Skip to content

Commit f747050

Browse files
siegfriedwebersiegfriedweber
committed
feat: Add node domains to nodes_dn
1 parent 74b8986 commit f747050

7 files changed

Lines changed: 46 additions & 78 deletions

File tree

‎Cargo.lock‎

Lines changed: 0 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.nix‎

Lines changed: 9 additions & 54 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,4 @@ uuid = "1.18"
2828

2929
[patch."https://github.com/stackabletech/operator-rs"]
3030
# stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
31+
stackable-operator = { path = "../operator-rs/crates/stackable-operator" }

‎crate-hashes.json‎

Lines changed: 0 additions & 9 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎rust/operator-binary/src/controller/build/node_config.rs‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ use crate::{
1616
framework::{
1717
builder::pod::container::{EnvVarName, EnvVarSet},
1818
product_logging::framework::STACKABLE_LOG_DIR,
19-
role_group_utils,
19+
role_group_utils::{self, ResourceNames},
2020
types::{kubernetes::ServiceName, operator::RoleGroupName},
2121
},
2222
};
@@ -223,11 +223,39 @@ impl NodeConfig {
223223
CONFIG_OPTION_DISCOVERY_TYPE.to_owned(),
224224
json!(self.discovery_type()),
225225
);
226+
let nodes_dn = self
227+
.cluster
228+
.role_group_configs
229+
.keys()
230+
.map(|role_group_name| {
231+
let resource_names = ResourceNames {
232+
cluster_name: self.cluster.name.clone(),
233+
role_name: ValidatedCluster::role_name(),
234+
role_group_name: role_group_name.clone(),
235+
};
236+
237+
self.cluster_domain_name
238+
.split('.')
239+
.rev()
240+
.chain([
241+
"svc",
242+
self.cluster.namespace.as_ref(),
243+
resource_names.headless_service_name().as_ref(),
244+
&format!(
245+
"{stateful_set_name}-*",
246+
stateful_set_name = resource_names.stateful_set_name()
247+
),
248+
])
249+
.map(|component| format!("DC={component}"))
250+
.collect::<Vec<_>>()
251+
.join(",")
252+
})
253+
.collect::<Vec<_>>();
226254
config.insert
227255
// Accept certificates generated by the secret-operator
228256
(
229257
CONFIG_OPTION_PLUGINS_SECURITY_NODES_DN.to_owned(),
230-
json!(["CN=generated certificate for pod".to_owned()]),
258+
json!(nodes_dn),
231259
);
232260
config.insert(
233261
CONFIG_OPTION_NODE_ATTR_ROLE_GROUP.to_owned(),

‎rust/operator-binary/src/controller/build/role_group_builder.rs‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1075,7 +1075,8 @@ impl<'a> RoleGroupBuilder<'a> {
10751075
.with_pod_scope()
10761076
.with_listener_volume_scope(ROLE_GROUP_LISTENER_VOLUME_NAME.to_string())
10771077
.with_format(SecretFormat::TlsPem)
1078-
.with_auto_tls_cert_lifetime(self.role_group_config.config.requested_secret_lifetime);
1078+
.with_auto_tls_cert_lifetime(self.role_group_config.config.requested_secret_lifetime)
1079+
.with_auto_tls_cert_domain_components_in_subject_dn(true);
10791080

10801081
if self
10811082
.role_group_config
@@ -1110,7 +1111,8 @@ impl<'a> RoleGroupBuilder<'a> {
11101111
.with_pod_scope()
11111112
.with_listener_volume_scope(ROLE_GROUP_LISTENER_VOLUME_NAME.to_string())
11121113
.with_format(SecretFormat::TlsPem)
1113-
.with_auto_tls_cert_lifetime(self.role_group_config.config.requested_secret_lifetime);
1114+
.with_auto_tls_cert_lifetime(self.role_group_config.config.requested_secret_lifetime)
1115+
.with_auto_tls_cert_domain_components_in_subject_dn(true);
11141116

11151117
if self.role_group_config.config.discovery_service_exposed {
11161118
volume_source_builder

‎tests/templates/kuttl/smoke/10-assert.yaml.j2‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1000,7 +1000,7 @@ data:
10001000
node.store.allow_mmap: "false"
10011001
path.logs: "/stackable/log/opensearch"
10021002
plugins.security.allow_default_init_securityindex: true
1003-
plugins.security.nodes_dn: ["CN=generated certificate for pod"]
1003+
plugins.security.nodes_dn: ["DC=local,DC=cluster,DC=svc,DC=test,DC=opensearch-nodes-cluster-manager-headless,DC=opensearch-nodes-cluster-manager-*","DC=local,DC=cluster,DC=svc,DC=test,DC=opensearch-nodes-data-headless,DC=opensearch-nodes-data-*"]
10041004
{% if test_scenario['values']['server-use-tls'] == 'true' %}
10051005
plugins.security.ssl.http.enabled: true
10061006
plugins.security.ssl.http.pemcert_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/server/tls.crt"
@@ -1041,7 +1041,7 @@ data:
10411041
node.store.allow_mmap: "false"
10421042
path.logs: "/stackable/log/opensearch"
10431043
plugins.security.allow_default_init_securityindex: true
1044-
plugins.security.nodes_dn: ["CN=generated certificate for pod"]
1044+
plugins.security.nodes_dn: ["DC=local,DC=cluster,DC=svc,DC=test,DC=opensearch-nodes-cluster-manager-headless,DC=opensearch-nodes-cluster-manager-*","DC=local,DC=cluster,DC=svc,DC=test,DC=opensearch-nodes-data-headless,DC=opensearch-nodes-data-*"]
10451045
{% if test_scenario['values']['server-use-tls'] == 'true' %}
10461046
plugins.security.ssl.http.enabled: true
10471047
plugins.security.ssl.http.pemcert_filepath: "{{ test_scenario['values']['opensearch_home'] }}/config/tls/server/tls.crt"

0 commit comments

Comments
 (0)