups: []string{"security.openshift.io"},
478-
ResourceNames: []string{"anyuid"},
479-
Resources: []string{"securitycontextconstraints"},
480-
Verbs: []string{"use"},
481-
},
482-
{
483-
APIGroups: []string{""},
484-
Resources: []string{"secrets"},
485-
Verbs: []string{"patch"},
486-
},
487-
}
488-
fernetRbacResult, err := common_rbac.ReconcileRbac(ctx, helper, keystonev1.KeystoneAPIFernet{KeystoneAPI: instance}, fernetRbacRules)
489-
if err != nil {
490-
return fernetRbacResult, err
491-
} else if (rbacResult != ctrl.Result{}) {
492-
return fernetRbacResult, nil
493-
}
494-
495472
//
496473
// run keystone db sync
497474
//
@@ -1104,35 +1081,14 @@ func (r *KeystoneAPIReconciler) reconcileNormal(
11041081
}
11051082
}
11061083

1107-
// create Trust Flush CronJob
1084+
// create CronJob
11081085
cronjobDef := keystone.CronJob(instance, serviceLabels, serviceAnnotations)
1109-
trustflushjob := cronjob.NewCronJob(
1086+
cronjob := cronjob.NewCronJob(
11101087
cronjobDef,
11111088
5*time.Second,
11121089
)
11131090

1114-
ctrlResult, err = trustflushjob.CreateOrPatch(ctx, helper)
1115-
if err != nil {
1116-
instance.Status.Conditions.Set(condition.FalseCondition(
1117-
condition.CronJobReadyCondition,
1118-
condition.ErrorReason,
1119-
condition.SeverityWarning,
1120-
condition.CronJobReadyErrorMessage,
1121-
err.Error()))
1122-
return ctrlResult, err
1123-
}
1124-
1125-
instance.Status.Conditions.MarkTrue(condition.CronJobReadyCondition, condition.CronJobReadyMessage)
1126-
// create Trust Flush CronJob - end
1127-
1128-
// create Fernet Key Rotation CronJob
1129-
fernetjobDef := keystone.FernetCronJob(instance, serviceLabels, serviceAnnotations)
1130-
fernetjob := cronjob.NewCronJob(
1131-
fernetjobDef,
1132-
5*time.Second,
1133-
)
1134-
1135-
ctrlResult, err = fernetjob.CreateOrPatch(ctx, helper)
1091+
ctrlResult, err = cronjob.CreateOrPatch(ctx, helper)
11361092
if err != nil {
11371093
instance.Status.Conditions.Set(condition.FalseCondition(
11381094
condition.CronJobReadyCondition,
@@ -1144,7 +1100,7 @@ func (r *KeystoneAPIReconciler) reconcileNormal(
11441100
}
11451101

11461102
instance.Status.Conditions.MarkTrue(condition.CronJobReadyCondition, condition.CronJobReadyMessage)
1147-
// create Fernet Key Rotation CronJob - end
1103+
// create CronJob - end
11481104

11491105
//
11501106
// create OpenStackClient config

‎pkg/keystone/fernet.go‎

Lines changed: 0 additions & 146 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,6 @@ package keystone
1818
import (
1919
"encoding/base64"
2020
"math/rand"
21-
"strconv"
22-
23-
keystonev1 "github.com/openstack-k8s-operators/keystone-operator/api/v1beta1"
24-
"github.com/openstack-k8s-operators/lib-common/modules/common/env"
25-
26-
batchv1 "k8s.io/api/batch/v1"
27-
corev1 "k8s.io/api/core/v1"
28-
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2921
)
3022

3123
// GenerateFernetKey -
@@ -36,141 +28,3 @@ func GenerateFernetKey() string {
3628
}
3729
return base64.StdEncoding.EncodeToString(data)
3830
}
39-
40-
const (
41-
// FernetRotationCommand -
42-
FernetRotationCommand = `
43-
echo $(date -u) Starting...
44-
case $MAX_ACTIVE_KEYS in
45-
''|*[!0-9]*)
46-
echo "MAX_ACTIVE_KEYS is not a number, exiting."
47-
exit 1
48-
;;
49-
[01])
50-
echo "MAX_ACTIVE_KEYS ($MAX_ACTIVE_KEYS) -lt 2, exiting."
51-
exit 1
52-
esac
53-
54-
cd /var/lib/fernet-keys
55-
mkdir /tmp/keys
56-
for file in [0-9]*;
57-
do
58-
cat "$file" > /tmp/keys/"${file}"
59-
done
60-
61-
cd /tmp/keys
62-
63-
number_of_keys=$(ls -1 | wc -l)
64-
max_key=$(ls -1 | sort -n | tail -1)
65-
66-
if [ $((number_of_keys - 1)) != $max_key ]; then
67-
echo "Corrupted FernetKeys secret, exiting."
68-
exit 1
69-
fi
70-
71-
mv 0 $((max_key + 1))
72-
dd if=/dev/urandom bs=32 count=1 2>/dev/null | base64 > 0
73-
74-
while [ -f "$MAX_ACTIVE_KEYS" ]; do
75-
i=2
76-
while [ -f "$i" ]; do
77-
mv $i $((i-1))
78-
i=$((i+1))
79-
done
80-
done
81-
82-
echo '{"stringData": {' > /tmp/patch_file.json
83-
i=0
84-
while [ -f "$((i+1))" ]; do
85-
echo '"FernetKeys'$i'": "'$(cat $i)'",' >> /tmp/patch_file.json
86-
i=$((i+1))
87-
done
88-
echo '"FernetKeys'$i'": "'$(cat $i)'"' >> /tmp/patch_file.json
89-
echo '}}' >> /tmp/patch_file.json
90-
91-
kubectl patch secret -n $NAMESPACE $SECRET_NAME \
92-
--patch-file=/tmp/patch_file.json
93-
echo $(date -u) $((i+1)) keys rotated.
94-
`
95-
)
96-
97-
// FernetCronJob func
98-
func FernetCronJob(
99-
keystoneapiinstance *keystonev1.KeystoneAPI,
100-
labels map[string]string,
101-
annotations map[string]string,
102-
) *batchv1.CronJob {
103-
instance := &keystonev1.KeystoneAPIFernet{KeystoneAPI: keystoneapiinstance}
104-
runAsUser := int64(0)
105-
suspend := false
106-
successfulJobsHistoryLimit := int32(3)
107-
failedJobsHistoryLimit := int32(1)
108-
109-
args := []string{"-c", FernetRotationCommand}
110-
111-
envVars := map[string]env.Setter{}
112-
envVars["KOLLA_CONFIG_STRATEGY"] = env.SetValue("COPY_ALWAYS")
113-
envVars["SECRET_NAME"] = env.SetValue(ServiceName)
114-
envVars["MAX_ACTIVE_KEYS"] = env.SetValue(
115-
strconv.Itoa(int(*instance.Spec.FernetMaxActiveKeys)))
116-
117-
backoffLimit := int32(0)
118-
parallelism := int32(1)
119-
completions := int32(1)
120-
121-
// create Volume and VolumeMounts
122-
volumes := getVolumes(keystoneapiinstance)
123-
volumeMounts := getVolumeMounts()
124-
125-
cronjob := &batchv1.CronJob{
126-
ObjectMeta: metav1.ObjectMeta{
127-
Name: ServiceName + "-fernet-cronjob",
128-
Namespace: instance.Namespace,
129-
},
130-
Spec: batchv1.CronJobSpec{
131-
Schedule: instance.Spec.FernetRotationSchedule,
132-
Suspend: &suspend,
133-
ConcurrencyPolicy: batchv1.ForbidConcurrent,
134-
SuccessfulJobsHistoryLimit: &successfulJobsHistoryLimit,
135-
FailedJobsHistoryLimit: &failedJobsHistoryLimit,
136-
JobTemplate: batchv1.JobTemplateSpec{
137-
ObjectMeta: metav1.ObjectMeta{
138-
Annotations: annotations,
139-
Labels: labels,
140-
},
141-
Spec: batchv1.JobSpec{
142-
BackoffLimit: &backoffLimit,
143-
Parallelism: &parallelism,
144-
Completions: &completions,
145-
Template: corev1.PodTemplateSpec{
146-
Spec: corev1.PodSpec{
147-
Containers: []corev1.Container{
148-
{
149-
Name: ServiceName + "-fernet-job",
150-
Image: instance.Spec.FernetRotationContainerImage,
151-
Command: []string{
152-
"/bin/bash",
153-
},
154-
Args: args,
155-
Env: env.MergeEnvs([]corev1.EnvVar{}, envVars),
156-
VolumeMounts: volumeMounts,
157-
SecurityContext: &corev1.SecurityContext{
158-
RunAsUser: &runAsUser,
159-
},
160-
},
161-
},
162-
Volumes: volumes,
163-
RestartPolicy: corev1.RestartPolicyNever,
164-
ServiceAccountName: instance.RbacResourceName(),
165-
},
166-
},
167-
},
168-
},
169-
},
170-
}
171-
if instance.Spec.NodeSelector != nil && len(instance.Spec.NodeSelector) > 0 {
172-
cronjob.Spec.JobTemplate.Spec.Template.Spec.NodeSelector = instance.Spec.NodeSelector
173-
}
174-
175-
return cronjob
176-
}

‎pkg/keystone/volumes.go‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,11 @@ import (
2222
)
2323

2424
// getVolumes - service volumes
25-
func getVolumes(keystoneapiinstance *keystonev1.KeystoneAPI) []corev1.Volume {
26-
name := keystoneapiinstance.Name
25+
func getVolumes(instance *keystonev1.KeystoneAPI) []corev1.Volume {
26+
name := instance.Name
2727
var scriptsVolumeDefaultMode int32 = 0755
2828
var config0640AccessMode int32 = 0640
2929

30-
instance := &keystonev1.KeystoneAPIFernet{KeystoneAPI: keystoneapiinstance}
31-
3230
fernetKeys := []corev1.KeyToPath{}
3331
numberKeys := int(*instance.Spec.FernetMaxActiveKeys)
3432

0 commit comments

Comments
 (0)