refactor for HTTPS

Signed-off-by: Roy Kaufman <rkaufman@redhat.com>

Author: iroykaufman

lib/src/endpoints.rs

@@ -4,7 +4,6 @@
 
 pub const TRUSTEE_SERVICE: &str = "kbs-service";
 pub const TRUSTEE_DEPLOYMENT: &str = "trustee-deployment";
-pub const KBS_LABEL_SELECTOR: &str = "kbs";
 pub const TRUSTEE_PORT: i32 = 8080;
 pub const TRUSTEE_APP_LABEL: &str = "kbs";
 pub const REGISTER_SERVER_SERVICE: &str = "register-server";

operator/src/kbs-config.toml

@@ -2,9 +2,11 @@
 sockets = ["0.0.0.0:8080"]
 
 [admin]
-type = "DenyAll"
-insecure_api = true
-auth_public_key="/key/public.pub"
+type = "Simple"
+
+[[admin.personas]]
+id = "admin"
+public_key_path = "/key/public.pub"
 
 
 [attestation_token]

operator/src/trustee.rs

@@ -31,11 +31,9 @@ use kube::{
 use log::{info, warn};
 use operator::{
     ControllerError, RvContextData, controller_error_policy, controller_info,
-    create_or_info_if_exists,
+    create_or_info_if_exists, read_certificate, TLS_DIR
 };
 
-use log::info;
-use operator::{RvContextData, TLS_DIR, create_or_info_if_exists, read_certificate};
 use serde::{Serialize, Serializer};
 use serde_json::{Value::String as JsonString, json};
 use std::collections::BTreeMap;
@@ -161,30 +159,53 @@ async fn get_auth_key(client: &Client) -> Result<String> {
         .context("Auth private key is not valid UTF-8")?;
     Ok(auth_key)
 }
+async fn get_kbs_connection(client: &Client) -> Result<(String, Vec<String>)> {
+    let tec = trusted_cluster_operator_lib::get_trusted_execution_cluster(client.clone()).await?;
+    let secret_api: Api<Secret> = Api::default_namespaced(client.clone());
+
+    if let Some(secret_name) = &tec.spec.trustee_secret {
+        if let Ok(secret) = secret_api.get(secret_name).await {
+            if let Some(ca_crt) = secret.data.as_ref().and_then(|d| d.get("ca.crt")) {
+                let ca_pem = String::from_utf8(ca_crt.0.clone())
+                    .context("CA certificate is not valid UTF-8")?;
+                return Ok((
+                    format!("https://{TRUSTEE_SERVICE}:{TRUSTEE_PORT}"),
+                    vec![ca_pem],
+                ));
+            }
+        }
+    }
+
+    Ok((
+        format!("http://{TRUSTEE_SERVICE}:{TRUSTEE_PORT}"),
+        vec![],
+    ))
+}
+
 pub async fn send_secret(client: Client, id: &str) -> Result<()> {
     let secret_api: Api<Secret> = Api::default_namespaced(client.clone());
     let auth_key = get_auth_key(&client).await?;
+    let (url, certs) = get_kbs_connection(&client).await?;
     let secret = secret_api.get(id).await?;
     let secret_data = secret.data.context("Secret has no data")?;
     let resource_bytes = secret_data
         .get("root")
         .context("Secret missing root key")?
         .0
         .clone();
-    let url = format!("http://{TRUSTEE_SERVICE}:{TRUSTEE_PORT}");
     let path = format!("default/{id}/root");
     info!("Sending secret {id} to KBS API...");
-    kbs_client::set_resource(&url, auth_key, resource_bytes, &path, vec![]).await?;
+    kbs_client::set_resource(&url, auth_key, resource_bytes, &path, certs).await?;
     info!("Secret {id} sent successfully");
     Ok(())
 }
 
 pub async fn delete_secret(client: Client, id: &str) -> Result<()> {
     let auth_key = get_auth_key(&client).await?;
-    let url = format!("http://{TRUSTEE_SERVICE}:{TRUSTEE_PORT}");
+    let (url, certs) = get_kbs_connection(&client).await?;
     let path = format!("default/{id}/root");
     info!("Deleting secret {id} to KBS API...");
-    kbs_client::delete_resource(&url, auth_key, &path, vec![]).await?;
+    kbs_client::delete_resource(&url, auth_key, &path, certs).await?;
     info!("Secret {id} deleted successfully");
     Ok(())
 }
@@ -244,7 +265,7 @@ async fn trustee_deployment_reconcile(
 pub async fn launch_trustee_sync_controller(client: Client) {
     let deployments: Api<Deployment> = Api::default_namespaced(client.clone());
     let watcher_config = watcher::Config {
-        label_selector: Some(format!("app={KBS_LABEL_SELECTOR}")),
+        label_selector: Some(format!("app={TRUSTEE_APP_LABEL}")),
         ..Default::default()
     };
     tokio::spawn(