pki.go

// Copyright 2021 - 2024 Crunchy Data Solutions, Inc.
//
// SPDX-License-Identifier: Apache-2.0

package postgrescluster

import (
	"context"

	gover "github.com/hashicorp/go-version"
	"github.com/pkg/errors"
	appsv1 "k8s.io/api/apps/v1"
	corev1 "k8s.io/api/core/v1"
	k8serrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"sigs.k8s.io/controller-runtime/pkg/client"

	"github.com/percona/percona-postgresql-operator/v2/internal/logging"
	"github.com/percona/percona-postgresql-operator/v2/internal/naming"
	"github.com/percona/percona-postgresql-operator/v2/internal/pki"
	"github.com/percona/percona-postgresql-operator/v2/percona/certmanager"
	"github.com/percona/percona-postgresql-operator/v2/pkg/apis/postgres-operator.crunchydata.com/v1beta1"
)

const (
	// https://www.postgresql.org/docs/current/ssl-tcp.html
	clusterCertFile = "tls.crt"
	clusterKeyFile  = "tls.key"
	rootCertFile    = "ca.crt"
)

// +kubebuilder:rbac:groups="",resources="secrets",verbs={get}
// +kubebuilder:rbac:groups="",resources="secrets",verbs={create,patch}

// reconcileRootCertificate ensures the root certificate, stored
// in the relevant secret, has been created and is not 'bad' due
// to being expired, formatted incorrectly, etc.
// If it is bad for some reason, a new root certificate is
// generated for use.
func (r *Reconciler) reconcileRootCertificate(
	ctx context.Context, cluster *v1beta1.PostgresCluster,
) (
	*pki.RootCertificateAuthority, error,
) {
	const keyCertificate, keyPrivateKey = "root.crt", "root.key"

	// K8SPG-553
	existing := &corev1.Secret{
		ObjectMeta: naming.PostgresRootCASecret(cluster),
	}

	privateKey := keyPrivateKey
	certificateKey := keyCertificate
	if cluster.Spec.CustomRootCATLSSecret != nil {
		existing.Name = cluster.Spec.CustomRootCATLSSecret.Name

		for _, i := range cluster.Spec.CustomRootCATLSSecret.Items {
			switch i.Path {
			case keyCertificate:
				certificateKey = i.Key
			case keyPrivateKey:
				privateKey = i.Key
			}
		}
	}

	err := errors.WithStack(
		r.Client.Get(ctx, client.ObjectKeyFromObject(existing), existing))
	// K8SPG-555: we need to check ca certificate from old operator versions
	// TODO: remove when 2.4.0 will become unsupported
	if k8serrors.IsNotFound(err) {
		nn := client.ObjectKeyFromObject(existing)
		nn.Name = naming.RootCertSecret
		err = errors.WithStack(
			r.Client.Get(ctx, nn, existing))
		if err == nil {
			existing.Name = naming.RootCertSecret
		}
	}
	if k8serrors.IsNotFound(err) {
		err = nil

		certManagerSecret, certManagerErr := r.reconcileCertManagerRootCertificate(ctx, cluster)
		if certManagerErr != nil {
			return nil, certManagerErr
		}
		if certManagerSecret != nil {
			existing = certManagerSecret
		}
	}

	// If the secret is managed by cert-manager, parse it using cert-manager key names
	// (tls.crt/tls.key) and return without overwriting the secret with internal PKI.
	if err == nil && existing.Annotations["cert-manager.io/certificate-name"] != "" {
		if _, certManagerErr := r.reconcileCertManagerRootCertificate(ctx, cluster); certManagerErr != nil {
			return nil, certManagerErr
		}
		root := &pki.RootCertificateAuthority{}
		_ = root.Certificate.UnmarshalText(existing.Data["tls.crt"])
		_ = root.PrivateKey.UnmarshalText(existing.Data["tls.key"])
		if pki.RootIsValid(root) {
			return root, nil
		}
		return nil, errors.New("waiting for cert-manager to issue a valid CA certificate")
	}

	root := &pki.RootCertificateAuthority{}

	if err == nil {
		// Unmarshal and validate the stored root. These first errors can
		// be ignored because they result in an invalid root which is then
		// correctly regenerated.
		// K8SPG-553
		_ = root.Certificate.UnmarshalText(existing.Data[certificateKey])
		_ = root.PrivateKey.UnmarshalText(existing.Data[privateKey])

		if cluster.Spec.CustomRootCATLSSecret != nil {
			return root, err
		}

		if !pki.RootIsValid(root) {
			root, err = pki.NewRootCertificateAuthority()
			err = errors.WithStack(err)
		}
	}

	// K8SPG-555
	intent := &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{
			Name:      existing.Name,
			Namespace: existing.Namespace,
		},
	}
	intent.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Secret"))
	intent.Data = make(map[string][]byte)
	intent.ObjectMeta.OwnerReferences = existing.ObjectMeta.OwnerReferences

	if cluster.Labels != nil {
		currVersion, err := gover.NewVersion(cluster.Labels[naming.LabelVersion])
		if err == nil && currVersion.GreaterThanOrEqual(gover.Must(gover.NewVersion("2.6.0"))) && cluster.Spec.Metadata != nil {
			intent.Labels = cluster.Spec.Metadata.Labels
			intent.Annotations = cluster.Spec.Metadata.Annotations
		}
	}

	// A root secret is scoped to the namespace where postgrescluster(s)
	// are deployed. For operator deployments with postgresclusters in more than
	// one namespace, there will be one root per namespace.
	// During reconciliation, the owner reference block of the root secret is
	// updated to include the postgrescluster as an owner.
	// However, unlike the leaf certificate, the postgrescluster will not be
	// set as the controller. This allows for multiple owners to guide garbage
	// collection, but avoids any errors related to setting multiple controllers.
	// https://docs.k8s.io/concepts/workloads/controllers/garbage-collection/#owners-and-dependents
	if err == nil {
		err = errors.WithStack(r.setOwnerReference(cluster, intent))
	}
	if err == nil {
		intent.Data[keyCertificate], err = root.Certificate.MarshalText()
		err = errors.WithStack(err)
	}
	if err == nil {
		intent.Data[keyPrivateKey], err = root.PrivateKey.MarshalText()
		err = errors.WithStack(err)
	}
	if err == nil {
		err = errors.WithStack(r.apply(ctx, intent))
	}

	return root, err
}

// +kubebuilder:rbac:groups=certmanager.k8s.io,resources=issuers;certificates;certificaterequests,verbs=get;list;watch;create;update;patch;delete;deletecollection
// +kubebuilder:rbac:groups=cert-manager.io,resources=issuers;certificates;certificaterequests,verbs=get;list;watch;create;update;patch;delete;deletecollection

// reconcileCertManagerRootCertificate func.
func (r *Reconciler) reconcileCertManagerRootCertificate(
	ctx context.Context, cluster *v1beta1.PostgresCluster,
) (*corev1.Secret, error) {
	log := logging.FromContext(ctx)
	installed, err := r.isCertManagerInstalled(ctx, cluster.Namespace)
	if err != nil {
		return nil, errors.Wrap(err, "error checking if cert-manager is installed")
	}
	if !installed {
		log.Info("cert-manager is not installed")
		return nil, nil
	}
	c := r.CertManagerCtrlFunc(r.Client, r.Scheme, false)
	err = c.ApplyCAIssuer(ctx, cluster)
	if err != nil {
		return nil, errors.Wrap(err, "error applying CA issuer")
	}
	err = c.ApplyCACertificate(ctx, cluster)
	if err != nil {
		return nil, errors.Wrap(err, "error applying CA certificate")
	}

	// Try to fetch the CA secret created by cert-manager.
	secret := &corev1.Secret{ObjectMeta: naming.PostgresRootCASecret(cluster)}
	if err := r.Client.Get(ctx, client.ObjectKeyFromObject(secret), secret); err != nil {
		if k8serrors.IsNotFound(err) {
			log.Info("waiting for cert-manager to issue CA certificate")
			return nil, errors.New("waiting for cert-manager to issue CA certificate")
		}
		return nil, errors.Wrap(err, "error getting cert-manager CA secret")
	}

	return secret, nil
}

// +kubebuilder:rbac:groups="",resources="secrets",verbs={get}
// +kubebuilder:rbac:groups="",resources="secrets",verbs={create,patch}

// reconcileClusterCertificate first checks if a custom certificate
// secret is configured. If so, that secret projection is returned.
// Otherwise, it checks if cert-manager is installed. If installed, cert-manager
// is used to create and manage the certificate. Otherwise, a secret containing
// a generated leaf certificate is created using the internal PKI.
// In either case, the relevant secret is expected to contain three files:
// tls.crt, tls.key and ca.crt which are the TLS certificate, private key
// and CA certificate, respectively.
func (r *Reconciler) reconcileClusterCertificate(
	ctx context.Context, root *pki.RootCertificateAuthority,
	cluster *v1beta1.PostgresCluster, primaryService *corev1.Service,
	replicaService *corev1.Service,
) (
	*corev1.SecretProjection, error,
) {
	if cluster.Spec.CustomTLSSecret != nil {
		return cluster.Spec.CustomTLSSecret, nil
	}

	certManagerInstalled, err := r.isCertManagerInstalled(ctx, cluster.Namespace)
	if err != nil {
		return nil, errors.Wrap(err, "failed to check if cert-manager is installed")
	}

	if certManagerInstalled {
		return r.reconcileCertManagerClusterCertificate(ctx, root, cluster, primaryService, replicaService)
	}

	return r.reconcileInternalClusterCertificate(ctx, root, cluster, primaryService, replicaService)
}

// reconcileInternalClusterCertificate creates a cluster certificate using internal PKI.
func (r *Reconciler) reconcileInternalClusterCertificate(
	ctx context.Context, root *pki.RootCertificateAuthority,
	cluster *v1beta1.PostgresCluster, primaryService *corev1.Service,
	replicaService *corev1.Service,
) (
	*corev1.SecretProjection, error,
) {
	const keyCertificate, keyPrivateKey, rootCA = "tls.crt", "tls.key", "ca.crt"

	existing := &corev1.Secret{ObjectMeta: naming.PostgresTLSSecret(cluster)}
	err := errors.WithStack(client.IgnoreNotFound(
		r.Client.Get(ctx, client.ObjectKeyFromObject(existing), existing)))

	leaf := &pki.LeafCertificate{}
	primaryServiceDNSNames, err := naming.ServiceDNSNames(ctx, primaryService, cluster.Spec.ClusterServiceDNSSuffix)
	if err != nil {
		return nil, errors.Wrap(err, "get primary service dns names")
	}

	replicaServiceDNSNames, err := naming.ServiceDNSNames(ctx, replicaService, cluster.Spec.ClusterServiceDNSSuffix)
	if err != nil {
		return nil, errors.Wrap(err, "get replica service dns names")
	}

	dnsNames := append(primaryServiceDNSNames, replicaServiceDNSNames...)
	dnsFQDN := dnsNames[0]

	if err == nil {
		// Unmarshal and validate the stored leaf. These first errors can
		// be ignored because they result in an invalid leaf which is then
		// correctly regenerated.
		_ = leaf.Certificate.UnmarshalText(existing.Data[keyCertificate])
		_ = leaf.PrivateKey.UnmarshalText(existing.Data[keyPrivateKey])

		leaf, err = root.RegenerateLeafWhenNecessary(leaf, dnsFQDN, dnsNames)
		err = errors.WithStack(err)
	}

	intent := &corev1.Secret{ObjectMeta: naming.PostgresTLSSecret(cluster)}
	intent.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("Secret"))
	intent.Data = make(map[string][]byte)
	intent.ObjectMeta.OwnerReferences = existing.ObjectMeta.OwnerReferences

	intent.Annotations = naming.Merge(cluster.Spec.Metadata.GetAnnotationsOrNil())
	intent.Labels = naming.Merge(
		cluster.Spec.Metadata.GetLabelsOrNil(),
		naming.WithPerconaLabels(map[string]string{
			naming.LabelCluster:            cluster.Name,
			naming.LabelClusterCertificate: "postgres-tls",
		}, cluster.Name, "", cluster.Labels[naming.LabelVersion]))

	// K8SPG-330: Keep this commented in case of conflicts.
	// We don't want to delete TLS secrets on cluster deletion.
	// if err == nil {
	// 	err = errors.WithStack(r.setControllerReference(cluster, intent))
	// }

	if err == nil {
		intent.Data[keyCertificate], err = leaf.Certificate.MarshalText()
		err = errors.WithStack(err)
	}
	if err == nil {
		intent.Data[keyPrivateKey], err = leaf.PrivateKey.MarshalText()
		err = errors.WithStack(err)
	}
	if err == nil {
		intent.Data[rootCA], err = root.Certificate.MarshalText()
		err = errors.WithStack(err)
	}

	// TODO(tjmoore4): The generated postgrescluster secret is only created
	// when a custom secret is not specified. However, if the secret is
	// initially created and a custom secret is later used, the generated
	// secret is currently left in place.
	if err == nil {
		err = errors.WithStack(r.apply(ctx, intent))
	}

	return clusterCertSecretProjection(intent), err
}

// reconcileCertManagerClusterCertificate creates a cluster certificate using cert-manager.
// It first ensures the TLS issuer exists, then creates the cluster Certificate CR.
func (r *Reconciler) reconcileCertManagerClusterCertificate(
	ctx context.Context, root *pki.RootCertificateAuthority,
	cluster *v1beta1.PostgresCluster, primaryService *corev1.Service,
	replicaService *corev1.Service,
) (
	*corev1.SecretProjection, error,
) {
	c := r.CertManagerCtrlFunc(r.Client, r.Scheme, false)

	err := c.ApplyIssuer(ctx, cluster)
	if err != nil {
		return nil, errors.Wrap(err, "failed to apply TLS issuer")
	}

	primaryDNSNames, err := naming.ServiceDNSNames(ctx, primaryService, cluster.Spec.ClusterServiceDNSSuffix)
	if err != nil {
		return nil, errors.Wrap(err, "get primary service DNS names")
	}
	replicaDNSNames, err := naming.ServiceDNSNames(ctx, replicaService, cluster.Spec.ClusterServiceDNSSuffix)
	if err != nil {
		return nil, errors.Wrap(err, "get replica service DNS names")
	}
	dnsNames := append(primaryDNSNames, replicaDNSNames...)

	err = c.ApplyClusterCertificate(ctx, cluster, dnsNames)
	if err != nil {
		return nil, errors.Wrap(err, "failed to apply cluster certificate")
	}

	return clusterCertSecretProjection(&corev1.Secret{
		ObjectMeta: naming.PostgresTLSSecret(cluster),
	}), nil
}

func (r *Reconciler) isCertManagerInstalled(ctx context.Context, ns string) (bool, error) {
	if r.RestConfig == nil {
		return false, nil
	}
	c := r.CertManagerCtrlFunc(r.Client, r.Scheme, true)
	err := c.Check(ctx, r.RestConfig, ns)
	if err != nil {
		switch {
		case errors.Is(err, certmanager.ErrCertManagerNotFound):
			return false, nil
		case errors.Is(err, certmanager.ErrCertManagerNotReady):
			logging.FromContext(ctx).Info("cert-manager is not ready, falling back to internal PKI")
			return false, nil
		}
		return false, err
	}
	return true, nil
}

// +kubebuilder:rbac:groups="",resources="secrets",verbs={get}
// +kubebuilder:rbac:groups="",resources="secrets",verbs={create,patch}

// instanceCertificate populates intent with the DNS leaf certificate and
// returns it. It also ensures the leaf certificate, stored in the relevant
// secret, has been created and is not 'bad' due to being expired, formatted
// incorrectly, etc. In addition, a check is made to ensure the leaf cert's
// authority key ID matches the corresponding root cert's subject
// key ID (i.e. the root cert is the 'parent' of the leaf cert).
// If it is bad for any reason, a new leaf certificate is generated
// using the current root certificate
func (*Reconciler) instanceCertificate(
	ctx context.Context, instance *appsv1.StatefulSet,
	existing, intent *corev1.Secret, root *pki.RootCertificateAuthority, dnsSuffix string,
) (
	*pki.LeafCertificate, error,
) {
	var err error
	const keyCertificate, keyPrivateKey = "dns.crt", "dns.key"

	leaf := &pki.LeafCertificate{}

	// RFC 2818 states that the certificate DNS names must be used to verify
	// HTTPS identity.
	dnsNames := naming.InstancePodDNSNames(ctx, instance, dnsSuffix)
	dnsFQDN := dnsNames[0]

	if err == nil {
		// Unmarshal and validate the stored leaf. These first errors can
		// be ignored because they result in an invalid leaf which is then
		// correctly regenerated.
		_ = leaf.Certificate.UnmarshalText(existing.Data[keyCertificate])
		_ = leaf.PrivateKey.UnmarshalText(existing.Data[keyPrivateKey])

		leaf, err = root.RegenerateLeafWhenNecessary(leaf, dnsFQDN, dnsNames)
		err = errors.WithStack(err)
	}

	if err == nil {
		intent.Data[keyCertificate], err = leaf.Certificate.MarshalText()
		err = errors.WithStack(err)
	}
	if err == nil {
		intent.Data[keyPrivateKey], err = leaf.PrivateKey.MarshalText()
		err = errors.WithStack(err)
	}

	return leaf, err
}

// clusterCertSecretProjection returns a secret projection of the postgrescluster's
// CA, key, and certificate to include in the instance configuration volume.
func clusterCertSecretProjection(certificate *corev1.Secret) *corev1.SecretProjection {
	return &corev1.SecretProjection{
		LocalObjectReference: corev1.LocalObjectReference{
			Name: certificate.Name,
		},
		Items: []corev1.KeyToPath{
			{
				Key:  clusterCertFile,
				Path: clusterCertFile,
			},
			{
				Key:  clusterKeyFile,
				Path: clusterKeyFile,
			},
			{
				Key:  rootCertFile,
				Path: rootCertFile,
			},
		},
	}
}