Skip to content

Commit dba4dcb

Browse files
maierlarsmaierlars
committed
Use jwt-keyfile option if available.
1 parent 11ed832 commit dba4dcb

File tree

10 files changed

+151
-103
lines changed

10 files changed

+151
-103
lines changed

‎dashboard/assets.go‎

Lines changed: 65 additions & 65 deletions
Large diffs are not rendered by default.

‎pkg/deployment/images.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ func (ib *imagesBuilder) fetchArangoDBImageIDAndVersion(ctx context.Context, ima
198198
}
199199
}
200200
if err := k8sutil.CreateArangodPod(ib.KubeCli, true, ib.APIObject, role, id, podName, "", image, "", "", ib.Spec.GetImagePullPolicy(), "", false, terminationGracePeriod, args, env, nil, nil, nil,
201-
tolerations, serviceAccountName, "", "", nil); err != nil {
201+
tolerations, serviceAccountName, "", "", "", nil); err != nil {
202202
log.Debug().Err(err).Msg("Failed to create image ID pod")
203203
return true, maskAny(err)
204204
}

‎pkg/deployment/members.go‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -90,9 +90,9 @@ func createMember(log zerolog.Logger, status *api.DeploymentStatus, group api.Se
9090
case api.ServerGroupSingle:
9191
log.Debug().Str("id", id).Msg("Adding single server")
9292
if err := status.Members.Add(api.MemberStatus{
93-
ID: id,
94-
CreatedAt: metav1.Now(),
95-
Phase: api.MemberPhaseNone,
93+
ID: id,
94+
CreatedAt: metav1.Now(),
95+
Phase: api.MemberPhaseNone,
9696
PersistentVolumeClaimName: k8sutil.CreatePersistentVolumeClaimName(deploymentName, role, id),
9797
PodName: "",
9898
}, group); err != nil {
@@ -101,9 +101,9 @@ func createMember(log zerolog.Logger, status *api.DeploymentStatus, group api.Se
101101
case api.ServerGroupAgents:
102102
log.Debug().Str("id", id).Msg("Adding agent")
103103
if err := status.Members.Add(api.MemberStatus{
104-
ID: id,
105-
CreatedAt: metav1.Now(),
106-
Phase: api.MemberPhaseNone,
104+
ID: id,
105+
CreatedAt: metav1.Now(),
106+
Phase: api.MemberPhaseNone,
107107
PersistentVolumeClaimName: k8sutil.CreatePersistentVolumeClaimName(deploymentName, role, id),
108108
PodName: "",
109109
}, group); err != nil {
@@ -112,9 +112,9 @@ func createMember(log zerolog.Logger, status *api.DeploymentStatus, group api.Se
112112
case api.ServerGroupDBServers:
113113
log.Debug().Str("id", id).Msg("Adding dbserver")
114114
if err := status.Members.Add(api.MemberStatus{
115-
ID: id,
116-
CreatedAt: metav1.Now(),
117-
Phase: api.MemberPhaseNone,
115+
ID: id,
116+
CreatedAt: metav1.Now(),
117+
Phase: api.MemberPhaseNone,
118118
PersistentVolumeClaimName: k8sutil.CreatePersistentVolumeClaimName(deploymentName, role, id),
119119
PodName: "",
120120
}, group); err != nil {
@@ -123,9 +123,9 @@ func createMember(log zerolog.Logger, status *api.DeploymentStatus, group api.Se
123123
case api.ServerGroupCoordinators:
124124
log.Debug().Str("id", id).Msg("Adding coordinator")
125125
if err := status.Members.Add(api.MemberStatus{
126-
ID: id,
127-
CreatedAt: metav1.Now(),
128-
Phase: api.MemberPhaseNone,
126+
ID: id,
127+
CreatedAt: metav1.Now(),
128+
Phase: api.MemberPhaseNone,
129129
PersistentVolumeClaimName: "",
130130
PodName: "",
131131
}, group); err != nil {
@@ -134,9 +134,9 @@ func createMember(log zerolog.Logger, status *api.DeploymentStatus, group api.Se
134134
case api.ServerGroupSyncMasters:
135135
log.Debug().Str("id", id).Msg("Adding syncmaster")
136136
if err := status.Members.Add(api.MemberStatus{
137-
ID: id,
138-
CreatedAt: metav1.Now(),
139-
Phase: api.MemberPhaseNone,
137+
ID: id,
138+
CreatedAt: metav1.Now(),
139+
Phase: api.MemberPhaseNone,
140140
PersistentVolumeClaimName: "",
141141
PodName: "",
142142
}, group); err != nil {
@@ -145,9 +145,9 @@ func createMember(log zerolog.Logger, status *api.DeploymentStatus, group api.Se
145145
case api.ServerGroupSyncWorkers:
146146
log.Debug().Str("id", id).Msg("Adding syncworker")
147147
if err := status.Members.Add(api.MemberStatus{
148-
ID: id,
149-
CreatedAt: metav1.Now(),
150-
Phase: api.MemberPhaseNone,
148+
ID: id,
149+
CreatedAt: metav1.Now(),
150+
Phase: api.MemberPhaseNone,
151151
PersistentVolumeClaimName: "",
152152
PodName: "",
153153
}, group); err != nil {

‎pkg/deployment/resources/pod_creator.go‎

Lines changed: 38 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,17 @@ func versionHasAdvertisedEndpoint(v driver.Version) bool {
6565
return v.CompareTo("3.4.0") >= 0
6666
}
6767

68+
func versionHasJWTSecretKeyfile(v driver.Version) bool {
69+
if v.CompareTo("3.3.22") >= 0 && v.CompareTo("3.4.0") < 0 {
70+
return true
71+
}
72+
if v.CompareTo("3.4.2") >= 0 {
73+
return true
74+
}
75+
76+
return false
77+
}
78+
6879
// createArangodArgs creates command line arguments for an arangod server in the given group.
6980
func createArangodArgs(apiObject metav1.Object, deplSpec api.DeploymentSpec, group api.ServerGroup,
7081
agents api.MemberStatusList, id string, version driver.Version, autoUpgrade bool) []string {
@@ -85,8 +96,17 @@ func createArangodArgs(apiObject metav1.Object, deplSpec api.DeploymentSpec, gro
8596
// With authentication
8697
options = append(options,
8798
optionPair{"--server.authentication", "true"},
88-
optionPair{"--server.jwt-secret", "$(" + constants.EnvArangodJWTSecret + ")"},
8999
)
100+
if versionHasJWTSecretKeyfile(version) {
101+
keyPath := filepath.Join(k8sutil.ClusterJWTSecretVolumeName, constants.SecretKeyToken)
102+
options = append(options,
103+
optionPair{"--server.jwt-secret-keyfile", keyPath},
104+
)
105+
} else {
106+
options = append(options,
107+
optionPair{"--server.jwt-secret", "$(" + constants.EnvArangodJWTSecret + ")"},
108+
)
109+
}
90110
} else {
91111
// Without authentication
92112
options = append(options,
@@ -499,17 +519,18 @@ func (r *Resources) createPodForMember(spec api.DeploymentSpec, memberID string,
499519
// Create pod
500520
if group.IsArangod() {
501521
// Prepare arguments
522+
version := imageInfo.ArangoDBVersion
502523
autoUpgrade := m.Conditions.IsTrue(api.ConditionTypeAutoUpgrade)
503524
if autoUpgrade {
504525
newPhase = api.MemberPhaseUpgrading
505526
}
506-
args := createArangodArgs(apiObject, spec, group, status.Members.Agents, m.ID, imageInfo.ArangoDBVersion, autoUpgrade)
527+
args := createArangodArgs(apiObject, spec, group, status.Members.Agents, m.ID, version, autoUpgrade)
507528
env := make(map[string]k8sutil.EnvValue)
508529
livenessProbe, err := r.createLivenessProbe(spec, group)
509530
if err != nil {
510531
return maskAny(err)
511532
}
512-
readinessProbe, err := r.createReadinessProbe(spec, group, imageInfo.ArangoDBVersion)
533+
readinessProbe, err := r.createReadinessProbe(spec, group, version)
513534
if err != nil {
514535
return maskAny(err)
515536
}
@@ -535,11 +556,21 @@ func (r *Resources) createPodForMember(spec api.DeploymentSpec, memberID string,
535556
return maskAny(errors.Wrapf(err, "RocksDB encryption key secret validation failed"))
536557
}
537558
}
559+
// Check cluster JWT secret
560+
var clusterJWTSecretName string
538561
if spec.IsAuthenticated() {
539-
env[constants.EnvArangodJWTSecret] = k8sutil.EnvValue{
540-
SecretName: spec.Authentication.GetJWTSecretName(),
541-
SecretKey: constants.SecretKeyToken,
562+
if versionHasJWTSecretKeyfile(version) {
563+
clusterJWTSecretName = spec.Authentication.GetJWTSecretName()
564+
if err := k8sutil.ValidateTokenSecret(secrets, clusterJWTSecretName); err != nil {
565+
return maskAny(errors.Wrapf(err, "Cluster JWT secret validation failed"))
566+
}
567+
} else {
568+
env[constants.EnvArangodJWTSecret] = k8sutil.EnvValue{
569+
SecretName: spec.Authentication.GetJWTSecretName(),
570+
SecretKey: constants.SecretKeyToken,
571+
}
542572
}
573+
543574
}
544575

545576
if spec.License.HasSecretName() {
@@ -554,7 +585,7 @@ func (r *Resources) createPodForMember(spec api.DeploymentSpec, memberID string,
554585
finalizers := r.createPodFinalizers(group)
555586
if err := k8sutil.CreateArangodPod(kubecli, spec.IsDevelopment(), apiObject, role, m.ID, m.PodName, m.PersistentVolumeClaimName, imageInfo.ImageID, lifecycleImage, alpineImage, spec.GetImagePullPolicy(),
556587
engine, requireUUID, terminationGracePeriod, args, env, finalizers, livenessProbe, readinessProbe, tolerations, serviceAccountName, tlsKeyfileSecretName, rocksdbEncryptionSecretName,
557-
groupSpec.GetNodeSelector()); err != nil {
588+
clusterJWTSecretName, groupSpec.GetNodeSelector()); err != nil {
558589
return maskAny(err)
559590
}
560591
log.Debug().Str("pod-name", m.PodName).Msg("Created pod")

‎pkg/logging/logger.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ var (
3636
// The defaultLevels list is used during development to increase the
3737
// default level for components that we care a little less about.
3838
defaultLevels = map[string]string{
39-
//"operator": "info",
40-
//"something.status": "info",
39+
//"operator": "info",
40+
//"something.status": "info",
4141
}
4242
)
4343

‎pkg/operator/operator_deployment_relication.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ func (o *Operator) onDeleteArangoDeploymentReplication(obj interface{}) {
109109
Str("name", apiObject.GetObjectMeta().GetName()).
110110
Msg("ArangoDeploymentReplication deleted")
111111
ev := &Event{
112-
Type: kwatch.Deleted,
112+
Type: kwatch.Deleted,
113113
DeploymentReplication: apiObject,
114114
}
115115

@@ -124,7 +124,7 @@ func (o *Operator) onDeleteArangoDeploymentReplication(obj interface{}) {
124124
// syncArangoDeploymentReplication synchronized the given deployment replication.
125125
func (o *Operator) syncArangoDeploymentReplication(apiObject *api.ArangoDeploymentReplication) {
126126
ev := &Event{
127-
Type: kwatch.Added,
127+
Type: kwatch.Added,
128128
DeploymentReplication: apiObject,
129129
}
130130
// re-watch or restart could give ADD event.

‎pkg/replication/deployment_replication.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ func New(config Config, deps Dependencies, apiObject *api.ArangoDeploymentReplic
112112
// This sends an update event in the event queue.
113113
func (dr *DeploymentReplication) Update(apiObject *api.ArangoDeploymentReplication) {
114114
dr.send(&deploymentReplicationEvent{
115-
Type: eventArangoDeploymentReplicationUpdated,
115+
Type: eventArangoDeploymentReplicationUpdated,
116116
DeploymentReplication: apiObject,
117117
})
118118
}

‎pkg/storage/pv_creator_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ func TestGetDeploymentInfo(t *testing.T) {
135135
ExpectedEnforceAntiAffinity bool
136136
}{
137137
{
138-
Input: v1.PersistentVolumeClaim{},
138+
Input: v1.PersistentVolumeClaim{},
139139
ExpectedDeploymentName: "",
140140
ExpectedRole: "",
141141
ExpectedEnforceAntiAffinity: false,

‎pkg/storage/pvc_informer.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,15 +54,15 @@ func (ls *LocalStorage) listenForPvcEvents() {
5454
AddFunc: func(obj interface{}) {
5555
if pvc, ok := getPvc(obj); ok {
5656
ls.send(&localStorageEvent{
57-
Type: eventPVCAdded,
57+
Type: eventPVCAdded,
5858
PersistentVolumeClaim: pvc,
5959
})
6060
}
6161
},
6262
UpdateFunc: func(oldObj, newObj interface{}) {
6363
if pvc, ok := getPvc(newObj); ok {
6464
ls.send(&localStorageEvent{
65-
Type: eventPVCUpdated,
65+
Type: eventPVCUpdated,
6666
PersistentVolumeClaim: pvc,
6767
})
6868
}

‎pkg/util/k8sutil/pods.go‎

Lines changed: 21 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -44,11 +44,12 @@ const (
4444
tlsKeyfileVolumeName = "tls-keyfile"
4545
lifecycleVolumeName = "lifecycle"
4646
clientAuthCAVolumeName = "client-auth-ca"
47-
clusterJWTSecretVolumeName = "cluster-jwt"
47+
ClusterJWTSecretVolumeName = "cluster-jwt"
4848
masterJWTSecretVolumeName = "master-jwt"
4949
rocksdbEncryptionVolumeName = "rocksdb-encryption"
5050
ArangodVolumeMountDir = "/data"
5151
RocksDBEncryptionVolumeMountDir = "/secrets/rocksdb/encryption"
52+
JWTSecretFileVolumeMountDir = "/secrets/jwt"
5253
TLSKeyfileVolumeMountDir = "/secrets/tls"
5354
LifecycleVolumeMountDir = "/lifecycle/tools"
5455
ClientAuthCAVolumeMountDir = "/secrets/client-auth/ca"
@@ -214,7 +215,7 @@ func masterJWTVolumeMounts() []v1.VolumeMount {
214215
func clusterJWTVolumeMounts() []v1.VolumeMount {
215216
return []v1.VolumeMount{
216217
{
217-
Name: clusterJWTSecretVolumeName,
218+
Name: ClusterJWTSecretVolumeName,
218219
MountPath: ClusterJWTSecretVolumeMountDir,
219220
},
220221
}
@@ -417,7 +418,7 @@ func CreateArangodPod(kubecli kubernetes.Interface, developmentMode bool, deploy
417418
engine string, requireUUID bool, terminationGracePeriod time.Duration,
418419
args []string, env map[string]EnvValue, finalizers []string,
419420
livenessProbe *HTTPProbeConfig, readinessProbe *HTTPProbeConfig, tolerations []v1.Toleration, serviceAccountName string,
420-
tlsKeyfileSecretName, rocksdbEncryptionSecretName string, nodeSelector map[string]string) error {
421+
tlsKeyfileSecretName, rocksdbEncryptionSecretName string, clusterJWTSecretName string, nodeSelector map[string]string) error {
421422
// Prepare basic pod
422423
p := newPod(deployment.GetName(), deployment.GetNamespace(), role, id, podName, finalizers, tolerations, serviceAccountName, nodeSelector)
423424
terminationGracePeriodSeconds := int64(math.Ceil(terminationGracePeriod.Seconds()))
@@ -447,6 +448,9 @@ func CreateArangodPod(kubecli kubernetes.Interface, developmentMode bool, deploy
447448
if rocksdbEncryptionSecretName != "" {
448449
c.VolumeMounts = append(c.VolumeMounts, rocksdbEncryptionVolumeMounts()...)
449450
}
451+
if ClusterJWTSecretVolumeName != "" {
452+
c.VolumeMounts = append(c.VolumeMounts, clusterJWTVolumeMounts()...)
453+
}
450454
p.Spec.Containers = append(p.Spec.Containers, c)
451455

452456
// Add UUID init container
@@ -503,6 +507,19 @@ func CreateArangodPod(kubecli kubernetes.Interface, developmentMode bool, deploy
503507
p.Spec.Volumes = append(p.Spec.Volumes, vol)
504508
}
505509

510+
// Cluster JWT secret mount (if any)
511+
if clusterJWTSecretName != "" {
512+
vol := v1.Volume{
513+
Name: ClusterJWTSecretVolumeName,
514+
VolumeSource: v1.VolumeSource{
515+
Secret: &v1.SecretVolumeSource{
516+
SecretName: clusterJWTSecretName,
517+
},
518+
},
519+
}
520+
p.Spec.Volumes = append(p.Spec.Volumes, vol)
521+
}
522+
506523
// Lifecycle volumes (if any)
507524
p.Spec.Volumes = append(p.Spec.Volumes, lifecycleVolumes...)
508525

@@ -603,7 +620,7 @@ func CreateArangoSyncPod(kubecli kubernetes.Interface, developmentMode bool, dep
603620
// Cluster JWT secret mount (if any)
604621
if clusterJWTSecretName != "" {
605622
vol := v1.Volume{
606-
Name: clusterJWTSecretVolumeName,
623+
Name: ClusterJWTSecretVolumeName,
607624
VolumeSource: v1.VolumeSource{
608625
Secret: &v1.SecretVolumeSource{
609626
SecretName: clusterJWTSecretName,

0 commit comments

Comments
 (0)