add tls secret class to crd

Author: labrenbe

deploy/helm/opensearch-operator/crds/crds.yaml

@@ -25,6 +25,18 @@ spec:
             spec:
               description: A OpenSearch cluster stacklet. This resource is managed by the Stackable operator for OpenSearch. Find more information on how to use it and the resources that the operator generates in the [operator documentation](https://docs.stackable.tech/home/nightly/opensearch/).
               properties:
+                clusterConfig:
+                  properties:
+                    tls:
+                      properties:
+                        secretClass:
+                          default: tls
+                          description: 'Only affects client connections. This setting controls: - If TLS encryption is used at all - Which cert the servers should use to authenticate themselves against the client'
+                          type: string
+                      type: object
+                  required:
+                    - tls
+                  type: object
                 clusterOperation:
                   default:
                     reconciliationPaused: false
@@ -461,6 +473,7 @@ spec:
                     - roleGroups
                   type: object
               required:
+                - clusterConfig
                 - image
                 - nodes
               type: object

rust/operator-binary/src/controller.rs

@@ -28,7 +28,7 @@ use validate::validate;
 use crate::{
     crd::{
         NodeRoles,
-        v1alpha1::{self},
+        v1alpha1::{self, OpenSearchClusterConfig},
     },
     framework::{
         ClusterName, ControllerName, HasNamespace, HasObjectName, HasUid, IsLabelValue,
@@ -132,6 +132,7 @@ pub struct ValidatedCluster {
     pub name: ClusterName,
     pub namespace: String,
     pub uid: String,
+    pub cluster_config: OpenSearchClusterConfig,
     pub role_config: GenericRoleConfig,
     // "validated" means that labels are valid and no ugly rolegroup name broke them
     pub role_group_configs: BTreeMap<RoleGroupName, OpenSearchRoleGroupConfig>,

rust/operator-binary/src/controller/build/job_builder.rs

@@ -66,33 +66,34 @@ impl<'a> JobBuilder<'a> {
 
         let args = [
             "plugins/opensearch-security/tools/securityadmin.sh".to_string(),
+            "--hostname".to_string(),
+            self.opensearch_master_fqdn(),
+            "--configdir".to_string(),
+            "config/opensearch-security/".to_string(),
             "-cacert".to_string(),
             "/stackable/tls-client/ca.crt".to_string(),
             "-cert".to_string(),
             "/stackable/tls-client/tls.crt".to_string(),
             "-key".to_string(),
             "/stackable/tls-client/tls.key".to_string(),
-            "--hostname".to_string(),
-            self.opensearch_master_fqdn(),
-            "--configdir".to_string(),
-            "config/opensearch-security/".to_string(),
         ];
+
         let mut cb = ContainerBuilder::new(RUN_SECURITYADMIN_CONTAINER_NAME)
             .expect("should be a valid container name");
         let container = cb
             .image_from_product_image(&product_image)
             .command(vec!["sh".to_string(), "-c".to_string()])
             .args(vec![args.join(" ")])
             // The VolumeMount for the secret operator key store certificates
-            .add_volume_mounts([
+            .add_volume_mounts(vec![
                 VolumeMount {
-                    mount_path: RUN_SECURITYADMIN_CERT_VOLUME_MOUNT.to_owned(),
-                    name: RUN_SECURITYADMIN_CERT_VOLUME_NAME.to_owned(),
+                    mount_path: SECURITY_CONFIG_VOLUME_MOUNT.to_owned(),
+                    name: SECURITY_CONFIG_VOLUME_NAME.to_owned(),
                     ..VolumeMount::default()
                 },
                 VolumeMount {
-                    mount_path: SECURITY_CONFIG_VOLUME_MOUNT.to_owned(),
-                    name: SECURITY_CONFIG_VOLUME_NAME.to_owned(),
+                    mount_path: RUN_SECURITYADMIN_CERT_VOLUME_MOUNT.to_owned(),
+                    name: RUN_SECURITYADMIN_CERT_VOLUME_NAME.to_owned(),
                     ..VolumeMount::default()
                 },
             ])
@@ -106,7 +107,6 @@ impl<'a> JobBuilder<'a> {
                     .build(),
             )
             .build();
-
         let pod_template = PodTemplateSpec {
             metadata: Some(metadata.clone()),
             spec: Some(PodSpec {
@@ -128,6 +128,7 @@ impl<'a> JobBuilder<'a> {
                     },
                     build_tls_volume(
                         RUN_SECURITYADMIN_CERT_VOLUME_NAME,
+                        &self.cluster.cluster_config.tls.secret_class,
                         Vec::<String>::new(),
                         SecretFormat::TlsPem,
                         &Duration::from_days_unchecked(15),

rust/operator-binary/src/controller/build/node_config.rs

@@ -258,7 +258,10 @@ mod tests {
     use super::*;
     use crate::{
         controller::ValidatedOpenSearchConfig,
-        crd::NodeRoles,
+        crd::{
+            NodeRoles,
+            v1alpha1::{OpenSearchClusterConfig, OpenSearchTls},
+        },
         framework::{ClusterName, ProductVersion, role_utils::GenericProductSpecificCommonConfig},
     };
 
@@ -275,6 +278,11 @@ mod tests {
                 .expect("should be a valid ClusterName"),
             namespace: "default".to_owned(),
             uid: "0b1e30e6-326e-4c1a-868d-ad6598b49e8b".to_owned(),
+            cluster_config: OpenSearchClusterConfig {
+                tls: OpenSearchTls {
+                    secret_class: "my-tls-secret-class".to_owned(),
+                },
+            },
             role_config: GenericRoleConfig::default(),
             role_group_configs: BTreeMap::new(),
         };

rust/operator-binary/src/controller/validate.rs

@@ -13,9 +13,11 @@ use super::{
     ValidatedOpenSearchConfig,
 };
 use crate::{
-    crd::v1alpha1::{self, OpenSearchConfig, OpenSearchConfigFragment},
+    crd::v1alpha1::{
+        self, OpenSearchClusterConfig, OpenSearchConfig, OpenSearchConfigFragment, OpenSearchTls,
+    },
     framework::{
-        ClusterName,
+        ClusterName, TlsSecretClassName,
         role_utils::{GenericProductSpecificCommonConfig, RoleGroupConfig, with_validated_config},
     },
 };
@@ -41,6 +43,9 @@ pub enum Error {
     #[snafu(display("failed to set role-group name"))]
     ParseRoleGroupName { source: crate::framework::Error },
 
+    #[snafu(display("failed to set tls secret class"))]
+    ParseTlsSecretClassName { source: crate::framework::Error },
+
     #[snafu(display("fragment validation failure"))]
     ValidateOpenSearchConfig {
         source: stackable_operator::config::fragment::ValidationError,
@@ -70,6 +75,8 @@ pub fn validate(
     let product_version = ProductVersion::from_str(cluster.spec.image.product_version())
         .context(ParseProductVersionSnafu)?;
 
+    let validated_cluster_config = validate_cluster_config(cluster.spec.cluster_config.clone())?;
+
     let mut role_group_configs = BTreeMap::new();
     for (raw_role_group_name, role_group_config) in &cluster.spec.nodes.role_groups {
         let role_group_name =
@@ -88,11 +95,24 @@ pub fn validate(
         name: cluster_name,
         namespace,
         uid,
+        cluster_config: validated_cluster_config,
         role_config: cluster.spec.nodes.role_config.clone(),
         role_group_configs,
     })
 }
 
+fn validate_cluster_config(
+    cluster_config: OpenSearchClusterConfig,
+) -> Result<OpenSearchClusterConfig> {
+    validate_tls_config(&cluster_config.tls)?;
+    Ok(cluster_config)
+}
+
+fn validate_tls_config(tls_config: &OpenSearchTls) -> Result<()> {
+    TlsSecretClassName::from_str(&tls_config.secret_class).context(ParseTlsSecretClassNameSnafu)?;
+    Ok(())
+}
+
 fn validate_role_group_config(
     context_names: &ContextNames,
     cluster_name: &ClusterName,

rust/operator-binary/src/crd/mod.rs

@@ -31,6 +31,7 @@ use crate::framework::{
 };
 
 const DEFAULT_LISTENER_CLASS: &str = "cluster-internal";
+const TLS_DEFAULT_SECRET_CLASS: &str = "tls";
 
 #[versioned(version(name = "v1alpha1"))]
 pub mod versioned {
@@ -57,6 +58,9 @@ pub mod versioned {
         // no doc string - see ProductImage struct
         pub image: ProductImage,
 
+        // no doc string - see ProductImage struct
+        pub cluster_config: OpenSearchClusterConfig,
+
         // no doc string - see ClusterOperation struct
         #[serde(default)]
         pub cluster_operation: ClusterOperation,
@@ -66,6 +70,23 @@ pub mod versioned {
             Role<OpenSearchConfigFragment, GenericRoleConfig, GenericProductSpecificCommonConfig>,
     }
 
+    #[derive(Clone, Debug, Deserialize, JsonSchema, PartialEq, Serialize)]
+    #[serde(rename_all = "camelCase")]
+    pub struct OpenSearchClusterConfig {
+        pub tls: OpenSearchTls,
+    }
+
+    #[derive(Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]
+    #[serde(rename_all = "camelCase")]
+    pub struct OpenSearchTls {
+        /// Only affects client connections.
+        /// This setting controls:
+        /// - If TLS encryption is used at all
+        /// - Which cert the servers should use to authenticate themselves against the client
+        #[serde(default = "tls_secret_class_default")]
+        pub secret_class: String,
+    }
+
     // The possible node roles are by default the built-in roles and the search role, see
     // https://github.com/opensearch-project/OpenSearch/blob/3.0.0/server/src/main/java/org/opensearch/cluster/node/DiscoveryNode.java#L609-L614.
     //
@@ -243,6 +264,18 @@ impl v1alpha1::OpenSearchConfig {
     }
 }
 
+impl Default for v1alpha1::OpenSearchTls {
+    fn default() -> Self {
+        v1alpha1::OpenSearchTls {
+            secret_class: tls_secret_class_default(),
+        }
+    }
+}
+
+fn tls_secret_class_default() -> String {
+    TLS_DEFAULT_SECRET_CLASS.to_string()
+}
+
 #[derive(Clone, Debug, Default, Deserialize, JsonSchema, PartialEq, Serialize)]
 pub struct NodeRoles(Vec<v1alpha1::NodeRole>);
 

rust/operator-binary/src/framework.rs

@@ -38,6 +38,9 @@ pub enum Error {
 #[allow(dead_code)]
 pub const MAX_OBJECT_NAME_LENGTH: usize = 253;
 
+#[allow(dead_code)]
+pub const MAX_ANNOTATION_LENGTH: usize = 253;
+
 /// Has a name that can be used as a DNS subdomain name as defined in RFC 1123.
 /// Most resource types, e.g. a Pod, require such a compliant name.
 pub trait HasObjectName {
@@ -172,7 +175,11 @@ attributed_string_type! {
     is_object_name,
     is_valid_label_value
 }
-
+attributed_string_type! {
+    TlsSecretClassName,
+    "The TLS SecretClass name",
+    (max_length = MAX_ANNOTATION_LENGTH - 30)
+}
 #[cfg(test)]
 mod tests {
     use std::str::FromStr;

rust/operator-binary/src/framework/builder/volume.rs

@@ -6,13 +6,14 @@ use stackable_operator::{
 
 pub fn build_tls_volume(
     volume_name: &str,
+    tls_secret_class_name: &str,
     service_scopes: impl IntoIterator<Item = impl AsRef<str>>,
     secret_format: SecretFormat,
     requested_secret_lifetime: &Duration,
     listener_scope: Option<&str>,
 ) -> Volume {
     let mut secret_volume_source_builder =
-        SecretOperatorVolumeSourceBuilder::new("tls".to_string());
+        SecretOperatorVolumeSourceBuilder::new(tls_secret_class_name);
 
     for scope in service_scopes {
         secret_volume_source_builder.with_service_scope(scope.as_ref());
@@ -28,7 +29,7 @@ pub fn build_tls_volume(
                 .with_format(secret_format)
                 .with_auto_tls_cert_lifetime(*requested_secret_lifetime)
                 .build()
-                .expect("volume should be built"),
+                .expect("volume should be built without parse errors"),
         )
         .build()
 }