dev: refactor merge #930 add Root CA

sunsingerus · sunsingerus · commit 9a9b1ad20ee4 · 2022-07-01T14:37:23.000+03:00
diff --git a/deploy/operator/clickhouse-operator-install-ansible.yaml b/deploy/operator/clickhouse-operator-install-ansible.yaml
@@ -2847,6 +2847,9 @@ spec:
                         password:
                           type: string
                           description: "ClickHouse password to be used by operator to connect to ClickHouse instances, deprecated, use chCredentialsSecretName"
+                        rootCA:
+                          type: string
+                          description: "Root certificate authority that clients use when verifying server certificates. Used for https connection to ClickHouse"
                         secret:
                           type: object
                           properties:
diff --git a/deploy/operator/clickhouse-operator-install-bundle-v1beta1.yaml b/deploy/operator/clickhouse-operator-install-bundle-v1beta1.yaml
@@ -2812,6 +2812,9 @@ spec:
                     password:
                       type: string
                       description: "ClickHouse password to be used by operator to connect to ClickHouse instances, deprecated, use chCredentialsSecretName"
+                    rootCA:
+                      type: string
+                      description: "Root certificate authority that clients use when verifying server certificates. Used for https connection to ClickHouse"
                     secret:
                       type: object
                       properties:
diff --git a/deploy/operator/clickhouse-operator-install-bundle.yaml b/deploy/operator/clickhouse-operator-install-bundle.yaml
@@ -2840,6 +2840,9 @@ spec:
                         password:
                           type: string
                           description: "ClickHouse password to be used by operator to connect to ClickHouse instances, deprecated, use chCredentialsSecretName"
+                        rootCA:
+                          type: string
+                          description: "Root certificate authority that clients use when verifying server certificates. Used for https connection to ClickHouse"
                         secret:
                           type: object
                           properties:
diff --git a/deploy/operator/clickhouse-operator-install-template-v1beta1.yaml b/deploy/operator/clickhouse-operator-install-template-v1beta1.yaml
@@ -2812,6 +2812,9 @@ spec:
                     password:
                       type: string
                       description: "ClickHouse password to be used by operator to connect to ClickHouse instances, deprecated, use chCredentialsSecretName"
+                    rootCA:
+                      type: string
+                      description: "Root certificate authority that clients use when verifying server certificates. Used for https connection to ClickHouse"
                     secret:
                       type: object
                       properties:
diff --git a/deploy/operator/clickhouse-operator-install-template.yaml b/deploy/operator/clickhouse-operator-install-template.yaml
@@ -2840,6 +2840,9 @@ spec:
                         password:
                           type: string
                           description: "ClickHouse password to be used by operator to connect to ClickHouse instances, deprecated, use chCredentialsSecretName"
+                        rootCA:
+                          type: string
+                          description: "Root certificate authority that clients use when verifying server certificates. Used for https connection to ClickHouse"
                         secret:
                           type: object
                           properties:
diff --git a/deploy/operator/clickhouse-operator-install-tf.yaml b/deploy/operator/clickhouse-operator-install-tf.yaml
@@ -2847,6 +2847,9 @@ spec:
                         password:
                           type: string
                           description: "ClickHouse password to be used by operator to connect to ClickHouse instances, deprecated, use chCredentialsSecretName"
+                        rootCA:
+                          type: string
+                          description: "Root certificate authority that clients use when verifying server certificates. Used for https connection to ClickHouse"
                         secret:
                           type: object
                           properties:
diff --git a/deploy/operator/parts/crd.yaml b/deploy/operator/parts/crd.yaml
@@ -2840,6 +2840,9 @@ spec:
                         password:
                           type: string
                           description: "ClickHouse password to be used by operator to connect to ClickHouse instances, deprecated, use chCredentialsSecretName"
+                        rootCA:
+                          type: string
+                          description: "Root certificate authority that clients use when verifying server certificates. Used for https connection to ClickHouse"
                         secret:
                           type: object
                           properties:
diff --git a/pkg/apis/clickhouse.altinity.com/v1/type_config_chop.go b/pkg/apis/clickhouse.altinity.com/v1/type_config_chop.go
@@ -55,7 +55,7 @@ const (
 	defaultChUsername = ""
 	defaultChPassword = ""
 	defaultChPort     = 8123
-	defaultChRootCA    = ""
+	defaultChRootCA   = ""
 
 	// defaultReconcileThreadsNumber specifies default number of controller threads running concurrently.
 	// Used in case no other specified in config
diff --git a/pkg/apis/metrics/clickhouse_fetcher.go b/pkg/apis/metrics/clickhouse_fetcher.go
@@ -132,9 +132,9 @@ type ClickHouseFetcher struct {
 }
 
 // NewClickHouseFetcher creates new clickhouse fetcher object
-func NewClickHouseFetcher(scheme, hostname, username, password string, port int) *ClickHouseFetcher {
+func NewClickHouseFetcher(scheme, hostname, username, password, rootCA string, port int) *ClickHouseFetcher {
 	return &ClickHouseFetcher{
-		connectionParams: clickhouse.NewConnectionParams(scheme, hostname, username, password, port),
+		connectionParams: clickhouse.NewConnectionParams(scheme, hostname, username, password, rootCA, port),
 	}
 }
 
diff --git a/pkg/apis/metrics/exporter.go b/pkg/apis/metrics/exporter.go
@@ -167,6 +167,7 @@ func (e *Exporter) newFetcher(hostname string) *ClickHouseFetcher {
 		hostname,
 		e.chAccessInfo.Username,
 		e.chAccessInfo.Password,
+		e.chAccessInfo.RootCA,
 		e.chAccessInfo.Port,
 	).SetQueryTimeout(e.timeout)
 }
diff --git a/pkg/apis/metrics/type_ch_access_info.go b/pkg/apis/metrics/type_ch_access_info.go
@@ -19,15 +19,17 @@ type CHAccessInfo struct {
 	Scheme   string
 	Username string
 	Password string
+	RootCA   string
 	Port     int
 }
 
 // NewCHAccessInfo creates new CHAccessInfo from specified access info
-func NewCHAccessInfo(scheme, username, password string, port int) *CHAccessInfo {
+func NewCHAccessInfo(scheme, username, password, rootCA string, port int) *CHAccessInfo {
 	return &CHAccessInfo{
 		Scheme:   scheme,
 		Username: username,
 		Password: password,
+		RootCA:   rootCA,
 		Port:     port,
 	}
 }
diff --git a/pkg/controller/chi/worker.go b/pkg/controller/chi/worker.go
@@ -85,6 +85,7 @@ func (c *Controller) newWorker(q queue.PriorityQueue, sys bool) *worker {
 			chop.Config().ClickHouse.Access.Scheme,
 			chop.Config().ClickHouse.Access.Username,
 			chop.Config().ClickHouse.Access.Password,
+			chop.Config().ClickHouse.Access.RootCA,
 			chop.Config().ClickHouse.Access.Port,
 		),
 		start: start,
diff --git a/pkg/model/clickhouse/cluster.go b/pkg/model/clickhouse/cluster.go
@@ -67,7 +67,7 @@ func (c *Cluster) SetHosts(hosts []string) *Cluster {
 
 // getConnection gets connection
 func (c *Cluster) getConnection(host string) *Connection {
-	return GetPooledDBConnection(NewConnectionParams(c.Scheme, host, c.Username, c.Password, c.Port)).SetLog(c.l)
+	return GetPooledDBConnection(NewConnectionParams(c.Scheme, host, c.Username, c.Password, c.RootCA, c.Port)).SetLog(c.l)
 }
 
 // QueryAny walks over all endpoints and runs query sequentially on each of them.
diff --git a/pkg/model/clickhouse/connection.go b/pkg/model/clickhouse/connection.go
@@ -17,15 +17,16 @@ package clickhouse
 import (
 	"context"
 	"crypto/tls"
+	"crypto/x509"
 	databasesql "database/sql"
 	"fmt"
 	"time"
 
-	log "github.com/altinity/clickhouse-operator/pkg/announcer"
-	"github.com/altinity/clickhouse-operator/pkg/util"
-
 	// go-clickhouse is explicitly required in order to setup connection to clickhouse db
 	goch "github.com/mailru/go-clickhouse"
+
+	log "github.com/altinity/clickhouse-operator/pkg/announcer"
+	"github.com/altinity/clickhouse-operator/pkg/util"
 )
 
 func init() {
@@ -68,6 +69,21 @@ func (c *Connection) SetLog(l log.Announcer) *Connection {
 
 // connect performs connect
 func (c *Connection) connect(ctx context.Context) {
+	// Add root CA
+	if c.params.rootCA != "" {
+		rootCAs := x509.NewCertPool()
+		if cert, err := x509.ParseCertificate([]byte(c.params.rootCA)); err != nil {
+			c.l.V(1).F().Error("unable to parse CERT specified in rootCA: %v", err)
+		} else {
+			rootCAs.AddCert(cert)
+			if err := goch.RegisterTLSConfig(tlsSettings, &tls.Config{
+				RootCAs: rootCAs,
+			}); err != nil {
+				c.l.V(1).F().Error("unable to register TLS config %v", err)
+			}
+		}
+	}
+
 	c.l.V(2).Info("Establishing connection: %s", c.params.GetDSNWithHiddenCredentials())
 	dbConnection, err := databasesql.Open("clickhouse", c.params.GetDSN())
 	if err != nil {
diff --git a/pkg/model/clickhouse/connection_params.go b/pkg/model/clickhouse/connection_params.go
@@ -21,9 +21,9 @@ type ConnectionParams struct {
 }
 
 // NewConnectionParams creates new ConnectionParams
-func NewConnectionParams(scheme, hostname, username, password string, port int) *ConnectionParams {
+func NewConnectionParams(scheme, hostname, username, password, rootCA string, port int) *ConnectionParams {
 	return &ConnectionParams{
-		NewEndpointCredentials(scheme, hostname, username, password, port),
+		NewEndpointCredentials(scheme, hostname, username, password, rootCA, port),
 		NewTimeouts(),
 	}
 }
diff --git a/pkg/model/clickhouse/endpoint_credentials.go b/pkg/model/clickhouse/endpoint_credentials.go
@@ -40,6 +40,7 @@ type EndpointCredentials struct {
 	hostname string
 	username string
 	password string
+	rootCA   string
 	port     int
 
 	// Internal generated data
@@ -48,12 +49,13 @@ type EndpointCredentials struct {
 }
 
 // NewEndpointCredentials creates new EndpointCredentials object
-func NewEndpointCredentials(scheme, hostname, username, password string, port int) *EndpointCredentials {
+func NewEndpointCredentials(scheme, hostname, username, password, rootCA string, port int) *EndpointCredentials {
 	params := &EndpointCredentials{
 		scheme:   scheme,
 		hostname: hostname,
 		username: username,
 		password: password,
+		rootCA:   rootCA,
 		port:     port,
 	}
 
diff --git a/pkg/model/clickhouse/endpoint_credentials_cluster.go b/pkg/model/clickhouse/endpoint_credentials_cluster.go
@@ -19,5 +19,6 @@ type ClusterEndpointCredentials struct {
 	Scheme   string
 	Username string
 	Password string
+	RootCA   string
 	Port     int
 }
diff --git a/pkg/model/schemer.go b/pkg/model/schemer.go
@@ -35,11 +35,12 @@ type Schemer struct {
 const ignoredDBs = `'system', 'information_schema', 'INFORMATION_SCHEMA'`
 
 // NewSchemer creates new Schemer object
-func NewSchemer(scheme, username, password string, port int) *Schemer {
+func NewSchemer(scheme, username, password, rootCA string, port int) *Schemer {
 	credentials := &clickhouse.ClusterEndpointCredentials{
 		Scheme:   scheme,
 		Username: username,
 		Password: password,
+		RootCA:   rootCA,
 		Port:     port,
 	}
 	return &Schemer{

Original file line number	Diff line number	Diff line change
`@@ -132,9 +132,9 @@ type ClickHouseFetcher struct {`
`132`	`132`	`}`
`133`	`133`
`134`	`134`	`// NewClickHouseFetcher creates new clickhouse fetcher object`
`135`		`-func NewClickHouseFetcher(scheme, hostname, username, password string, port int) *ClickHouseFetcher {`
	`135`	`+func NewClickHouseFetcher(scheme, hostname, username, password, rootCA string, port int) *ClickHouseFetcher {`
`136`	`136`	`return &ClickHouseFetcher{`
`137`		`- connectionParams: clickhouse.NewConnectionParams(scheme, hostname, username, password, port),`
	`137`	`+ connectionParams: clickhouse.NewConnectionParams(scheme, hostname, username, password, rootCA, port),`
`138`	`138`	`}`
`139`	`139`	`}`
`140`	`140`
Original file line number	Diff line number	Diff line change
`@@ -167,6 +167,7 @@ func (e Exporter) newFetcher(hostname string) ClickHouseFetcher {`
`167`	`167`	`hostname,`
`168`	`168`	`e.chAccessInfo.Username,`
`169`	`169`	`e.chAccessInfo.Password,`
	`170`	`+ e.chAccessInfo.RootCA,`
`170`	`171`	`e.chAccessInfo.Port,`
`171`	`172`	`).SetQueryTimeout(e.timeout)`
`172`	`173`	`}`