Skip to content

Commit e0a181c

Browse files
tommyd450osmman
tommyd450
authored and
osmman
committed
Enabling Rekor to set custom Trillian log signer service
1 parent b7bd354 commit e0a181c

16 files changed

+161
-80
lines changed

‎api/v1alpha1/common.go

+13
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,19 @@ type MonitoringConfig struct {
2121
Enabled bool `json:"enabled"`
2222
}
2323

24+
// TrillianService configuration to connect Trillian server
25+
type TrillianService struct {
26+
// Address to Trillian Log Server End point
27+
//+optional
28+
Address string `json:"address,omitempty"`
29+
// Port of Trillian Log Server End point
30+
//+kubebuilder:validation:Minimum:=1
31+
//+kubebuilder:validation:Maximum:=65535
32+
//+kubebuilder:default:=8091
33+
//+optional
34+
Port *int32 `json:"port,omitempty"`
35+
}
36+
2437
// LocalObjectReference contains enough information to let you locate the
2538
// referenced object inside the same namespace.
2639
// +structType=atomic

‎api/v1alpha1/rekor_types.go

+3
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ type RekorSpec struct {
1313
// If it is unset, the operator will create new Merkle tree in the Trillian backend
1414
//+optional
1515
TreeID *int64 `json:"treeID,omitempty"`
16+
// Trillian service configuration
17+
//+kubebuilder:default:={port: 8091}
18+
Trillian TrillianService `json:"trillian,omitempty"`
1619
// Define whether you want to export service or not
1720
ExternalAccess ExternalAccess `json:"externalAccess,omitempty"`
1821
//Enable Service monitors for rekor

‎api/v1alpha1/rekor_types_test.go

+9-1
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,8 @@ var _ = Describe("Rekor", func() {
198198
It("outputs the CR", func() {
199199
storage := k8sresource.MustParse("987Gi")
200200
tree := int64(1269875)
201+
port := int32(8091)
202+
201203
rekorInstance = Rekor{
202204
ObjectMeta: metav1.ObjectMeta{
203205
Name: "rekor-full-manifest",
@@ -240,6 +242,10 @@ var _ = Describe("Rekor", func() {
240242
Key: "key",
241243
},
242244
},
245+
Trillian: TrillianService{
246+
Address: "trillian-system.default.svc",
247+
Port: &port,
248+
},
243249
},
244250
}
245251

@@ -253,7 +259,6 @@ var _ = Describe("Rekor", func() {
253259
When("CR is partially set", func() {
254260

255261
It("sets spec.pvc.storage if spec.pvc is partially set", func() {
256-
257262
rekorInstance = Rekor{
258263
ObjectMeta: metav1.ObjectMeta{
259264
Name: "rekor-storage",
@@ -299,6 +304,9 @@ func generateRekorObject(name string) *Rekor {
299304
Retain: utils.Pointer(true),
300305
Size: &storage,
301306
},
307+
Trillian: TrillianService{
308+
Port: utils.Pointer(int32(8091)),
309+
},
302310
},
303311
}
304312
}

‎api/v1alpha1/zz_generated.deepcopy.go

+21
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/manifests/rhtas-operator.clusterserviceversion.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ metadata:
192192
]
193193
capabilities: Seamless Upgrades
194194
containerImage: registry.redhat.io/rhtas/rhtas-rhel9-operator@sha256:a21f7128694a64989bf0d84a7a7da4c1ffc89edf62d594dc8bea7bcfe9ac08d3
195-
createdAt: "2024-06-12T14:09:20Z"
195+
createdAt: "2024-06-13T10:31:51Z"
196196
features.operators.openshift.io/cnf: "false"
197197
features.operators.openshift.io/cni: "false"
198198
features.operators.openshift.io/csi: "false"
@@ -204,7 +204,7 @@ metadata:
204204
features.operators.openshift.io/token-auth-azure: "false"
205205
features.operators.openshift.io/token-auth-gcp: "false"
206206
operators.openshift.io/valid-subscription: '["Red Hat Trusted Artifact Signer"]'
207-
operators.operatorframework.io/builder: operator-sdk-v1.34.1
207+
operators.operatorframework.io/builder: operator-sdk-v1.34.2
208208
operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
209209
repository: https://github.com/securesign/secure-sign-operator
210210
support: Red Hat

‎bundle/manifests/rhtas.redhat.com_rekors.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,22 @@ spec:
204204
If it is unset, the operator will create new Merkle tree in the Trillian backend
205205
format: int64
206206
type: integer
207+
trillian:
208+
default:
209+
port: 8091
210+
description: Trillian service configuration
211+
properties:
212+
address:
213+
description: Address to Trillian Log Server End point
214+
type: string
215+
port:
216+
default: 8091
217+
description: Port of Trillian Log Server End point
218+
format: int32
219+
maximum: 65535
220+
minimum: 1
221+
type: integer
222+
type: object
207223
type: object
208224
status:
209225
description: RekorStatus defines the observed state of Rekor

‎bundle/manifests/rhtas.redhat.com_securesigns.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -551,6 +551,22 @@ spec:
551551
If it is unset, the operator will create new Merkle tree in the Trillian backend
552552
format: int64
553553
type: integer
554+
trillian:
555+
default:
556+
port: 8091
557+
description: Trillian service configuration
558+
properties:
559+
address:
560+
description: Address to Trillian Log Server End point
561+
type: string
562+
port:
563+
default: 8091
564+
description: Port of Trillian Log Server End point
565+
format: int32
566+
maximum: 65535
567+
minimum: 1
568+
type: integer
569+
type: object
554570
type: object
555571
trillian:
556572
description: TrillianSpec defines the desired state of Trillian

‎config/crd/bases/rhtas.redhat.com_rekors.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,22 @@ spec:
204204
If it is unset, the operator will create new Merkle tree in the Trillian backend
205205
format: int64
206206
type: integer
207+
trillian:
208+
default:
209+
port: 8091
210+
description: Trillian service configuration
211+
properties:
212+
address:
213+
description: Address to Trillian Log Server End point
214+
type: string
215+
port:
216+
default: 8091
217+
description: Port of Trillian Log Server End point
218+
format: int32
219+
maximum: 65535
220+
minimum: 1
221+
type: integer
222+
type: object
207223
type: object
208224
status:
209225
description: RekorStatus defines the observed state of Rekor

‎config/crd/bases/rhtas.redhat.com_securesigns.yaml

+16
Original file line numberDiff line numberDiff line change
@@ -551,6 +551,22 @@ spec:
551551
If it is unset, the operator will create new Merkle tree in the Trillian backend
552552
format: int64
553553
type: integer
554+
trillian:
555+
default:
556+
port: 8091
557+
description: Trillian service configuration
558+
properties:
559+
address:
560+
description: Address to Trillian Log Server End point
561+
type: string
562+
port:
563+
default: 8091
564+
description: Port of Trillian Log Server End point
565+
format: int32
566+
maximum: 65535
567+
minimum: 1
568+
type: integer
569+
type: object
554570
type: object
555571
trillian:
556572
description: TrillianSpec defines the desired state of Trillian

‎internal/controller/rekor/actions/pending.go

-48
This file was deleted.

‎internal/controller/rekor/actions/server/createTree.go

+15-6
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,14 @@ import (
44
"context"
55
"fmt"
66

7+
"github.com/google/trillian"
78
rhtasv1alpha1 "github.com/securesign/operator/api/v1alpha1"
89
"github.com/securesign/operator/internal/controller/common"
910
"github.com/securesign/operator/internal/controller/common/action"
10-
k8sutils "github.com/securesign/operator/internal/controller/common/utils/kubernetes"
1111
"github.com/securesign/operator/internal/controller/constants"
1212
"github.com/securesign/operator/internal/controller/rekor/actions"
13-
trillian "github.com/securesign/operator/internal/controller/trillian/actions"
13+
"github.com/securesign/operator/internal/controller/rekor/utils"
14+
actions2 "github.com/securesign/operator/internal/controller/trillian/actions"
1415
v1 "k8s.io/api/core/v1"
1516
"k8s.io/apimachinery/pkg/api/meta"
1617
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -39,12 +40,20 @@ func (i createTrillianTreeAction) Handle(ctx context.Context, instance *rhtasv1a
3940
return i.StatusUpdate(ctx, instance)
4041
}
4142
var err error
43+
var tree *trillian.Tree
44+
var trillUrl string
4245

43-
trillUrl, err := k8sutils.GetInternalUrl(ctx, i.Client, instance.Namespace, trillian.LogserverDeploymentName)
44-
if err != nil {
45-
return i.Failed(err)
46+
switch {
47+
case instance.Spec.Trillian.Port == nil:
48+
err = fmt.Errorf("%s: %w", i.Name(), utils.TrillianPortNotSpecified)
49+
case instance.Spec.Trillian.Address == "":
50+
trillUrl = fmt.Sprintf("%s.%s.svc:%d", actions2.LogserverDeploymentName, instance.Namespace, *instance.Spec.Trillian.Port)
51+
default:
52+
trillUrl = fmt.Sprintf("%s:%d", instance.Spec.Trillian.Address, *instance.Spec.Trillian.Port)
4653
}
47-
tree, err := common.CreateTrillianTree(ctx, "rekor-tree", trillUrl+":8091", constants.CreateTreeDeadline)
54+
i.Logger.V(1).Info("trillian logserver", "address", trillUrl)
55+
56+
tree, err = common.CreateTrillianTree(ctx, "rekor-tree", trillUrl, constants.CreateTreeDeadline)
4857
if err != nil {
4958
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
5059
Type: actions.ServerCondition,

‎internal/controller/rekor/actions/server/deployment.go

+9-1
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"github.com/securesign/operator/internal/controller/constants"
99
"github.com/securesign/operator/internal/controller/rekor/actions"
1010
"github.com/securesign/operator/internal/controller/rekor/utils"
11+
actions2 "github.com/securesign/operator/internal/controller/trillian/actions"
1112
"k8s.io/apimachinery/pkg/api/meta"
1213
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1314
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -38,7 +39,14 @@ func (i deployAction) Handle(ctx context.Context, instance *rhtasv1alpha1.Rekor)
3839
updated bool
3940
)
4041
labels := constants.LabelsFor(actions.ServerComponentName, actions.ServerDeploymentName, instance.Name)
41-
dp, err := utils.CreateRekorDeployment(instance, actions.ServerDeploymentName, actions.RBACName, labels)
42+
43+
insCopy := instance.DeepCopy()
44+
if insCopy.Spec.Trillian.Address == "" {
45+
insCopy.Spec.Trillian.Address = fmt.Sprintf("%s.%s.svc", actions2.LogserverDeploymentName, instance.Namespace)
46+
}
47+
i.Logger.V(1).Info("trillian logserver", "address", insCopy.Spec.Trillian.Address)
48+
dp, err := utils.CreateRekorDeployment(insCopy, actions.ServerDeploymentName, actions.RBACName, labels)
49+
4250
if err != nil {
4351
meta.SetStatusCondition(&instance.Status.Conditions, metav1.Condition{
4452
Type: actions.ServerCondition,

‎internal/controller/rekor/rekor_controller.go

-2
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,6 @@ func (r *RekorReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl
9191
// NONE -> PENDING
9292
actions2.NewInitializeConditions(),
9393

94-
// PENDING
95-
actions2.NewPendingAction(),
9694
// PENDING -> CREATE
9795
server.NewGenerateSignerAction(),
9896

‎internal/controller/rekor/rekor_controller_test.go

-11
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,9 @@ import (
2323
"github.com/securesign/operator/internal/controller/common/utils"
2424

2525
"github.com/securesign/operator/api/v1alpha1"
26-
"github.com/securesign/operator/internal/controller/common/utils/kubernetes"
2726
"github.com/securesign/operator/internal/controller/constants"
2827
"github.com/securesign/operator/internal/controller/rekor/actions"
2928
"github.com/securesign/operator/internal/controller/rekor/actions/server"
30-
trillian "github.com/securesign/operator/internal/controller/trillian/actions"
3129
appsv1 "k8s.io/api/apps/v1"
3230
corev1 "k8s.io/api/core/v1"
3331
"k8s.io/apimachinery/pkg/api/errors"
@@ -128,15 +126,6 @@ var _ = Describe("Rekor controller", func() {
128126
return meta.IsStatusConditionPresentAndEqual(found.Status.Conditions, constants.Ready, metav1.ConditionFalse)
129127
}).Should(BeTrue())
130128

131-
Eventually(func() string {
132-
found := &v1alpha1.Rekor{}
133-
Expect(k8sClient.Get(ctx, typeNamespaceName, found)).Should(Succeed())
134-
return meta.FindStatusCondition(found.Status.Conditions, constants.Ready).Reason
135-
}).Should(Equal(constants.Pending))
136-
137-
By("Move to CreatingPhase by creating trillian service")
138-
Expect(k8sClient.Create(ctx, kubernetes.CreateService(Namespace, trillian.LogserverDeploymentName, 8091, constants.LabelsForComponent(trillian.LogServerComponentName, instance.Name)))).To(Succeed())
139-
140129
By("Rekor signer created")
141130
found := &v1alpha1.Rekor{}
142131
Eventually(func() *v1alpha1.SecretKeySelector {

‎internal/controller/rekor/utils/errors.go

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
package utils
2+
3+
import "errors"
4+
5+
var (
6+
ServerConfigNotSpecified = errors.New("server config name not specified")
7+
TreeNotSpecified = errors.New("tree not specified")
8+
TrillianAddressNotSpecified = errors.New("trillian address not specified")
9+
TrillianPortNotSpecified = errors.New("trillian port not specified")
10+
SignerKeyNotSpecified = errors.New("signer key reference not specified")
11+
)

0 commit comments

Comments
 (0)