Skip to content

Commit 507f58b

Browse files
slawqoslawqo
committed
Generate OVN RBAC PKI
This patch adds generation of the rootca-ovn-rbac issuer which is used by the ovn-operator to sign per-node ovn-controller RBAC certificates. This CA is intentionally not added to the combined CA bundle as it is only used between the SB database and ovn-controller nodes. When TLS is enabled, the reconciler passes the RBAC CA cert secret name to the SB DB cluster and the RBAC issuer name to OVNController so the ovn-operator can create cert-manager Certificate resources and verify client connections. Related: #OSPRH-1921 Related: #OSPRH-1922 Signed-off-by: Slawek Kaplonski <skaplons@redhat.com>
1 parent e795160 commit 507f58b

14 files changed

Lines changed: 263 additions & 3 deletions

‎api/bases/core.openstack.org_openstackcontrolplanes.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13083,6 +13083,8 @@ spec:
1308313083
ovsLogLevel:
1308413084
default: info
1308513085
type: string
13086+
rbacIssuerName:
13087+
type: string
1308613088
resources:
1308713089
properties:
1308813090
claims:
@@ -13217,6 +13219,8 @@ spec:
1321713219
default: 60000
1321813220
format: int32
1321913221
type: integer
13222+
rbacCACertSecretName:
13223+
type: string
1322013224
replicas:
1322113225
default: 1
1322213226
format: int32

‎api/core/v1beta1/openstackcontrolplane_types.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,8 @@ const (
6161
OvnDbCaName = tls.DefaultCAPrefix + "ovn"
6262
// LibvirtCaName -
6363
LibvirtCaName = tls.DefaultCAPrefix + "libvirt"
64+
// OvnRbacCaName -
65+
OvnRbacCaName = tls.DefaultCAPrefix + "ovn-rbac"
6466

6567
// GlanceName - Default Glance name
6668
GlanceName = "glance"
@@ -1244,6 +1246,11 @@ func (instance OpenStackControlPlane) GetOvnIssuer() string {
12441246
return OvnDbCaName
12451247
}
12461248

1249+
// GetOvnRbacIssuer - returns the OVN RBAC CA issuer name
1250+
func (instance OpenStackControlPlane) GetOvnRbacIssuer() string {
1251+
return OvnRbacCaName
1252+
}
1253+
12471254
// GetLibvirtIssuer - returns the libvirt CA issuer name or custom if configured
12481255
func (instance OpenStackControlPlane) GetLibvirtIssuer() string {
12491256
// use custom issuer if set

‎bindata/crds/crds.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13617,6 +13617,8 @@ spec:
1361713617
ovsLogLevel:
1361813618
default: info
1361913619
type: string
13620+
rbacIssuerName:
13621+
type: string
1362013622
resources:
1362113623
properties:
1362213624
claims:
@@ -13751,6 +13753,8 @@ spec:
1375113753
default: 60000
1375213754
format: int32
1375313755
type: integer
13756+
rbacCACertSecretName:
13757+
type: string
1375413758
replicas:
1375513759
default: 1
1375613760
format: int32

‎bindata/crds/ovn.openstack.org_ovncontrollers.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,13 @@ spec:
164164
description: OVSLogLevel - Set log level off, emer, err, warn, info,
165165
or dbg. Default is info.
166166
type: string
167+
rbacIssuerName:
168+
description: |-
169+
RbacIssuerName - The name of the cert-manager Issuer used to sign
170+
per-node ovn-controller RBAC certificates. When set, the controller
171+
creates cert-manager Certificate resources for each node instead of
172+
signing certificates locally with the CA key.
173+
type: string
167174
resources:
168175
description: |-
169176
Resources - Compute Resources required by this service (Limits/Requests).

‎bindata/crds/ovn.openstack.org_ovndbclusters.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,12 @@ spec:
266266
Active probe interval from standby to active ovsdb-server remote
267267
format: int32
268268
type: integer
269+
rbacCACertSecretName:
270+
description: |-
271+
RbacCACertSecretName - The name of the K8s Secret containing the RBAC
272+
PKI CA certificate (tls.crt). Used by the SB database to verify
273+
ovn-controller client certificates when RBAC is enabled.
274+
type: string
269275
replicas:
270276
default: 1
271277
description: Replicas of OVN DBCluster to run

‎bindata/rbac/ovn-operator-rbac.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,26 @@ rules:
127127
- patch
128128
- update
129129
- watch
130+
- apiGroups:
131+
- cert-manager.io
132+
resources:
133+
- certificates
134+
verbs:
135+
- create
136+
- delete
137+
- get
138+
- list
139+
- patch
140+
- update
141+
- watch
142+
- apiGroups:
143+
- cert-manager.io
144+
resources:
145+
- issuers
146+
verbs:
147+
- get
148+
- list
149+
- watch
130150
- apiGroups:
131151
- k8s.cni.cncf.io
132152
resources:

‎config/crd/bases/core.openstack.org_openstackcontrolplanes.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13083,6 +13083,8 @@ spec:
1308313083
ovsLogLevel:
1308413084
default: info
1308513085
type: string
13086+
rbacIssuerName:
13087+
type: string
1308613088
resources:
1308713089
properties:
1308813090
claims:
@@ -13217,6 +13219,8 @@ spec:
1321713219
default: 60000
1321813220
format: int32
1321913221
type: integer
13222+
rbacCACertSecretName:
13223+
type: string
1322013224
replicas:
1322113225
default: 1
1322213226
format: int32

‎go.mod‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -181,3 +181,5 @@ replace k8s.io/code-generator => k8s.io/code-generator v0.31.14 //allow-merging
181181
replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging
182182

183183
replace github.com/cert-manager/cmctl/v2 => github.com/cert-manager/cmctl/v2 v2.1.2-0.20241127223932-88edb96860cf //allow-merging
184+
185+
replace github.com/openstack-k8s-operators/ovn-operator/api => ../ovn-operator/api

‎go.sum‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -180,8 +180,6 @@ github.com/openstack-k8s-operators/octavia-operator/api v0.6.1-0.20260413082059-
180180
github.com/openstack-k8s-operators/octavia-operator/api v0.6.1-0.20260413082059-d107b5bac378/go.mod h1:XO02J/MSp7f+HMyoT5xImUvTtDvDY4SgG2mi+nwdTMY=
181181
github.com/openstack-k8s-operators/openstack-baremetal-operator/api v0.6.1-0.20260413094947-83f411fa655c h1:77hLym7nButLmaRm2aKozn0kW2WmrAaaYpx/HWHlUzc=
182182
github.com/openstack-k8s-operators/openstack-baremetal-operator/api v0.6.1-0.20260413094947-83f411fa655c/go.mod h1:WKiIsGtY1q6VbpSa8QmOY3rYFpI061hwqYVFnAFfiFI=
183-
github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260416085208-12e49450bfee h1:XoxZ0HVNN6uarOM8Nt2WFAsaS1JEbX+kHS8FCTJgqvM=
184-
github.com/openstack-k8s-operators/ovn-operator/api v0.6.1-0.20260416085208-12e49450bfee/go.mod h1:wtnlbYH3u8jHHKltKDCf0ILNtCe7ZnOJSreSGXCbb2w=
185183
github.com/openstack-k8s-operators/placement-operator/api v0.6.1-0.20260413090520-f18a11875c1d h1:ZvVIq5E/F82tqQckheo3WnL6XywTPc+PiJWyrllkyVo=
186184
github.com/openstack-k8s-operators/placement-operator/api v0.6.1-0.20260413090520-f18a11875c1d/go.mod h1:34ka8QoEZ2LFmJv6wO5l9U29f9Kd1vizVzbkzRQnwVA=
187185
github.com/openstack-k8s-operators/rabbitmq-cluster-operator/v2 v2.6.1-0.20250929174222-a0d328fa4dec h1:saovr368HPAKHN0aRPh8h8n9s9dn3d8Frmfua0UYRlc=

‎internal/openstack/ca.go‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -408,6 +408,41 @@ func ReconcileCAs(ctx context.Context, instance *corev1.OpenStackControlPlane, h
408408
}
409409
}
410410

411+
// create CA for OVN RBAC (used to sign per-node ovn-controller certificates)
412+
// This CA is NOT added to the combined CA bundle — it is only used between
413+
// the SB database (to verify ovn-controller client certs) and the
414+
// ovn-controller nodes (whose certs are signed by this CA via cert-manager).
415+
issuerLabels = map[string]string{rootCAIssuerOvnRbacLabel: ""}
416+
issuerAnnotations = getIssuerAnnotations(&instance.Spec.TLS.PodLevel.Ovn.Cert)
417+
err = removeIssuerLabel(
418+
ctx,
419+
helper,
420+
corev1.OvnRbacCaName,
421+
instance.Namespace,
422+
issuerLabels,
423+
)
424+
if err != nil {
425+
return ctrl.Result{}, err
426+
}
427+
428+
ctrlResult, err = ensureRootCA(
429+
ctx,
430+
instance,
431+
helper,
432+
issuerReq,
433+
corev1.OvnRbacCaName,
434+
issuerLabels,
435+
issuerAnnotations,
436+
bundle,
437+
caOnlyBundle,
438+
instance.Spec.TLS.PodLevel.Ovn.Ca,
439+
)
440+
if err != nil {
441+
return ctrlResult, err
442+
} else if (ctrlResult != ctrl.Result{}) {
443+
return ctrlResult, nil
444+
}
445+
411446
// create/update combined CA secret
412447
if instance.Spec.TLS.CaBundleSecretName != "" {
413448
caSecret, _, err := secret.GetSecret(ctx, helper, instance.Spec.TLS.CaBundleSecretName, instance.Namespace)

0 commit comments

Comments
 (0)