OVN RBAC Switch to use exising CA to sign ovn-controller certs

slawqo · slawqo · commit 6c1aaf324bc3 · 2026-05-08T14:13:28.000+02:00
This is test patch, if will work fine it should be merged with previous
one.

Signed-off-by: Slawek Kaplonski &lt;skaplons@redhat.com&gt;
diff --git a/api/bases/ovn.openstack.org_ovncontrollers.yaml b/api/bases/ovn.openstack.org_ovncontrollers.yaml
@@ -150,6 +150,13 @@ spec:
                 description: Image used for the ovn-controller container (will be
                   set to environmental default if empty)
                 type: string
+              ovnIssuerName:
+                description: |-
+                  OvnIssuerName - The name of the cert-manager Issuer used to sign
+                  per-node ovn-controller certificates. When set, the controller
+                  creates cert-manager Certificate resources for each node with
+                  CN matching the chassis system-id for OVN RBAC.
+                type: string
               ovnLogLevel:
                 default: info
                 description: OVNLogLevel - Set log level off, emer, err, warn, info
@@ -178,13 +185,6 @@ spec:
                 - info
                 - dbg
                 type: string
-              rbacIssuerName:
-                description: |-
-                  RbacIssuerName - The name of the cert-manager Issuer used to sign
-                  per-node ovn-controller RBAC certificates. When set, the controller
-                  creates cert-manager Certificate resources for each node instead of
-                  signing certificates locally with the CA key.
-                type: string
               resources:
                 description: |-
                   Resources - Compute Resources required by this service (Limits/Requests).
diff --git a/api/bases/ovn.openstack.org_ovndbclusters.yaml b/api/bases/ovn.openstack.org_ovndbclusters.yaml
@@ -274,12 +274,6 @@ spec:
                   Active probe interval from standby to active ovsdb-server remote
                 format: int32
                 type: integer
-              rbacCACertSecretName:
-                description: |-
-                  RbacCACertSecretName - The name of the K8s Secret containing the RBAC
-                  PKI CA certificate (tls.crt). Used by the SB database to verify
-                  ovn-controller client certificates when RBAC is enabled.
-                type: string
               replicas:
                 default: 1
                 description: Replicas of OVN DBCluster to run
diff --git a/api/v1beta1/ovncontroller_types.go b/api/v1beta1/ovncontroller_types.go
@@ -126,11 +126,11 @@ type OVNControllerSpecCore struct {
 	MetricsTLS tls.SimpleService `json:"metricsTLS,omitempty"`
 
 	// +kubebuilder:validation:Optional
-	// RbacIssuerName - The name of the cert-manager Issuer used to sign
-	// per-node ovn-controller RBAC certificates. When set, the controller
-	// creates cert-manager Certificate resources for each node instead of
-	// signing certificates locally with the CA key.
-	RbacIssuerName string `json:"rbacIssuerName,omitempty"`
+	// OvnIssuerName - The name of the cert-manager Issuer used to sign
+	// per-node ovn-controller certificates. When set, the controller
+	// creates cert-manager Certificate resources for each node with
+	// CN matching the chassis system-id for OVN RBAC.
+	OvnIssuerName string `json:"ovnIssuerName,omitempty"`
 }
 
 // OVNControllerStatus defines the observed state of OVNController
diff --git a/api/v1beta1/ovndbcluster_types.go b/api/v1beta1/ovndbcluster_types.go
@@ -146,12 +146,6 @@ type OVNDBClusterSpecCore struct {
 	// +kubebuilder:validation:Optional
 	// MetricsTLS - Parameters related to TLS for metrics sidecar
 	MetricsTLS tls.SimpleService `json:"metricsTLS,omitempty"`
-
-	// +kubebuilder:validation:Optional
-	// RbacCACertSecretName - The name of the K8s Secret containing the RBAC
-	// PKI CA certificate (tls.crt). Used by the SB database to verify
-	// ovn-controller client certificates when RBAC is enabled.
-	RbacCACertSecretName string `json:"rbacCACertSecretName,omitempty"`
 }
 
 // OVNDBClusterOverrideSpec to override the generated manifest of several child resources.
diff --git a/config/crd/bases/ovn.openstack.org_ovncontrollers.yaml b/config/crd/bases/ovn.openstack.org_ovncontrollers.yaml
@@ -150,6 +150,13 @@ spec:
                 description: Image used for the ovn-controller container (will be
                   set to environmental default if empty)
                 type: string
+              ovnIssuerName:
+                description: |-
+                  OvnIssuerName - The name of the cert-manager Issuer used to sign
+                  per-node ovn-controller certificates. When set, the controller
+                  creates cert-manager Certificate resources for each node with
+                  CN matching the chassis system-id for OVN RBAC.
+                type: string
               ovnLogLevel:
                 default: info
                 description: OVNLogLevel - Set log level off, emer, err, warn, info
@@ -178,13 +185,6 @@ spec:
                 - info
                 - dbg
                 type: string
-              rbacIssuerName:
-                description: |-
-                  RbacIssuerName - The name of the cert-manager Issuer used to sign
-                  per-node ovn-controller RBAC certificates. When set, the controller
-                  creates cert-manager Certificate resources for each node instead of
-                  signing certificates locally with the CA key.
-                type: string
               resources:
                 description: |-
                   Resources - Compute Resources required by this service (Limits/Requests).
diff --git a/config/crd/bases/ovn.openstack.org_ovndbclusters.yaml b/config/crd/bases/ovn.openstack.org_ovndbclusters.yaml
@@ -274,12 +274,6 @@ spec:
                   Active probe interval from standby to active ovsdb-server remote
                 format: int32
                 type: integer
-              rbacCACertSecretName:
-                description: |-
-                  RbacCACertSecretName - The name of the K8s Secret containing the RBAC
-                  PKI CA certificate (tls.crt). Used by the SB database to verify
-                  ovn-controller client certificates when RBAC is enabled.
-                type: string
               replicas:
                 default: 1
                 description: Replicas of OVN DBCluster to run
diff --git a/internal/common/const.go b/internal/common/const.go
@@ -14,9 +14,6 @@ const (
 	// OVNMetricsKeyPath is the path to the metrics private key file
 	OVNMetricsKeyPath string = "/etc/pki/tls/private/ovnmetrics.key"
 
-	// OVNRbacCACertPath is the mount path for the RBAC CA certificate in the SB DB pod
-	OVNRbacCACertPath string = "/etc/pki/tls/certs/ovnrbacca.crt"
-
 	// OVNRbacCertMountPath is the mount path for the per-node RBAC certificate in config jobs
 	OVNRbacCertMountPath string = "/tmp/ovn-rbac-cert"
 
diff --git a/internal/controller/ovncontroller_controller.go b/internal/controller/ovncontroller_controller.go
@@ -877,7 +877,7 @@ func (r *OVNControllerReconciler) reconcileNormal(ctx context.Context, instance
 
 	// Create per-node RBAC certificates if configured
 	nodeSystemIDs := map[string]string{}
-	if instance.Spec.RbacIssuerName != "" {
+	if instance.Spec.OvnIssuerName != "" {
 		ovnPods, podErr := ovncontroller.GetOVNControllerPods(ctx, r.Client, instance)
 		if podErr != nil {
 			return ctrl.Result{}, podErr
@@ -892,7 +892,7 @@ func (r *OVNControllerReconciler) reconcileNormal(ctx context.Context, instance
 			certName := ovncontroller.RbacCertName(nodeName)
 			nodeSystemIDs[nodeName] = systemID
 
-			certResult, certErr := ovncontroller.EnsureRbacCert(ctx, r.Client, r.Scheme, instance, certName, systemID, instance.Spec.RbacIssuerName, ovnServiceLabels)
+			certResult, certErr := ovncontroller.EnsureRbacCert(ctx, r.Client, r.Scheme, instance, certName, systemID, instance.Spec.OvnIssuerName, ovnServiceLabels)
 			if certErr != nil {
 				return certResult, certErr
 			}
diff --git a/internal/controller/ovndbcluster_controller.go b/internal/controller/ovndbcluster_controller.go
@@ -1297,9 +1297,6 @@ func (r *OVNDBClusterReconciler) generateServiceConfigMaps(
 	templateParameters["OVN_METRICS_CERT_PATH"] = ovn_common.OVNMetricsCertPath
 	templateParameters["OVN_METRICS_KEY_PATH"] = ovn_common.OVNMetricsKeyPath
 	templateParameters["OVN_RUNDIR"] = "/etc/ovn"
-	if instance.Spec.DBType == ovnv1.SBDBType && instance.Spec.RbacCACertSecretName != "" {
-		templateParameters["OVN_RBAC_CACERT_PATH"] = ovn_common.OVNRbacCACertPath
-	}
 	if instance.Spec.DBType == ovnv1.SBDBType && instance.Spec.TLS.Enabled() {
 		templateParameters["DB_PORT_FULL_ACCESS"] = ovndbcluster.DbPortSBRBACFullAccess
 	} else {
diff --git a/internal/ovncontroller/daemonset.go b/internal/ovncontroller/daemonset.go
@@ -77,7 +77,7 @@ func CreateOVNDaemonSet(
 	// cert file before starting ovn-controller so it doesn't connect to
 	// the SB DB without client authentication.
 	var cmd []string
-	if instance.Spec.TLS.Enabled() && instance.Spec.RbacIssuerName != "" {
+	if instance.Spec.TLS.Enabled() && instance.Spec.OvnIssuerName != "" {
 		cmd = []string{
 			"/bin/bash", "-c",
 			"source /usr/local/bin/container-scripts/functions && wait_for_rbac_cert && exec " + strings.Join(ovnCmd, " "),
diff --git a/internal/ovndbcluster/statefulset.go b/internal/ovndbcluster/statefulset.go
@@ -134,29 +134,6 @@ func StatefulSet(
 		volumes = append(volumes, svc.CreateVolume(serviceName))
 		volumeMounts = append(volumeMounts, svc.CreateVolumeMounts(serviceName)...)
 
-		// For SB DB, mount the RBAC CA cert so we can build a combined CA bundle
-		if instance.Spec.DBType == ovnv1.SBDBType && instance.Spec.RbacCACertSecretName != "" {
-			volumes = append(volumes, corev1.Volume{
-				Name: "rbac-ca-cert",
-				VolumeSource: corev1.VolumeSource{
-					Secret: &corev1.SecretVolumeSource{
-						SecretName: instance.Spec.RbacCACertSecretName,
-						Items: []corev1.KeyToPath{
-							{
-								Key:  "tls.crt",
-								Path: "ovnrbacca.crt",
-							},
-						},
-					},
-				},
-			})
-			volumeMounts = append(volumeMounts, corev1.VolumeMount{
-				Name:      "rbac-ca-cert",
-				MountPath: ovn_common.OVNRbacCACertPath,
-				SubPath:   "ovnrbacca.crt",
-				ReadOnly:  true,
-			})
-		}
 	}
 
 	// NOTE(ihar) ovndb pods leave the raft cluster on delete; it's important
diff --git a/templates/ovndbcluster/bin/setup.sh b/templates/ovndbcluster/bin/setup.sh
@@ -20,12 +20,7 @@ DB_PORT="{{ .DB_PORT }}"
 DB_PORT_FULL_ACCESS="{{ .DB_PORT_FULL_ACCESS }}"
 {{- if .TLS }}
 DB_SCHEME="pssl"
-{{- if index . "OVN_RBAC_CACERT_PATH" }}
-SSL_CA_CERT=/etc/ovn/combined-ca.pem
-cat {{.OVNDB_CACERT_PATH}} {{ index . "OVN_RBAC_CACERT_PATH" }} > ${SSL_CA_CERT}
-{{- else }}
 SSL_CA_CERT={{.OVNDB_CACERT_PATH}}
-{{- end }}
 {{- else }}
 DB_SCHEME="ptcp"
 {{- end }}
diff --git a/test/functional/base_test.go b/test/functional/base_test.go
@@ -191,8 +191,7 @@ func DeleteOVNDBClusters(names []types.NamespacedName) {
 }
 
 // CreateTLSOVNDBClusters Creates NB and SB OVNDBClusters with TLS enabled.
-// SB cluster also has RbacCACertSecretName set.
-// Caller must create TLS secrets (CABundleSecretName, OvnDbCertSecretName, RbacCACertSecretName) first.
+// Caller must create TLS secrets (CABundleSecretName, OvnDbCertSecretName) first.
 func CreateTLSOVNDBClusters(namespace string, nad map[string][]string, replicas int32) []types.NamespacedName {
 	dbs := []types.NamespacedName{}
 	for _, db := range []string{ovnv1.NBDBType, ovnv1.SBDBType} {
@@ -210,10 +209,6 @@ func CreateTLSOVNDBClusters(namespace string, nad map[string][]string, replicas
 		spec.DBType = db
 		spec.NetworkAttachment = stringNad
 		spec.Replicas = &replicas
-		if db == ovnv1.SBDBType {
-			spec.RbacCACertSecretName = RbacCACertSecretName
-		}
-
 		instance := CreateOVNDBCluster(namespace, spec)
 		instanceName := types.NamespacedName{Name: instance.GetName(), Namespace: instance.GetNamespace()}
 
@@ -314,14 +309,12 @@ func GetTLSOVNControllerSpec() ovnv1.OVNControllerSpec {
 
 func GetTLSRbacOVNControllerSpec() ovnv1.OVNControllerSpec {
 	spec := GetTLSOVNControllerSpec()
-	spec.RbacIssuerName = RbacIssuerName
+	spec.OvnIssuerName = OvnIssuerName
 	return spec
 }
 
 func GetTLSRbacOVNDBClusterSpec() ovnv1.OVNDBClusterSpec {
-	spec := GetTLSOVNDBClusterSpec()
-	spec.RbacCACertSecretName = RbacCACertSecretName
-	return spec
+	return GetTLSOVNDBClusterSpec()
 }
 
 func CreateOVNController(namespace string, spec ovnv1.OVNControllerSpec) client.Object {
diff --git a/test/functional/ovncontroller_controller_test.go b/test/functional/ovncontroller_controller_test.go
@@ -1185,10 +1185,6 @@ var _ = Describe("OVNController controller", func() {
 				Name:      OvnDbCertSecretName,
 				Namespace: namespace,
 			}))
-			DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(types.NamespacedName{
-				Name:      RbacCACertSecretName,
-				Namespace: namespace,
-			}))
 			dbs = CreateTLSOVNDBClusters(namespace, map[string][]string{}, 1)
 			DeferCleanup(DeleteOVNDBClusters, dbs)
 			northdName := CreateReadyOVNNorthd(namespace, GetDefaultOVNNorthdSpec())
@@ -1227,7 +1223,7 @@ var _ = Describe("OVNController controller", func() {
 			cert := GetCertManagerCert(certNN)
 			expectedSystemID := ovncontroller.ComputeSystemID(nodeName)
 			Expect(cert.Spec.CommonName).To(Equal(expectedSystemID))
-			Expect(cert.Spec.IssuerRef.Name).To(Equal(RbacIssuerName))
+			Expect(cert.Spec.IssuerRef.Name).To(Equal(OvnIssuerName))
 			Expect(cert.Spec.IssuerRef.Kind).To(Equal("Issuer"))
 			Expect(cert.Spec.Usages).To(ContainElement(certmgrv1.UsageClientAuth))
 		})
diff --git a/test/functional/ovndbcluster_controller_test.go b/test/functional/ovndbcluster_controller_test.go
@@ -1318,10 +1318,6 @@ var _ = Describe("OVNDBCluster controller", func() {
 				Name:      OvnDbCertSecretName,
 				Namespace: namespace,
 			}))
-			DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(types.NamespacedName{
-				Name:      RbacCACertSecretName,
-				Namespace: namespace,
-			}))
 
 			statefulSetName := types.NamespacedName{
 				Namespace: namespace,
@@ -1345,23 +1341,6 @@ var _ = Describe("OVNDBCluster controller", func() {
 			th.AssertVolumeMountExists("ovsdbserver-sb-tls-certs", "tls.crt", svcC.VolumeMounts)
 			th.AssertVolumeMountExists("ovsdbserver-sb-tls-certs", "ca.crt", svcC.VolumeMounts)
 
-			// check RBAC CA cert volume and mount
-			hasRbacCaVolume := false
-			for _, v := range ss.Spec.Template.Spec.Volumes {
-				if v.Name == "rbac-ca-cert" && v.Secret != nil && v.Secret.SecretName == RbacCACertSecretName {
-					hasRbacCaVolume = true
-				}
-			}
-			Expect(hasRbacCaVolume).To(BeTrue(), "StatefulSet should have rbac-ca-cert volume")
-
-			hasRbacCaMount := false
-			for _, vm := range svcC.VolumeMounts {
-				if vm.Name == "rbac-ca-cert" && vm.MountPath == ovn_common.OVNRbacCACertPath {
-					hasRbacCaMount = true
-				}
-			}
-			Expect(hasRbacCaMount).To(BeTrue(), "Container should have rbac-ca-cert volume mount")
-
 			// check DB url schema
 			Eventually(func(g Gomega) {
 				OVNDBCluster := GetOVNDBCluster(OVNDBClusterName)
@@ -1404,10 +1383,6 @@ var _ = Describe("OVNDBCluster controller", func() {
 				Name:      OvnDbCertSecretName,
 				Namespace: namespace,
 			}))
-			DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(types.NamespacedName{
-				Name:      RbacCACertSecretName,
-				Namespace: namespace,
-			}))
 
 			statefulSetName := types.NamespacedName{
 				Namespace: namespace,
@@ -1454,10 +1429,6 @@ var _ = Describe("OVNDBCluster controller", func() {
 				Name:      OvnDbCertSecretName,
 				Namespace: namespace,
 			}))
-			DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(types.NamespacedName{
-				Name:      RbacCACertSecretName,
-				Namespace: namespace,
-			}))
 
 			statefulSetName := types.NamespacedName{
 				Namespace: namespace,
@@ -1504,10 +1475,6 @@ var _ = Describe("OVNDBCluster controller", func() {
 				Name:      OvnDbCertSecretName,
 				Namespace: namespace,
 			}))
-			DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(types.NamespacedName{
-				Name:      RbacCACertSecretName,
-				Namespace: namespace,
-			}))
 
 			statefulSetName := types.NamespacedName{
 				Namespace: namespace,
@@ -1542,10 +1509,6 @@ var _ = Describe("OVNDBCluster controller", func() {
 				Name:      OvnDbCertSecretName,
 				Namespace: namespace,
 			}))
-			DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(types.NamespacedName{
-				Name:      RbacCACertSecretName,
-				Namespace: namespace,
-			}))
 
 			statefulSetName := types.NamespacedName{
 				Namespace: namespace,
@@ -1573,10 +1536,6 @@ var _ = Describe("OVNDBCluster controller", func() {
 				Name:      OvnDbCertSecretName,
 				Namespace: namespace,
 			}))
-			DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(types.NamespacedName{
-				Name:      RbacCACertSecretName,
-				Namespace: namespace,
-			}))
 
 			statefulSetName := types.NamespacedName{
 				Namespace: namespace,
@@ -1597,9 +1556,6 @@ var _ = Describe("OVNDBCluster controller", func() {
 			Expect(th.GetConfigMap(scriptsCM).Data["setup.sh"]).Should(
 				ContainSubstring(fmt.Sprintf("DB_PORT_FULL_ACCESS=\"%d\"", ovndbcluster.DbPortSBRBACFullAccess)))
 
-			Expect(th.GetConfigMap(scriptsCM).Data["setup.sh"]).Should(
-				ContainSubstring(ovn_common.OVNRbacCACertPath))
-
 			Expect(th.GetConfigMap(scriptsCM).Data["setup.sh"]).Should(
 				ContainSubstring("role=ovn-controller"))
 		})
diff --git a/test/functional/ovnnorthd_controller_test.go b/test/functional/ovnnorthd_controller_test.go
@@ -474,10 +474,6 @@ var _ = Describe("OVNNorthd controller", func() {
 				Name:      OvnDbCertSecretName,
 				Namespace: namespace,
 			}))
-			DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(types.NamespacedName{
-				Name:      RbacCACertSecretName,
-				Namespace: namespace,
-			}))
 			dbs := CreateTLSOVNDBClusters(namespace, map[string][]string{}, 1)
 			DeferCleanup(DeleteOVNDBClusters, dbs)
 
diff --git a/test/functional/suite_test.go b/test/functional/suite_test.go
@@ -77,10 +77,9 @@ var (
 )
 
 const (
-	CABundleSecretName   = "combined-ca-bundle" //nolint:gosec // G101: Not actual credentials, just secret name constants
-	OvnDbCertSecretName  = "ovndb-tls-cert"     //nolint:gosec // G101: Not actual credentials, just secret name constants
-	RbacCACertSecretName = "ovn-rbac-ca-cert"   //nolint:gosec // G101: Not actual credentials, just secret name constants
-	RbacIssuerName       = "ovn-rbac-issuer"
+	CABundleSecretName  = "combined-ca-bundle" //nolint:gosec // G101: Not actual credentials, just secret name constants
+	OvnDbCertSecretName = "ovndb-tls-cert"     //nolint:gosec // G101: Not actual credentials, just secret name constants
+	OvnIssuerName       = "ovn-issuer"
 )
 
 func TestAPIs(t *testing.T) {
