Skip to content

Commit

Permalink
fix: mounting additional certificates even if TLS is off for the Tena…
Browse files Browse the repository at this point in the history 
…nt and the Operator (#879)

Signed-off-by: Daniel Valdivia <[email protected]>
  • Loading branch information
@dvaldivia
dvaldivia authored Oct 21, 2021
1 parent c0d39f4 commit 85c254e
Showing 1 changed file with 13 additions and 13 deletions.
26 changes: 13 additions & 13 deletions pkg/resources/statefulsets/minio-statefulset.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -233,7 +233,7 @@ func ContainerMatchLabels(t *miniov2.Tenant, pool *miniov2.Pool) *metav1.LabelSe
}

// Builds the volume mounts for MinIO container.
func volumeMounts(t *miniov2.Tenant, pool *miniov2.Pool, operatorTLS bool) (mounts []corev1.VolumeMount) {
func volumeMounts(t *miniov2.Tenant, pool *miniov2.Pool, operatorTLS bool, certVolumeSources []v1.VolumeProjection) (mounts []v1.VolumeMount) {
// This is the case where user didn't provide a pool and we deploy a EmptyDir based
// single node single drive (FS) MinIO deployment
name := miniov2.MinIOVolumeName
Expand All @@ -257,7 +257,7 @@ func volumeMounts(t *miniov2.Tenant, pool *miniov2.Pool, operatorTLS bool) (moun

// CertPath (/tmp/certs) will always be mounted even if the tenant doesnt have any TLS certificate
// operator will still mount the operator public cert under /tmp/certs/CAs/operator.crt
if operatorTLS {
if operatorTLS || len(certVolumeSources) > 0 {
mounts = append(mounts, corev1.VolumeMount{
Name: t.MinIOTLSSecretName(),
MountPath: miniov2.MinIOCertPath,
Expand All @@ -275,7 +275,7 @@ func volumeMounts(t *miniov2.Tenant, pool *miniov2.Pool, operatorTLS bool) (moun
}

// Builds the MinIO container for a Tenant.
func poolMinioServerContainer(t *miniov2.Tenant, wsSecret *v1.Secret, pool *miniov2.Pool, hostsTemplate string, opVersion string, operatorTLS bool) corev1.Container {
func poolMinioServerContainer(t *miniov2.Tenant, wsSecret *v1.Secret, pool *miniov2.Pool, hostsTemplate string, opVersion string, operatorTLS bool, certVolumeSources []v1.VolumeProjection) v1.Container {
consolePort := miniov2.ConsolePort
if t.TLS() {
consolePort = miniov2.ConsoleTLSPort
Expand Down Expand Up @@ -308,7 +308,7 @@ func poolMinioServerContainer(t *miniov2.Tenant, wsSecret *v1.Secret, pool *mini
},
},
ImagePullPolicy: t.Spec.ImagePullPolicy,
VolumeMounts: volumeMounts(t, pool, operatorTLS),
VolumeMounts: volumeMounts(t, pool, operatorTLS, certVolumeSources),
Args: args,
Env: append(minioEnvironmentVars(t, wsSecret, hostsTemplate, opVersion), consoleEnvVars(t)...),
Resources: pool.Resources,
Expand Down Expand Up @@ -370,7 +370,7 @@ func poolSecurityContext(pool *miniov2.Pool, status *miniov2.PoolStatus) *v1.Pod
func NewPool(t *miniov2.Tenant, wsSecret *v1.Secret, pool *miniov2.Pool, poolStatus *miniov2.PoolStatus, serviceName, hostsTemplate, operatorVersion string, operatorTLS bool) *appsv1.StatefulSet {
var podVolumes []corev1.Volume
var replicas = pool.Servers
var podVolumeSources []corev1.VolumeProjection
var certVolumeSources []corev1.VolumeProjection

var clientCertSecret string
var clientCertPaths = []corev1.KeyToPath{
Expand Down Expand Up @@ -440,7 +440,7 @@ func NewPool(t *miniov2.Tenant, wsSecret *v1.Secret, pool *miniov2.Pool, poolSta
{Key: "public.crt", Path: caMountPath},
}
}
podVolumeSources = append(podVolumeSources, corev1.VolumeProjection{
certVolumeSources = append(certVolumeSources, corev1.VolumeProjection{
Secret: &corev1.SecretProjection{
LocalObjectReference: corev1.LocalObjectReference{
Name: secret.Name,
Expand All @@ -460,7 +460,7 @@ func NewPool(t *miniov2.Tenant, wsSecret *v1.Secret, pool *miniov2.Pool, poolSta
keyMountPath = fmt.Sprintf("hostname-%d/private.key", index)
caMountPath = fmt.Sprintf("CAs/hostname-%d.crt", index)
}
podVolumeSources = append(podVolumeSources, corev1.VolumeProjection{
certVolumeSources = append(certVolumeSources, corev1.VolumeProjection{
Secret: &corev1.SecretProjection{
LocalObjectReference: corev1.LocalObjectReference{
Name: t.MinIOTLSSecretName(),
Expand Down Expand Up @@ -498,7 +498,7 @@ func NewPool(t *miniov2.Tenant, wsSecret *v1.Secret, pool *miniov2.Pool, poolSta
{Key: "public.crt", Path: fmt.Sprintf("CAs/ca-%d.crt", index)},
}
}
podVolumeSources = append(podVolumeSources, corev1.VolumeProjection{
certVolumeSources = append(certVolumeSources, corev1.VolumeProjection{
Secret: &corev1.SecretProjection{
LocalObjectReference: corev1.LocalObjectReference{
Name: secret.Name,
Expand All @@ -511,7 +511,7 @@ func NewPool(t *miniov2.Tenant, wsSecret *v1.Secret, pool *miniov2.Pool, poolSta
if operatorTLS {
// Mount Operator TLS certificate to MinIO ~/cert/CAs
operatorTLSSecretName := "operator-tls"
podVolumeSources = append(podVolumeSources, []corev1.VolumeProjection{
certVolumeSources = append(certVolumeSources, []corev1.VolumeProjection{
{
Secret: &corev1.SecretProjection{
LocalObjectReference: corev1.LocalObjectReference{
Expand Down Expand Up @@ -560,7 +560,7 @@ func NewPool(t *miniov2.Tenant, wsSecret *v1.Secret, pool *miniov2.Pool, poolSta
kesCertSecret = t.KESTLSSecretName()
}

podVolumeSources = append(podVolumeSources, []corev1.VolumeProjection{
certVolumeSources = append(certVolumeSources, []corev1.VolumeProjection{
{
Secret: &corev1.SecretProjection{
LocalObjectReference: corev1.LocalObjectReference{
Expand All @@ -580,12 +580,12 @@ func NewPool(t *miniov2.Tenant, wsSecret *v1.Secret, pool *miniov2.Pool, poolSta
}...)
}

if len(podVolumeSources) > 0 {
if len(certVolumeSources) > 0 {
podVolumes = append(podVolumes, corev1.Volume{
Name: t.MinIOTLSSecretName(),
VolumeSource: corev1.VolumeSource{
Projected: &corev1.ProjectedVolumeSource{
Sources: podVolumeSources,
Sources: certVolumeSources,
},
},
})
Expand Down Expand Up @@ -643,7 +643,7 @@ func NewPool(t *miniov2.Tenant, wsSecret *v1.Secret, pool *miniov2.Pool, poolSta
}

containers := []corev1.Container{
poolMinioServerContainer(t, wsSecret, pool, hostsTemplate, operatorVersion, operatorTLS),
poolMinioServerContainer(t, wsSecret, pool, hostsTemplate, operatorVersion, operatorTLS, certVolumeSources),
}

// attach any sidecar containers and volumes
Expand Down

0 comments on commit 85c254e

Please sign in to comment.