Merge pull request #580 from cybozu-go/backup-enable-tls

Add tls settings for BackupPolicy
cybozu-go · Oct 27, 2023 · c17a4a2 · c17a4a2
2 parents 7b0b37b + 96c7266
commit c17a4a2
Show file tree

Hide file tree

Showing 28 changed files with 608 additions and 124 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,9 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
 
+### Added
+- Add tls settings for BackupPolicy [#580](https://github.com/cybozu-go/moco/pull/580)
+
 ## [0.17.0] - 2023-09-11
 
 ### Breaking Changes

diff --git a/api/v1beta1/job_types.go b/api/v1beta1/job_types.go
@@ -218,4 +218,8 @@ type BucketConfig struct {
 	// +kubebuilder:default=s3
 	// +optional
 	BackendType string `json:"backendType,omitempty"`
+
+	// Path to SSL CA certificate file used in addition to system default.
+	// +optional
+	CaCert string `json:"caCert,omitempty"`
 }
diff --git a/api/v1beta1/zz_generated.conversion.go b/api/v1beta1/zz_generated.conversion.go
diff --git a/api/v1beta2/job_types.go b/api/v1beta2/job_types.go
@@ -201,6 +201,10 @@ type BucketConfig struct {
 	// +kubebuilder:default=s3
 	// +optional
 	BackendType string `json:"backendType,omitempty"`
+
+	// Path to SSL CA certificate file used in addition to system default.
+	// +optional
+	CaCert string `json:"caCert,omitempty"`
 }
 
 // AffinityApplyConfiguration is the type defined to implement the DeepCopy method.

diff --git a/charts/moco/templates/generated/crds/moco_crds.yaml b/charts/moco/templates/generated/crds/moco_crds.yaml
@@ -422,6 +422,9 @@ spec:
                           description: The name of the bucket
                           minLength: 1
                           type: string
+                        caCert:
+                          description: Path to SSL CA certificate file used in addition t
+                          type: string
                         endpointURL:
                           description: The API endpoint URL.
                           pattern: ^https?://.*
@@ -2452,6 +2455,9 @@ spec:
                           description: The name of the bucket
                           minLength: 1
                           type: string
+                        caCert:
+                          description: Path to SSL CA certificate file used in addition t
+                          type: string
                         endpointURL:
                           description: The API endpoint URL.
                           pattern: ^https?://.*
@@ -7722,6 +7728,9 @@ spec:
                               description: The name of the bucket
                               minLength: 1
                               type: string
+                            caCert:
+                              description: Path to SSL CA certificate file used in addition t
+                              type: string
                             endpointURL:
                               description: The API endpoint URL.
                               pattern: ^https?://.*
@@ -13606,6 +13615,9 @@ spec:
                               description: The name of the bucket
                               minLength: 1
                               type: string
+                            caCert:
+                              description: Path to SSL CA certificate file used in addition t
+                              type: string
                             endpointURL:
                               description: The API endpoint URL.
                               pattern: ^https?://.*

diff --git a/cmd/moco-backup/cmd/root.go b/cmd/moco-backup/cmd/root.go
@@ -2,8 +2,11 @@ package cmd
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"errors"
 	"fmt"
+	"net/http"
 	"net/url"
 	"os"
 
@@ -15,12 +18,13 @@ import (
 )
 
 var commonArgs struct {
-	workDir      string
-	threads      int
-	region       string
-	endpointURL  string
-	usePathStyle bool
-	backendType  string
+	workDir        string
+	threads        int
+	region         string
+	endpointURL    string
+	usePathStyle   bool
+	backendType    string
+	caCertFilePath string
 }
 
 func makeBucket(bucketName string) (bucket.Bucket, error) {
@@ -45,6 +49,27 @@ func makeS3Bucket(bucketName string) (bucket.Bucket, error) {
 	if commonArgs.usePathStyle {
 		opts = append(opts, bucket.WithPathStyle())
 	}
+	if len(commonArgs.caCertFilePath) > 0 {
+		caCertFile, err := os.ReadFile(commonArgs.caCertFilePath)
+		if err != nil {
+			return nil, err
+		}
+		caCertPool, err := x509.SystemCertPool()
+		if err != nil {
+			return nil, err
+		}
+		if ok := caCertPool.AppendCertsFromPEM(caCertFile); !ok {
+			return nil, fmt.Errorf("failed to add ca cert")
+		}
+		transport := http.DefaultTransport.(*http.Transport).Clone()
+		if transport.TLSClientConfig == nil {
+			transport.TLSClientConfig = &tls.Config{}
+		}
+		transport.TLSClientConfig.RootCAs = caCertPool
+		opts = append(opts, bucket.WithHTTPClient(&http.Client{
+			Transport: transport,
+		}))
+	}
 	return bucket.NewS3Bucket(bucketName, opts...)
 }
 
@@ -95,4 +120,5 @@ func init() {
 	pf.StringVar(&commonArgs.endpointURL, "endpoint", "", "Object storage API endpoint URL")
 	pf.BoolVar(&commonArgs.usePathStyle, "use-path-style", false, "Use path-style S3 API")
 	pf.StringVar(&commonArgs.backendType, "backend-type", "s3", "The identifier for the object storage to be used.")
+	pf.StringVar(&commonArgs.caCertFilePath, "ca-cert", "", "Path to SSL CA certificate file used in addition to system default")
 }
diff --git a/config/crd/bases/moco.cybozu.com_backuppolicies.yaml b/config/crd/bases/moco.cybozu.com_backuppolicies.yaml
@@ -462,6 +462,10 @@ spec:
                         description: The name of the bucket
                         minLength: 1
                         type: string
+                      caCert:
+                        description: Path to SSL CA certificate file used in addition
+                          t
+                        type: string
                       endpointURL:
                         description: The API endpoint URL.
                         pattern: ^https?://.*
@@ -2649,6 +2653,10 @@ spec:
                         description: The name of the bucket
                         minLength: 1
                         type: string
+                      caCert:
+                        description: Path to SSL CA certificate file used in addition
+                          t
+                        type: string
                       endpointURL:
                         description: The API endpoint URL.
                         pattern: ^https?://.*

diff --git a/config/crd/bases/moco.cybozu.com_mysqlclusters.yaml b/config/crd/bases/moco.cybozu.com_mysqlclusters.yaml
@@ -3999,6 +3999,10 @@ spec:
                             description: The name of the bucket
                             minLength: 1
                             type: string
+                          caCert:
+                            description: Path to SSL CA certificate file used in addition
+                              t
+                            type: string
                           endpointURL:
                             description: The API endpoint URL.
                             pattern: ^https?://.*
@@ -10430,6 +10434,10 @@ spec:
                             description: The name of the bucket
                             minLength: 1
                             type: string
+                          caCert:
+                            description: Path to SSL CA certificate file used in addition
+                              t
+                            type: string
                           endpointURL:
                             description: The API endpoint URL.
                             pattern: ^https?://.*

diff --git a/...ests/apiextensions.k8s.io_v1_customresourcedefinition_backuppolicies.moco.cybozu.com.yaml b/...ests/apiextensions.k8s.io_v1_customresourcedefinition_backuppolicies.moco.cybozu.com.yaml
@@ -461,6 +461,10 @@ spec:
                         description: The name of the bucket
                         minLength: 1
                         type: string
+                      caCert:
+                        description: Path to SSL CA certificate file used in addition
+                          t
+                        type: string
                       endpointURL:
                         description: The API endpoint URL.
                         pattern: ^https?://.*
@@ -2648,6 +2652,10 @@ spec:
                         description: The name of the bucket
                         minLength: 1
                         type: string
+                      caCert:
+                        description: Path to SSL CA certificate file used in addition
+                          t
+                        type: string
                       endpointURL:
                         description: The API endpoint URL.
                         pattern: ^https?://.*

diff --git a/...tests/apiextensions.k8s.io_v1_customresourcedefinition_mysqlclusters.moco.cybozu.com.yaml b/...tests/apiextensions.k8s.io_v1_customresourcedefinition_mysqlclusters.moco.cybozu.com.yaml
@@ -4009,6 +4009,10 @@ spec:
                             description: The name of the bucket
                             minLength: 1
                             type: string
+                          caCert:
+                            description: Path to SSL CA certificate file used in addition
+                              t
+                            type: string
                           endpointURL:
                             description: The API endpoint URL.
                             pattern: ^https?://.*
@@ -10440,6 +10444,10 @@ spec:
                             description: The name of the bucket
                             minLength: 1
                             type: string
+                          caCert:
+                            description: Path to SSL CA certificate file used in addition
+                              t
+                            type: string
                           endpointURL:
                             description: The API endpoint URL.
                             pattern: ^https?://.*

diff --git a/controllers/mysqlcluster_controller.go b/controllers/mysqlcluster_controller.go
@@ -997,6 +997,9 @@ func bucketArgs(bc mocov1beta2.BucketConfig) []string {
 	if bc.BackendType != "" {
 		args = append(args, "--backend-type="+bc.BackendType)
 	}
+	if bc.CaCert != "" {
+		args = append(args, "--ca-cert="+bc.CaCert)
+	}
 
 	return append(args, bc.BucketName)
 }

diff --git a/docs/crd_backuppolicy_v1beta1.md b/docs/crd_backuppolicy_v1beta1.md
@@ -60,6 +60,7 @@ BucketConfig is a set of parameter to access an object storage bucket.
 | endpointURL | The API endpoint URL.  Set this for non-S3 object storages. | string | false |
 | usePathStyle | Allows you to enable the client to use path-style addressing, i.e., https?://ENDPOINT/BUCKET/KEY. By default, a virtual-host addressing is used (https?://BUCKET.ENDPOINT/KEY). | bool | false |
 | backendType | BackendType is an identifier for the object storage to be used. | string | false |
+| caCert | Path to SSL CA certificate file used in addition to system default. | string | false |
 
 [Back to Custom Resources](#custom-resources)
 

diff --git a/docs/crd_backuppolicy_v1beta2.md b/docs/crd_backuppolicy_v1beta2.md
@@ -60,6 +60,7 @@ BucketConfig is a set of parameter to access an object storage bucket.
 | endpointURL | The API endpoint URL.  Set this for non-S3 object storages. | string | false |
 | usePathStyle | Allows you to enable the client to use path-style addressing, i.e., https?://ENDPOINT/BUCKET/KEY. By default, a virtual-host addressing is used (https?://BUCKET.ENDPOINT/KEY). | bool | false |
 | backendType | BackendType is an identifier for the object storage to be used. | string | false |
+| caCert | Path to SSL CA certificate file used in addition to system default. | string | false |
 
 [Back to Custom Resources](#custom-resources)
 

diff --git a/docs/crd_mysqlcluster_v1beta1.md b/docs/crd_mysqlcluster_v1beta1.md
@@ -181,6 +181,7 @@ BucketConfig is a set of parameter to access an object storage bucket.
 | endpointURL | The API endpoint URL.  Set this for non-S3 object storages. | string | false |
 | usePathStyle | Allows you to enable the client to use path-style addressing, i.e., https?://ENDPOINT/BUCKET/KEY. By default, a virtual-host addressing is used (https?://BUCKET.ENDPOINT/KEY). | bool | false |
 | backendType | BackendType is an identifier for the object storage to be used. | string | false |
+| caCert | Path to SSL CA certificate file used in addition to system default. | string | false |
 
 [Back to Custom Resources](#custom-resources)
 

diff --git a/docs/crd_mysqlcluster_v1beta2.md b/docs/crd_mysqlcluster_v1beta2.md
@@ -195,6 +195,7 @@ BucketConfig is a set of parameter to access an object storage bucket.
 | endpointURL | The API endpoint URL.  Set this for non-S3 object storages. | string | false |
 | usePathStyle | Allows you to enable the client to use path-style addressing, i.e., https?://ENDPOINT/BUCKET/KEY. By default, a virtual-host addressing is used (https?://BUCKET.ENDPOINT/KEY). | bool | false |
 | backendType | BackendType is an identifier for the object storage to be used. | string | false |
+| caCert | Path to SSL CA certificate file used in addition to system default. | string | false |
 
 [Back to Custom Resources](#custom-resources)
 

diff --git a/docs/moco-backup.md b/docs/moco-backup.md
@@ -19,6 +19,7 @@ Global Flags:
       --threads int       The number of threads to be used (default 4)
       --use-path-style    Use path-style S3 API
       --work-dir string   The writable working directory (default "/work")
+      --ca-cert string    Path to SSL CA certificate file used in addition to system default
 ```
 
 ## Subcommands

diff --git a/e2e/Makefile b/e2e/Makefile
@@ -48,6 +48,7 @@ endif
 	$(KUSTOMIZE) build . | $(KUBECTL) apply -f -
 	$(KUBECTL) -n moco-system wait --for=condition=available --timeout=180s --all deployments
 	$(KUBECTL) apply -f minio.yaml
+	$(KUBECTL) apply -f minio-tls.yaml
 	$(KUBECTL) apply -f fake-gcs-server.yaml
 	$(KUBECTL) wait --timeout=60s --for=condition=Ready --all pods