Skip to content

Commit 4322bf5

Browse files
ajanikowajanikow
authored
[Feature] [ML] Add TLS Secrets (#1654)
1 parent 51989bc commit 4322bf5

File tree

12 files changed

+248
-10
lines changed

12 files changed

+248
-10
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
- (Bugfix) Fix Schema Apply Checksum
88
- (Bugfix) Use MD5 instead of SHA256 for CRD Checksums
99
- (Feature) (ML) Unify API
10+
- (Feature) (ML) Add TLS Secrets
1011

1112
## [1.2.40](https://github.com/arangodb/kube-arangodb/tree/1.2.40) (2024-04-10)
1213
- (Feature) Add Core fields to the Scheduler Container Spec

‎docs/api/ArangoMLExtension.V1Alpha1.md‎

Lines changed: 50 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ Links:
9898

9999
### .spec.deployment.gpu
100100

101-
Type: `boolean` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/ml/v1alpha1/extension_spec_deployment.go#L52)</sup>
101+
Type: `boolean` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/ml/v1alpha1/extension_spec_deployment.go#L55)</sup>
102102

103103
GPU defined if GPU Jobs are enabled.
104104

@@ -231,7 +231,7 @@ Links:
231231

232232
### .spec.deployment.port
233233

234-
Type: `integer` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/ml/v1alpha1/extension_spec_deployment.go#L55)</sup>
234+
Type: `integer` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/ml/v1alpha1/extension_spec_deployment.go#L58)</sup>
235235

236236
Port defines on which port the container will be listening for connections
237237

@@ -359,6 +359,22 @@ Links:
359359

360360
***
361361

362+
### .spec.deployment.tls.altNames
363+
364+
Type: `array` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/ml/v1alpha1/extension_spec_deployment_tls.go#L28)</sup>
365+
366+
AltNames define TLS AltNames used when TLS on the ArangoDB is enabled
367+
368+
***
369+
370+
### .spec.deployment.tls.enabled
371+
372+
Type: `boolean` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/ml/v1alpha1/extension_spec_deployment_tls.go#L25)</sup>
373+
374+
Enabled define if TLS Should be enabled. If is not set then default is taken from ArangoDeployment settings
375+
376+
***
377+
362378
### .spec.deployment.tolerations
363379

364380
Type: `[]core.Toleration` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/scheduler/v1alpha1/pod/resources/scheduling.go#L49)</sup>
@@ -2905,6 +2921,38 @@ UID keeps the information about object UID
29052921

29062922
***
29072923

2924+
### .status.arangoDB.tls.checksum
2925+
2926+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/shared/v1/object.go#L61)</sup>
2927+
2928+
UID keeps the information about object Checksum
2929+
2930+
***
2931+
2932+
### .status.arangoDB.tls.name
2933+
2934+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/shared/v1/object.go#L52)</sup>
2935+
2936+
Name of the object
2937+
2938+
***
2939+
2940+
### .status.arangoDB.tls.namespace
2941+
2942+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/shared/v1/object.go#L55)</sup>
2943+
2944+
Namespace of the object. Should default to the namespace of the parent object
2945+
2946+
***
2947+
2948+
### .status.arangoDB.tls.uid
2949+
2950+
Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/shared/v1/object.go#L58)</sup>
2951+
2952+
UID keeps the information about object UID
2953+
2954+
***
2955+
29082956
### .status.conditions
29092957

29102958
Type: `api.Conditions` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.40/pkg/apis/ml/v1alpha1/extension_status.go#L31)</sup>

‎pkg/apis/ml/v1alpha1/extension_spec_deployment.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@ type ArangoMLExtensionSpecDeployment struct {
4141
// Service defines how components will be exposed
4242
Service *ArangoMLExtensionSpecDeploymentService `json:"service,omitempty"`
4343

44+
// TLS defined TLS Settings for extension
45+
TLS *ArangoMLExtensionSpecDeploymentTLS `json:"tls,omitempty"`
46+
4447
// Pod defines base template for pods
4548
*schedulerPodApi.Pod
4649

@@ -99,6 +102,13 @@ func (s *ArangoMLExtensionSpecDeployment) GetService() *ArangoMLExtensionSpecDep
99102
return s.Service
100103
}
101104

105+
func (s *ArangoMLExtensionSpecDeployment) GetTLS() *ArangoMLExtensionSpecDeploymentTLS {
106+
if s == nil {
107+
return nil
108+
}
109+
return s.TLS
110+
}
111+
102112
func (s *ArangoMLExtensionSpecDeployment) Validate() error {
103113
if s == nil {
104114
return nil

‎pkg/apis/ml/v1alpha1/extension_spec_deployment_tls.go‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
//
2+
// DISCLAIMER
3+
//
4+
// Copyright 2024 ArangoDB GmbH, Cologne, Germany
5+
//
6+
// Licensed under the Apache License, Version 2.0 (the "License");
7+
// you may not use this file except in compliance with the License.
8+
// You may obtain a copy of the License at
9+
//
10+
// http://www.apache.org/licenses/LICENSE-2.0
11+
//
12+
// Unless required by applicable law or agreed to in writing, software
13+
// distributed under the License is distributed on an "AS IS" BASIS,
14+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
// See the License for the specific language governing permissions and
16+
// limitations under the License.
17+
//
18+
// Copyright holder is ArangoDB GmbH, Cologne, Germany
19+
//
20+
21+
package v1alpha1
22+
23+
type ArangoMLExtensionSpecDeploymentTLS struct {
24+
// Enabled define if TLS Should be enabled. If is not set then default is taken from ArangoDeployment settings
25+
Enabled *bool `json:"enabled,omitempty"`
26+
27+
// AltNames define TLS AltNames used when TLS on the ArangoDB is enabled
28+
AltNames []string `json:"altNames,omitempty"`
29+
}

‎pkg/apis/ml/v1alpha1/extension_status_arangodb_ref.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,6 @@ import sharedApi "github.com/arangodb/kube-arangodb/pkg/apis/shared/v1"
2525
type ArangoMLExtensionStatusArangoDBRef struct {
2626
// Secret keeps the information about ArangoDB deployment
2727
Secret *sharedApi.Object `json:"secret,omitempty"`
28+
// TLS keeps information about TLS Secret rendered from ArangoDB deployment
29+
TLS *sharedApi.Object `json:"tls,omitempty"`
2830
}

‎pkg/apis/ml/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 36 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/apis/shared/v1/object.go‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,20 @@ func (o *Object) GetUID() types.UID {
9494
return ""
9595
}
9696

97+
func (o *Object) AsUIDPrecondition() *meta.Preconditions {
98+
if o == nil || o.UID == nil {
99+
return nil
100+
}
101+
102+
uid := o.GetUID()
103+
104+
if uid == "" {
105+
return nil
106+
}
107+
108+
return meta.NewUIDPreconditions(string(uid))
109+
}
110+
97111
func (o *Object) GetChecksum() string {
98112
if o != nil {
99113
if n := o.Checksum; n != nil {

‎pkg/crd/crds/ml-extension.schema.generated.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -927,6 +927,18 @@ v1alpha1:
927927
format: int32
928928
type: integer
929929
type: object
930+
tls:
931+
description: TLS defined TLS Settings for extension
932+
properties:
933+
altNames:
934+
description: AltNames define TLS AltNames used when TLS on the ArangoDB is enabled
935+
items:
936+
type: string
937+
type: array
938+
enabled:
939+
description: Enabled define if TLS Should be enabled. If is not set then default is taken from ArangoDeployment settings
940+
type: boolean
941+
type: object
930942
tolerations:
931943
items:
932944
properties:

‎pkg/deployment/resources/certificates_tls.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// DISCLAIMER
33
//
4-
// Copyright 2016-2022 ArangoDB GmbH, Cologne, Germany
4+
// Copyright 2016-2024 ArangoDB GmbH, Cologne, Germany
55
//
66
// Licensed under the Apache License, Version 2.0 (the "License");
77
// you may not use this file except in compliance with the License.
@@ -113,7 +113,8 @@ func createTLSServerCertificate(ctx context.Context, log logging.Logger, cachedS
113113
strings.TrimSpace(priv)
114114

115115
err = globals.GetGlobalTimeouts().Kubernetes().RunWithTimeout(ctx, func(ctxChild context.Context) error {
116-
return k8sutil.CreateTLSKeyfileSecret(ctxChild, secrets, secretName, keyfile, ownerRef)
116+
_, err := k8sutil.CreateTLSKeyfileSecret(ctxChild, secrets, secretName, keyfile, ownerRef)
117+
return err
117118
})
118119
if err != nil {
119120
if kerrors.IsAlreadyExists(err) {

‎pkg/util/context.go‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// DISCLAIMER
33
//
4-
// Copyright 2023 ArangoDB GmbH, Cologne, Germany
4+
// Copyright 2023-2024 ArangoDB GmbH, Cologne, Germany
55
//
66
// Licensed under the Apache License, Version 2.0 (the "License");
77
// you may not use this file except in compliance with the License.
@@ -64,6 +64,39 @@ func WithContextTimeoutP2A2[P1, P2, A1, A2 interface{}](ctx context.Context, tim
6464
return f(nCtx, a1, a2)
6565
}
6666

67+
func WithKubernetesContextTimeoutP1A4[P1, A1, A2, A3, A4 interface{}](ctx context.Context, f func(context.Context, A1, A2, A3, A4) P1, a1 A1, a2 A2, a3 A3, a4 A4) P1 {
68+
return WithContextTimeoutP1A4(ctx, globals.GetGlobals().Timeouts().Kubernetes().Get(), f, a1, a2, a3, a4)
69+
}
70+
71+
func WithContextTimeoutP1A4[P1, A1, A2, A3, A4 interface{}](ctx context.Context, timeout time.Duration, f func(context.Context, A1, A2, A3, A4) P1, a1 A1, a2 A2, a3 A3, a4 A4) P1 {
72+
nCtx, c := context.WithTimeout(ctx, timeout)
73+
defer c()
74+
75+
return f(nCtx, a1, a2, a3, a4)
76+
}
77+
78+
func WithKubernetesContextTimeoutP2A4[P1, P2, A1, A2, A3, A4 interface{}](ctx context.Context, f func(context.Context, A1, A2, A3, A4) (P1, P2), a1 A1, a2 A2, a3 A3, a4 A4) (P1, P2) {
79+
return WithContextTimeoutP2A4(ctx, globals.GetGlobals().Timeouts().Kubernetes().Get(), f, a1, a2, a3, a4)
80+
}
81+
82+
func WithContextTimeoutP2A4[P1, P2, A1, A2, A3, A4 interface{}](ctx context.Context, timeout time.Duration, f func(context.Context, A1, A2, A3, A4) (P1, P2), a1 A1, a2 A2, a3 A3, a4 A4) (P1, P2) {
83+
nCtx, c := context.WithTimeout(ctx, timeout)
84+
defer c()
85+
86+
return f(nCtx, a1, a2, a3, a4)
87+
}
88+
89+
func WithKubernetesContextTimeoutP4A3[P1, P2, P3, P4, A1, A2, A3 interface{}](ctx context.Context, f func(context.Context, A1, A2, A3) (P1, P2, P3, P4), a1 A1, a2 A2, a3 A3) (P1, P2, P3, P4) {
90+
return WithContextTimeoutP4A3(ctx, globals.GetGlobals().Timeouts().Kubernetes().Get(), f, a1, a2, a3)
91+
}
92+
93+
func WithContextTimeoutP4A3[P1, P2, P3, P4, A1, A2, A3 interface{}](ctx context.Context, timeout time.Duration, f func(context.Context, A1, A2, A3) (P1, P2, P3, P4), a1 A1, a2 A2, a3 A3) (P1, P2, P3, P4) {
94+
nCtx, c := context.WithTimeout(ctx, timeout)
95+
defer c()
96+
97+
return f(nCtx, a1, a2, a3)
98+
}
99+
67100
type PatchInterface[P1 meta.Object] interface {
68101
Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts meta.PatchOptions, subresources ...string) (P1, error)
69102
}

0 commit comments

Comments
 (0)