Skip to content

Add per-node secret rotation tracking with drift detection #1781

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lmiccini wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add per-node secret rotation tracking with drift detection #1781

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions api/bases/dataplane.openstack.org_openstackdataplanenodesets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1983,6 +1983,35 @@ spec:
generation, then the controller has not processed the latest changes.
format: int64
type: integer
secretDeployment:
description: |-
SecretDeployment tracks secret deployment progress across nodeset nodes
Details are stored in a ConfigMap to avoid bloating the CR status
properties:
allNodesUpdated:
description: AllNodesUpdated indicates all nodes have current
versions of all tracked secrets
type: boolean
configMapName:
description: ConfigMapName references the ConfigMap containing
detailed per-secret tracking
type: string
lastUpdateTime:
description: LastUpdateTime is when this status was last updated
format: date-time
type: string
totalNodes:
description: TotalNodes is the total number of nodes in the nodeset
type: integer
updatedNodes:
description: UpdatedNodes is count of nodes with all current secret
versions
type: integer
required:
- allNodesUpdated
- totalNodes
- updatedNodes
type: object
secretHashes:
additionalProperties:
type: string
Expand Down
30 changes: 30 additions & 0 deletions api/dataplane/v1beta1/openstackdataplanenodeset_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,28 @@ type OpenStackDataPlaneNodeSetStatus struct {

//DeployedBmhHash - Hash of BMHs deployed
DeployedBmhHash string `json:"deployedBmhHash,omitempty"`

// SecretDeployment tracks secret deployment progress across nodeset nodes
// Details are stored in a ConfigMap to avoid bloating the CR status
SecretDeployment *SecretDeploymentStatus `json:"secretDeployment,omitempty"`
}

// SecretDeploymentStatus tracks secret deployment progress across nodeset nodes
type SecretDeploymentStatus struct {
// AllNodesUpdated indicates all nodes have current versions of all tracked secrets
AllNodesUpdated bool `json:"allNodesUpdated"`

// TotalNodes is the total number of nodes in the nodeset
TotalNodes int `json:"totalNodes"`

// UpdatedNodes is count of nodes with all current secret versions
UpdatedNodes int `json:"updatedNodes"`

// ConfigMapName references the ConfigMap containing detailed per-secret tracking
ConfigMapName string `json:"configMapName,omitempty"`

// LastUpdateTime is when this status was last updated
LastUpdateTime *metav1.Time `json:"lastUpdateTime,omitempty"`
}

// +kubebuilder:object:root=true
Expand All @@ -180,6 +202,14 @@ func (instance OpenStackDataPlaneNodeSet) IsReady() bool {
return instance.Status.Conditions.IsTrue(condition.ReadyCondition)
}

// AreAllNodesUpdated returns true if all nodes in the nodeset have been updated
// with current versions of all tracked secrets. Returns false if secret deployment
// tracking is not initialized or if any nodes have pending updates.
func (instance OpenStackDataPlaneNodeSet) AreAllNodesUpdated() bool {
return instance.Status.SecretDeployment != nil &&
instance.Status.SecretDeployment.AllNodesUpdated
}

// InitConditions - Initializes Status Conditons
func (instance *OpenStackDataPlaneNodeSet) InitConditions() {
instance.Status.Conditions = condition.Conditions{}
Expand Down
24 changes: 24 additions & 0 deletions api/dataplane/v1beta1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 2 additions & 0 deletions api/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,3 +143,5 @@ replace k8s.io/code-generator => k8s.io/code-generator v0.31.14 //allow-merging
replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging

replace github.com/cert-manager/cmctl/v2 => github.com/cert-manager/cmctl/v2 v2.1.2-0.20241127223932-88edb96860cf //allow-merging

replace github.com/openstack-k8s-operators/infra-operator/apis => github.com/lmiccini/infra-operator/apis v0.0.0-20260305173326-b5e2b69b7528
4 changes: 2 additions & 2 deletions api/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
github.com/lmiccini/infra-operator/apis v0.0.0-20260305173326-b5e2b69b7528 h1:ycxOb+7knjg1j0tuA15TOhiC2wGtOUjk260XDtQ+6ig=
github.com/lmiccini/infra-operator/apis v0.0.0-20260305173326-b5e2b69b7528/go.mod h1:tv2jcffX2OtznllHNwNy3AxUdXzYcRq8vIxHcIKc9nU=
github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
Expand Down Expand Up @@ -126,8 +128,6 @@ github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260224124345-771
github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260224124345-771b1609979a/go.mod h1:oCU2YPu91BPMRN8a+gKcct3GRXGaIuBj9JAN73nO4dY=
github.com/openstack-k8s-operators/horizon-operator/api v0.6.1-0.20260223151854-36176307c2c1 h1:P+yf2BZz5dR5BW8eUHcNK1aQmnHviFZwa0A3D9WPM3g=
github.com/openstack-k8s-operators/horizon-operator/api v0.6.1-0.20260223151854-36176307c2c1/go.mod h1:rbJiGqYQIGdbfCLienv6qrzC2ve8pl8zhim7Atwe6wE=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260226150302-364bc9caac2c h1:JokgOl3nOi+GxYDHsw/Y1zKYFHFOfzLlhMtm39Jig4E=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260226150302-364bc9caac2c/go.mod h1:5hS/cVzc/HURwsbp4MMNwgqAl5bUqKvJdK+4irXeymE=
github.com/openstack-k8s-operators/ironic-operator/api v0.6.1-0.20260223140038-38453280e869 h1:YEBKRN4/vaCzg+jm/7MQwF1R7vsssbgGZIlU4GseF10=
github.com/openstack-k8s-operators/ironic-operator/api v0.6.1-0.20260223140038-38453280e869/go.mod h1:rwSopRg6m3xK0KVu8UZ7w3UXhInil/5W4qJMOoAH3VE=
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260226214115-ba279900835f h1:kww9uX/ai4jkYhH4zzVNqSp4ea5rt1YHJfNmZVUeeOo=
Expand Down
29 changes: 29 additions & 0 deletions bindata/crds/crds.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20901,6 +20901,35 @@ spec:
generation, then the controller has not processed the latest changes.
format: int64
type: integer
secretDeployment:
description: |-
SecretDeployment tracks secret deployment progress across nodeset nodes
Details are stored in a ConfigMap to avoid bloating the CR status
properties:
allNodesUpdated:
description: AllNodesUpdated indicates all nodes have current
versions of all tracked secrets
type: boolean
configMapName:
description: ConfigMapName references the ConfigMap containing
detailed per-secret tracking
type: string
lastUpdateTime:
description: LastUpdateTime is when this status was last updated
format: date-time
type: string
totalNodes:
description: TotalNodes is the total number of nodes in the nodeset
type: integer
updatedNodes:
description: UpdatedNodes is count of nodes with all current secret
versions
type: integer
required:
- allNodesUpdated
- totalNodes
- updatedNodes
type: object
secretHashes:
additionalProperties:
type: string
Expand Down
8 changes: 8 additions & 0 deletions bindata/rbac/infra-operator-rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,14 @@ rules:
- get
- list
- watch
- apiGroups:
- dataplane.openstack.org
resources:
- openstackdataplanenodesets
verbs:
- get
- list
- watch
- apiGroups:
- frrk8s.metallb.io
resources:
Expand Down
8 changes: 8 additions & 0 deletions bindata/rbac/rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -655,6 +655,14 @@ rules:
- patch
- update
- watch
- apiGroups:
- rabbitmq.openstack.org
resources:
- rabbitmqusers
verbs:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
Expand Down
7 changes: 4 additions & 3 deletions cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -337,9 +337,10 @@ func main() {
os.Exit(1)
}
if err := (&dataplanecontroller.OpenStackDataPlaneNodeSetReconciler{
Client: mgr.GetClient(),
Scheme: mgr.GetScheme(),
Kclient: kclient,
Client: mgr.GetClient(),
APIReader: mgr.GetAPIReader(),
Scheme: mgr.GetScheme(),
Kclient: kclient,
}).SetupWithManager(ctx, mgr); err != nil {
setupLog.Error(err, "unable to create controller", "controller", "OpenStackDataPlaneNodeSet")
os.Exit(1)
Expand Down
29 changes: 29 additions & 0 deletions config/crd/bases/dataplane.openstack.org_openstackdataplanenodesets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1983,6 +1983,35 @@ spec:
generation, then the controller has not processed the latest changes.
format: int64
type: integer
secretDeployment:
description: |-
SecretDeployment tracks secret deployment progress across nodeset nodes
Details are stored in a ConfigMap to avoid bloating the CR status
properties:
allNodesUpdated:
description: AllNodesUpdated indicates all nodes have current
versions of all tracked secrets
type: boolean
configMapName:
description: ConfigMapName references the ConfigMap containing
detailed per-secret tracking
type: string
lastUpdateTime:
description: LastUpdateTime is when this status was last updated
format: date-time
type: string
totalNodes:
description: TotalNodes is the total number of nodes in the nodeset
type: integer
updatedNodes:
description: UpdatedNodes is count of nodes with all current secret
versions
type: integer
required:
- allNodesUpdated
- totalNodes
- updatedNodes
type: object
secretHashes:
additionalProperties:
type: string
Expand Down
3 changes: 3 additions & 0 deletions config/manifests/bases/openstack-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -376,6 +376,9 @@ spec:
Resource
displayName: Template
path: openstackclient.template
- description: List of environment variables to set in the container.
displayName: Env
path: openstackclient.template.env
- description: Ovn - Overrides to use when creating the OVN Services
displayName: Ovn
path: ovn
Expand Down
2 changes: 1 addition & 1 deletion config/operator/manager_operator_images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ spec:
- name: RELATED_IMAGE_HORIZON_OPERATOR_MANAGER_IMAGE_URL
value: quay.io/openstack-k8s-operators/horizon-operator@sha256:114c0dee0bab1d453890e9dcc7727de749055bdbea049384d5696e7ac8d78fe3
- name: RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL
value: quay.io/openstack-k8s-operators/infra-operator@sha256:e97889bd4dd6896d3272e1237f231c79ecc661730a8a757a527ec6c6716908e5
value: quay.io/lmiccini/infra-operator@sha256:5c823e50e4dbe3b4200b37069023bea10ca702ba783ce7e2e83f0e76497c288e
- name: RELATED_IMAGE_IRONIC_OPERATOR_MANAGER_IMAGE_URL
value: quay.io/openstack-k8s-operators/ironic-operator@sha256:e41dfadd2c3bbcae29f8c43cd2feea6724a48cdef127d65d1d37816bb9945a01
- name: RELATED_IMAGE_KEYSTONE_OPERATOR_MANAGER_IMAGE_URL
Expand Down
8 changes: 8 additions & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -606,6 +606,14 @@ rules:
- patch
- update
- watch
- apiGroups:
- rabbitmq.openstack.org
resources:
- rabbitmqusers
verbs:
- get
- list
- watch
- apiGroups:
- rbac.authorization.k8s.io
resources:
Expand Down
2 changes: 2 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,3 +181,5 @@ replace k8s.io/code-generator => k8s.io/code-generator v0.31.14 //allow-merging
replace k8s.io/component-base => k8s.io/component-base v0.31.14 //allow-merging

replace github.com/cert-manager/cmctl/v2 => github.com/cert-manager/cmctl/v2 v2.1.2-0.20241127223932-88edb96860cf //allow-merging

replace github.com/openstack-k8s-operators/infra-operator/apis => github.com/lmiccini/infra-operator/apis v0.0.0-20260305173326-b5e2b69b7528
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
github.com/lmiccini/infra-operator/apis v0.0.0-20260305173326-b5e2b69b7528 h1:ycxOb+7knjg1j0tuA15TOhiC2wGtOUjk260XDtQ+6ig=
github.com/lmiccini/infra-operator/apis v0.0.0-20260305173326-b5e2b69b7528/go.mod h1:tv2jcffX2OtznllHNwNy3AxUdXzYcRq8vIxHcIKc9nU=
github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
github.com/maruel/natural v1.1.1 h1:Hja7XhhmvEFhcByqDoHz9QZbkWey+COd9xWfCfn1ioo=
Expand Down Expand Up @@ -150,8 +152,6 @@ github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260224124345-771
github.com/openstack-k8s-operators/heat-operator/api v0.6.1-0.20260224124345-771b1609979a/go.mod h1:oCU2YPu91BPMRN8a+gKcct3GRXGaIuBj9JAN73nO4dY=
github.com/openstack-k8s-operators/horizon-operator/api v0.6.1-0.20260223151854-36176307c2c1 h1:P+yf2BZz5dR5BW8eUHcNK1aQmnHviFZwa0A3D9WPM3g=
github.com/openstack-k8s-operators/horizon-operator/api v0.6.1-0.20260223151854-36176307c2c1/go.mod h1:rbJiGqYQIGdbfCLienv6qrzC2ve8pl8zhim7Atwe6wE=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260226150302-364bc9caac2c h1:JokgOl3nOi+GxYDHsw/Y1zKYFHFOfzLlhMtm39Jig4E=
github.com/openstack-k8s-operators/infra-operator/apis v0.6.1-0.20260226150302-364bc9caac2c/go.mod h1:5hS/cVzc/HURwsbp4MMNwgqAl5bUqKvJdK+4irXeymE=
github.com/openstack-k8s-operators/ironic-operator/api v0.6.1-0.20260223140038-38453280e869 h1:YEBKRN4/vaCzg+jm/7MQwF1R7vsssbgGZIlU4GseF10=
github.com/openstack-k8s-operators/ironic-operator/api v0.6.1-0.20260223140038-38453280e869/go.mod h1:rwSopRg6m3xK0KVu8UZ7w3UXhInil/5W4qJMOoAH3VE=
github.com/openstack-k8s-operators/keystone-operator/api v0.6.1-0.20260226214115-ba279900835f h1:kww9uX/ai4jkYhH4zzVNqSp4ea5rt1YHJfNmZVUeeOo=
Expand Down
2 changes: 1 addition & 1 deletion hack/export_operator_related_images.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ export RELATED_IMAGE_DESIGNATE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-
export RELATED_IMAGE_GLANCE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/glance-operator@sha256:81e43c058d9af1d3bc31704010c630bc2a574c2ee388aa0ffe8c7b9621a7d051
export RELATED_IMAGE_HEAT_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/heat-operator@sha256:ee642fcf655f9897d480460008cba2e98b497d3ffdf7ab1d48ea460eb20c2053
export RELATED_IMAGE_HORIZON_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/horizon-operator@sha256:114c0dee0bab1d453890e9dcc7727de749055bdbea049384d5696e7ac8d78fe3
export RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/infra-operator@sha256:e97889bd4dd6896d3272e1237f231c79ecc661730a8a757a527ec6c6716908e5
export RELATED_IMAGE_INFRA_OPERATOR_MANAGER_IMAGE_URL=quay.io/lmiccini/infra-operator@sha256:5c823e50e4dbe3b4200b37069023bea10ca702ba783ce7e2e83f0e76497c288e
export RELATED_IMAGE_IRONIC_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/ironic-operator@sha256:e41dfadd2c3bbcae29f8c43cd2feea6724a48cdef127d65d1d37816bb9945a01
export RELATED_IMAGE_KEYSTONE_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/keystone-operator@sha256:9d723ab33964ee44704eed3223b64e828349d45dee04695434a6fcf4b6807d4c
export RELATED_IMAGE_MANILA_OPERATOR_MANAGER_IMAGE_URL=quay.io/openstack-k8s-operators/manila-operator@sha256:f1158ec4d879c4646eee4323bc501eba4d377beb2ad6fbe08ed30070c441ac26
Expand Down
Loading
Loading