Skip to content

Commit ac803d1

Browse files
butler54butler54
committed
feat: enable multi-cluster support as an option in the pattern
Signed-off-by: Chris Butler <chris.butler@redhat.com>
1 parent bbeb442 commit ac803d1

43 files changed

Lines changed: 1143 additions & 109 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitignore‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,8 @@ install-config.yaml
1616
azure-env.sh
1717
.openshift*
1818
.DS_Store
19-
openshift-install
19+
openshift-install*
2020
node_modules
2121
.envrc
22-
.ansible/
22+
.ansible/
23+
__pycache__/

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ Future work includes:
2424

2525
- Only currently is known to work with `azure` as the provider of confidential vms via peer-pods.
2626
- Only known to work today with everything on one cluster. The work to expand this is in flight.
27-
- If not using ARO you must either provide your own CA signed certs, or use let's encrypt.
27+
- Below version 3.1, if not using ARO you must either provide your own CA signed certs, or use let's encrypt.
2828
- Must be on 4.16.14 or later.
2929

3030
## Major versions

‎ansible/gen-certificate.yaml‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
---
2+
- name: Generate self-signed TLS cert for KBS and push to Kubernetes Secret
3+
hosts: localhost
4+
connection: local
5+
become: false
6+
gather_facts: false
7+
vars:
8+
kubeconfig: "{{ lookup('env', 'KUBECONFIG') }}"
9+
hub_domain: "{{ global.hubClusterDomain | default('none') | lower}}"
10+
secret_name: kbs-tls-self-signed
11+
common_name: "kbs-trustee-operator-system.{{ hub_domain }}"
12+
days_valid: 365
13+
renewal_threshold_days: 10
14+
need_new_cert: false
15+
pre_tasks:
16+
17+
- name: Check if TLS secret exists
18+
kubernetes.core.k8s_info:
19+
kubeconfig: "{{ kubeconfig }}"
20+
api_version: v1
21+
kind: Secret
22+
name: "{{ secret_name }}"
23+
namespace: "imperative"
24+
register: existing_secret
25+
ignore_errors: true
26+
27+
- name: Set fact that certificate doesn't exist
28+
ansible.builtin.set_fact:
29+
need_new_cert: true
30+
when: existing_secret.resources | length == 0
31+
32+
- name: Extract existing certificate if secret exists
33+
ansible.builtin.set_fact:
34+
existing_cert_data: "{{ existing_secret.resources[0].data['tls.crt'] | b64decode }}"
35+
when: existing_secret.resources | length > 0
36+
37+
- name: Create temporary file for existing certificate analysis
38+
ansible.builtin.tempfile:
39+
state: file
40+
suffix: .crt
41+
register: temp_cert_file
42+
when: existing_secret.resources | length > 0
43+
44+
- name: Write existing certificate to temp file
45+
ansible.builtin.copy:
46+
content: "{{ existing_cert_data }}"
47+
dest: "{{ temp_cert_file.path }}"
48+
mode: "0600"
49+
when: existing_secret.resources | length > 0
50+
51+
- name: Get certificate expiry date
52+
community.crypto.x509_certificate_info:
53+
path: "{{ temp_cert_file.path }}"
54+
register: cert_info
55+
when: existing_secret.resources | length > 0
56+
57+
- name: Calculate days until expiry
58+
ansible.builtin.set_fact:
59+
days_until_expiry: "{{ ((cert_info.not_after | to_datetime('%Y%m%d%H%M%SZ')) - now()).days }}"
60+
when: existing_secret.resources | length > 0
61+
62+
- name: Set fact to generate new certificate if expiring soon
63+
ansible.builtin.set_fact:
64+
need_new_cert: true
65+
when:
66+
- existing_secret.resources | length > 0
67+
- days_until_expiry | int <= renewal_threshold_days
68+
69+
- name: Clean up temporary certificate file
70+
ansible.builtin.file:
71+
path: "{{ temp_cert_file.path }}"
72+
state: absent
73+
when: existing_secret.resources | length > 0
74+
75+
- name: Display certificate status
76+
ansible.builtin.debug:
77+
msg: >
78+
Certificate status:
79+
{% if existing_secret.resources | length == 0 %}
80+
No existing certificate found. Will generate new certificate.
81+
{% elif need_new_cert %}
82+
Certificate expires in {{ days_until_expiry }} days (threshold: {{ renewal_threshold_days }} days). Will generate new certificate.
83+
{% else %}
84+
Certificate is valid for {{ days_until_expiry }} more days. Skipping certificate generation.
85+
{% endif %}
86+
87+
- name: Create temporary directory for cert generation
88+
ansible.builtin.tempfile:
89+
state: directory
90+
prefix: kbs-cert-
91+
register: tmpdir
92+
when: need_new_cert
93+
94+
tasks:
95+
- name: Generate private key
96+
community.crypto.openssl_privatekey:
97+
path: "{{ tmpdir.path }}/tls.key"
98+
size: 4096
99+
when: need_new_cert
100+
101+
- name: Generate CSR
102+
community.crypto.openssl_csr:
103+
path: "{{ tmpdir.path }}/tls.csr"
104+
privatekey_path: "{{ tmpdir.path }}/tls.key"
105+
common_name: "kbs-trustee-operator-system"
106+
subject_alt_name:
107+
- "DNS:{{ common_name }}"
108+
when: need_new_cert
109+
110+
- name: Generate self-signed certificate
111+
community.crypto.x509_certificate:
112+
path: "{{ tmpdir.path }}/tls.crt"
113+
privatekey_path: "{{ tmpdir.path }}/tls.key"
114+
csr_path: "{{ tmpdir.path }}/tls.csr"
115+
provider: selfsigned
116+
selfsigned_not_after: "+{{ days_valid }}d"
117+
when: need_new_cert
118+
119+
- name: Create or update TLS secret for KBS
120+
kubernetes.core.k8s:
121+
kubeconfig: "{{ kubeconfig }}"
122+
state: present
123+
definition:
124+
apiVersion: v1
125+
kind: Secret
126+
metadata:
127+
name: "{{ secret_name }}"
128+
namespace: "imperative"
129+
type: kubernetes.io/tls
130+
stringData:
131+
tls.crt: "{{ lookup('file', tmpdir.path + '/tls.crt') }}"
132+
tls.key: "{{ lookup('file', tmpdir.path + '/tls.key') }}"
133+
when: need_new_cert
134+
135+
- name: Cleanup temporary directory
136+
ansible.builtin.file:
137+
path: "{{ tmpdir.path }}"
138+
state: absent
139+
when: need_new_cert and tmpdir is defined

‎ansible/init-data-gzipper.yaml‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
- name: Collect AWS facts and set secrurity group policies
1+
- name: Gzip initdata
22
become: false
33
connection: local
44
hosts: localhost
@@ -14,6 +14,24 @@
1414
state: directory
1515
suffix: initdata
1616
register: tmpdir
17+
- name: Read KBS TLS secret from Kubernetes
18+
kubernetes.core.k8s_info:
19+
kubeconfig: "{{ lookup('env', 'KUBECONFIG') }}"
20+
api_version: v1
21+
kind: Secret
22+
name: kbs-tls-self-signed
23+
namespace: imperative
24+
register: kbs_secret_result
25+
26+
- name: Extract and decode certificate from secret
27+
ansible.builtin.set_fact:
28+
trustee_cert: "{{ kbs_secret_result.resources[0].data['tls.crt'] | b64decode }}"
29+
when: kbs_secret_result.resources | length > 0
30+
31+
- name: Fail if certificate not found
32+
ansible.builtin.fail:
33+
msg: "KBS TLS certificate not found in secret 'kbs-tls-self-signed' in namespace 'imperative'"
34+
when: kbs_secret_result.resources | length == 0
1735

1836
- name: Define temp file paths
1937
ansible.builtin.set_fact:

‎ansible/initdata-default.toml.tpl‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ url = "https://kbs-trustee-operator-system.{{ hub_domain }}"
99

1010
[token_configs.kbs]
1111
url = "https://kbs-trustee-operator-system.{{ hub_domain }}"
12+
cert = """
13+
{{ trustee_cert }}
14+
"""
1215
'''
1316

1417
"cdh.toml" = '''
@@ -18,4 +21,48 @@ credentials = []
1821
[kbc]
1922
name = "cc_kbc"
2023
url = "https://kbs-trustee-operator-system.{{ hub_domain }}"
24+
kbs_cert = """
25+
{{ trustee_cert }}
26+
"""
2127
'''
28+
29+
"policy.rego" = '''
30+
package agent_policy
31+
32+
default AddARPNeighborsRequest := true
33+
default AddSwapRequest := true
34+
default CloseStdinRequest := true
35+
default CopyFileRequest := true
36+
default CreateContainerRequest := true
37+
default CreateSandboxRequest := true
38+
default DestroySandboxRequest := true
39+
default ExecProcessRequest := false
40+
default GetMetricsRequest := true
41+
default GetOOMEventRequest := true
42+
default GuestDetailsRequest := true
43+
default ListInterfacesRequest := true
44+
default ListRoutesRequest := true
45+
default MemHotplugByProbeRequest := true
46+
default OnlineCPUMemRequest := true
47+
default PauseContainerRequest := true
48+
default PullImageRequest := true
49+
default ReadStreamRequest := false
50+
default RemoveContainerRequest := true
51+
default RemoveStaleVirtiofsShareMountsRequest := true
52+
default ReseedRandomDevRequest := true
53+
default ResumeContainerRequest := true
54+
default SetGuestDateTimeRequest := true
55+
default SetPolicyRequest := true
56+
default SignalProcessRequest := true
57+
default StartContainerRequest := true
58+
default StartTracingRequest := true
59+
default StatsContainerRequest := true
60+
default StopTracingRequest := true
61+
default TtyWinResizeRequest := true
62+
default UpdateContainerRequest := true
63+
default UpdateEphemeralMountsRequest := true
64+
default UpdateInterfaceRequest := true
65+
default UpdateRoutesRequest := true
66+
default WaitProcessRequest := true
67+
default WriteStreamRequest := true
68+
'''

‎charts/all/letsencrypt/values.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
global:
44
## -- String containing the domain including the apps. prefix. Gets set by the Validated Pattern framework
55
localClusterDomain: "apps.example.com"
6+
## -- String defining the cluster platform: "Azure" or "AWS" (overridden by values-global.yaml)
7+
clusterPlatform: ""
68

79

810
# -- This section contains all the parameters for the letsencrypt chart in
@@ -55,7 +57,7 @@ letsencrypt:
5557
azure:
5658
secretStoreKey: 'secret/data/global/azure'
5759

58-
60+
# Secret store configuration (overridden by values-global.yaml)
5961
secretStore:
60-
name: vault-backend
61-
kind: ClusterSecretStore
62+
name: ""
63+
kind: ""

‎charts/coco-supported/hello-openshift/templates/_helpers.tpl‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "hello-openshift.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "hello-openshift.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "hello-openshift.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "hello-openshift.labels" -}}
37+
helm.sh/chart: {{ include "hello-openshift.chart" . }}
38+
{{ include "hello-openshift.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "hello-openshift.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "hello-openshift.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Determine runtime class name based on cluster platform
55+
Returns "kata-remote" for Azure/AWS, "kata-cc" for other platforms
56+
*/}}
57+
{{- define "hello-openshift.runtimeClassName" -}}
58+
{{- if or (eq .Values.global.clusterPlatform "Azure") (eq .Values.global.clusterPlatform "AWS") -}}
59+
kata-remote
60+
{{- else -}}
61+
kata-cc
62+
{{- end -}}
63+
{{- end }}

‎charts/coco-supported/hello-openshift/templates/insecure-policy-pod.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ metadata:
77
annotations:
88
io.katacontainers.config.agent.policy: '{{ tpl ( .Files.Get "insecure-policy.rego") . | b64enc }}'
99
spec:
10-
runtimeClassName: kata-remote
10+
runtimeClassName: {{ include "hello-openshift.runtimeClassName" . }}
1111
containers:
1212
- name: hello-openshift
1313
image: quay.io/openshift/origin-hello-openshift

‎charts/coco-supported/hello-openshift/templates/secure-pod.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ metadata:
77
annotations:
88
peerpods: "true"
99
spec:
10-
runtimeClassName: kata-remote
10+
runtimeClassName: {{ include "hello-openshift.runtimeClassName" . }}
1111
containers:
1212
- name: hello-openshift
1313
image: quay.io/openshift/origin-hello-openshift

‎charts/coco-supported/hello-openshift/templates/standard-pod.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ metadata:
55
labels:
66
app: standard
77
spec:
8-
runtimeClassName: {{ .Values.global.runtimeClass }}
98
containers:
109
- name: hello-openshift
1110
image: quay.io/openshift/origin-hello-openshift

0 commit comments

Comments
 (0)