Skip to content

Commit 77416d8

Browse files
stuggiclaude
stuggi
and
claude
committed
[b/r] Add restore=false label to internal service cert requests
Internal service certs (galera, memcached, rabbitmq, ovn, nova, neutron, octavia, redis) are regenerated by cert-manager during restore and should not be restored from backup. Add backup.BackupRestoreLabel: "false" to their CertificateRequest Labels, matching what common.go already does for route certs. cert-manager propagates labels from Certificate CR to the Secret it creates. The BackupConfig controller then sees restore=false and skips these secrets during backup labeling. Note: cert-nova-metadata-internal-svc uses lib-common's EnsureCertForServiceWithSelector which needs a separate fix. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent d5e4520 commit 77416d8

12 files changed

Lines changed: 34 additions & 21 deletions

File tree

‎api/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging
144144

145145
replace github.com/cert-manager/cmctl/v2 => github.com/cert-manager/cmctl/v2 v2.1.2-0.20241127223932-88edb96860cf //allow-merging
146146

147-
replace github.com/openstack-k8s-operators/lib-common/modules/common => github.com/stuggi/lib-common/modules/common v0.0.0-20260319153531-b6972195788d
147+
replace github.com/openstack-k8s-operators/lib-common/modules/common => github.com/stuggi/lib-common/modules/common v0.0.0-20260324154846-c2eb57bed8d7
148148

149149
replace github.com/openstack-k8s-operators/mariadb-operator/api => github.com/stuggi/mariadb-operator/api v0.0.0-20260323091819-07fa2e3001c0
150150

‎api/go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,8 +183,8 @@ github.com/stuggi/glance-operator/api v0.0.0-20260319161100-d27378aa9783 h1:V94x
183183
github.com/stuggi/glance-operator/api v0.0.0-20260319161100-d27378aa9783/go.mod h1:TLRqdtji6ZhMcwI/uy70t8cKmIDjo/q4bjUUOYbeB+Y=
184184
github.com/stuggi/infra-operator/apis v0.0.0-20260313105254-f85e28889d29 h1:Z+Qo/USVFiq2TQFRaEHJ1rS6J6Dkd2wiYjxjGd7j9S0=
185185
github.com/stuggi/infra-operator/apis v0.0.0-20260313105254-f85e28889d29/go.mod h1:XsEbK1LxXg8beKXRf8s1OQanE82hCuGtkO1URg7uezU=
186-
github.com/stuggi/lib-common/modules/common v0.0.0-20260319153531-b6972195788d h1:bshrKJVnihAu8AGIxLUZ4Ta8DOjG7iOmBrpJbty+PGI=
187-
github.com/stuggi/lib-common/modules/common v0.0.0-20260319153531-b6972195788d/go.mod h1:I/VBXZLdjk8DUGsEbB+Ha72JBFYYntP7Pm2FpEto9K8=
186+
github.com/stuggi/lib-common/modules/common v0.0.0-20260324154846-c2eb57bed8d7 h1:oExdwaeBQae3Tpsc21QOwjagL30kCBvAoBWfeMEhxG0=
187+
github.com/stuggi/lib-common/modules/common v0.0.0-20260324154846-c2eb57bed8d7/go.mod h1:I/VBXZLdjk8DUGsEbB+Ha72JBFYYntP7Pm2FpEto9K8=
188188
github.com/stuggi/mariadb-operator/api v0.0.0-20260323091819-07fa2e3001c0 h1:vvSKXEVSc12xKF+yWh5HD9ZmEviECoovcNrqqObA160=
189189
github.com/stuggi/mariadb-operator/api v0.0.0-20260323091819-07fa2e3001c0/go.mod h1:cyeexUkEIgzQ3c1vVVv/DQ3AbnECfDwKdZteKC+sZKY=
190190
github.com/stuggi/swift-operator/api v0.0.0-20260319154125-3d8c75168895 h1:2thlxyQQ/EUmh+Shczy78nAcsMST8FgeztnlWpz19kM=

‎go.mod‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -182,7 +182,9 @@ replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging
182182

183183
replace github.com/cert-manager/cmctl/v2 => github.com/cert-manager/cmctl/v2 v2.1.2-0.20241127223932-88edb96860cf //allow-merging
184184

185-
replace github.com/openstack-k8s-operators/lib-common/modules/common => github.com/stuggi/lib-common/modules/common v0.0.0-20260319153531-b6972195788d
185+
replace github.com/openstack-k8s-operators/lib-common/modules/common => github.com/stuggi/lib-common/modules/common v0.0.0-20260324154846-c2eb57bed8d7
186+
187+
replace github.com/openstack-k8s-operators/lib-common/modules/certmanager => github.com/stuggi/lib-common/modules/certmanager v0.0.0-20260324154846-c2eb57bed8d7
186188

187189
replace github.com/openstack-k8s-operators/mariadb-operator/api => github.com/stuggi/mariadb-operator/api v0.0.0-20260323091819-07fa2e3001c0
188190

‎go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -152,8 +152,6 @@ github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260314080138
152152
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260314080138-b41734470581/go.mod h1:l15wx+Qxi/I9Nlj6u6PheZqkf9dBW7cCxAcjl8zsu+8=
153153
github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260310070607-b96da8dd520e h1:X7HkZG8rWmb5qK5IrGVuAQj1qCsjBRlo2JZyOPjmAiY=
154154
github.com/openstack-k8s-operators/lib-common/modules/ansible v0.6.1-0.20260310070607-b96da8dd520e/go.mod h1:tXxVkkk8HlATwTmDA5RTP3b+c8apfuMM15mZ2wW5iNs=
155-
github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.6.1-0.20260310070607-b96da8dd520e h1:OthI0EGrntYyFV0YkQHJ1i4sYcylWBeh09x1lxK97ak=
156-
github.com/openstack-k8s-operators/lib-common/modules/certmanager v0.6.1-0.20260310070607-b96da8dd520e/go.mod h1:GzD7Jc5o98ptJ97DSjhC0CQ6OiTP0PB/2qJqxYGcOH8=
157155
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260310070607-b96da8dd520e h1:42OT26Ak0lwWbJDNwhv/0HsjafVkLyPhfonS5DjDb2g=
158156
github.com/openstack-k8s-operators/lib-common/modules/openstack v0.6.1-0.20260310070607-b96da8dd520e/go.mod h1:7yqbVpg0k0vW+kZks+TMU/cd1ovoejyHfVPWcyGYLHI=
159157
github.com/openstack-k8s-operators/lib-common/modules/storage v0.6.1-0.20260310070607-b96da8dd520e h1:lHsE9kmPzGHfO6o9vXj6f5UTIlQRJNdrvrj8GWy/ct8=
@@ -226,8 +224,10 @@ github.com/stuggi/glance-operator/api v0.0.0-20260319161100-d27378aa9783 h1:V94x
226224
github.com/stuggi/glance-operator/api v0.0.0-20260319161100-d27378aa9783/go.mod h1:TLRqdtji6ZhMcwI/uy70t8cKmIDjo/q4bjUUOYbeB+Y=
227225
github.com/stuggi/infra-operator/apis v0.0.0-20260313105254-f85e28889d29 h1:Z+Qo/USVFiq2TQFRaEHJ1rS6J6Dkd2wiYjxjGd7j9S0=
228226
github.com/stuggi/infra-operator/apis v0.0.0-20260313105254-f85e28889d29/go.mod h1:XsEbK1LxXg8beKXRf8s1OQanE82hCuGtkO1URg7uezU=
229-
github.com/stuggi/lib-common/modules/common v0.0.0-20260319153531-b6972195788d h1:bshrKJVnihAu8AGIxLUZ4Ta8DOjG7iOmBrpJbty+PGI=
230-
github.com/stuggi/lib-common/modules/common v0.0.0-20260319153531-b6972195788d/go.mod h1:I/VBXZLdjk8DUGsEbB+Ha72JBFYYntP7Pm2FpEto9K8=
227+
github.com/stuggi/lib-common/modules/certmanager v0.0.0-20260324154846-c2eb57bed8d7 h1:dDdVqumOg+K9jewhtJjQzTMmt/ufuXpvB1YR9b9lv5M=
228+
github.com/stuggi/lib-common/modules/certmanager v0.0.0-20260324154846-c2eb57bed8d7/go.mod h1:GzD7Jc5o98ptJ97DSjhC0CQ6OiTP0PB/2qJqxYGcOH8=
229+
github.com/stuggi/lib-common/modules/common v0.0.0-20260324154846-c2eb57bed8d7 h1:oExdwaeBQae3Tpsc21QOwjagL30kCBvAoBWfeMEhxG0=
230+
github.com/stuggi/lib-common/modules/common v0.0.0-20260324154846-c2eb57bed8d7/go.mod h1:I/VBXZLdjk8DUGsEbB+Ha72JBFYYntP7Pm2FpEto9K8=
231231
github.com/stuggi/mariadb-operator/api v0.0.0-20260323091819-07fa2e3001c0 h1:vvSKXEVSc12xKF+yWh5HD9ZmEviECoovcNrqqObA160=
232232
github.com/stuggi/mariadb-operator/api v0.0.0-20260323091819-07fa2e3001c0/go.mod h1:cyeexUkEIgzQ3c1vVVv/DQ3AbnECfDwKdZteKC+sZKY=
233233
github.com/stuggi/swift-operator/api v0.0.0-20260319154125-3d8c75168895 h1:2thlxyQQ/EUmh+Shczy78nAcsMST8FgeztnlWpz19kM=

‎internal/openstack/galera.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010

1111
certmgrv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
1212
"github.com/openstack-k8s-operators/lib-common/modules/certmanager"
13+
"github.com/openstack-k8s-operators/lib-common/modules/common/backup"
1314
"github.com/openstack-k8s-operators/lib-common/modules/common/clusterdns"
1415
"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
1516
"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
@@ -142,7 +143,7 @@ func ReconcileGaleras(
142143
"server auth",
143144
"client auth",
144145
},
145-
Labels: map[string]string{serviceCertSelector: ""},
146+
Labels: map[string]string{serviceCertSelector: "", backup.BackupRestoreLabel: "false"},
146147
}
147148
if instance.Spec.TLS.PodLevel.Internal.Cert.Duration != nil {
148149
certRequest.Duration = &instance.Spec.TLS.PodLevel.Internal.Cert.Duration.Duration

‎internal/openstack/memcached.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
certmgrv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
1111
memcachedv1 "github.com/openstack-k8s-operators/infra-operator/apis/memcached/v1beta1"
1212
"github.com/openstack-k8s-operators/lib-common/modules/certmanager"
13+
"github.com/openstack-k8s-operators/lib-common/modules/common/backup"
1314
"github.com/openstack-k8s-operators/lib-common/modules/common/clusterdns"
1415
"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
1516
"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
@@ -213,7 +214,7 @@ func reconcileMemcached(
213214
fmt.Sprintf("%s.%s.svc.%s", name, instance.Namespace, clusterDomain),
214215
fmt.Sprintf("*.%s.%s.svc.%s", name, instance.Namespace, clusterDomain),
215216
},
216-
Labels: map[string]string{serviceCertSelector: ""},
217+
Labels: map[string]string{serviceCertSelector: "", backup.BackupRestoreLabel: "false"},
217218
}
218219
if instance.Spec.TLS.PodLevel.Internal.Cert.Duration != nil {
219220
certRequest.Duration = &instance.Spec.TLS.PodLevel.Internal.Cert.Duration.Duration
@@ -245,7 +246,7 @@ func reconcileMemcached(
245246
fmt.Sprintf("*.%s.svc", instance.Namespace),
246247
fmt.Sprintf("*.%s.svc.%s", instance.Namespace, clusterDomain),
247248
},
248-
Labels: map[string]string{serviceCertSelector: ""},
249+
Labels: map[string]string{serviceCertSelector: "", backup.BackupRestoreLabel: "false"},
249250
Usages: []certmgrv1.KeyUsage{
250251
certmgrv1.UsageKeyEncipherment,
251252
certmgrv1.UsageDigitalSignature,

‎internal/openstack/neutron.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66

77
certmgrv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
88
"github.com/openstack-k8s-operators/lib-common/modules/certmanager"
9+
"github.com/openstack-k8s-operators/lib-common/modules/common/backup"
910
"github.com/openstack-k8s-operators/lib-common/modules/common/clusterdns"
1011
"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
1112
"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
@@ -91,7 +92,7 @@ func ReconcileNeutron(ctx context.Context, instance *corev1beta1.OpenStackContro
9192
certmgrv1.UsageDigitalSignature,
9293
certmgrv1.UsageClientAuth,
9394
},
94-
Labels: map[string]string{serviceCertSelector: ""},
95+
Labels: map[string]string{serviceCertSelector: "", backup.BackupRestoreLabel: "false"},
9596
}
9697
if instance.Spec.TLS.PodLevel.Ovn.Cert.Duration != nil {
9798
certRequest.Duration = &instance.Spec.TLS.PodLevel.Ovn.Cert.Duration.Duration

‎internal/openstack/nova.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"fmt"
2222

2323
"github.com/openstack-k8s-operators/lib-common/modules/certmanager"
24+
"github.com/openstack-k8s-operators/lib-common/modules/common/backup"
2425
"github.com/openstack-k8s-operators/lib-common/modules/common/clusterdns"
2526
"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
2627
"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
@@ -273,7 +274,8 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl
273274
nova.Namespace,
274275
instance.Spec.Nova.Template.MetadataServiceTemplate.Override.Service.Labels,
275276
instance.GetInternalIssuer(),
276-
nil)
277+
nil,
278+
map[string]string{backup.BackupRestoreLabel: "false"})
277279
if err != nil && !k8s_errors.IsNotFound(err) {
278280
return ctrlResult, err
279281
} else if (ctrlResult != ctrl.Result{}) {
@@ -296,7 +298,8 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl
296298
nova.Namespace,
297299
cellTemplate.MetadataServiceTemplate.Override.Service.Labels,
298300
instance.GetInternalIssuer(),
299-
nil)
301+
nil,
302+
map[string]string{backup.BackupRestoreLabel: "false"})
300303
if err != nil && !k8s_errors.IsNotFound(err) {
301304
return ctrlResult, err
302305
} else if (ctrlResult != ctrl.Result{}) {
@@ -378,7 +381,7 @@ func ReconcileNova(ctx context.Context, instance *corev1beta1.OpenStackControlPl
378381
certmgrv1.UsageServerAuth,
379382
certmgrv1.UsageClientAuth,
380383
},
381-
Labels: map[string]string{serviceCertSelector: ""},
384+
Labels: map[string]string{serviceCertSelector: "", backup.BackupRestoreLabel: "false"},
382385
}
383386
if instance.Spec.TLS.PodLevel.Libvirt.Cert.Duration != nil {
384387
certRequest.Duration = &instance.Spec.TLS.PodLevel.Libvirt.Cert.Duration.Duration

‎internal/openstack/octavia.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222

2323
certmgrv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
2424
"github.com/openstack-k8s-operators/lib-common/modules/certmanager"
25+
"github.com/openstack-k8s-operators/lib-common/modules/common/backup"
2526
"github.com/openstack-k8s-operators/lib-common/modules/common/clusterdns"
2627
"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
2728
"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
@@ -132,7 +133,7 @@ func ReconcileOctavia(ctx context.Context, instance *corev1beta1.OpenStackContro
132133
certmgrv1.UsageDigitalSignature,
133134
certmgrv1.UsageClientAuth,
134135
},
135-
Labels: map[string]string{serviceCertSelector: ""},
136+
Labels: map[string]string{serviceCertSelector: "", backup.BackupRestoreLabel: "false"},
136137
}
137138
if instance.Spec.TLS.PodLevel.Ovn.Cert.Duration != nil {
138139
certRequest.Duration = &instance.Spec.TLS.PodLevel.Ovn.Cert.Duration.Duration

‎internal/openstack/ovn.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"reflect"
77

88
"github.com/openstack-k8s-operators/lib-common/modules/certmanager"
9+
"github.com/openstack-k8s-operators/lib-common/modules/common/backup"
910
"github.com/openstack-k8s-operators/lib-common/modules/common/clusterdns"
1011
"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
1112
"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
@@ -180,7 +181,7 @@ func ReconcileOVNDbClusters(ctx context.Context, instance *corev1beta1.OpenStack
180181
certmgrv1.UsageServerAuth,
181182
certmgrv1.UsageClientAuth,
182183
},
183-
Labels: map[string]string{serviceCertSelector: ""},
184+
Labels: map[string]string{serviceCertSelector: "", backup.BackupRestoreLabel: "false"},
184185
}
185186
if instance.Spec.TLS.PodLevel.Ovn.Cert.Duration != nil {
186187
certRequest.Duration = &instance.Spec.TLS.PodLevel.Ovn.Cert.Duration.Duration
@@ -320,7 +321,7 @@ func ReconcileOVNNorthd(ctx context.Context, instance *corev1beta1.OpenStackCont
320321
certmgrv1.UsageServerAuth,
321322
certmgrv1.UsageClientAuth,
322323
},
323-
Labels: map[string]string{serviceCertSelector: ""},
324+
Labels: map[string]string{serviceCertSelector: "", backup.BackupRestoreLabel: "false"},
324325
}
325326
if instance.Spec.TLS.PodLevel.Ovn.Cert.Duration != nil {
326327
certRequest.Duration = &instance.Spec.TLS.PodLevel.Ovn.Cert.Duration.Duration
@@ -464,7 +465,7 @@ func ReconcileOVNController(ctx context.Context, instance *corev1beta1.OpenStack
464465
certmgrv1.UsageServerAuth,
465466
certmgrv1.UsageClientAuth,
466467
},
467-
Labels: map[string]string{serviceCertSelector: ""},
468+
Labels: map[string]string{serviceCertSelector: "", backup.BackupRestoreLabel: "false"},
468469
}
469470
if instance.Spec.TLS.PodLevel.Ovn.Cert.Duration != nil {
470471
certRequest.Duration = &instance.Spec.TLS.PodLevel.Ovn.Cert.Duration.Duration
@@ -607,7 +608,7 @@ func EnsureOVNMetricsCert(ctx context.Context, instance *corev1beta1.OpenStackCo
607608
certmgrv1.UsageServerAuth,
608609
certmgrv1.UsageClientAuth,
609610
},
610-
Labels: map[string]string{serviceCertSelector: ""},
611+
Labels: map[string]string{serviceCertSelector: "", backup.BackupRestoreLabel: "false"},
611612
}
612613

613614
// Apply certificate duration settings if configured

0 commit comments

Comments
 (0)