add db and storage certs

cryostatio · Jul 31, 2024 · 3df1d31 · 3df1d31
1 parent 841cae2
commit 3df1d31
Show file tree

Hide file tree

Showing 5 changed files with 28 additions and 29 deletions.
diff --git a/bundle/manifests/cryostat-operator.clusterserviceversion.yaml b/bundle/manifests/cryostat-operator.clusterserviceversion.yaml
@@ -35,7 +35,7 @@ metadata:
  capabilities: Seamless Upgrades
  categories: Monitoring, Developer Tools
  containerImage: quay.io/cryostat/cryostat-operator:4.0.0-dev
- createdAt: "2024-07-30T18:48:36Z"
+ createdAt: "2024-07-30T20:58:48Z"
  description: JVM monitoring and profiling tool
  operatorframework.io/initialization-resource: |-
  {

diff --git a/internal/controllers/certmanager.go b/internal/controllers/certmanager.go
@@ -90,7 +90,6 @@ func (r *Reconciler) setupTLS(ctx context.Context, cr *model.CryostatInstance) (
  return nil, err
  }
 
- /**
  // Create a certificate for the Cryostat database signed by the Cryostat CA
  databaseCert := resources.NewDatabaseCert(cr)
  err = r.createOrUpdateCertificate(ctx, databaseCert, cr.Object)
@@ -103,10 +102,12 @@ func (r *Reconciler) setupTLS(ctx context.Context, cr *model.CryostatInstance) (
  err = r.createOrUpdateCertificate(ctx, storageCert, cr.Object)
  if err != nil {
  return nil, err
- }**/
+ }
 
  tlsConfig := &resources.TLSConfig{
  CryostatSecret: cryostatCert.Spec.SecretName,
+ DatabaseSecret: databaseCert.Spec.SecretName,
+ StorageSecret: storageCert.Spec.SecretName,
  ReportsSecret: reportsCert.Spec.SecretName,
  KeystorePassSecret: cryostatCert.Spec.Keystores.PKCS12.PasswordSecretRef.Name,
  }

diff --git a/internal/controllers/common/resource_definitions/certificates.go b/internal/controllers/common/resource_definitions/certificates.go
@@ -132,7 +132,6 @@ func NewReportsCert(cr *model.CryostatInstance) *certv1.Certificate {
  }
 }
 
-/**
 func NewDatabaseCert(cr *model.CryostatInstance) *certv1.Certificate {
  return &certv1.Certificate{
  ObjectMeta: metav1.ObjectMeta{
@@ -180,4 +179,3 @@ func NewStorageCert(cr *model.CryostatInstance) *certv1.Certificate {
  },
  }
 }
-**/
diff --git a/internal/controllers/common/resource_definitions/resource_definitions.go b/internal/controllers/common/resource_definitions/resource_definitions.go
@@ -62,9 +62,9 @@ type TLSConfig struct {
  // Name of the TLS secret for Reports Generator
  ReportsSecret string
  // Name of the TLS secret for Database
- // DatabaseSecret string
+ DatabaseSecret string
  // Name of the TLS secret for Storage
- // StorageSecret string
+ StorageSecret string
  // Name of the secret containing the password for the keystore in CryostatSecret
  KeystorePassSecret string
  // PEM-encoded X.509 certificate for the Cryostat CA
@@ -618,7 +618,7 @@ func NewPodForDatabase(cr *model.CryostatInstance, imageTags *ImageTags, tls *TL
  container := []corev1.Container{NewDatabaseContainer(cr, imageTags.DatabaseImageTag, tls)}
 
  volumes := newVolumeForDatabse(cr)
- /**
+
  if tls != nil {
  secretVolume := corev1.Volume{
  Name: "database-tls-secret",
@@ -629,7 +629,7 @@ func NewPodForDatabase(cr *model.CryostatInstance, imageTags *ImageTags, tls *TL
  },
  }
  volumes = append(volumes, secretVolume)
- }**/
+ }
 
  var podSc *corev1.PodSecurityContext
  if cr.Spec.SecurityOptions != nil && cr.Spec.SecurityOptions.PodSecurityContext != nil {
@@ -675,7 +675,7 @@ func NewPodForStorage(cr *model.CryostatInstance, imageTags *ImageTags, tls *TLS
  container := []corev1.Container{NewStorageContainer(cr, imageTags.StorageImageTag, tls)}
 
  volumes := newVolumeForStorage(cr)
- /**
+
  if tls != nil {
  secretVolume := corev1.Volume{
  Name: "storage-tls-secret",
@@ -686,7 +686,7 @@ func NewPodForStorage(cr *model.CryostatInstance, imageTags *ImageTags, tls *TLS
  },
  }
  volumes = append(volumes, secretVolume)
- }**/
+ }
 
  var podSc *corev1.PodSecurityContext
  if cr.Spec.SecurityOptions != nil && cr.Spec.SecurityOptions.PodSecurityContext != nil {
@@ -1223,7 +1223,7 @@ func NewCoreContainer(cr *model.CryostatInstance, specs *ServiceSpecs, imageTag
  },
  {
  Name: "QUARKUS_S3_ENDPOINT_OVERRIDE",
- Value: fmt.Sprintf("http://%s-storage.%s.svc.cluster.local:8333", cr.Name, cr.InstallNamespace),
+ Value: fmt.Sprintf("https://%s-storage.%s.svc.cluster.local:8333", cr.Name, cr.InstallNamespace),
  },
  {
  Name: "QUARKUS_S3_PATH_STYLE_ACCESS",
@@ -1600,8 +1600,9 @@ func NewStorageContainer(cr *model.CryostatInstance, imageTag string, tls *TLSCo
  })
 
  livenessProbeScheme := corev1.URISchemeHTTP
- /**
+
  if tls != nil {
+ /**
  tlsEnvs := []corev1.EnvVar{
  {
  Name: "S3_PORT_HTTPS",
@@ -1616,17 +1617,17 @@ func NewStorageContainer(cr *model.CryostatInstance, imageTag string, tls *TLSCo
  Value: fmt.Sprintf("/var/run/secrets/operator.cryostat.io/%s/%s", tls.StorageSecret, corev1.TLSCertKey),
  },
  }
+ envs = append(envs, tlsEnvs...) **/
 
  tlsSecretMount := corev1.VolumeMount{
  Name: "storage-tls-secret",
  MountPath: "/var/run/secrets/operator.cryostat.io/" + tls.StorageSecret,
  ReadOnly: true,
  }
 
- envs = append(envs, tlsEnvs...)
  mounts = append(mounts, tlsSecretMount)
  livenessProbeScheme = corev1.URISchemeHTTPS
- } else {
+ } /** else {
  envs = append(envs, corev1.EnvVar{
  Name: "QUARKUS_HTTP_PORT",
  Value: strconv.Itoa(int(constants.StorageContainerPort)),
@@ -1747,8 +1748,8 @@ func NewDatabaseContainer(cr *model.CryostatInstance, imageTag string, tls *TLSC
  },
  }
 
- /**
  if tls != nil {
+ /**
  tlsEnvs := []corev1.EnvVar{
  {
  Name: "QUARKUS_DATASOURCE_REACTIVE_TRUST_ALL",
@@ -1767,15 +1768,16 @@ func NewDatabaseContainer(cr *model.CryostatInstance, imageTag string, tls *TLSC
  Value: fmt.Sprintf("https://%s-database:5432", cr.Name),
  },
  }
+ envs = append(envs, tlsEnvs...) **/
+
  tlsSecretMount := corev1.VolumeMount{
  Name: "database-tls-secret",
  MountPath: "/var/run/secrets/operator.cryostat.io/" + tls.DatabaseSecret,
  ReadOnly: true,
  }
 
- envs = append(envs, tlsEnvs...)
  mounts = append(mounts, tlsSecretMount)
- } else {
+ } /** else {
  envs = append(envs, corev1.EnvVar{
  Name: "QUARKUS_DATASOURCE_REACTIVE_URL",
  Value: fmt.Sprintf("http://%s-database:5432", cr.Name),

diff --git a/internal/test/resources.go b/internal/test/resources.go
@@ -1397,7 +1397,7 @@ func (r *TestResources) NewCoreEnvironmentVariables(reportsUrl string, ingress b
  },
  {
  Name: "QUARKUS_S3_ENDPOINT_OVERRIDE",
- Value: fmt.Sprintf("http://%s-storage.%s.svc.cluster.local:8333", r.Name, r.Namespace),
+ Value: fmt.Sprintf("https://%s-storage.%s.svc.cluster.local:8333", r.Name, r.Namespace),
  },
  {
  Name: "QUARKUS_S3_PATH_STYLE_ACCESS",
@@ -1960,15 +1960,15 @@ func (r *TestResources) NewStorageVolumeMounts() []corev1.VolumeMount {
  MountPath: "/data",
  SubPath: "seaweed",
  })
- /**
+
  if r.TLS {
  mounts = append(mounts,
  corev1.VolumeMount{
  Name: "storage-tls-secret",
  MountPath: fmt.Sprintf("/var/run/secrets/operator.cryostat.io/%s-storage-tls", r.Name),
  ReadOnly: true,
  })
- }**/
+ }
  return mounts
 }
 
@@ -1980,15 +1980,15 @@ func (r *TestResources) NewDatabaseVolumeMounts() []corev1.VolumeMount {
  MountPath: "/data",
  SubPath: "postgres",
  })
- /**
+
  if r.TLS {
  mounts = append(mounts,
  corev1.VolumeMount{
  Name: "database-tls-secret",
  MountPath: fmt.Sprintf("/var/run/secrets/operator.cryostat.io/%s-database-tls", r.Name),
  ReadOnly: true,
  })
- }**/
+ }
  return mounts
 }
 
@@ -2114,10 +2114,10 @@ func (r *TestResources) NewDatasourceLivenessProbe() *corev1.Probe {
 
 func (r *TestResources) NewStorageLivenessProbe() *corev1.Probe {
  protocol := corev1.URISchemeHTTP
- /**
+
  if r.TLS {
  protocol = corev1.URISchemeHTTPS
- }**/
+ }
  return &corev1.Probe{
  ProbeHandler: corev1.ProbeHandler{
  HTTPGet: &corev1.HTTPGetAction{
@@ -2483,7 +2483,6 @@ func (r *TestResources) NewDatabaseVolumes() []corev1.Volume {
  },
  }
 
- /**
  if r.TLS {
  volumes = append(volumes, corev1.Volume{
  Name: "database-tls-secret",
@@ -2493,7 +2492,7 @@ func (r *TestResources) NewDatabaseVolumes() []corev1.Volume {
  },
  },
  })
- } **/
+ }
  return volumes
 }
 
@@ -2510,7 +2509,6 @@ func (r *TestResources) NewStorageVolumes() []corev1.Volume {
  },
  }
 
- /**
  if r.TLS {
  volumes = append(volumes, corev1.Volume{
  Name: "storage-tls-secret",
@@ -2520,7 +2518,7 @@ func (r *TestResources) NewStorageVolumes() []corev1.Volume {
  },
  },
  })
- }**/
+ }
  return volumes
 }