Skip to content

Add TLS certificate for InstanceHA metrics endpoint #1932

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lmiccini wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add TLS certificate for InstanceHA metrics endpoint #1932

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions api/core/v1beta1/conditions.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,9 @@ const (
// OpenStackControlPlaneInstanceHaCMReadyCondition Status=True condition which indicates if InstanceHa CM is ready
OpenStackControlPlaneInstanceHaCMReadyCondition condition.Type = "OpenStackControlPlaneInstanceHaCMReadyCondition"

// OpenStackControlPlaneInstanceHaTLSReadyCondition Status=True condition which indicates if InstanceHa TLS certificate is ready
OpenStackControlPlaneInstanceHaTLSReadyCondition condition.Type = "OpenStackControlPlaneInstanceHaTLSReadyCondition"

// OpenStackControlPlaneCertCleanupReadyCondition Status=True condition which indicates global certification cleanup is Ready
OpenStackControlPlaneCertCleanupReadyCondition condition.Type = "OpenStackControlPlaneCertCleanupReadyCondition"

Expand Down Expand Up @@ -492,6 +495,12 @@ const (
// OpenStackControlPlaneInstanceHaCMReadyMessage
OpenStackControlPlaneInstanceHaCMReadyMessage = "OpenStackControlPlane InstanceHa CM is available"

// OpenStackControlPlaneInstanceHaTLSReadyErrorMessage
OpenStackControlPlaneInstanceHaTLSReadyErrorMessage = "OpenStackControlPlane InstanceHa TLS cert error occured %s"

// OpenStackControlPlaneInstanceHaTLSReadyMessage
OpenStackControlPlaneInstanceHaTLSReadyMessage = "OpenStackControlPlane InstanceHa TLS cert is available"

// OpenStackControlPlaneOpenStackVersionInitializationReadyInitMessage
OpenStackControlPlaneOpenStackVersionInitializationReadyInitMessage = "OpenStackControlPlane OpenStackVersion initialization not started"

Expand Down
69 changes: 69 additions & 0 deletions internal/openstack/instanceha.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,11 @@ package openstack

import (
"context"
"fmt"

certmgrv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
"github.com/openstack-k8s-operators/lib-common/modules/certmanager"
"github.com/openstack-k8s-operators/lib-common/modules/common/clusterdns"
"github.com/openstack-k8s-operators/lib-common/modules/common/condition"
"github.com/openstack-k8s-operators/lib-common/modules/common/configmap"
"github.com/openstack-k8s-operators/lib-common/modules/common/helper"
Expand All @@ -21,6 +25,26 @@ const (

// ReconcileInstanceHa reconciles the instance HA configuration for the OpenStack control plane
func ReconcileInstanceHa(ctx context.Context, instance *corev1beta1.OpenStackControlPlane, version *corev1beta1.OpenStackVersion, helper *helper.Helper) (ctrl.Result, error) {
Log := GetLogger(ctx)

if instance.Spec.TLS.PodLevel.Enabled {
_, err := EnsureInstanceHAMetricsCert(ctx, instance, helper)
if err != nil {
Log.Error(err, "Failed to ensure InstanceHA metrics certificate")
instance.Status.Conditions.Set(condition.FalseCondition(
corev1beta1.OpenStackControlPlaneInstanceHaTLSReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
corev1beta1.OpenStackControlPlaneInstanceHaTLSReadyErrorMessage,
err.Error()))
return ctrl.Result{}, err
}
instance.Status.Conditions.Set(condition.TrueCondition(
Copy link
Copy Markdown
Contributor

@fmount fmount May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lmiccini are these conditions initialized somewhere to Unknown? Maybe it doesn't matter as they're not part of the main condition pool.

Copy link
Copy Markdown
Contributor Author

@lmiccini lmiccini May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no they are not, they're just cosmetic and set during reconcile to signal stuff is ready or not

corev1beta1.OpenStackControlPlaneInstanceHaTLSReadyCondition,
corev1beta1.OpenStackControlPlaneInstanceHaTLSReadyMessage,
))
}

customData := map[string]string{
InstanceHaImageKey: *getImg(version.Status.ContainerImages.OpenstackClientImage, &missingImageDefault),
}
Expand Down Expand Up @@ -54,3 +78,48 @@ func ReconcileInstanceHa(ctx context.Context, instance *corev1beta1.OpenStackCon

return ctrl.Result{}, nil
}

// EnsureInstanceHAMetricsCert creates a TLS certificate for InstanceHA metrics services
func EnsureInstanceHAMetricsCert(ctx context.Context, instance *corev1beta1.OpenStackControlPlane, helper *helper.Helper) (string, error) {
Log := GetLogger(ctx)

dnsSuffix := clusterdns.GetDNSClusterDomain()

certRequest := certmanager.CertificateRequest{
IssuerName: instance.GetInternalIssuer(),
CertName: "instanceha-metrics",
Hostnames: []string{
fmt.Sprintf("*.%s.svc", instance.Namespace),
fmt.Sprintf("*.%s.svc.%s", instance.Namespace, dnsSuffix),
},
Ips: nil,
Usages: []certmgrv1.KeyUsage{
certmgrv1.UsageKeyEncipherment,
certmgrv1.UsageDigitalSignature,
certmgrv1.UsageServerAuth,
},
Labels: map[string]string{ServiceCertSelector: ""},
}

if instance.Spec.TLS.PodLevel.Internal.Cert.Duration != nil {
certRequest.Duration = &instance.Spec.TLS.PodLevel.Internal.Cert.Duration.Duration
}
if instance.Spec.TLS.PodLevel.Internal.Cert.RenewBefore != nil {
certRequest.RenewBefore = &instance.Spec.TLS.PodLevel.Internal.Cert.RenewBefore.Duration
}

certSecret, ctrlResult, err := certmanager.EnsureCert(
ctx,
helper,
certRequest,
nil)
if err != nil {
return "", err
} else if (ctrlResult != ctrl.Result{}) {
Log.Info("InstanceHA metrics certificate creation in progress", "certificate", certRequest.CertName)
return "", fmt.Errorf("InstanceHA metrics certificate creation in progress")
}

Log.Info("InstanceHA metrics certificate ensured", "secret", certSecret.Name, "certificate", certRequest.CertName)
return certSecret.Name, nil
}
5 changes: 5 additions & 0 deletions test/functional/ctlplane/base_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,7 @@ type Names struct {
OVNDbServerNBName types.NamespacedName
OVNDbServerSBName types.NamespacedName
OVNMetricsCertName types.NamespacedName
InstanceHAMetricsCertName types.NamespacedName
NeutronOVNCertName types.NamespacedName
OpenStackTopology []types.NamespacedName
WatcherCertPublicRouteName types.NamespacedName
Expand Down Expand Up @@ -291,6 +292,10 @@ func CreateNames(openstackControlplaneName types.NamespacedName) Names {
Namespace: openstackControlplaneName.Namespace,
Name: "cert-ovn-metrics",
},
InstanceHAMetricsCertName: types.NamespacedName{
Namespace: openstackControlplaneName.Namespace,
Name: "cert-instanceha-metrics",
},
NeutronOVNCertName: types.NamespacedName{
Namespace: openstackControlplaneName.Namespace,
Name: "cert-neutron-ovndbs",
Expand Down
8 changes: 8 additions & 0 deletions test/functional/ctlplane/openstackoperator_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -937,6 +937,7 @@ var _ = Describe("OpenStackOperator controller", func() {
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNNorthdCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNControllerCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.InstanceHAMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.NeutronOVNCertName))
DeferCleanup(
th.DeleteInstance,
Expand Down Expand Up @@ -1259,6 +1260,7 @@ var _ = Describe("OpenStackOperator controller", func() {
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNNorthdCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNControllerCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.InstanceHAMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.NeutronOVNCertName))
spec := GetDefaultOpenStackControlPlaneSpec()
spec["tls"] = GetTLSeCustomIssuerSpec()
Expand Down Expand Up @@ -1388,6 +1390,7 @@ var _ = Describe("OpenStackOperator controller", func() {
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNNorthdCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNControllerCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.InstanceHAMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.NeutronOVNCertName))

DeferCleanup(k8sClient.Delete, ctx,
Expand Down Expand Up @@ -2083,6 +2086,7 @@ var _ = Describe("OpenStackOperator controller", func() {
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNNorthdCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNControllerCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.InstanceHAMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.NeutronOVNCertName))

DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.WatcherCertPublicRouteName))
Expand Down Expand Up @@ -2273,6 +2277,7 @@ var _ = Describe("OpenStackOperator controller", func() {
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNNorthdCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNControllerCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.InstanceHAMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.NeutronOVNCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.WatcherCertPublicRouteName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.WatcherCertPublicSvcName))
Expand Down Expand Up @@ -2750,6 +2755,7 @@ var _ = Describe("OpenStackOperator controller", func() {
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNNorthdCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNControllerCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.InstanceHAMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.NeutronOVNCertName))

DeferCleanup(
Expand Down Expand Up @@ -2991,6 +2997,7 @@ var _ = Describe("OpenStackOperator controller", func() {
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNNorthdCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNControllerCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.InstanceHAMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.NeutronOVNCertName))
// create cert secret for octavia ovn client
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(types.NamespacedName{Name: "cert-octavia-ovndbs", Namespace: names.Namespace}))
Expand Down Expand Up @@ -4049,6 +4056,7 @@ var _ = Describe("OpenStackOperator controller nova cell deletion", func() {
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNNorthdCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNControllerCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.OVNMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.InstanceHAMetricsCertName))
DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(names.NeutronOVNCertName))

// create cert secrets for memcached instance
Expand Down
4 changes: 4 additions & 0 deletions test/kuttl/common/assert-sample-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,6 +266,10 @@ status:
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaCMReadyCondition
- message: OpenStackControlPlane InstanceHa TLS cert is available
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaTLSReadyCondition
- message: OpenStackControlPlane KeystoneAPI completed
reason: Ready
status: "True"
Expand Down
4 changes: 4 additions & 0 deletions test/kuttl/tests/ctlplane-basic-deployment/03-assert-deploy-custom-cacert.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,10 @@ status:
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaCMReadyCondition
- message: OpenStackControlPlane InstanceHa TLS cert is available
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaTLSReadyCondition
- message: OpenStackControlPlane KeystoneAPI completed
reason: Ready
status: "True"
Expand Down
4 changes: 4 additions & 0 deletions test/kuttl/tests/ctlplane-collapsed/01-assert-collapsed-cell.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -244,6 +244,10 @@ status:
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaCMReadyCondition
- message: OpenStackControlPlane InstanceHa TLS cert is available
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaTLSReadyCondition
- message: OpenStackControlPlane KeystoneAPI completed
reason: Ready
status: "True"
Expand Down
4 changes: 4 additions & 0 deletions test/kuttl/tests/ctlplane-galera-3replicas/01-assert-galera-3replicas.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,10 @@ status:
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaCMReadyCondition
- message: OpenStackControlPlane InstanceHa TLS cert is available
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaTLSReadyCondition
- message: OpenStackControlPlane KeystoneAPI completed
reason: Ready
status: "True"
Expand Down
4 changes: 4 additions & 0 deletions test/kuttl/tests/ctlplane-tls-cert-rotation/03-assert-new-certs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -287,6 +287,10 @@ status:
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaCMReadyCondition
- message: OpenStackControlPlane InstanceHa TLS cert is available
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaTLSReadyCondition
- message: OpenStackControlPlane KeystoneAPI completed
reason: Ready
status: "True"
Expand Down
4 changes: 4 additions & 0 deletions test/kuttl/tests/ctlplane-tls-custom-issuers/01-assert-deploy-openstack.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,6 +252,10 @@ status:
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaCMReadyCondition
- message: OpenStackControlPlane InstanceHa TLS cert is available
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaTLSReadyCondition
- message: OpenStackControlPlane KeystoneAPI completed
reason: Ready
status: "True"
Expand Down
4 changes: 4 additions & 0 deletions test/kuttl/tests/ctlplane-tls-custom-issuers/09-assert-deploy-openstack.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,6 +252,10 @@ status:
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaCMReadyCondition
- message: OpenStackControlPlane InstanceHa TLS cert is available
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaTLSReadyCondition
- message: OpenStackControlPlane KeystoneAPI completed
reason: Ready
status: "True"
Expand Down
4 changes: 4 additions & 0 deletions test/kuttl/tests/ctlplane-tls-custom-route/03-assert-deploy-openstack.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,6 +278,10 @@ status:
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaCMReadyCondition
- message: OpenStackControlPlane InstanceHa TLS cert is available
reason: Ready
status: "True"
type: OpenStackControlPlaneInstanceHaTLSReadyCondition
- message: OpenStackControlPlane KeystoneAPI completed
reason: Ready
status: "True"
Expand Down
Loading