Ver 99110 allow users to specify tls certis for https server and client-server authentication #1041

LiboYu2 · 2025-01-25T20:12:22Z

1 removed nma cert mount
2 generate https and client-server tls cert secret when they are not set by users
3 put https and client-server secret names in a config json file and mount it to the vertica pod.
4 an e2e test case is added

roypaulin · 2025-01-28T16:31:22Z

For you test failure you need to add vertica-license: ${{ secrets.VERTICA_LICENSE }} to e2e-leg-6 in e2e.yml

roypaulin · 2025-01-29T18:38:42Z

api/v1/verticadb_types.go

+	HTTPSTLSSecret string `json:"httpsTLSSecret,omitempty"`
+
+	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors="urn:alm:descriptor:com.tectonic.ui:hidden"
+	// +kubebuilder:default:=""
+	// +kubebuilder:validation:Optional
+	// A secret that contains the TLS credentials to be used by Vertica's client
+	// (vsql). If this is empty, the operator will create a secret to use and add
+	// the name of the generate secret to this field.
+	// When set, the secret must have the following keys defined: tls.key,
+	// tls.crt and ca.crt.  To store this secret outside of Kubernetes, you can
+	// use a secret path reference prefix, such as gsm://. Everything after the
+	// prefix is the name of the secret in the service you are storing.
+	ClientTLSSecret string `json:"clientTLSSecret,omitempty"`


How is this going to work?

This secret ClientTLSSecret stores the TLS cert. After the DB is created, we will use the new DDL (added by Fen) to let Vertica server load the certificate directly from the secret. Vertica Server will use the this certificate when vsql connects to it.

roypaulin · 2025-01-29T18:46:16Z

pkg/controllers/vdb/nmaservercertgen_reconciler.go

There is a lot of code duplication with tlsservercertgen_reconciler.

yes, I've resolved the duplicated code.

roypaulin · 2025-01-29T18:47:09Z

pkg/controllers/vdb/verticadb_controller.go

@@ -185,7 +185,11 @@ func (r *VerticaDBReconciler) constructActors(log logr.Logger, vdb *vapi.Vertica
 		// of the operator.
 		MakeUpgradeOperatorReconciler(r, log, vdb),
 		// Create a TLS secret for the NMA service
-		MakeHTTPServerCertGenReconciler(r, log, vdb),
+		MakeNMACertGenReconciler(r, log, vdb),
+		// use the same TLS secret used by the NMA service for https service


I thought you added a new secret for http service

Originally we only had 'http' which was used for NMA.
Now we will have separate certificates for NMA, Https, Client.
So here, I renamed http to NMA.

roypaulin · 2025-01-29T18:47:45Z

pkg/builder/builder.go

 	volMnts := []corev1.VolumeMount{
 		buildScrutinizeSharedVolumeMount(vscr),
 	}
-
-	if vmeta.UseNMACertsMount(vdb.Annotations) &&


Why can't we no longer mount nma certs?

OpenText's new security policy does not allow the certificates to be stored on hard drives.
Previously, we offered volume mount and environmental variables to pass the certificate to NMA.
Now we no longer support volume mount. We still support environment variables. But the
environment variables are mapped from a config map. When users try to rotate NMA cert, they
need to update the configmap with new cert secret name and restart NMA.

roypaulin · 2025-01-29T18:52:13Z

pkg/controllers/vdb/tlscertconfigmapgen_reconciler.go

+		h.Log.Info("not all tls secret names are ready. wait for them to be created")
+		return false
+	}
+	found, err := vapi.IsK8sSecretFound(ctx, h.Vdb, h.VRec.Client, &h.Vdb.Spec.NMATLSSecret)


I don't think you need err given that found will always be false when err != nil

Good catch. I added logging for err.

roypaulin · 2025-01-29T18:54:16Z

@cchen-vertica there is a lot of things I don't understand about these changes. Can you add your comments? Can we also have a discussion tomorrow so you can explain what we are doing.

LiboYu2 · 2025-01-29T19:22:18Z

@cchen-vertica there is a lot of things I don't understand about these changes. Can you add your comments? Can we also have a discussion tomorrow so you can explain what we are doing.

I will update it. You'd better wait until it is updated.

cchen-vertica

You need to add two changie logs: 1. added fields ... 2. removed cert mount for NMA container.

cchen-vertica · 2025-02-03T20:26:59Z

api/v1/verticadb_types.go

+	// +kubebuilder:default:=""
+	// +kubebuilder:validation:Optional
+	// A secret that contains the TLS credentials to be used by Vertica's embedded
+	// http service. If this is empty, the operator will create a secret to use


Modify "http" to "https". We should comment out or hide this field for now. The reason is : if the user specifies different secrets for "HTTPSTLSSecret" and "NMATLSSecret", vclusterOps will reject the request.

It is removed. Lint does not allow commenting out code.

cchen-vertica · 2025-02-03T20:34:16Z

api/v1/verticadb_types.go

+	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors="urn:alm:descriptor:com.tectonic.ui:hidden"
+	// +kubebuilder:default:=""
+	// +kubebuilder:validation:Optional
+	// A secret that contains the TLS credentials to be used by Vertica's client


change it to "... to be used to authenticate Vertica clients' certificates".

In addition, we should rename "ClientTLSSecret" to "ServerTLSSecret" or "ClientServerTLSSecret". Also, we need to add one more field "ServerTLSMode" or "ClientServerTLSMode" to configure TLS mode in the server.

"ClientServerTLSMode" and "ClientServerTLSSecret" will be used.

cchen-vertica · 2025-02-03T20:43:49Z

pkg/builder/builder_test.go

@@ -555,65 +555,6 @@ var _ = Describe("builder", func() {
 		}
 	})

-	It("should mount or not mount NMA certs volume based on NMA container", func() {


Can we have a test to verify the ENV var are coming from the config map?

Are we able to add this kind of unit test?

I don't think that is doable in unit tests as the ENV var is in nma container env. I already have that covered in e2e tests.

You should have a unit test to verify your config map is having the correct data. That is for verifying your new function BuildNMATLSConfigMap().

cchen-vertica · 2025-02-03T20:45:10Z

pkg/controllers/vdb/nmacertconfigmapgen_reconciler.go

+)
+
+// NMACertGenReconciler will create a secret that has TLS credentials.  This
+// secret will be used to authenticate with the http server.


Update "http" to "https" in this file

This needs to be done.

cchen-vertica · 2025-02-03T20:54:23Z

pkg/controllers/vdb/tlsservercertgen_reconciler.go

+	if err != nil {
+		return ctrl.Result{}, err
+	}
+	h.Log.Info("created certificate and secret for https service")


Use secretFieldName to replace "https service".

cchen-vertica · 2025-02-03T20:55:44Z

pkg/controllers/vdb/tlsservercertgen_reconciler.go

+// Reconcile will create a TLS secret for the http server if one is missing
+func (h *TLSServerCertGenReconciler) Reconcile(ctx context.Context, _ *ctrl.Request) (ctrl.Result, error) {
+	secretFieldNameMap := map[string]string{
+		HTTPSTLSSecret:  h.Vdb.Spec.HTTPSTLSSecret,


When HTTPSTLSSecret is not specified in the vdb, we should use NMATLSSecret, not need to generate another one.

cchen-vertica · 2025-02-03T20:57:48Z

pkg/controllers/vdb/tlsservercertgen_reconciler.go

+
+// reconcileOneSecret will create a TLS secret for the http server if one is missing
+func (h *TLSServerCertGenReconciler) reconcileOneSecret(secretFieldName, secretName string,
+	ctx context.Context) (ctrl.Result, error) { //nolint:unparam


Why disabling "unparam" lint here? We should check if the parameters are set reasonable.

Here is the error I got after enabling it. Any idea about how to get rid of it?

pkg/controllers/vdb/tlsservercertgen_reconciler.go:76:24: (*TLSServerCertGenReconciler).reconcileOneSecret - result 0 (sigs.k8s.io/controller-runtime/pkg/reconcile.Result) is always nil (unparam)
ctx context.Context) (ctrl.Result, error) {
^

This error occurs because your function can only return "ctrl.Result{}" and an error. You need to remove your first returned value.

Good point!

cchen-vertica · 2025-02-03T21:00:25Z

tests/e2e-leg-9/tls-certs-config/17-assert.yaml

+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nma-tls-config


We should be able to verify the data in the config map as well.

cchen-vertica · 2025-02-03T21:01:19Z

tests/e2e-leg-9/tls-certs-config/45-verify-nam-tls-certs-env.yaml

@@ -14,5 +14,6 @@
 apiVersion: kuttl.dev/v1beta2
 kind: TestStep
 commands:
-  # nma certs volume mount path should not exist.
-  - command: kubectl exec -n $NAMESPACE v-nma-certs-sc1-0 -- bash -c "! test -d /certs/nma"
+  # nma env variable should exist.


Let's also verify if the env variable value matches the value we set.

cchen-vertica · 2025-02-03T21:02:34Z

tests/e2e-leg-9/tls-certs-config/setup-vdb/base/setup-vdb.yaml

  annotations:
    vertica.com/vcluster-ops: "true"
-    vertica.com/mount-nma-certs: "false"
 spec:
  initPolicy: CreateSkipPackageInstall
  image: kustomize-vertica-image


We could set the field "NMATLSSecret" here, and verify if the customized value equal to the one in the environment variable.

roypaulin · 2025-02-03T21:27:03Z

pkg/controllers/vdb/nmacertconfigmapgen_reconciler.go

+	return &NMACertConfigMapGenReconciler{
+		VRec: vdbrecon,
+		Vdb:  vdb,
+		Log:  log.WithName("TLSCertConfigMapGenReconciler"),


Suggested change

Log: log.WithName("TLSCertConfigMapGenReconciler"),

Log: log.WithName("NMACertConfigMapGenReconciler"),

roypaulin · 2025-02-03T21:28:21Z

pkg/controllers/vdb/nmacertconfigmapgen_reconciler.go

+}
+
+// buildTLSConfigMap return a ConfigMap. Key is the json file name and value is the json file content
+func (h *NMACertConfigMapGenReconciler) buildTLSConfigMap(vdb *vapi.VerticaDB) *corev1.ConfigMap {


Move this to builder.go

roypaulin · 2025-02-03T21:35:15Z

pkg/controllers/vdb/tlsservercertgen_reconciler.go

There is still a lot of code duplication with nmaservertgen_reconciler: the 2 secrets are quite similar so must of the code can be reused. May be you can move it to a separate package and reuse the code. The secrets have the same structure so there is no reason why we cannot reuse the same logic to construct both.

Good observation. I almost forgot that. It is pretty easy to use tlsservertgen_reconciler for nma.

This is still not address. I see functions like getDNSName(), createSecret(), setSecretNameInVDB() in both files. Also reconcileOneSecret() code is similar to (h *NMACertGenReconciler) Reconcile(). Move those logics to a separate file (ex k8s.go in the same package) and use the functions in the 2 files. The 2 reconcilers do the same thing for different secret so a lot of code can be reuse in both. Please address this!!!

NMACertGenReconciler is removed. No duplicates any more.

cchen-vertica · 2025-02-04T15:25:48Z

tests/e2e-leg-9/tls-certs-config/35-kill-sts.yaml

We need to add another test that only kill NMA containers without shutting down the database.

cchen-vertica · 2025-02-06T21:23:10Z

api/v1/verticadb_types.go

+	// +kubebuilder:default:=""
+	// +kubebuilder:validation:Optional
+	// A secret that contains the TLS credentials to be used to authenticate Vertica clients' certificates
+	// (vsql). If this is empty, the operator will create a secret to use and add


remove "(vsql)"

cchen-vertica · 2025-02-06T21:25:34Z

api/v1/verticadb_types.go

+	// +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors="urn:alm:descriptor:com.tectonic.ui:hidden"
+	// +kubebuilder:default:=verify_ca
+	// +kubebuilder:validation:Optional
+	ClientServerTLSMode string `json:"clientServerTLSMode,omitempty"`


Write a description of this field and list all its supported values. The default value should be "try_verify".

cchen-vertica · 2025-02-06T21:27:52Z

api/v1/verticadb_webhook.go

+			}
+		}
+		if !validMode {
+			err := field.Invalid(field.NewPath("spec").Child("clientservertlssecret"), v.Spec.ClientServerTLSMode, "invalid tls mode")


Use camel case for "clientservertlssecret" - "clientSeverTLSSecret"

cchen-vertica · 2025-02-06T21:31:04Z

changes/unreleased/Changed-20250204-162421.yaml

@@ -0,0 +1,5 @@
+kind: Changed


This should be "Removed". Before NMATLSSecret supported both mount and unmount options, and now NMATLSSecret only supported unmount option, right?

cchen-vertica · 2025-02-06T21:31:49Z

changes/unreleased/Added-20250204-161432.yaml

+body: ClientServerTLSSecret has been added to Vertica DB definition. It contains the TLS credentials to authenticate Vertica clients' certificates (vsql)
+time: 2025-02-04T16:14:32.906578043-05:00
+custom:
+    Issue: "99110"


The issue number should be "1041"

cchen-vertica · 2025-02-06T21:38:33Z

pkg/controllers/vdb/tlsservercertgen_reconciler.go

+
+// reconcileOneSecret will create a TLS secret for the http server if one is missing
+func (h *TLSServerCertGenReconciler) reconcileOneSecret(secretFieldName, secretName string,
+	ctx context.Context) (ctrl.Result, error) { //nolint:unparam


This error occurs because your function can only return "ctrl.Result{}" and an error. You need to remove your first returned value.

cchen-vertica · 2025-02-06T22:27:23Z

tests/e2e-leg-9/nma-user-cert-config/17-assert.yaml

+kind: VerticaDB
+metadata:
+  name: v-tls-certs
+status:


verify nmaTLSSecret here as well

cchen-vertica · 2025-02-06T22:29:00Z

tests/e2e-leg-9/nma-user-cert-config/25-verify-nma-tls-certs-env.yaml

-  # nma certs volume mount path should exist.
-  - command: kubectl exec -n $NAMESPACE v-nma-certs-sc1-0 -- bash -c "test -d /certs/nma"
+  # nma env variable should exist.
+  - command: kubectl exec -n $NAMESPACE v-tls-certs-sc1-0 -c nma -- bash -c "env | grep nma-tls-cert-secret"


We should verify two env vars equal the target value, e.g. secretName=nma-tls-cert-secret,namespace=$NAMESPACE

I tried that. It is not possible to pass a pod environmental variable. Kuttl assumes all environmental variables are from its test environment.

But you can execute inside the pod and print out its value, right? Here you already can access "env".
Do something like:
k exec -it v-base-upgrade-pri1-0 -c nma -- sh -c '[ "$SECRET_NAME" = "nma-tls-cert-secret" ] || { echo "Mismatch"; exit 1; }'

cchen-vertica · 2025-02-06T22:30:22Z

tests/e2e-leg-9/nma-user-cert-config/45-verify-nma-tls-certs-env.yaml

+kind: TestStep
+commands:
+  # nma env variable should exist.
+  - command: kubectl exec -n $NAMESPACE v-tls-certs-sc1-0 -c nma -- bash -c "env | grep nma-tls-cert-secret"


We should add a couple of extra steps to verify when you change the nmaTLSSecret to another one, the config map and env vars of nma will be updated as well.

That is a good point. I will add that.

I added the steps and found a bug in the code. Fixed the bug.

Where are the steps you added? I cannot see them in this test suite.

cchen-vertica · 2025-02-06T22:32:00Z

tests/e2e-leg-9/nma-user-cert-config/setup-vdb/base/nma-tls-cert.json

+{
+  "apiVersion": "v1",
+  "data": {
+    "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lSQUp2bWl1b1BPNnFCeEFLbmtHMFp3NkV3RFFZSktvWklodmNOQVFFTEJRQXcKR2pFWU1CWUdBMVVFQXhNUGF6aHpMblpsY25ScFkyRXVZMjl0TUI0WERUSTBNVEl3T1RFM01UUTBORm9YRFRJMQpNRE13T1RFM01UUTBORm93R2pFWU1CWUdBMVVFQXhNUGF6aHpMblpsY25ScFkyRXVZMjl0TUlJQklqQU5CZ2txCmhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBdmlidlhhbkVYY004Z3EzazFhayt5N0I2VnB5Q2pkeWUKaVhEVmZTQUZVdWlpcE1VVFJ0cDRPQWs3TFh2Y2lVc3lsUk5NT3FYdGxXTUJXZEpXZkl3S2owc2hEYVhsRTkzWQprOFBEY0JPN1FGRHVLVWRUSldHbmVkQ0ZrSGlBUEJJSlRlRFQ2Q1ZEZDFhbDdrdGtmbzhxaXBLS2s2QXZ6c3VjCkxPUk81QWo4bzFqWWkySkZxYytKTjgrZFhDWERYczRMM2oxNWZaUUlrakg1ODdPMDNGcVpxZzlRa0tVTHlZdmoKOHllZ0N4UWlzdW94SjN5bVJwa21xamRqdnlVQUlTT3EyYThremhDcjBGSUhHcEk5eU1TM0RsTnVLMlJDZFNiUwpROSs2RG1VNjlUZEN6RWVLVktSeGFsK3A1UEREMHlVMzZiQ3VyVVN4eXpSaG0zZGxDNm5LTlFJREFRQUJvMFl3ClJEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0RBWURWUjBUQVFIL0JBSXdBREFrQmdOVkhSRUVIVEFiZ2dWdGFXNXAKYjRJU2JXbHVhVzh1YTNWMGRHd3RaVEpsTFhNek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQm53RFJJMUoyaApqV0lNYnJnSWhyTFVDREt2STFvN1NBRXJ4ME9BL0U0YlZSMGZnZVpZQ005UURpM21HY1Zvc1N6QlNtcEJaTHBpCjVsL1Zwc051Q1c4ZkR5UzJaeC9ybXlUMzV2RVc4dGN2aFhEeGV0RXYvTTJLRkZYVWV5TDNrQ21xTTAwcjFybmYKZG9OQUxIcCsyS3B5RDlJZ3lQdHU3NFp2SGNYWFp3SjdONlczU0k4c0E0S0NzOTNLNXRnSWVoZlFMbmFEektGYQpEU3EzN1VBclkzVU5OWlJGdnVtbXc2WmFjMG5mdTF2Q2J3bmc1cXlyaDE0TUFLcGlhMGlPcXp6aVpPVlNUSkY4CmdoajZiSnd1OG5UVVhZaU1aaGdTbno5N29IWFVBOHR1SVRMU2tmMVBUNGkxeUtCbFVDOGhLWWZhb0JDTXNVYVMKTkJyQmFsaUorZGNMCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K",


Just use K8s "kind: Certificate". Refer to "tests/e2e-leg-5/metrics-auth-cert/04-create-cert.yaml"

I copied the json from ./kustomize-base/communal-ep-cert.json. I added its name to the vdb in setup-vdb.yaml.

Basically, I don't want the certs to be directly list in the code. Some security check will report this expose. As you can see, ./kustomize-base/communal-ep-cert.json is not in our repo. It will only be generated in your local env.

cchen-vertica · 2025-02-07T21:12:05Z

changes/unreleased/Added-20250204-161432.yaml

@@ -0,0 +1,5 @@
+kind: Added
+body: ClientServerTLSSecret has been added to Vertica DB definition. It contains the TLS credentials to authenticate Vertica clients' certificates (vsql)


Remove "(vsql)" since we have other types of clients.

cchen-vertica · 2025-02-07T21:17:27Z

pkg/builder/builder_test.go

@@ -555,65 +555,6 @@ var _ = Describe("builder", func() {
 		}
 	})

-	It("should mount or not mount NMA certs volume based on NMA container", func() {


You should have a unit test to verify your config map is having the correct data. That is for verifying your new function BuildNMATLSConfigMap().

cchen-vertica · 2025-02-07T21:18:13Z

pkg/controllers/vdb/nmacertconfigmapgen_reconciler.go

+)
+
+// NMACertGenReconciler will create a secret that has TLS credentials.  This
+// secret will be used to authenticate with the http server.


This needs to be done.

cchen-vertica · 2025-02-07T21:20:02Z

pkg/controllers/vdb/nmacertconfigmapgen_reconciler.go

+func (h *NMACertConfigMapGenReconciler) Reconcile(ctx context.Context, _ *ctrl.Request) (ctrl.Result, error) {
+	nmaSecret := corev1.Secret{}
+	if !h.tlsSecretsReady(ctx, &nmaSecret) {
+		return ctrl.Result{Requeue: true}, nil


Add a log here to show why we requeue the reconciler.

cchen-vertica · 2025-02-07T21:35:59Z

tests/e2e-leg-9/nma-user-cert-config/25-verify-nma-tls-certs-env.yaml

-  # nma certs volume mount path should exist.
-  - command: kubectl exec -n $NAMESPACE v-nma-certs-sc1-0 -- bash -c "test -d /certs/nma"
+  # nma env variable should exist.
+  - command: kubectl exec -n $NAMESPACE v-tls-certs-sc1-0 -c nma -- bash -c "env | grep nma-tls-cert-secret"


But you can execute inside the pod and print out its value, right? Here you already can access "env".
Do something like:
k exec -it v-base-upgrade-pri1-0 -c nma -- sh -c '[ "$SECRET_NAME" = "nma-tls-cert-secret" ] || { echo "Mismatch"; exit 1; }'

cchen-vertica · 2025-02-07T21:39:11Z

tests/e2e-leg-9/nma-user-cert-config/45-verify-nma-tls-certs-env.yaml

+kind: TestStep
+commands:
+  # nma env variable should exist.
+  - command: kubectl exec -n $NAMESPACE v-tls-certs-sc1-0 -c nma -- bash -c "env | grep nma-tls-cert-secret"


Where are the steps you added? I cannot see them in this test suite.

cchen-vertica · 2025-02-07T21:44:30Z

tests/e2e-leg-9/nma-user-cert-config/setup-vdb/base/nma-tls-cert.json

+{
+  "apiVersion": "v1",
+  "data": {
+    "ca.crt": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lSQUp2bWl1b1BPNnFCeEFLbmtHMFp3NkV3RFFZSktvWklodmNOQVFFTEJRQXcKR2pFWU1CWUdBMVVFQXhNUGF6aHpMblpsY25ScFkyRXVZMjl0TUI0WERUSTBNVEl3T1RFM01UUTBORm9YRFRJMQpNRE13T1RFM01UUTBORm93R2pFWU1CWUdBMVVFQXhNUGF6aHpMblpsY25ScFkyRXVZMjl0TUlJQklqQU5CZ2txCmhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBdmlidlhhbkVYY004Z3EzazFhayt5N0I2VnB5Q2pkeWUKaVhEVmZTQUZVdWlpcE1VVFJ0cDRPQWs3TFh2Y2lVc3lsUk5NT3FYdGxXTUJXZEpXZkl3S2owc2hEYVhsRTkzWQprOFBEY0JPN1FGRHVLVWRUSldHbmVkQ0ZrSGlBUEJJSlRlRFQ2Q1ZEZDFhbDdrdGtmbzhxaXBLS2s2QXZ6c3VjCkxPUk81QWo4bzFqWWkySkZxYytKTjgrZFhDWERYczRMM2oxNWZaUUlrakg1ODdPMDNGcVpxZzlRa0tVTHlZdmoKOHllZ0N4UWlzdW94SjN5bVJwa21xamRqdnlVQUlTT3EyYThremhDcjBGSUhHcEk5eU1TM0RsTnVLMlJDZFNiUwpROSs2RG1VNjlUZEN6RWVLVktSeGFsK3A1UEREMHlVMzZiQ3VyVVN4eXpSaG0zZGxDNm5LTlFJREFRQUJvMFl3ClJEQU9CZ05WSFE4QkFmOEVCQU1DQmFBd0RBWURWUjBUQVFIL0JBSXdBREFrQmdOVkhSRUVIVEFiZ2dWdGFXNXAKYjRJU2JXbHVhVzh1YTNWMGRHd3RaVEpsTFhNek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQm53RFJJMUoyaApqV0lNYnJnSWhyTFVDREt2STFvN1NBRXJ4ME9BL0U0YlZSMGZnZVpZQ005UURpM21HY1Zvc1N6QlNtcEJaTHBpCjVsL1Zwc051Q1c4ZkR5UzJaeC9ybXlUMzV2RVc4dGN2aFhEeGV0RXYvTTJLRkZYVWV5TDNrQ21xTTAwcjFybmYKZG9OQUxIcCsyS3B5RDlJZ3lQdHU3NFp2SGNYWFp3SjdONlczU0k4c0E0S0NzOTNLNXRnSWVoZlFMbmFEektGYQpEU3EzN1VBclkzVU5OWlJGdnVtbXc2WmFjMG5mdTF2Q2J3bmc1cXlyaDE0TUFLcGlhMGlPcXp6aVpPVlNUSkY4CmdoajZiSnd1OG5UVVhZaU1aaGdTbno5N29IWFVBOHR1SVRMU2tmMVBUNGkxeUtCbFVDOGhLWWZhb0JDTXNVYVMKTkJyQmFsaUorZGNMCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K",


Basically, I don't want the certs to be directly list in the code. Some security check will report this expose. As you can see, ./kustomize-base/communal-ep-cert.json is not in our repo. It will only be generated in your local env.

roypaulin reviewed Jan 29, 2025

View reviewed changes

cchen-vertica reviewed Feb 3, 2025

View reviewed changes

roypaulin reviewed Feb 3, 2025

View reviewed changes

cchen-vertica reviewed Feb 4, 2025

View reviewed changes

cchen-vertica reviewed Feb 6, 2025

View reviewed changes

LiboYu2 added 22 commits February 7, 2025 14:58

add 2 new fields and rename 2 files. compile ok

5c53c06

https and client reconcilers added. compile ok

b081f50

ready to test

8887931

basic creating secrets scenario works

ff700d9

refactoring

488aced

remove nma cert mount option

1fc33b0

add basic e2e test

92c206b

better verification

3f4528a

address gocritic errors

f046aa7

fix a couple of new code format issues

a424f56

use a single reconciler for both

1a36312

address lint issues

6830710

address lint concerns

6af698c

disable lint for false positive

07f68be

change ready, test to be added

864aeb8

add missing env names

dd42283

updated e2e test case

92d6368

add logging for err from searching for secret

c0f07a7

move tls-certs-config to leg 9

b497925

remove https secret field and tls mode

cf2917d

address PR comments

7e310ad

test case works

b03ae8e

LiboYu2 added 8 commits February 7, 2025 15:01

rename test case

76d0312

a new test case for generated cert

8ba46d9

add changie logs

c299358

restart nma instead of restarting sts

bed125b

removed duplicate file and fix unit tests

30cf8cf

addressed PR comments

a1c9638

fix configmap update issue

207b52e

fix assert step

3085e52

LiboYu2 force-pushed the VER-99110 branch from f5dc049 to 3085e52 Compare February 7, 2025 20:38

fix lint complain

640137e

cchen-vertica reviewed Feb 7, 2025

View reviewed changes

	Log: log.WithName("TLSCertConfigMapGenReconciler"),
	Log: log.WithName("NMACertConfigMapGenReconciler"),

		@@ -0,0 +1,5 @@
		kind: Added
		body: ClientServerTLSSecret has been added to Vertica DB definition. It contains the TLS credentials to authenticate Vertica clients' certificates (vsql)

Ver 99110 allow users to specify tls certis for https server and client-server authentication #1041

Are you sure you want to change the base?

Ver 99110 allow users to specify tls certis for https server and client-server authentication #1041

Conversation

LiboYu2 commented Jan 25, 2025

roypaulin commented Jan 28, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

roypaulin commented Jan 29, 2025

LiboYu2 commented Jan 29, 2025

cchen-vertica left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

LiboYu2 Feb 7, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

LiboYu2 Feb 7, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

LiboYu2 Feb 7, 2025 •

edited

Loading

LiboYu2 Feb 7, 2025 •

edited

Loading