Skip to content

Commit 971d680

Browse files
anik120anik120
authored
Add OpenShift service-ca support for authenticated metrics endpoints (#3677)
Adds support for OpenShift service-ca-operator alongside existing cert-manager support for authenticated metrics endpoints. This enables the metrics authentication feature to work in both upstream Kubernetes (with cert-manager) and OpenShift (with service-ca) environments. - Add explicit RBAC permissions for `tokenreviews` and `subjectaccessreviews` required by authentication filters - Add `serviceCa` configuration section to values.yaml with configurable secret/service names - Update deployment templates to support both `certManager` and `serviceCa` modes conditionally - Update service templates to conditionally add service-ca annotations when enabled - Maintain backward compatibility with existing `certManager` and `monitoring` configurations
1 parent 62e3677 commit 971d680

File tree

5 files changed

+67
-23
lines changed

5 files changed

+67
-23
lines changed

‎deploy/chart/templates/0000_50_olm_02-olm-operator.serviceaccount.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,18 @@ rules:
88
verbs: ["watch", "list", "get", "create", "update", "patch", "delete", "deletecollection", "escalate", "bind"]
99
- nonResourceURLs: ["*"]
1010
verbs: ["*"]
11+
- apiGroups:
12+
- authentication.k8s.io
13+
resources:
14+
- tokenreviews
15+
verbs:
16+
- create
17+
- apiGroups:
18+
- authorization.k8s.io
19+
resources:
20+
- subjectaccessreviews
21+
verbs:
22+
- create
1123
---
1224
kind: ServiceAccount
1325
apiVersion: v1

‎deploy/chart/templates/0000_50_olm_03-services.yaml‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,43 @@
1-
{{ if .Values.monitoring.enabled }}
1+
{{- if or .Values.monitoring.enabled .Values.serviceCa.enabled }}
22
apiVersion: v1
33
kind: Service
44
metadata:
5-
name: olm-operator-metrics
5+
name: {{ .Values.olm.service.name }}
66
namespace: {{ .Values.namespace }}
7+
{{- if .Values.serviceCa.enabled }}
78
annotations:
8-
service.alpha.openshift.io/serving-cert-secret-name: olm-operator-serving-cert
9+
service.alpha.openshift.io/serving-cert-secret-name: {{ .Values.serviceCa.olmOperator.secretName }}
10+
{{- end }}
911
labels:
1012
app: olm-operator
1113
spec:
1214
type: ClusterIP
1315
ports:
1416
- name: https-metrics
15-
port: {{ .Values.olm.service.externalPort }}
17+
port: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}{{ .Values.olm.service.internalPortHttps }}{{ else }}{{ .Values.olm.service.externalPort }}{{ end }}
1618
protocol: TCP
17-
targetPort: {{ .Values.olm.service.internalPort }}
19+
targetPort: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}{{ .Values.olm.service.internalPortHttps }}{{ else }}{{ .Values.olm.service.internalPort }}{{ end }}
1820
selector:
1921
app: olm-operator
2022
---
2123
apiVersion: v1
2224
kind: Service
2325
metadata:
24-
name: catalog-operator-metrics
26+
name: {{ .Values.catalog.service.name }}
2527
namespace: {{ .Values.namespace }}
28+
{{- if .Values.serviceCa.enabled }}
2629
annotations:
27-
service.alpha.openshift.io/serving-cert-secret-name: catalog-operator-serving-cert
30+
service.alpha.openshift.io/serving-cert-secret-name: {{ .Values.serviceCa.catalogOperator.secretName }}
31+
{{- end }}
2832
labels:
2933
app: catalog-operator
3034
spec:
3135
type: ClusterIP
3236
ports:
3337
- name: https-metrics
34-
port: {{ .Values.catalog.service.externalPort }}
38+
port: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}{{ .Values.catalog.service.internalPortHttps }}{{ else }}{{ .Values.catalog.service.externalPort }}{{ end }}
3539
protocol: TCP
36-
targetPort: {{ .Values.catalog.service.internalPort }}
40+
targetPort: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}{{ .Values.catalog.service.internalPortHttps }}{{ else }}{{ .Values.catalog.service.internalPort }}{{ end }}
3741
selector:
3842
app: catalog-operator
3943
{{ end }}

‎deploy/chart/templates/0000_50_olm_07-olm-operator.deployment.yaml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,13 @@ spec:
3030
- name: profile-collector-cert
3131
secret:
3232
secretName: {{ .Values.certManager.certificate.secretName }}
33+
{{- else if .Values.serviceCa.enabled }}
34+
- name: srv-cert
35+
secret:
36+
secretName: {{ .Values.serviceCa.olmOperator.secretName }}
37+
- name: profile-collector-cert
38+
secret:
39+
secretName: {{ .Values.serviceCa.olmOperator.secretName }}
3340
{{- end }}
3441
- name: tmpfs
3542
emptyDir: {}
@@ -41,7 +48,7 @@ spec:
4148
capabilities:
4249
drop: [ "ALL" ]
4350
volumeMounts:
44-
{{- if .Values.certManager.enabled }}
51+
{{- if or .Values.certManager.enabled .Values.serviceCa.enabled }}
4552
- name: srv-cert
4653
mountPath: "/srv-cert"
4754
readOnly: true
@@ -74,7 +81,7 @@ spec:
7481
- --writePackageServerStatusName
7582
- {{ .Values.writePackageServerStatusName }}
7683
{{- end }}
77-
{{- if .Values.certManager.enabled }}
84+
{{- if or .Values.certManager.enabled .Values.serviceCa.enabled }}
7885
- --tls-cert
7986
- /srv-cert/tls.crt
8087
- --tls-key
@@ -85,18 +92,18 @@ spec:
8592
image: {{ .Values.olm.image.ref }}
8693
imagePullPolicy: {{ .Values.olm.image.pullPolicy }}
8794
ports:
88-
- containerPort: {{ if .Values.certManager.enabled }}{{ .Values.olm.service.internalPortHttps }}{{ else }}{{ .Values.olm.service.internalPort }}{{ end }}
95+
- containerPort: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}{{ .Values.olm.service.internalPortHttps }}{{ else }}{{ .Values.olm.service.internalPort }}{{ end }}
8996
name: metrics
9097
livenessProbe:
9198
httpGet:
9299
path: /healthz
93-
port: {{ if .Values.certManager.enabled }}{{ .Values.olm.service.internalPortHttps }}{{ else }}{{ .Values.olm.service.internalPort }}{{ end }}
94-
scheme: {{ if .Values.certManager.enabled }}HTTPS{{ else }}HTTP{{ end }}
100+
port: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}{{ .Values.olm.service.internalPortHttps }}{{ else }}{{ .Values.olm.service.internalPort }}{{ end }}
101+
scheme: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}HTTPS{{ else }}HTTP{{ end }}
95102
readinessProbe:
96103
httpGet:
97104
path: /healthz
98-
port: {{ if .Values.certManager.enabled }}{{ .Values.olm.service.internalPortHttps }}{{ else }}{{ .Values.olm.service.internalPort }}{{ end }}
99-
scheme: {{ if .Values.certManager.enabled }}HTTPS{{ else }}HTTP{{ end }}
105+
port: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}{{ .Values.olm.service.internalPortHttps }}{{ else }}{{ .Values.olm.service.internalPort }}{{ end }}
106+
scheme: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}HTTPS{{ else }}HTTP{{ end }}
100107
terminationMessagePolicy: FallbackToLogsOnError
101108
env:
102109
- name: OPERATOR_NAMESPACE

‎deploy/chart/templates/0000_50_olm_08-catalog-operator.deployment.yaml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,13 @@ spec:
3030
- name: profile-collector-cert
3131
secret:
3232
secretName: {{ .Values.certManager.certificate.secretName }}
33+
{{- else if .Values.serviceCa.enabled }}
34+
- name: srv-cert
35+
secret:
36+
secretName: {{ .Values.serviceCa.catalogOperator.secretName }}
37+
- name: profile-collector-cert
38+
secret:
39+
secretName: {{ .Values.serviceCa.catalogOperator.secretName }}
3340
{{- end }}
3441
- name: tmpfs
3542
emptyDir: {}
@@ -41,7 +48,7 @@ spec:
4148
capabilities:
4249
drop: [ "ALL" ]
4350
volumeMounts:
44-
{{- if .Values.certManager.enabled }}
51+
{{- if or .Values.certManager.enabled .Values.serviceCa.enabled }}
4552
- name: srv-cert
4653
mountPath: "/srv-cert"
4754
readOnly: true
@@ -71,7 +78,7 @@ spec:
7178
- --writeStatusName
7279
- {{ .Values.writeStatusNameCatalog }}
7380
{{- end }}
74-
{{- if .Values.certManager.enabled }}
81+
{{- if or .Values.certManager.enabled .Values.serviceCa.enabled }}
7582
- --tls-cert
7683
- /srv-cert/tls.crt
7784
- --tls-key
@@ -92,18 +99,18 @@ spec:
9299
{{- end }}
93100
imagePullPolicy: {{ .Values.catalog.image.pullPolicy }}
94101
ports:
95-
- containerPort: {{ if .Values.certManager.enabled }}{{ .Values.catalog.service.internalPortHttps }}{{ else }}{{ .Values.catalog.service.internalPort }}{{ end }}
102+
- containerPort: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}{{ .Values.catalog.service.internalPortHttps }}{{ else }}{{ .Values.catalog.service.internalPort }}{{ end }}
96103
name: metrics
97104
livenessProbe:
98105
httpGet:
99106
path: /healthz
100-
port: {{ if .Values.certManager.enabled }}{{ .Values.catalog.service.internalPortHttps }}{{ else }}{{ .Values.catalog.service.internalPort }}{{ end }}
101-
scheme: {{ if .Values.certManager.enabled }}HTTPS{{ else }}HTTP{{ end }}
107+
port: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}{{ .Values.catalog.service.internalPortHttps }}{{ else }}{{ .Values.catalog.service.internalPort }}{{ end }}
108+
scheme: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}HTTPS{{ else }}HTTP{{ end }}
102109
readinessProbe:
103110
httpGet:
104111
path: /healthz
105-
port: {{ if .Values.certManager.enabled }}{{ .Values.catalog.service.internalPortHttps }}{{ else }}{{ .Values.catalog.service.internalPort }}{{ end }}
106-
scheme: {{ if .Values.certManager.enabled }}HTTPS{{ else }}HTTP{{ end }}
112+
port: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}{{ .Values.catalog.service.internalPortHttps }}{{ else }}{{ .Values.catalog.service.internalPort }}{{ end }}
113+
scheme: {{ if or .Values.certManager.enabled .Values.serviceCa.enabled }}HTTPS{{ else }}HTTP{{ end }}
107114
terminationMessagePolicy: FallbackToLogsOnError
108115
{{- if .Values.catalog.resources }}
109116
resources:

‎deploy/chart/values.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ olm:
2727
ref: quay.io/operator-framework/olm:master
2828
pullPolicy: Always
2929
service:
30+
name: olm-operator-metrics
3031
internalPort: 8080
3132
internalPortHttps: 8443
3233
externalPort: metrics
@@ -46,6 +47,7 @@ catalog:
4647
ref: quay.io/operator-framework/olm:master
4748
pullPolicy: Always
4849
service:
50+
name: catalog-operator-metrics
4951
internalPort: 8080
5052
internalPortHttps: 8443
5153
externalPort: metrics
@@ -89,6 +91,18 @@ certManager:
8991
extraDnsNames: []
9092
extraIpAddresses: []
9193

94+
# OpenShift service-ca configuration
95+
# When enabled, uses OpenShift service-ca-operator for certificate management
96+
# This is mutually exclusive with certManager - only one should be enabled
97+
serviceCa:
98+
enabled: false
99+
# Secret names are left empty in upstream, to be filled by downstream values.yaml
100+
# Service names are taken from olm.service.name and catalog.service.name
101+
olmOperator:
102+
secretName: ""
103+
catalogOperator:
104+
secretName: ""
105+
92106
networkPolicy:
93107
dns:
94108
ports:

0 commit comments

Comments
 (0)