configure tls on run-securityadmin

Author: labrenbe

rust/operator-binary/src/controller/build.rs

@@ -2,9 +2,8 @@ use std::marker::PhantomData;
 
 use role_builder::RoleBuilder;
 
-use crate::controller::build::job_builder::JobBuilder;
-
 use super::{ContextNames, KubernetesResources, Prepared, ValidatedCluster};
+use crate::controller::build::job_builder::JobBuilder;
 
 pub mod job_builder;
 pub mod node_config;

rust/operator-binary/src/controller/build/job_builder.rs

@@ -1,7 +1,10 @@
 use stackable_operator::{
     builder::{
         meta::ObjectMetaBuilder,
-        pod::{container::ContainerBuilder, resources::ResourceRequirementsBuilder},
+        pod::{
+            container::ContainerBuilder, resources::ResourceRequirementsBuilder,
+            volume::SecretFormat,
+        },
     },
     k8s_openapi::api::{
         batch::v1::{Job, JobSpec},
@@ -14,17 +17,20 @@ use stackable_operator::{
         Label, Labels,
         consts::{STACKABLE_VENDOR_KEY, STACKABLE_VENDOR_VALUE},
     },
+    time::Duration,
 };
 
 use crate::{
     controller::{ContextNames, ValidatedCluster},
     framework::{
-        IsLabelValue, builder::meta::ownerreference_from_resource, role_utils::ResourceNames,
+        IsLabelValue,
+        builder::{meta::ownerreference_from_resource, volume::build_tls_volume},
+        role_utils::ResourceNames,
     },
 };
 
 const RUN_SECURITYADMIN_CERT_VOLUME_NAME: &str = "tls";
-const RUN_SECURITYADMIN_CERT_VOLUME_MOUNT: &str = "/stackable/cert";
+const RUN_SECURITYADMIN_CERT_VOLUME_MOUNT: &str = "/stackable/tls-client";
 const SECURITY_CONFIG_VOLUME_NAME: &str = "security-config";
 const SECURITY_CONFIG_VOLUME_MOUNT: &str = "/stackable/opensearch/config/opensearch-security";
 const RUN_SECURITYADMIN_CONTAINER_NAME: &str = "run-securityadmin";
@@ -61,11 +67,11 @@ impl<'a> JobBuilder<'a> {
         let args = [
             "plugins/opensearch-security/tools/securityadmin.sh".to_string(),
             "-cacert".to_string(),
-            "config/tls-client/ca.crt".to_string(),
+            "/stackable/tls-client/ca.crt".to_string(),
             "-cert".to_string(),
-            "config/tls-client/tls.crt".to_string(),
+            "/stackable/tls-client/tls.crt".to_string(),
             "-key".to_string(),
-            "config/tls-client/tls.key".to_string(),
+            "/stackable/tls-client/tls.key".to_string(),
             "--hostname".to_string(),
             self.opensearch_master_fqdn(),
             "--configdir".to_string(),
@@ -105,20 +111,29 @@ impl<'a> JobBuilder<'a> {
             metadata: Some(metadata.clone()),
             spec: Some(PodSpec {
                 containers: vec![container],
-
                 security_context: Some(PodSecurityContext {
                     fs_group: Some(1000),
                     ..PodSecurityContext::default()
                 }),
+                restart_policy: Some("OnFailure".to_string()),
                 service_account_name: Some(self.resource_names.service_account_name()),
-                volumes: Some(vec![Volume {
-                    name: SECURITY_CONFIG_VOLUME_NAME.to_owned(),
-                    secret: Some(SecretVolumeSource {
-                        secret_name: Some("opensearch-security-config".to_string()),
-                        ..Default::default()
-                    }),
-                    ..Volume::default()
-                }]),
+                volumes: Some(vec![
+                    Volume {
+                        name: SECURITY_CONFIG_VOLUME_NAME.to_owned(),
+                        secret: Some(SecretVolumeSource {
+                            secret_name: Some("opensearch-security-config".to_string()),
+                            ..Default::default()
+                        }),
+                        ..Volume::default()
+                    },
+                    build_tls_volume(
+                        RUN_SECURITYADMIN_CERT_VOLUME_NAME,
+                        Vec::<String>::new(),
+                        SecretFormat::TlsPem,
+                        &Duration::from_days_unchecked(15),
+                        None,
+                    ),
+                ]),
                 ..PodSpec::default()
             }),
         };

rust/operator-binary/src/framework/builder.rs

@@ -1,3 +1,4 @@
 pub mod meta;
 pub mod pdb;
 pub mod pod;
+pub mod volume;

rust/operator-binary/src/framework/builder/volume.rs

@@ -0,0 +1,34 @@
+use stackable_operator::{
+    builder::pod::volume::{SecretFormat, SecretOperatorVolumeSourceBuilder, VolumeBuilder},
+    k8s_openapi::api::core::v1::Volume,
+    time::Duration,
+};
+
+pub fn build_tls_volume(
+    volume_name: &str,
+    service_scopes: impl IntoIterator<Item = impl AsRef<str>>,
+    secret_format: SecretFormat,
+    requested_secret_lifetime: &Duration,
+    listener_scope: Option<&str>,
+) -> Volume {
+    let mut secret_volume_source_builder =
+        SecretOperatorVolumeSourceBuilder::new("tls".to_string());
+
+    for scope in service_scopes {
+        secret_volume_source_builder.with_service_scope(scope.as_ref());
+    }
+    if let Some(listener_scope) = listener_scope {
+        secret_volume_source_builder.with_listener_volume_scope(listener_scope);
+    }
+
+    VolumeBuilder::new(volume_name)
+        .ephemeral(
+            secret_volume_source_builder
+                .with_pod_scope()
+                .with_format(secret_format)
+                .with_auto_tls_cert_lifetime(*requested_secret_lifetime)
+                .build()
+                .expect("volume should be built"),
+        )
+        .build()
+}