Skip to content

Commit 1347c2a

Browse files
adwk67adwk67
committed
change to tls class
1 parent 00045e9 commit 1347c2a

9 files changed

Lines changed: 137 additions & 82 deletions

File tree

‎Cargo.lock‎

Lines changed: 0 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.nix‎

Lines changed: 9 additions & 54 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,5 +34,5 @@ tracing = "0.1"
3434

3535
[patch."https://github.com/stackabletech/operator-rs.git"]
3636
# TODO revert this before merging!
37-
stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "feat/gitsync-ca-support" }
38-
# stackable-operator = { path = "../operator-rs/crates/stackable-operator" }
37+
# stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "feat/gitsync-ca-support" }
38+
stackable-operator = { path = "../operator-rs/crates/stackable-operator" }

‎crate-hashes.json‎

Lines changed: 0 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎extra/crds.yaml‎

Lines changed: 90 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1155,12 +1155,6 @@ spec:
11551155

11561156
Since git-sync v4.x.x this field is mapped to the flag `--ref`.
11571157
type: string
1158-
caCertSecretName:
1159-
description: |-
1160-
An optional secret used for holding CA certificates that will be used to verify the git server's TLS certificate by passing it to the git config option `http.sslCAInfo` passed with the gitsync command. The secret must have a key named `ca.crt` whose value is the PEM-encoded certificate bundle.
1161-
If `http.sslCAInfo` is also set via `gitSyncConf` (the `--git-config` option) then a warning will be logged.
1162-
nullable: true
1163-
type: string
11641158
credentials:
11651159
description: An optional secret used for git access.
11661160
nullable: true
@@ -1219,6 +1213,51 @@ spec:
12191213
description: 'The git repository URL that will be cloned, for example: `https://github.com/stackabletech/airflow-operator` or `ssh://git@github.com:stackable-airflow/dags.git`.'
12201214
format: uri
12211215
type: string
1216+
tls:
1217+
description: Use a TLS connection. If not specified no TLS will be used.
1218+
nullable: true
1219+
properties:
1220+
verification:
1221+
description: The verification method used to verify the certificates of the server and/or the client.
1222+
oneOf:
1223+
- required:
1224+
- none
1225+
- required:
1226+
- server
1227+
properties:
1228+
none:
1229+
description: Use TLS but don't verify certificates.
1230+
type: object
1231+
server:
1232+
description: Use TLS and a CA certificate to verify the server.
1233+
properties:
1234+
caCert:
1235+
description: CA cert to verify the server.
1236+
oneOf:
1237+
- required:
1238+
- webPki
1239+
- required:
1240+
- secretClass
1241+
properties:
1242+
secretClass:
1243+
description: |-
1244+
Name of the [SecretClass](https://docs.stackable.tech/home/nightly/secret-operator/secretclass) which will provide the CA certificate.
1245+
Note that a SecretClass does not need to have a key but can also work with just a CA certificate,
1246+
so if you got provided with a CA cert but don't have access to the key you can still use this method.
1247+
type: string
1248+
webPki:
1249+
description: |-
1250+
Use TLS and the CA certificates trusted by the common web browsers to verify the server.
1251+
This can be useful when you e.g. use public AWS S3 or other public available services.
1252+
type: object
1253+
type: object
1254+
required:
1255+
- caCert
1256+
type: object
1257+
type: object
1258+
required:
1259+
- verification
1260+
type: object
12221261
wait:
12231262
default: 20s
12241263
description: |-
@@ -7074,6 +7113,51 @@ spec:
70747113
description: 'The git repository URL that will be cloned, for example: `https://github.com/stackabletech/airflow-operator` or `ssh://git@github.com:stackable-airflow/dags.git`.'
70757114
format: uri
70767115
type: string
7116+
tls:
7117+
description: Use a TLS connection. If not specified no TLS will be used.
7118+
nullable: true
7119+
properties:
7120+
verification:
7121+
description: The verification method used to verify the certificates of the server and/or the client.
7122+
oneOf:
7123+
- required:
7124+
- none
7125+
- required:
7126+
- server
7127+
properties:
7128+
none:
7129+
description: Use TLS but don't verify certificates.
7130+
type: object
7131+
server:
7132+
description: Use TLS and a CA certificate to verify the server.
7133+
properties:
7134+
caCert:
7135+
description: CA cert to verify the server.
7136+
oneOf:
7137+
- required:
7138+
- webPki
7139+
- required:
7140+
- secretClass
7141+
properties:
7142+
secretClass:
7143+
description: |-
7144+
Name of the [SecretClass](https://docs.stackable.tech/home/nightly/secret-operator/secretclass) which will provide the CA certificate.
7145+
Note that a SecretClass does not need to have a key but can also work with just a CA certificate,
7146+
so if you got provided with a CA cert but don't have access to the key you can still use this method.
7147+
type: string
7148+
webPki:
7149+
description: |-
7150+
Use TLS and the CA certificates trusted by the common web browsers to verify the server.
7151+
This can be useful when you e.g. use public AWS S3 or other public available services.
7152+
type: object
7153+
type: object
7154+
required:
7155+
- caCert
7156+
type: object
7157+
type: object
7158+
required:
7159+
- verification
7160+
type: object
70777161
wait:
70787162
default: 20s
70797163
description: |-

tests/templates/kuttl/ca-cert/15-rbac.yaml.j2 renamed to tests/templates/kuttl/ca-cert/00-rbac.yaml.j2

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ rules:
1111
- secrets
1212
verbs:
1313
- create
14+
- get
15+
- patch
1416
{% if test_scenario['values']['openshift'] == "true" %}
1517
- apiGroups: ["security.openshift.io"]
1618
resources: ["securitycontextconstraints"]

‎tests/templates/kuttl/ca-cert/15-create-ca-cert.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,13 +43,17 @@ commands:
4343
kubectl create secret generic git-ca-cert \
4444
--from-file=ca.crt=ca.crt
4545
46+
kubectl label secret git-ca-cert secrets.stackable.tech/class=git-ca-cert
47+
4648
# Create an incorrect cert which should cause the gitsync container to exit
4749
openssl req -x509 -newkey rsa:4096 \
4850
-nodes -keyout ca-wrong.key -out ca-wrong.crt \
4951
-subj "/CN=wrong-git-ca"
5052
5153
kubectl create secret generic git-wrong-ca-cert \
5254
--from-file=ca.crt=ca-wrong.crt
55+
56+
kubectl label secret git-wrong-ca-cert secrets.stackable.tech/class=git-wrong-ca-cert
5357
securityContext:
5458
runAsUser: 1000
5559
runAsGroup: 1000

‎tests/templates/kuttl/ca-cert/25_airflow-wrong-cert.yaml.j2‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,14 @@
11
---
2+
apiVersion: secrets.stackable.tech/v1alpha1
3+
kind: SecretClass
4+
metadata:
5+
name: git-wrong-ca-cert
6+
spec:
7+
backend:
8+
k8sSearch:
9+
searchNamespace:
10+
pod: {}
11+
---
212
apiVersion: airflow.stackable.tech/v1alpha2
313
kind: AirflowCluster
414
metadata:
@@ -23,7 +33,11 @@ spec:
2333
basicAuthSecretName: git-credentials
2434
gitFolder: "mount-dags-gitsync/dags_airflow3"
2535
wait: 5s
26-
caCertSecretName: git-wrong-ca-cert
36+
tls:
37+
verification:
38+
server:
39+
caCert:
40+
secretClass: git-wrong-ca-cert
2741
webservers:
2842
roleConfig:
2943
listenerClass: external-unstable

0 commit comments

Comments
 (0)