Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Certificate Authorities to wasmcloud host #72

Merged
merged 8 commits into from
Jul 17, 2024
Merged

feat: Certificate Authorities to wasmcloud host #72

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
0b036e2
feat: Customize Certificate Authorities
lxfontes Jul 11, 2024
61f3554
handling 'optional'
lxfontes Jul 12, 2024
ffec6b8
falling back to default if needed
lxfontes Jul 12, 2024
cbbfa29
changing function signature
lxfontes Jul 12, 2024
6cbb314
better 'format'
lxfontes Jul 12, 2024
e275b4f
Using upstream structs
lxfontes Jul 15, 2024
f6af671
addressing nits
lxfontes Jul 15, 2024
65bbf5f
checking for valid types
lxfontes Jul 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions crates/types/src/v1alpha1/wasmcloud_host_config.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,8 @@ pub struct WasmCloudHostConfigSpec {
pub scheduling_options: Option<KubernetesSchedulingOptions>,
/// Observability options for configuring the OpenTelemetry integration
pub observability: Option<ObservabilityConfiguration>,
/// Certificates: Authorities, client certificates
pub certificates: Option<WasmCloudHostCertificates>,
}

#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
Expand Down Expand Up @@ -187,6 +189,36 @@ fn default_nats_leafnode_port() -> u16 {
7422
}

#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
pub struct ConfigMapSource {
protochron marked this conversation as resolved.
Show resolved Hide resolved
/// Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
pub name: String,

/// Specify whether the ConfigMap must be defined
pub optional: Option<bool>,
}

#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
pub struct SecretSource {
lxfontes marked this conversation as resolved.
Show resolved Hide resolved
/// Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
pub name: String,

/// Specify whether the ConfigMap must be defined
lxfontes marked this conversation as resolved.
Show resolved Hide resolved
pub optional: Option<bool>,
}

#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
#[serde(rename_all = "camelCase")]
pub struct CertificateSource {
lxfontes marked this conversation as resolved.
Show resolved Hide resolved
pub config_map_ref: Option<ConfigMapSource>,
pub secret_ref: Option<SecretSource>,
}

#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
pub struct WasmCloudHostCertificates {
pub authorities: Option<Vec<CertificateSource>>,
lxfontes marked this conversation as resolved.
Show resolved Hide resolved
}

#[derive(Serialize, Deserialize, Clone, Debug, JsonSchema)]
pub struct WasmCloudHostConfigResources {
pub nats: Option<ResourceRequirements>,
Expand Down
112 changes: 96 additions & 16 deletions src/controller.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,7 @@ async fn cleanup(config: &WasmCloudHostConfig, ctx: Arc<Context>) -> Result<Acti
Ok(Action::await_change())
}

fn pod_template(config: &WasmCloudHostConfig, _ctx: Arc<Context>) -> PodTemplateSpec {
async fn pod_template(config: &WasmCloudHostConfig, ctx: Arc<Context>) -> Result<PodTemplateSpec> {
let labels = pod_labels(config);

let mut wasmcloud_env = vec![
Expand Down Expand Up @@ -373,7 +373,7 @@ fn pod_template(config: &WasmCloudHostConfig, _ctx: Arc<Context>) -> PodTemplate
}
}

let wasmcloud_args = configure_observability(&config.spec);
let mut wasmcloud_args = configure_observability(&config.spec);

let mut nats_resources: Option<k8s_openapi::api::core::v1::ResourceRequirements> = None;
let mut wasmcloud_resources: Option<k8s_openapi::api::core::v1::ResourceRequirements> = None;
Expand Down Expand Up @@ -403,14 +403,68 @@ fn pod_template(config: &WasmCloudHostConfig, _ctx: Arc<Context>) -> PodTemplate
..Default::default()
}];

let mut volume_mounts = vec![VolumeMount {
let mut nats_volume_mounts = vec![VolumeMount {
name: "nats-config".to_string(),
mount_path: "/nats/nats.conf".to_string(),
read_only: Some(true),
sub_path: Some("nats.conf".to_string()),
..Default::default()
}];

let mut wasm_volume_mounts: Vec<VolumeMount> = vec![];
if let Some(authorities) = &config
.spec
.certificates
.clone()
.and_then(|certificates| certificates.authorities)
{
for (i, authority) in authorities.iter().enumerate() {
// configmaps
if let Some(configmap) = &authority.config_map_ref {
let volume_name = format!("cert-authority-{i}");
let volume_path = format!("/wasmcloud/certificates/authorities/{volume_name}");
match discover_configmap_certificates(
config.namespace().unwrap_or_default().as_str(),
configmap.name.as_str(),
lxfontes marked this conversation as resolved.
Show resolved Hide resolved
&ctx,
)
.await
{
Ok(items) => {
for item in items {
wasmcloud_args.push("--tls-ca-path".to_string());
wasmcloud_args.push(format!("{volume_path}/{item}"));
}
}
Err(e) => {
if let Some(is_optional) = &configmap.optional {
if !is_optional {
return Err(e);
}
} else {
continue;
}
}
};
volumes.push(Volume {
name: volume_name.clone(),
config_map: Some(ConfigMapVolumeSource {
name: Some(configmap.name.clone()),
..Default::default()
}),
..Default::default()
});

wasm_volume_mounts.push(VolumeMount {
name: volume_name.clone(),
read_only: Some(true),
mount_path: volume_path,
..Default::default()
});
}
}
}

if let Some(secret_name) = &config.spec.secret_name {
volumes.push(Volume {
name: "nats-creds".to_string(),
Expand All @@ -421,7 +475,7 @@ fn pod_template(config: &WasmCloudHostConfig, _ctx: Arc<Context>) -> PodTemplate
..Default::default()
});

volume_mounts.push(VolumeMount {
nats_volume_mounts.push(VolumeMount {
name: "nats-creds".to_string(),
mount_path: "/nats/nats.creds".to_string(),
sub_path: Some("nats.creds".to_string()),
Expand Down Expand Up @@ -455,7 +509,7 @@ fn pod_template(config: &WasmCloudHostConfig, _ctx: Arc<Context>) -> PodTemplate
..Default::default()
}),
resources: nats_resources,
volume_mounts: Some(volume_mounts),
volume_mounts: Some(nats_volume_mounts),
..Default::default()
},
Container {
Expand All @@ -465,6 +519,7 @@ fn pod_template(config: &WasmCloudHostConfig, _ctx: Arc<Context>) -> PodTemplate
args: Some(wasmcloud_args),
env: Some(wasmcloud_env),
resources: wasmcloud_resources,
volume_mounts: Some(wasm_volume_mounts),
..Default::default()
},
];
Expand Down Expand Up @@ -495,7 +550,29 @@ fn pod_template(config: &WasmCloudHostConfig, _ctx: Arc<Context>) -> PodTemplate
template.spec = Some(overrides);
}
};
template
Ok(template)
}

async fn discover_configmap_certificates(
namespace: &str,
name: &str,
ctx: &Context,
) -> Result<Vec<String>> {
let kube_client = ctx.client.clone();
let api = Api::<ConfigMap>::namespaced(kube_client, &namespace);
let mut certs = Vec::new();

let raw_config_map = api.get(name).await?;

if let Some(raw_data) = raw_config_map.data {
for (key, _) in raw_data {
if key.ends_with(".crt") {
certs.push(key)
}
}
}

Ok(certs)
}

fn configure_observability(spec: &WasmCloudHostConfigSpec) -> Vec<String> {
Expand Down Expand Up @@ -543,19 +620,22 @@ fn configure_observability(spec: &WasmCloudHostConfigSpec) -> Vec<String> {
args
}

fn deployment_spec(config: &WasmCloudHostConfig, ctx: Arc<Context>) -> DeploymentSpec {
let pod_template = pod_template(config, ctx);
async fn deployment_spec(
config: &WasmCloudHostConfig,
ctx: Arc<Context>,
) -> Result<DeploymentSpec> {
let pod_template = pod_template(config, ctx).await?;
let ls = LabelSelector {
match_labels: Some(selector_labels(config)),
..Default::default()
};

DeploymentSpec {
Ok(DeploymentSpec {
replicas: Some(config.spec.host_replicas as i32),
selector: ls,
template: pod_template,
..Default::default()
}
})
}

fn pod_labels(config: &WasmCloudHostConfig) -> BTreeMap<String, String> {
Expand All @@ -582,18 +662,18 @@ fn selector_labels(config: &WasmCloudHostConfig) -> BTreeMap<String, String> {
labels
}

fn daemonset_spec(config: &WasmCloudHostConfig, ctx: Arc<Context>) -> DaemonSetSpec {
let pod_template = pod_template(config, ctx);
async fn daemonset_spec(config: &WasmCloudHostConfig, ctx: Arc<Context>) -> Result<DaemonSetSpec> {
let pod_template = pod_template(config, ctx).await?;
let ls = LabelSelector {
match_labels: Some(selector_labels(config)),
..Default::default()
};

DaemonSetSpec {
Ok(DaemonSetSpec {
selector: ls,
template: pod_template,
..Default::default()
}
})
}

async fn configure_hosts(config: &WasmCloudHostConfig, ctx: Arc<Context>) -> Result<()> {
Expand Down Expand Up @@ -665,7 +745,7 @@ async fn configure_hosts(config: &WasmCloudHostConfig, ctx: Arc<Context>) -> Res

if let Some(scheduling_options) = &config.spec.scheduling_options {
if scheduling_options.daemonset {
let mut spec = daemonset_spec(config, ctx.clone());
let mut spec = daemonset_spec(config, ctx.clone()).await?;
spec.template.spec.as_mut().unwrap().containers[1]
.env
.as_mut()
Expand Down Expand Up @@ -693,7 +773,7 @@ async fn configure_hosts(config: &WasmCloudHostConfig, ctx: Arc<Context>) -> Res
.await?;
}
} else {
let mut spec = deployment_spec(config, ctx.clone());
let mut spec = deployment_spec(config, ctx.clone()).await?;
spec.template.spec.as_mut().unwrap().containers[1]
.env
.as_mut()
Expand Down
Loading