8000 [Feature] [Platform] Add CA Integration propagation (#1782) · arangodb/kube-arangodb@f16d663 · GitHub
[go: up one dir, main page]
Skip to content

Commit f16d663

Browse files
ajanikowajanikow
authored
[Feature] [Platform] Add CA Integration propagation (#1782)
1 parent 58154db commit f16d663

File tree

3 files changed

+60
-2
lines changed

3 files changed

+60
-2
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
- (Feature) CertManager Integration
3535
- (Feature) (Networking) Gateway Options sync
3636
- (Feature) Webhooks
37+
- (Feature) (Platform) Add CA Integration propagation
3738

3839
## [1.2.43](https://github.com/arangodb/kube-arangodb/tree/1.2.43) (2024-10-14)
3940
- (Feature) ArangoRoute CRD

‎docs/integration-sidecar.md

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,4 +137,10 @@ Example: `deployment`
137137

138138
HTTP/S Endpoint of the ArangoDeployment Internal Service.
139139

140-
Example: `https://deployment.default.svc:8529`
140+
Example: `https://deployment.default.svc:8529`
141+
142+
#### ARANGO_DEPLOYMENT_CA (optional)
143+
144+
Path to the CA in the PEM format. If not set, TLS is disabled.
145+
146+
Example: `/etc/deployment-int/ca/ca.pem`

‎pkg/deployment/resources/arango_profiles.go

Lines changed: 52 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ import (
3434
schedulerApi "github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1"
3535
schedulerContainerApi "github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/container"
3636
schedulerContainerResourcesApi "github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/container/resources"
37+
schedulerPodApi "github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/pod"
38+
schedulerPodResourcesApi "github.com/arangodb/kube-arangodb/pkg/apis/scheduler/v1beta1/pod/resources"
3739
shared "github.com/arangodb/kube-arangodb/pkg/apis/shared"
3840
"github.com/arangodb/kube-arangodb/pkg/deployment/patch"
3941
"github.com/arangodb/kube-arangodb/pkg/integrations/sidecar"
@@ -125,7 +127,10 @@ func (r *Resources) EnsureArangoProfiles(ctx context.Context, cachedStatus inspe
125127

126128
integration, err := sidecar.NewIntegration(&schedulerContainerResourcesApi.Image{
127129
Image: util.NewType(r.context.GetOperatorImage()),
128-
}, spec.Integration.GetSidecar(), r.arangoDeploymentProfileTemplate(cachedStatus))
130+
}, spec.Integration.GetSidecar(),
131+
r.arangoDeploymentProfileTemplate(cachedStatus),
132+
r.arangoDeploymentCATemplate(),
133+
)
129134
if err != nil {
130135
return "", nil, err
131136
}
@@ -220,6 +225,52 @@ func (r *Resources) arangoDeploymentProfileTemplate(cachedStatus inspectorInterf
220225
}
221226
}
222227

228+
func (r *Resources) arangoDeploymentCATemplate() *schedulerApi.ProfileTemplate {
229+
t := r.context.GetSpec().TLS
230+
if !t.IsSecure() {
231+
return nil
232+
}
233+
234+
return &schedulerApi.ProfileTemplate{
235+
Pod: &schedulerPodApi.Pod{
236+
Volumes: &schedulerPodResourcesApi.Volumes{
237+
Volumes: []core.Volume{
238+
{
239+
Name: "deployment-int-ca",
240+
VolumeSource: core.VolumeSource{
241+
Secret: &core.SecretVolumeSource{
242+
SecretName: GetCASecretName(r.context.GetAPIObject()),
243+
},
244+
},
245+
},
246+
},
247+
},
248+
},
249+
Container: &schedulerApi.ProfileContainerTemplate{
250+
All: &schedulerContainerApi.Generic{
251+
Environments: &schedulerContainerResourcesApi.Environments{
252+
Env: []core.EnvVar{
253+
{
254+
Name: "ARANGO_DEPLOYMENT_CA",
255+
Value: fmt.Sprintf("/etc/deployment-int/ca/%s", CACertName),
256+
},
257+
},
258+
},
259+
VolumeMounts: &schedulerContainerResourcesApi.VolumeMounts{
260+
VolumeMounts: []core.VolumeMount{
261+
{
262+
Name: "deployment-int-ca",
263+
ReadOnly: true,
264+
RecursiveReadOnly: nil,
265+
MountPath: "/etc/deployment-int/ca",
266+
},
267+
},
268+
},
269+
},
270+
},
271+
}
272+
}
273+
223274
func (r *Resources) ensureArangoProfilesFactory(ctx context.Context, cachedStatus inspectorInterface.Inspector, expected ...func() (string, *schedulerApi.ArangoProfile, error)) (bool, error) {
224275
var changed bool
225276

0 commit comments

Comments
 (0)
0