Skip to content

Add per-node secret rotation tracking with drift detection #1781

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lmiccini wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add per-node secret rotation tracking with drift detection #1781

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions api/bases/dataplane.openstack.org_openstackdataplanenodesets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1983,6 +1983,35 @@ spec:
generation, then the controller has not processed the latest changes.
format: int64
type: integer
secretDeployment:
description: |-
SecretDeployment tracks secret deployment progress across nodeset nodes
Details are stored in a ConfigMap to avoid bloating the CR status
properties:
allNodesUpdated:
description: AllNodesUpdated indicates all nodes have current
versions of all tracked secrets
type: boolean
configMapName:
description: ConfigMapName references the ConfigMap containing
detailed per-secret tracking
type: string
lastUpdateTime:
description: LastUpdateTime is when this status was last updated
format: date-time
type: string
totalNodes:
description: TotalNodes is the total number of nodes in the nodeset
type: integer
updatedNodes:
description: UpdatedNodes is count of nodes with all current secret
versions
type: integer
required:
- allNodesUpdated
- totalNodes
- updatedNodes
type: object
secretHashes:
additionalProperties:
type: string
Expand Down
30 changes: 30 additions & 0 deletions api/dataplane/v1beta1/openstackdataplanenodeset_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,28 @@ type OpenStackDataPlaneNodeSetStatus struct {

//DeployedBmhHash - Hash of BMHs deployed
DeployedBmhHash string `json:"deployedBmhHash,omitempty"`

// SecretDeployment tracks secret deployment progress across nodeset nodes
// Details are stored in a ConfigMap to avoid bloating the CR status
SecretDeployment *SecretDeploymentStatus `json:"secretDeployment,omitempty"`
}

// SecretDeploymentStatus tracks secret deployment progress across nodeset nodes
type SecretDeploymentStatus struct {
// AllNodesUpdated indicates all nodes have current versions of all tracked secrets
AllNodesUpdated bool `json:"allNodesUpdated"`

// TotalNodes is the total number of nodes in the nodeset
TotalNodes int `json:"totalNodes"`

// UpdatedNodes is count of nodes with all current secret versions
UpdatedNodes int `json:"updatedNodes"`

// ConfigMapName references the ConfigMap containing detailed per-secret tracking
ConfigMapName string `json:"configMapName,omitempty"`

// LastUpdateTime is when this status was last updated
LastUpdateTime *metav1.Time `json:"lastUpdateTime,omitempty"`
}

// +kubebuilder:object:root=true
Expand All @@ -180,6 +202,14 @@ func (instance OpenStackDataPlaneNodeSet) IsReady() bool {
return instance.Status.Conditions.IsTrue(condition.ReadyCondition)
}

// AreAllNodesUpdated returns true if all nodes in the nodeset have been updated
// with current versions of all tracked secrets. Returns false if secret deployment
// tracking is not initialized or if any nodes have pending updates.
func (instance OpenStackDataPlaneNodeSet) AreAllNodesUpdated() bool {
return instance.Status.SecretDeployment != nil &&
instance.Status.SecretDeployment.AllNodesUpdated
}

// InitConditions - Initializes Status Conditons
func (instance *OpenStackDataPlaneNodeSet) InitConditions() {
instance.Status.Conditions = condition.Conditions{}
Expand Down
24 changes: 24 additions & 0 deletions api/dataplane/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions api/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,3 +143,5 @@ replace k8s.io/code-generator => k8s.io/code-generator v0.31.14 //allow-merging
replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging

replace github.com/cert-manager/cmctl/v2 => github.com/cert-manager/cmctl/v2 v2.1.2-0.20241127223932-88edb96860cf //allow-merging

replace github.com/openstack-k8s-operators/infra-operator/apis => github.com/lmiccini/infra-operator/apis v0.0.0-20260222082458-c85cbd18d081
4 changes: 2 additions & 2 deletions api/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
github.com/lmiccini/infra-operator/apis v0.0.0-20260222082458-c85cbd18d081 h1:/3rSCXn81bxZr7HEKGOTD0q9y60z5Ig6RelBx3IdmL4=
github.com/lmiccini/infra-operator/apis v0.0.0-20260222082458-c85cbd18d081/go.mod h1:hq7nh72XvzXS/qRU9h9QWRcpx7dLja+Y9twJ8NkWG7E=
github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
Expand Down Expand Up @@ -126,8 +128,6 @@ github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260212121707-580
github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260212121707-58003d674ab0/go.mod h1:Rrcqdhx2Af6TNdCrltujHnOeEZrEN4KB+NjhdnR4W5E=
github.com/openstack-k8s-operators/horizon-operator/api v0.6.1-0.20260212123139-a77cc1069d1e h1:ShxiQmVutTCga4ngfVv1EjphEqP1EU1B27/cWV4zpso=
github.com/openstack-k8s-operators/horizon-operator/api v0.6.1-0.20260212123139-a77cc1069d1e/go.mod h1:wQfIVVKxv/ct6+r6BeRo3JoV0INjqaC08B6KdlhkAhI=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260212124933-d2541a526cd3 h1:U6CAq9B6Ta/i089/ADVsyruBOvzZEJHaSWAO+s03jDA=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260212124933-d2541a526cd3/go.mod h1:5hS/cVzc/HURwsbp4MMNwgqAl5bUqKvJdK+4irXeymE=
github.com/openstack-k8s-operators/ironic-operator/api v0.6.1-0.20260212132719-11326f1b1dc5 h1:wCmtfb35vLARf5f/5YVoJBIW3U4RHvluJp3zIF1wdbA=
github.com/openstack-k8s-operators/ironic-operator/api v0.6.1-0.20260212132719-11326f1b1dc5/go.mod h1:2ZR33ifyn38qwNI9tIHcebxMCFDQPvwEIPYrGDxrDcU=
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260212134514-510b47405111 h1:5+mrqOjaEZR9DEYAgxw8XO2lrGtnQZo3XXXRMPzt8lA=
Expand Down
29 changes: 29 additions & 0 deletions bindata/crds/crds.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20553,6 +20553,35 @@ spec:
generation, then the controller has not processed the latest changes.
format: int64
type: integer
secretDeployment:
description: |-
SecretDeployment tracks secret deployment progress across nodeset nodes
Details are stored in a ConfigMap to avoid bloating the CR status
properties:
allNodesUpdated:
description: AllNodesUpdated indicates all nodes have current
versions of all tracked secrets
type: boolean
configMapName:
description: ConfigMapName references the ConfigMap containing
detailed per-secret tracking
type: string
lastUpdateTime:
description: LastUpdateTime is when this status was last updated
format: date-time
type: string
totalNodes:
description: TotalNodes is the total number of nodes in the nodeset
type: integer
updatedNodes:
description: UpdatedNodes is count of nodes with all current secret
versions
type: integer
required:
- allNodesUpdated
- totalNodes
- updatedNodes
type: object
secretHashes:
additionalProperties:
type: string
Expand Down
8 changes: 8 additions & 0 deletions bindata/rbac/infra-operator-rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,14 @@ rules:
- get
- list
- watch
- apiGroups:
- dataplane.openstack.org
resources:
- openstackdataplanenodesets
verbs:
- get
- list
- watch
- apiGroups:
- frrk8s.metallb.io
resources:
Expand Down
8 changes: 8 additions & 0 deletions bindata/rbac/rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -655,6 +655,14 @@ rules:
- patch
- update
- watch
- apiGroups:
- rabbitmq.openstack.org
resources:
- rabbitmqusers
verbs:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
Expand Down
7 changes: 4 additions & 3 deletions cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -337,9 +337,10 @@ func main() {
os.Exit(1)
}
if err := (&dataplanecontroller.OpenStackDataPlaneNodeSetReconciler{
Client: mgr.GetClient(),
Scheme: mgr.GetScheme(),
Kclient: kclient,
Client: mgr.GetClient(),
APIReader: mgr.GetAPIReader(),
Scheme: mgr.GetScheme(),
Kclient: kclient,
}).SetupWithManager(ctx, mgr); err != nil {
setupLog.Error(err, "unable to create controller", "controller", "OpenStackDataPlaneNodeSet")
os.Exit(1)
Expand Down
29 changes: 29 additions & 0 deletions config/crd/bases/dataplane.openstack.org_openstackdataplanenodesets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1983,6 +1983,35 @@ spec:
generation, then the controller has not processed the latest changes.
format: int64
type: integer
secretDeployment:
description: |-
SecretDeployment tracks secret deployment progress across nodeset nodes
Details are stored in a ConfigMap to avoid bloating the CR status
properties:
allNodesUpdated:
description: AllNodesUpdated indicates all nodes have current
versions of all tracked secrets
type: boolean
configMapName:
description: ConfigMapName references the ConfigMap containing
detailed per-secret tracking
type: string
lastUpdateTime:
description: LastUpdateTime is when this status was last updated
format: date-time
type: string
totalNodes:
description: TotalNodes is the total number of nodes in the nodeset
type: integer
updatedNodes:
description: UpdatedNodes is count of nodes with all current secret
versions
type: integer
required:
- allNodesUpdated
- totalNodes
- updatedNodes
type: object
secretHashes:
additionalProperties:
type: string
Expand Down
3 changes: 3 additions & 0 deletions config/manifests/bases/openstack-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -376,6 +376,9 @@ spec:
Resource
displayName: Template
path: openstackclient.template
- description: List of environment variables to set in the container.
displayName: Env
path: openstackclient.template.env
- description: Ovn - Overrides to use when creating the OVN Services
displayName: Ovn
path: ovn
Expand Down
2 changes: 1 addition & 1 deletion config/operator/manager_operator_images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ spec:
- name: RELATED_IMAGE_HORIZON_OPERATOR_MANAGER_IMAGE_URL
value: quay.io/openstack-k8s-operators/horizon-operator@sha256:9f2e1299d908411457e53b49e1062265d2b9d76f6719db24d1be9347c388e4da
- name: RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL
value: quay.io/openstack-k8s-operators/infra-operator@sha256:aef5ea3dc1d4f5b63416ee1cc12d0360a64229bb3fb954be3dd85eec8f4ae62a
value: quay.io/lmiccini/infra-operator@sha256:ef246f0417ce7731b24893cd8fe6d0ccd6d82765e3e8473786bdd00ab6f5cdf3
- name: RELATED_IMAGE_IRONIC_OPERATOR_MANAGER_IMAGE_URL
value: quay.io/openstack-k8s-operators/ironic-operator@sha256:7e1b0b7b172ad0d707ab80dd72d609e1d0f5bbd38a22c24a28ed0f17a960c867
- name: RELATED_IMAGE_KEYSTONE_OPERATOR_MANAGER_IMAGE_URL
Expand Down
8 changes: 8 additions & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -606,6 +606,14 @@ rules:
- patch
- update
- watch
- apiGroups:
- rabbitmq.openstack.org
resources:
- rabbitmqusers
verbs:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
Expand Down
2 changes: 2 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,3 +181,5 @@ replace k8s.io/code-generator => k8s.io/code-generator v0.31.14 //allow-merging
replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging

replace github.com/cert-manager/cmctl/v2 => github.com/cert-manager/cmctl/v2 v2.1.2-0.20241127223932-88edb96860cf //allow-merging

replace github.com/openstack-k8s-operators/infra-operator/apis => github.com/lmiccini/infra-operator/apis v0.0.0-20260222082458-c85cbd18d081
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
github.com/lmiccini/infra-operator/apis v0.0.0-20260222082458-c85cbd18d081 h1:/3rSCXn81bxZr7HEKGOTD0q9y60z5Ig6RelBx3IdmL4=
github.com/lmiccini/infra-operator/apis v0.0.0-20260222082458-c85cbd18d081/go.mod h1:hq7nh72XvzXS/qRU9h9QWRcpx7dLja+Y9twJ8NkWG7E=
github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
Expand Down Expand Up @@ -150,8 +152,6 @@ github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260212121707-580
github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260212121707-58003d674ab0/go.mod h1:Rrcqdhx2Af6TNdCrltujHnOeEZrEN4KB+NjhdnR4W5E=
github.com/openstack-k8s-operators/horizon-operator/api v0.6.1-0.20260212123139-a77cc1069d1e h1:ShxiQmVutTCga4ngfVv1EjphEqP1EU1B27/cWV4zpso=
github.com/openstack-k8s-operators/horizon-operator/api v0.6.1-0.20260212123139-a77cc1069d1e/go.mod h1:wQfIVVKxv/ct6+r6BeRo3JoV0INjqaC08B6KdlhkAhI=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260212124933-d2541a526cd3 h1:U6CAq9B6Ta/i089/ADVsyruBOvzZEJHaSWAO+s03jDA=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260212124933-d2541a526cd3/go.mod h1:5hS/cVzc/HURwsbp4MMNwgqAl5bUqKvJdK+4irXeymE=
github.com/openstack-k8s-operators/ironic-operator/api v0.6.1-0.20260212132719-11326f1b1dc5 h1:wCmtfb35vLARf5f/5YVoJBIW3U4RHvluJp3zIF1wdbA=
github.com/openstack-k8s-operators/ironic-operator/api v0.6.1-0.20260212132719-11326f1b1dc5/go.mod h1:2ZR33ifyn38qwNI9tIHcebxMCFDQPvwEIPYrGDxrDcU=
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260212134514-510b47405111 h1:5+mrqOjaEZR9DEYAgxw8XO2lrGtnQZo3XXXRMPzt8lA=
Expand Down
2 changes: 1 addition & 1 deletion hack/export_operator_related_images.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ export RELATED_IMAGE_DESIGNATE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-
export RELATED_IMAGE_GLANCE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/glance-operator@sha256:1ab3ec59cd8e30dd8423e91ad832403bdefbae3b8ac47e15578d5a677d7ba0df
export RELATED_IMAGE_HEAT_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/heat-operator@sha256:e8a675284ff97a1d3f0f07583863be20b20b4aa48ebb34dbc80d83fe39d757b2
export RELATED_IMAGE_HORIZON_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/horizon-operator@sha256:9f2e1299d908411457e53b49e1062265d2b9d76f6719db24d1be9347c388e4da
export RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/infra-operator@sha256:aef5ea3dc1d4f5b63416ee1cc12d0360a64229bb3fb954be3dd85eec8f4ae62a
export RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL=quay.io/lmiccini/infra-operator@sha256:ef246f0417ce7731b24893cd8fe6d0ccd6d82765e3e8473786bdd00ab6f5cdf3
export RELATED_IMAGE_IRONIC_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/ironic-operator@sha256:7e1b0b7b172ad0d707ab80dd72d609e1d0f5bbd38a22c24a28ed0f17a960c867
export RELATED_IMAGE_KEYSTONE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/keystone-operator@sha256:c6ad383f55f955902b074d1ee947a2233a5fcbf40698479ae693ce056c80dcc1
export RELATED_IMAGE_MANILA_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/manila-operator@sha256:8fb0a33b8d93cf9f84f079af5f2ceb680afada4e44542514959146779f57f64c
Expand Down
Loading
Loading