Skip to content

Commit 59b4388

Browse files
AlevskAlevsk
authored
Create Tenant TLS refactor (#450)
- fixed small bug in which RequestAutoCert was not setting properly - support AutoCert and external certificates on Tenant creation
1 parent 219fe55 commit 59b4388

File tree

3 files changed

+55
-49
lines changed

3 files changed

+55
-49
lines changed

‎restapi/admin_tenants.go‎

Lines changed: 45 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -433,6 +433,7 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
433433
tenantReq := params.Body
434434
minioImage := tenantReq.Image
435435
ctx := context.Background()
436+
consoleHasTLS := false
436437

437438
if minioImage == "" {
438439
minImg, err := cluster.GetMinioImage()
@@ -579,19 +580,20 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
579580
}
580581

581582
isEncryptionEnabled := false
582-
if tenantReq.EnableTLS != nil && *tenantReq.EnableTLS {
583-
// If user request autoCert, Operator will generate certificate keypair for MinIO (server), Console (server) and KES (server and app mTLS)
584-
isEncryptionEnabled = true
583+
584+
if tenantReq.EnableTLS != nil {
585+
// if enableTLS is defined in the create tenant request we assign the value
586+
// to the RequestAutoCert attribute in the tenant spec
585587
minInst.Spec.RequestAutoCert = tenantReq.EnableTLS
588+
if *tenantReq.EnableTLS {
589+
// requestAutoCert is enabled, MinIO will be deployed with TLS enabled and encryption can be enabled
590+
isEncryptionEnabled = true
591+
consoleHasTLS = true
592+
}
586593
}
587-
588-
if (minInst.Spec.RequestAutoCert == nil || (minInst.Spec.RequestAutoCert != nil && !*minInst.Spec.RequestAutoCert)) &&
589-
tenantReq.TLS != nil &&
590-
len(tenantReq.TLS.Minio) > 0 {
591-
// User provided TLS certificates for MinIO
594+
// External TLS certificates for MinIO
595+
if tenantReq.TLS != nil && len(tenantReq.TLS.Minio) > 0 {
592596
isEncryptionEnabled = true
593-
// disable autoCert
594-
minInst.Spec.RequestAutoCert = swag.Bool(false)
595597
// Certificates used by the MinIO instance
596598
externalCertSecretName := fmt.Sprintf("%s-instance-external-certificates", secretName)
597599
externalCertSecret, err := createOrReplaceExternalCertSecrets(ctx, &k8sClient, ns, tenantReq.TLS.Minio, externalCertSecretName, tenantName)
@@ -600,15 +602,10 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
600602
}
601603
minInst.Spec.ExternalCertSecret = externalCertSecret
602604
}
603-
605+
// If encryption configuration is present and TLS will be enabled (using AutoCert or External certificates)
604606
if tenantReq.Encryption != nil && isEncryptionEnabled {
605-
// Enable auto encryption
606-
minInst.Spec.Env = append(minInst.Spec.Env, corev1.EnvVar{
607-
Name: "MINIO_KMS_AUTO_ENCRYPTION",
608-
Value: "on",
609-
})
610-
// KES client mTLSCertificates used by MinIO instance, only if autoCert is not enabled
611-
if minInst.Spec.RequestAutoCert == nil || (minInst.Spec.RequestAutoCert != nil && !*minInst.Spec.RequestAutoCert) {
607+
// KES client mTLSCertificates used by MinIO instance
608+
if tenantReq.Encryption.Client != nil {
612609
tenantExternalClientCertSecretName := fmt.Sprintf("%s-tenant-external-client-cert", secretName)
613610
certificates := []*models.KeyPairConfiguration{tenantReq.Encryption.Client}
614611
certificateSecrets, err := createOrReplaceExternalCertSecrets(ctx, &k8sClient, ns, certificates, tenantExternalClientCertSecretName, tenantName)
@@ -619,8 +616,9 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
619616
minInst.Spec.ExternalClientCertSecret = certificateSecrets[0]
620617
}
621618
}
619+
622620
// KES configuration for Tenant instance
623-
minInst.Spec.KES, err = getKESConfiguration(ctx, &k8sClient, ns, tenantReq.Encryption, secretName, tenantName, minInst.Spec.RequestAutoCert)
621+
minInst.Spec.KES, err = getKESConfiguration(ctx, &k8sClient, ns, tenantReq.Encryption, secretName, tenantName)
624622
if err != nil {
625623
return nil, prepareError(errorGeneric)
626624
}
@@ -661,7 +659,32 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
661659
},
662660
}
663661

664-
// Enable IDP (Open ID Connect) for console
662+
minInst.Spec.Console = &operator.ConsoleConfiguration{
663+
Replicas: 1,
664+
Image: ConsoleImageVersion,
665+
ConsoleSecret: &corev1.LocalObjectReference{Name: consoleSecretName},
666+
Resources: corev1.ResourceRequirements{
667+
Requests: map[corev1.ResourceName]resource.Quantity{
668+
"memory": resource.MustParse("64Mi"),
669+
},
670+
},
671+
}
672+
if tenantReq.TLS != nil && tenantReq.TLS.Console != nil {
673+
consoleHasTLS = true
674+
// Certificates used by the console instance
675+
externalCertSecretName := fmt.Sprintf("%s-console-external-certificates", secretName)
676+
certificates := []*models.KeyPairConfiguration{tenantReq.TLS.Console}
677+
externalCertSecret, err := createOrReplaceExternalCertSecrets(ctx, &k8sClient, ns, certificates, externalCertSecretName, tenantName)
678+
if err != nil {
679+
return nil, prepareError(errorGeneric)
680+
}
681+
if len(externalCertSecret) > 0 {
682+
minInst.Spec.Console.ExternalCertSecret = externalCertSecret[0]
683+
}
684+
}
685+
686+
// If IDP is not already enabled via LDAP (Active Directory) and OIDC configuration is present then
687+
// enable oidc for console
665688
if !idpEnabled && tenantReq.Idp != nil && tenantReq.Idp.Oidc != nil {
666689
url := *tenantReq.Idp.Oidc.URL
667690
clientID := *tenantReq.Idp.Oidc.ClientID
@@ -672,7 +695,8 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
672695
instanceSecret.Data["CONSOLE_IDP_SECRET"] = []byte(secretID)
673696
consoleScheme := "http"
674697
consolePort := 9090
675-
if minInst.Spec.RequestAutoCert != nil && *minInst.Spec.RequestAutoCert {
698+
// If Console will be deployed with TLS enabled (using AutoCert or External certificates)
699+
if consoleHasTLS {
676700
consoleScheme = "https"
677701
consolePort = 9443
678702
}
@@ -687,30 +711,6 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
687711
return nil, prepareError(errorGeneric)
688712
}
689713

690-
const consoleVersion = "minio/console:v0.4.6"
691-
minInst.Spec.Console = &operator.ConsoleConfiguration{
692-
Replicas: 1,
693-
Image: consoleVersion,
694-
ConsoleSecret: &corev1.LocalObjectReference{Name: consoleSecretName},
695-
Resources: corev1.ResourceRequirements{
696-
Requests: map[corev1.ResourceName]resource.Quantity{
697-
"memory": resource.MustParse("64Mi"),
698-
},
699-
},
700-
}
701-
if (minInst.Spec.RequestAutoCert == nil || (minInst.Spec.RequestAutoCert != nil && !*minInst.Spec.RequestAutoCert)) && tenantReq.TLS != nil && tenantReq.TLS.Console != nil {
702-
// Certificates used by the console instance
703-
externalCertSecretName := fmt.Sprintf("%s-console-external-certificates", secretName)
704-
certificates := []*models.KeyPairConfiguration{tenantReq.TLS.Console}
705-
externalCertSecret, err := createOrReplaceExternalCertSecrets(ctx, &k8sClient, ns, certificates, externalCertSecretName, tenantName)
706-
if err != nil {
707-
return nil, prepareError(errorGeneric)
708-
}
709-
if len(externalCertSecret) > 0 {
710-
minInst.Spec.Console.ExternalCertSecret = externalCertSecret[0]
711-
}
712-
}
713-
714714
// Set Labels, Annotations and Node Selector for Console
715715
if tenantReq.Console != nil {
716716
minInst.Spec.Console.Annotations = tenantReq.Console.Annotations

‎restapi/admin_tenants_helper.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ func getTenantUpdateEncryptionResponse(session *models.Principal, params admin_a
185185

186186
// getKESConfiguration will generate the KES server certificate secrets, the tenant client secrets for mTLS authentication between MinIO and KES and the
187187
// kes-configuration.yaml file used by the KES service (how to connect to the external KMS, eg: Vault, AWS, Gemalto, etc)
188-
func getKESConfiguration(ctx context.Context, clientSet K8sClientI, ns string, encryptionCfg *models.EncryptionConfiguration, secretName, tenantName string, autoCert *bool) (kesConfiguration *operator.KESConfig, err error) {
188+
func getKESConfiguration(ctx context.Context, clientSet K8sClientI, ns string, encryptionCfg *models.EncryptionConfiguration, secretName, tenantName string) (kesConfiguration *operator.KESConfig, err error) {
189189
// Secrets used by the KES service
190190
//
191191
// kesExternalCertSecretName is the name of the secret that will store the certificates for TLS in the KES server, eg: server.key and server.crt
@@ -196,15 +196,15 @@ func getKESConfiguration(ctx context.Context, clientSet K8sClientI, ns string, e
196196
kesConfigurationSecretName := fmt.Sprintf("%s-kes-configuration", secretName)
197197

198198
kesConfiguration = &operator.KESConfig{
199-
Image: "minio/kes:v0.11.0",
199+
Image: KESImageVersion,
200200
Replicas: 1,
201201
}
202202
// Using custom image for KES
203203
if encryptionCfg.Image != "" {
204204
kesConfiguration.Image = encryptionCfg.Image
205205
}
206-
// Generate server certificates for KES only if autoCert is disabled
207-
if autoCert == nil || (autoCert != nil && !*autoCert) {
206+
// Generate server certificates for KES
207+
if encryptionCfg.Server != nil {
208208
certificates := []*models.KeyPairConfiguration{encryptionCfg.Server}
209209
certificateSecrets, err := createOrReplaceExternalCertSecrets(ctx, clientSet, ns, certificates, kesExternalCertSecretName, tenantName)
210210
if err != nil {

‎restapi/consts.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,3 +54,9 @@ const (
5454
prometheusPort = "prometheus.io/port"
5555
prometheusScrape = "prometheus.io/scrape"
5656
)
57+
58+
// Image versions
59+
const (
60+
KESImageVersion = "minio/kes:v0.12.1"
61+
ConsoleImageVersion = "minio/console:v0.4.6"
62+
)

0 commit comments

Comments
 (0)