Skip to content

Commit a523bd8

Browse files
vinokurigvinokurig
committed
fixup! Inject certificate to http client from a configmap referenced in the config
Signed-off-by: ivinokur <[email protected]>
1 parent a13aa5a commit a523bd8

File tree

9 files changed

+52
-41
lines changed

9 files changed

+52
-41
lines changed

‎controllers/workspace/devworkspace_controller.go

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package controllers
1818
import (
1919
"context"
2020
"fmt"
21+
"net/http"
2122
"strconv"
2223
"strings"
2324
"time"
@@ -667,14 +668,20 @@ func (r *DevWorkspaceReconciler) getWorkspaceId(ctx context.Context, workspace *
667668
}
668669
}
669670

670-
func (r *DevWorkspaceReconciler) SetupWithManager(mgr ctrl.Manager, k8s client.Client) error {
671-
setupHttpClients(k8s)
671+
func (r *DevWorkspaceReconciler) SetupWithManager(mgr ctrl.Manager) error {
672+
setupHttpClients(mgr.GetClient(), r.Log)
672673
maxConcurrentReconciles, err := wkspConfig.GetMaxConcurrentReconciles()
673674
if err != nil {
674675
return err
675676
}
676677

677-
var emptyMapper = func(obj client.Object) []reconcile.Request {
678+
var certificatesHandler = func(obj client.Object) []reconcile.Request {
679+
certs, ok := readCertificates(mgr.GetClient(), r.Log)
680+
if ok {
681+
for _, certsPem := range certs {
682+
injectCertificates([]byte(certsPem), httpClient.Transport.(*http.Transport))
683+
}
684+
}
678685
return []reconcile.Request{}
679686
}
680687

@@ -702,7 +709,7 @@ func (r *DevWorkspaceReconciler) SetupWithManager(mgr ctrl.Manager, k8s client.C
702709
Watches(&source.Kind{Type: &corev1.ConfigMap{}}, handler.EnqueueRequestsFromMapFunc(r.runningWorkspacesHandler), automountWatcher).
703710
Watches(&source.Kind{Type: &corev1.ConfigMap{}}, handler.EnqueueRequestsFromMapFunc(r.certificateHandler), certificateWatcher).
704711
Watches(&source.Kind{Type: &corev1.PersistentVolumeClaim{}}, handler.EnqueueRequestsFromMapFunc(r.runningWorkspacesHandler), automountWatcher).
705-
Watches(&source.Kind{Type: &controllerv1alpha1.DevWorkspaceOperatorConfig{}}, handler.EnqueueRequestsFromMapFunc(emptyMapper), configWatcher).
712+
Watches(&source.Kind{Type: &controllerv1alpha1.DevWorkspaceOperatorConfig{}}, handler.EnqueueRequestsFromMapFunc(certificatesHandler), configWatcher).
706713
WithEventFilter(devworkspacePredicates).
707714
WithEventFilter(podPredicates).
708715
Complete(r)

‎controllers/workspace/eventhandlers.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -110,8 +110,7 @@ func (r *DevWorkspaceReconciler) runningWorkspacesHandler(obj client.Object) []r
110110
}
111111

112112
func (r *DevWorkspaceReconciler) certificateHandler(obj client.Object) []reconcile.Request {
113-
certsPem, ok := obj.(*corev1.ConfigMap).Data["custom-ca-certificates.pem"]
114-
if ok {
113+
for _, certsPem := range obj.(*corev1.ConfigMap).Data {
115114
injectCertificates([]byte(certsPem), httpClient.Transport.(*http.Transport))
116115
}
117116
return []reconcile.Request{}

‎controllers/workspace/http.go

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import (
1717
"context"
1818
"crypto/tls"
1919
"crypto/x509"
20+
"github.com/go-logr/logr"
2021
corev1 "k8s.io/api/core/v1"
2122
"k8s.io/apimachinery/pkg/types"
2223
"net/http"
@@ -33,11 +34,13 @@ var (
3334
healthCheckHttpClient *http.Client
3435
)
3536

36-
func setupHttpClients(k8s client.Client) {
37+
func setupHttpClients(k8s client.Client, logger logr.Logger) {
3738
transport := http.DefaultTransport.(*http.Transport).Clone()
38-
certs, ok := readCertificates(k8s)
39+
certs, ok := readCertificates(k8s, logger)
3940
if ok {
40-
injectCertificates(certs, transport)
41+
for _, certsPem := range certs {
42+
injectCertificates([]byte(certsPem), transport)
43+
}
4144
}
4245
healthCheckTransport := http.DefaultTransport.(*http.Transport).Clone()
4346
healthCheckTransport.TLSClientConfig = &tls.Config{
@@ -74,7 +77,7 @@ func setupHttpClients(k8s client.Client) {
7477
}
7578
}
7679

77-
func readCertificates(k8s client.Client) ([]byte, bool) {
80+
func readCertificates(k8s client.Client, logger logr.Logger) (map[string]string, bool) {
7881
configmapRef := config.GetGlobalConfig().Routing.TLSCertificateConfigmapRef
7982
if configmapRef == nil {
8083
return nil, false
@@ -86,12 +89,11 @@ func readCertificates(k8s client.Client) ([]byte, bool) {
8689
}
8790
err := k8s.Get(context.Background(), *namespacedName, configMap)
8891
if err == nil {
89-
certificates, ok := configMap.Data["custom-ca-certificates.pem"]
90-
if ok {
91-
return []byte(certificates), true
92-
}
92+
return configMap.Data, true
93+
} else {
94+
logger.Error(err, "Failed to read configmap with certificates")
9395
}
94-
return []byte{}, false
96+
return map[string]string{}, false
9597
}
9698

9799
func injectCertificates(certsPem []byte, transport *http.Transport) {

‎controllers/workspace/predicates.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -128,10 +128,10 @@ func objectIsAutomountResource(obj client.Object) bool {
128128
}
129129

130130
func objectIsCertificateConfigmap(obj client.Object) bool {
131-
configmapRef := config.GetGlobalConfig().Routing.TLSCertificateConfigmapRef
132-
if configmapRef == nil {
131+
routing := config.GetGlobalConfig().Routing
132+
if routing == nil || routing.TLSCertificateConfigmapRef == nil {
133133
return false
134134
} else {
135-
return configmapRef.Name == obj.GetName() && configmapRef.Namespace == obj.GetNamespace()
135+
return routing.TLSCertificateConfigmapRef.Name == obj.GetName() && routing.TLSCertificateConfigmapRef.Namespace == obj.GetNamespace()
136136
}
137137
}

‎controllers/workspace/suite_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ var _ = BeforeSuite(func() {
138138
NonCachingClient: nonCachingClient,
139139
Log: ctrl.Log.WithName("controllers").WithName("DevWorkspace"),
140140
Scheme: mgr.GetScheme(),
141-
}).SetupWithManager(mgr, nonCachingClient)
141+
}).SetupWithManager(mgr)
142142
Expect(err).NotTo(HaveOccurred())
143143

144144
// Set HTTP client to fail all requests by default; tests that require HTTP must set this up directly

‎main.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ func main() {
165165
NonCachingClient: nonCachingClient,
166166
Log: ctrl.Log.WithName("controllers").WithName("DevWorkspace"),
167167
Scheme: mgr.GetScheme(),
168-
}).SetupWithManager(mgr, nonCachingClient); err != nil {
168+
}).SetupWithManager(mgr); err != nil {
169169
setupLog.Error(err, "unable to create controller", "controller", "DevWorkspace")
170170
os.Exit(1)
171171
}

‎pkg/config/predicates.go

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,13 @@ import (
2525
func Predicates() predicate.Predicate {
2626
return predicate.Funcs{
2727
UpdateFunc: func(evt event.UpdateEvent) bool {
28-
if config, ok := evt.ObjectNew.(*dw.DevWorkspaceOperatorConfig); ok {
29-
syncConfigFrom(config)
28+
if newConfig, ok := evt.ObjectNew.(*dw.DevWorkspaceOperatorConfig); ok {
29+
syncConfigFrom(newConfig)
30+
if oldConfig, ok := evt.ObjectOld.(*dw.DevWorkspaceOperatorConfig); ok {
31+
if *oldConfig.Config.Routing.TLSCertificateConfigmapRef != *newConfig.Config.Routing.TLSCertificateConfigmapRef {
32+
return true
33+
}
34+
}
3035
}
3136
return false
3237
},

‎pkg/config/proxy/openshift.go

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -59,24 +59,6 @@ func GetClusterProxyConfig(nonCachedClient crclient.Client) (*controller.Proxy,
5959
return proxyConfig, nil
6060
}
6161

62-
// MergeTLSCertificateConfigmapRef merges tls certificate configmap reference configurations
63-
// from the operator and the cluster and merges them, with the operator configuration taking precedence.
64-
func MergeTLSCertificateConfigmapRef(operatorConfig, clusterConfig *controller.ConfigmapReference) *controller.ConfigmapReference {
65-
mergedConfigmapReference := &controller.ConfigmapReference{
66-
Name: operatorConfig.Name,
67-
Namespace: operatorConfig.Namespace,
68-
}
69-
70-
if mergedConfigmapReference.Name == "" {
71-
mergedConfigmapReference.Name = clusterConfig.Name
72-
}
73-
if mergedConfigmapReference.Namespace == "" {
74-
mergedConfigmapReference.Namespace = clusterConfig.Namespace
75-
}
76-
77-
return mergedConfigmapReference
78-
}
79-
8062
// MergeProxyConfigs merges proxy configurations from the operator and the cluster and merges them, with the
8163
// operator configuration taking precedence. Accepts nil arguments. If both arguments are nil, returns nil.
8264
func MergeProxyConfigs(operatorConfig, clusterConfig *controller.Proxy) *controller.Proxy {

‎pkg/config/sync.go

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -273,7 +273,7 @@ func mergeConfig(from, to *controller.OperatorConfiguration) {
273273
if to.Routing.TLSCertificateConfigmapRef == nil {
274274
to.Routing.TLSCertificateConfigmapRef = &controller.ConfigmapReference{}
275275
}
276-
to.Routing.TLSCertificateConfigmapRef = proxy.MergeTLSCertificateConfigmapRef(from.Routing.TLSCertificateConfigmapRef, defaultConfig.Routing.TLSCertificateConfigmapRef)
276+
to.Routing.TLSCertificateConfigmapRef = mergeTLSCertificateConfigmapRef(from.Routing.TLSCertificateConfigmapRef, defaultConfig.Routing.TLSCertificateConfigmapRef)
277277
}
278278
}
279279
if from.Workspace != nil {
@@ -432,6 +432,22 @@ func mergeContainerSecurityContext(base, patch *corev1.SecurityContext) *corev1.
432432
return patched
433433
}
434434

435+
func mergeTLSCertificateConfigmapRef(operatorConfig, clusterConfig *controller.ConfigmapReference) *controller.ConfigmapReference {
436+
mergedConfigmapReference := &controller.ConfigmapReference{
437+
Name: operatorConfig.Name,
438+
Namespace: operatorConfig.Namespace,
439+
}
440+
441+
if mergedConfigmapReference.Name == "" {
442+
mergedConfigmapReference.Name = clusterConfig.Name
443+
}
444+
if mergedConfigmapReference.Namespace == "" {
445+
mergedConfigmapReference.Namespace = clusterConfig.Namespace
446+
}
447+
448+
return mergedConfigmapReference
449+
}
450+
435451
func mergeResources(from, to *corev1.ResourceRequirements) *corev1.ResourceRequirements {
436452
result := to.DeepCopy()
437453
if from.Limits != nil {

0 commit comments

Comments
 (0)