Skip to content

Commit 2a306f0

Browse files
jotakjotak
committed
Implement mTLS
1 parent d135964 commit 2a306f0

20 files changed

+839
-75
lines changed

‎RELEASE.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,12 +54,14 @@ kind: FlowCollector
5454
metadata:
5555
name: cluster
5656
spec:
57-
namespace: netobserv
5857
networkPolicy:
5958
enable: false
60-
deploymentModel: Direct
59+
consumerReplicas: 1
6160
consolePlugin:
6261
standalone: true
62+
processor:
63+
service:
64+
tlsType: Auto-mTLS
6365
loki:
6466
mode: Monolithic
6567
monolithic:

‎api/flowcollector/v1beta2/flowcollector_types.go‎

Lines changed: 42 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -516,12 +516,13 @@ type FlowCollectorOpenTelemetry struct {
516516
Metrics FlowCollectorOpenTelemetryMetrics `json:"metrics"`
517517
}
518518

519-
type ServerTLSConfigType string
519+
type TLSConfigType string
520520

521521
const (
522-
ServerTLSDisabled ServerTLSConfigType = "Disabled"
523-
ServerTLSProvided ServerTLSConfigType = "Provided"
524-
ServerTLSAuto ServerTLSConfigType = "Auto"
522+
TLSDisabled TLSConfigType = "Disabled"
523+
TLSProvided TLSConfigType = "Provided"
524+
TLSAuto TLSConfigType = "Auto"
525+
TLSAutoMTLS TLSConfigType = "Auto-mTLS"
525526
)
526527

527528
// `ServerTLS` define the TLS configuration, server side
@@ -534,7 +535,7 @@ type ServerTLS struct {
534535
// +kubebuilder:validation:Enum:="Disabled";"Provided";"Auto"
535536
// +kubebuilder:validation:Required
536537
//+kubebuilder:default:="Disabled"
537-
Type ServerTLSConfigType `json:"type,omitempty"`
538+
Type TLSConfigType `json:"type,omitempty"`
538539

539540
// TLS configuration when `type` is set to `Provided`.
540541
// +optional
@@ -547,7 +548,22 @@ type ServerTLS struct {
547548

548549
// Reference to the CA file when `type` is set to `Provided`.
549550
// +optional
550-
ProvidedCaFile *FileReference `json:"providedCaFile,omitempty"`
551+
ProvidedCAFile *FileReference `json:"providedCaFile,omitempty"`
552+
}
553+
554+
// `ClientServerTLS` define the TLS configuration for both client and server sides
555+
type ClientServerTLS struct {
556+
// TLS client certificate reference.
557+
// +optional
558+
ClientCert *CertificateReference `json:"clientCert,omitempty"`
559+
560+
// TLS server certificate reference.
561+
// +optional
562+
ServerCert *CertificateReference `json:"serverCert,omitempty"`
563+
564+
// Reference to the CA file.
565+
// +optional
566+
CAFile *FileReference `json:"caFile,omitempty"`
551567
}
552568

553569
// `MetricsServerConfig` define the metrics server endpoint configuration for Prometheus scraper
@@ -707,6 +723,10 @@ type FlowCollectorFLP struct {
707723
//+optional
708724
SlicesConfig *SlicesConfig `json:"slicesConfig,omitempty"`
709725

726+
// Service configuration, only used when `spec.deploymentModel` is `Service`.
727+
// +optional
728+
Service *ProcessorServiceConfig `json:"service,omitempty"`
729+
710730
// `advanced` allows setting some aspects of the internal configuration of the flow processor.
711731
// This section is aimed mostly for debugging and fine-grained performance optimizations,
712732
// such as `GOGC` and `GOMAXPROCS` environment variables. Set these values at your own risk.
@@ -1510,6 +1530,22 @@ type SubnetLabel struct {
15101530
Name string `json:"name,omitempty"`
15111531
}
15121532

1533+
type ProcessorServiceConfig struct {
1534+
// Select the type of TLS configuration:<br>
1535+
// - `Disabled` to not configure TLS for the endpoint.
1536+
// - `Provided` to manually provide cert file and a key file. [Unsupported (*)].
1537+
// - `Auto` (default) to try to determine if TLS can be enabled based on the running environment.
1538+
// - `Auto-mTLS` to preconfigure mTLS. [Unsupported (*)].
1539+
// +kubebuilder:validation:Enum:="Disabled";"Provided";"Auto";"Auto-mTLS"
1540+
// +kubebuilder:validation:Required
1541+
// +kubebuilder:default:="Auto"
1542+
TLSType TLSConfigType `json:"tlsType,omitempty"`
1543+
1544+
// TLS or mTLS configuration when `type` is set to `Provided`.
1545+
// +optional
1546+
ProvidedCertificates *ClientServerTLS `json:"providedCertificates,omitempty"`
1547+
}
1548+
15131549
// Add more exporter types below
15141550
type ExporterType string
15151551

‎api/flowcollector/v1beta2/zz_generated.deepcopy.go‎

Lines changed: 57 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/manifests/flows.netobserv.io_flowcollectors.yaml‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6165,6 +6165,116 @@ spec:
61656165
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
61666166
type: object
61676167
type: object
6168+
service:
6169+
description: Service configuration, only used when `spec.deploymentModel`
6170+
is `Service`.
6171+
properties:
6172+
providedCertificates:
6173+
description: TLS or mTLS configuration when `type` is set
6174+
to `Provided`.
6175+
properties:
6176+
caFile:
6177+
description: Reference to the CA file.
6178+
properties:
6179+
file:
6180+
description: File name within the config map or secret.
6181+
type: string
6182+
name:
6183+
description: Name of the config map or secret containing
6184+
the file.
6185+
type: string
6186+
namespace:
6187+
default: ""
6188+
description: |-
6189+
Namespace of the config map or secret containing the file. If omitted, the default is to use the same namespace as where NetObserv is deployed.
6190+
If the namespace is different, the config map or the secret is copied so that it can be mounted as required.
6191+
type: string
6192+
type:
6193+
description: 'Type for the file reference: `configmap`
6194+
or `secret`.'
6195+
enum:
6196+
- configmap
6197+
- secret
6198+
type: string
6199+
type: object
6200+
clientCert:
6201+
description: TLS client certificate reference.
6202+
properties:
6203+
certFile:
6204+
description: '`certFile` defines the path to the certificate
6205+
file name within the config map or secret.'
6206+
type: string
6207+
certKey:
6208+
description: '`certKey` defines the path to the certificate
6209+
private key file name within the config map or secret.
6210+
Omit when the key is not necessary.'
6211+
type: string
6212+
name:
6213+
description: Name of the config map or secret containing
6214+
certificates.
6215+
type: string
6216+
namespace:
6217+
default: ""
6218+
description: |-
6219+
Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed.
6220+
If the namespace is different, the config map or the secret is copied so that it can be mounted as required.
6221+
type: string
6222+
type:
6223+
description: 'Type for the certificate reference:
6224+
`configmap` or `secret`.'
6225+
enum:
6226+
- configmap
6227+
- secret
6228+
type: string
6229+
type: object
6230+
serverCert:
6231+
description: TLS server certificate reference.
6232+
properties:
6233+
certFile:
6234+
description: '`certFile` defines the path to the certificate
6235+
file name within the config map or secret.'
6236+
type: string
6237+
certKey:
6238+
description: '`certKey` defines the path to the certificate
6239+
private key file name within the config map or secret.
6240+
Omit when the key is not necessary.'
6241+
type: string
6242+
name:
6243+
description: Name of the config map or secret containing
6244+
certificates.
6245+
type: string
6246+
namespace:
6247+
default: ""
6248+
description: |-
6249+
Namespace of the config map or secret containing certificates. If omitted, the default is to use the same namespace as where NetObserv is deployed.
6250+
If the namespace is different, the config map or the secret is copied so that it can be mounted as required.
6251+
type: string
6252+
type:
6253+
description: 'Type for the certificate reference:
6254+
`configmap` or `secret`.'
6255+
enum:
6256+
- configmap
6257+
- secret
6258+
type: string
6259+
type: object
6260+
type: object
6261+
tlsType:
6262+
default: Auto
6263+
description: |-
6264+
Select the type of TLS configuration:<br>
6265+
- `Disabled` to not configure TLS for the endpoint.
6266+
- `Provided` to manually provide cert file and a key file. [Unsupported (*)].
6267+
- `Auto` (default) to try to determine if TLS can be enabled based on the running environment.
6268+
- `Auto-mTLS` to preconfigure mTLS. [Unsupported (*)].
6269+
enum:
6270+
- Disabled
6271+
- Provided
6272+
- Auto
6273+
- Auto-mTLS
6274+
type: string
6275+
required:
6276+
- tlsType
6277+
type: object
61686278
slicesConfig:
61696279
description: Global configuration managing FlowCollectorSlices
61706280
custom resources.

‎bundle/manifests/netobserv-operator.clusterserviceversion.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -470,6 +470,46 @@ spec:
470470
path: processor.metrics.includeList
471471
- displayName: Port
472472
path: processor.metrics.server.port
473+
- displayName: Service
474+
path: processor.service
475+
- displayName: Provided certificates
476+
path: processor.service.providedCertificates
477+
- displayName: Ca file
478+
path: processor.service.providedCertificates.caFile
479+
- displayName: File
480+
path: processor.service.providedCertificates.caFile.file
481+
- displayName: Name
482+
path: processor.service.providedCertificates.caFile.name
483+
- displayName: Namespace
484+
path: processor.service.providedCertificates.caFile.namespace
485+
- displayName: Type
486+
path: processor.service.providedCertificates.caFile.type
487+
- displayName: Client cert
488+
path: processor.service.providedCertificates.clientCert
489+
- displayName: Cert file
490+
path: processor.service.providedCertificates.clientCert.certFile
491+
- displayName: Cert key
492+
path: processor.service.providedCertificates.clientCert.certKey
493+
- displayName: Name
494+
path: processor.service.providedCertificates.clientCert.name
495+
- displayName: Namespace
496+
path: processor.service.providedCertificates.clientCert.namespace
497+
- displayName: Type
498+
path: processor.service.providedCertificates.clientCert.type
499+
- displayName: Server cert
500+
path: processor.service.providedCertificates.serverCert
501+
- displayName: Cert file
502+
path: processor.service.providedCertificates.serverCert.certFile
503+
- displayName: Cert key
504+
path: processor.service.providedCertificates.serverCert.certKey
505+
- displayName: Name
506+
path: processor.service.providedCertificates.serverCert.name
507+
- displayName: Namespace
508+
path: processor.service.providedCertificates.serverCert.namespace
509+
- displayName: Type
510+
path: processor.service.providedCertificates.serverCert.type
511+
- displayName: Tls type
512+
path: processor.service.tlsType
473513
- displayName: Slices config
474514
path: processor.slicesConfig
475515
- displayName: Collection mode

0 commit comments

Comments
 (0)