From ddd18caadb0c8e32b0ec36a4116e441622e0b5e6 Mon Sep 17 00:00:00 2001 From: Leonardo Rossetti Date: Sep 10 2021 11:41:48 +0000 Subject: [PATCH 1/5] removing mbbox references --- diff --git a/operator/roles/koji-builder/defaults/main.yml b/operator/roles/koji-builder/defaults/main.yml index 2044e89..87bf115 100644 --- a/operator/roles/koji-builder/defaults/main.yml +++ b/operator/roles/koji-builder/defaults/main.yml @@ -21,4 +21,4 @@ koji_builder_host_name: "{{ host_name | default('koji-hub:8443') }}" koji_builder_ssl_verify: "{{ ssl_verify | default(true) }}" koji_builder_shared_pvc: "{{ shared_pvc | default('koji-hub-mnt-pvc') }}" -koji_builder_mbox: "{{ mbox | default('') }}" + diff --git a/operator/roles/koji-builder/tasks/cert.yml b/operator/roles/koji-builder/tasks/cert.yml index e8cdc2e..7154560 100644 --- a/operator/roles/koji-builder/tasks/cert.yml +++ b/operator/roles/koji-builder/tasks/cert.yml @@ -12,11 +12,6 @@ suffix: koji register: koji_dir -- block: - - set_fact: - koji_builder_cacert_secret: "{{ k8s_mboxes.resources[0].spec.root_ca_secret_name }}" - when: koji_builder_mbox|length > 0 - - name: Check for koji-builder client secret existence k8s_info: api_version: v1 diff --git a/operator/roles/koji-builder/tasks/main.yml b/operator/roles/koji-builder/tasks/main.yml index 9961e7c..7e29bac 100644 --- a/operator/roles/koji-builder/tasks/main.yml +++ b/operator/roles/koji-builder/tasks/main.yml @@ -1,18 +1,7 @@ --- +- include_tasks: builders/repo.yml - set_fact: koji_builder_koji_hub_url: "https://{{ koji_builder_koji_hub_host }}.{{ meta.namespace }}.svc:{{ koji_builder_koji_hub_port }}" -- block: - - name: retrieve mbox resource - k8s_info: - api_version: apps.fedoraproject.org/v1alpha1 - kind: Mbox - namespace: "{{ meta.namespace }}" - name: "{{ koji_builder_mbox }}" - register: k8s_mboxes - - fail: - msg: "Failed to find mbox {{ koji_builder_mbox }} in namespace {{ meta.namespace }}" - when: k8s_mboxes.resources|length == 0 - when: koji_builder_mbox|length > 0 - block: - name: Ensure koji-builder configmap is updated From 15fb8beca2df3d22a5fff2f27121811796723e3a Mon Sep 17 00:00:00 2001 From: Leonardo Rossetti Date: Sep 11 2021 06:21:51 +0000 Subject: [PATCH 2/5] fix watch code format --- diff --git a/operator/watches.yaml b/operator/watches.yaml index 820c4c8..fa9d975 100644 --- a/operator/watches.yaml +++ b/operator/watches.yaml @@ -20,6 +20,7 @@ role: kojira vars: meta: '{{ ansible_operator_meta }}' + - version: v1alpha1 group: buildsys.apps.fedoraproject.org kind: KojiUser From 1ef928a0716b0f79c379e67570544ff8e69b4da5 Mon Sep 17 00:00:00 2001 From: Leonardo Rossetti Date: Sep 11 2021 06:22:42 +0000 Subject: [PATCH 3/5] use prper secret format and cert filename --- diff --git a/operator/molecule/default/tasks/kojibuilder_test.yml b/operator/molecule/default/tasks/kojibuilder_test.yml index cb158a8..6f2566e 100644 --- a/operator/molecule/default/tasks/kojibuilder_test.yml +++ b/operator/molecule/default/tasks/kojibuilder_test.yml @@ -39,8 +39,7 @@ that: - kojibuilder_client_secrets.resources|length == 1 - kojibuilder_client_secrets.resources[0].metadata.labels['app'] == 'koji-builder' - - "'tls.crt' in kojibuilder_client_secrets.resources[0].data" - - "'tls.key' in kojibuilder_client_secrets.resources[0].data" + - "'client.pem' in kojibuilder_client_secrets.resources[0].data" - block: - name: 'TEST: kojibuilder.pod deployment' diff --git a/operator/roles/koji-builder/tasks/cert.yml b/operator/roles/koji-builder/tasks/cert.yml index 7154560..5da5e05 100644 --- a/operator/roles/koji-builder/tasks/cert.yml +++ b/operator/roles/koji-builder/tasks/cert.yml @@ -1,17 +1,3 @@ -- name: create temporary cert directory - tempfile: - state: directory - prefix: kojibuilder - suffix: cert - register: cert_dir - -- name: create temporary koji directory - tempfile: - state: directory - prefix: kojibuilder - suffix: koji - register: koji_dir - - name: Check for koji-builder client secret existence k8s_info: api_version: v1 @@ -35,29 +21,29 @@ ca: "{{ k8s_secrets.resources[0] }}" - copy: content: "{{ ca.data.cert | b64decode }}" - dest: "{{ cert_dir.path }}/ca_cert.pem" + dest: "{{ koji_dir_path }}/ca_cert.pem" - copy: content: "{{ ca.data.key | b64decode }}" - dest: "{{ cert_dir.path }}/ca_key.pem" + dest: "{{ koji_dir_path }}/ca_key.pem" when: clientcert_query.resources|length == 0 - copy: content: "{{ ca.data.cert | b64decode }}" - dest: "{{ koji_dir.path }}/ca.pem" + dest: "{{ koji_dir_path }}/ca.pem" - name: Client certificate creation block: - openssl_privatekey: - path: "{{ cert_dir.path }}/client_key.pem" + path: "{{ koji_dir_path }}/client_key.pem" size: 4096 - openssl_csr: - path: "{{ cert_dir.path }}/client_req.pem" - privatekey_path: "{{ cert_dir.path }}/client_key.pem" + path: "{{ koji_dir_path }}/client_req.pem" + privatekey_path: "{{ koji_dir_path }}/client_key.pem" common_name: "{{ koji_builder_host_name }}" - openssl_certificate: - path: "{{ cert_dir.path }}/client_cert.pem" - csr_path: "{{ cert_dir.path }}/client_req.pem" - ownca_path: "{{ cert_dir.path }}/ca_cert.pem" - ownca_privatekey_path: "{{ cert_dir.path }}/ca_key.pem" + path: "{{ koji_dir_path }}/client_cert.pem" + csr_path: "{{ koji_dir_path }}/client_req.pem" + ownca_path: "{{ koji_dir_path }}/ca_cert.pem" + ownca_privatekey_path: "{{ koji_dir_path }}/ca_key.pem" provider: ownca when: clientcert_query.resources|length == 0 @@ -73,13 +59,8 @@ labels: app: koji-builder data: - tls.crt: "{{ lookup('file', cert_dir.path + '/client_cert.pem') | b64encode }}" - tls.key: "{{ lookup('file', cert_dir.path + '/client_key.pem') | b64encode }}" - tls.pem: "{{ (lookup('file', cert_dir.path + '/client_key.pem') + '\n' + lookup('file', cert_dir.path + '/client_cert.pem')) | b64encode }}" - type: kubernetes.io/tls + # tls.crt: "{{ lookup('file', koji_dir_path + '/client_cert.pem') | b64encode }}" + # tls.key: "{{ lookup('file', koji_dir_path + '/client_key.pem') | b64encode }}" + client.pem: "{{ (lookup('file', koji_dir_path + '/client_key.pem') + '\n' + lookup('file', koji_dir_path + '/client_cert.pem')) | b64encode }}" when: clientcert_query.resources|length == 0 -- name: cleanup - file: - path: "{{ cert_dir.path }}" - state: absent From 399ded4d878ecaa1cc07945c8e70345b37045599 Mon Sep 17 00:00:00 2001 From: Leonardo Rossetti Date: Sep 11 2021 06:23:12 +0000 Subject: [PATCH 4/5] implement koji builder 'repo' type --- diff --git a/operator/roles/koji-builder/defaults/main.yml b/operator/roles/koji-builder/defaults/main.yml index 87bf115..2c75626 100644 --- a/operator/roles/koji-builder/defaults/main.yml +++ b/operator/roles/koji-builder/defaults/main.yml @@ -21,4 +21,4 @@ koji_builder_host_name: "{{ host_name | default('koji-hub:8443') }}" koji_builder_ssl_verify: "{{ ssl_verify | default(true) }}" koji_builder_shared_pvc: "{{ shared_pvc | default('koji-hub-mnt-pvc') }}" - +koji_builder_type: "{{ type | default('repo') }}" diff --git a/operator/roles/koji-builder/tasks/builders/repo.yml b/operator/roles/koji-builder/tasks/builders/repo.yml new file mode 100644 index 0000000..c93aa24 --- /dev/null +++ b/operator/roles/koji-builder/tasks/builders/repo.yml @@ -0,0 +1,38 @@ +--- +- block: + - name: Download admin client certificate + k8s_info: + api_version: v1 + kind: Secret + namespace: "{{ meta.namespace }}" + name: "{{ koji_builder_admin_secret }}" + register: k8s_res + - fail: + msg: "Secret not found: {{ koji_builder_admin_secret }}" + when: k8s_res.resources|length == 0 + - set_fact: + koji_admin_secret: "{{ k8s_res.resources[0] | from_yaml }}" + - copy: + content: "{{ koji_admin_secret.data['client.pem'] | b64decode }}" + dest: "{{ koji_dir_path }}/admin.pem" + +- koji_host: + server: "{{ koji_builder_koji_hub_url }}/kojihub" + host: "{{ koji_builder_host_name }}" + archs: "{{ koji_builder_host_archs }}" + channels: [ "createrepo" ] + ssl_auth: + cert: "{{ koji_dir_path }}/admin.pem" + serverca: "{{ koji_dir_path }}/ca.pem" + verify: "{{ koji_builder_ssl_verify }}" + +- block: + - name: Apply koji-builder deployment + template: + src: deployment.yml.j2 + dest: "{{ koji_dir_path}}/deployment.yml" + - k8s: + state: present + src: "{{ koji_dir_path}}/deployment.yml" + wait: true + namespace: "{{ meta.namespace }}" diff --git a/operator/roles/koji-builder/tasks/main.yml b/operator/roles/koji-builder/tasks/main.yml index 7e29bac..87e91a8 100644 --- a/operator/roles/koji-builder/tasks/main.yml +++ b/operator/roles/koji-builder/tasks/main.yml @@ -1,78 +1,33 @@ --- -- include_tasks: builders/repo.yml +- name: Create temporary koji directory + tempfile: + state: directory + prefix: kojibuilder + suffix: koji + register: koji_dir + - set_fact: koji_builder_koji_hub_url: "https://{{ koji_builder_koji_hub_host }}.{{ meta.namespace }}.svc:{{ koji_builder_koji_hub_port }}" + koji_dir_path: "{{ koji_dir.path }}" + +- include_tasks: cert.yml - block: - name: Ensure koji-builder configmap is updated template: src: configmap.yml.j2 - dest: /tmp/configmap.yml + dest: "{{ koji_dir_path }}/configmap.yml" - k8s: state: present - src: /tmp/configmap.yml + src: "{{ koji_dir_path }}/configmap.yml" wait: true namespace: "{{ meta.namespace }}" - - file: - path: /tmp/configmap.yml - state: absent - -- include_tasks: cert.yml - -- block: - - name: retrieve and set shared pvc name var - k8s_info: - api_version: apps.fedoraproject.org/v1alpha1 - kind: Mbox - namespace: "{{ meta.namespace }}" - name: "{{ koji_builder_mbox }}" - register: k8s_mboxes - - fail: - msg: "Failed to find mbox {{ koji_builder_mbox }} in namespace {{ meta.namespace }}" - when: k8s_mboxes.resources|length == 0 - - set_fact: - koji_builder_pvc_name: "{{ k8s_mboxes.resources[0].spec.koji_pvc_name }}" - when: koji_builder_mbox|length > 0 + -- block: - - name: add default koji host - k8s_info: - api_version: v1 - kind: Secret - namespace: "{{ meta.namespace }}" - name: "{{ koji_builder_admin_secret }}" - register: k8s_res - - fail: - msg: "Secret not found: {{ koji_builder_admin_secret }}" - when: k8s_res.resources|length == 0 - - set_fact: - koji_admin_secret: "{{ k8s_res.resources[0] | from_yaml }}" - - copy: - content: "{{ koji_admin_secret.data['client.pem'] | b64decode }}" - dest: "{{ koji_dir.path }}/admin.pem" - - koji_host: - server: "{{ koji_builder_koji_hub_url }}/kojihub" - host: "{{ koji_builder_host_name }}" - archs: "{{ koji_builder_host_archs }}" - channels: "{{ koji_builder_host_channels }}" - ssl_auth: - cert: "{{ koji_dir.path }}/admin.pem" - serverca: "{{ koji_dir.path }}/ca.pem" - verify: "{{ koji_builder_ssl_verify }}" - - file: - state: absent - path: "{{ koji_dir.path }}" +- include_tasks: builders/repo.yml + when: "koji_builder_type == 'repo'" -- block: - - name: Apply koji-builder deployment - template: - src: deployment.yml.j2 - dest: /tmp/deployment.yml - - k8s: - state: present - src: /tmp/deployment.yml - wait: true - namespace: "{{ meta.namespace }}" - - file: - path: /tmp/deployment.yml - state: absent +- name: Remove temporary koji directory + file: + path: "{{ koji_dir_path }}" + state: absent diff --git a/operator/roles/koji-builder/templates/configmap.yml.j2 b/operator/roles/koji-builder/templates/configmap.yml.j2 index 8cc4696..5972866 100644 --- a/operator/roles/koji-builder/templates/configmap.yml.j2 +++ b/operator/roles/koji-builder/templates/configmap.yml.j2 @@ -19,6 +19,6 @@ data: plugins= ; Configuration authentication - serverca = /etc/cacert/cert - cert=/etc/clientcert/tls.pem + serverca = /etc/certs/ca/cert + cert=/etc/certs/client/client.pem diff --git a/operator/roles/koji-builder/templates/deployment.yml.j2 b/operator/roles/koji-builder/templates/deployment.yml.j2 index f0c44c7..7290867 100644 --- a/operator/roles/koji-builder/templates/deployment.yml.j2 +++ b/operator/roles/koji-builder/templates/deployment.yml.j2 @@ -1,7 +1,7 @@ apiVersion: apps/v1 kind: Deployment metadata: - name: koji-builder + name: "{{ meta.name }}" labels: app: koji-builder spec: @@ -15,7 +15,7 @@ spec: app: koji-builder spec: containers: - - name: koji-builder + - name: builder image: {{ koji_builder_image }} resources: {} livenessProbe: @@ -30,10 +30,10 @@ spec: mountPath: /etc/kojid readOnly: true - name: cacert-volume - mountPath: /etc/cacert + mountPath: /etc/certs/ca readOnly: true - name: client-cert-volume - mountPath: /etc/clientcert + mountPath: /etc/certs/client readOnly: true - name: koji-builder-mnt mountPath: /mnt/koji From 2fae73a8175dbff7adc93607be6baebae104bf96 Mon Sep 17 00:00:00 2001 From: Leonardo Rossetti Date: Sep 11 2021 06:24:21 +0000 Subject: [PATCH 5/5] add type in sample file --- diff --git a/operator/config/samples/buildsys_v1alpha1_kojibuilder.yaml b/operator/config/samples/buildsys_v1alpha1_kojibuilder.yaml index e0b8a37..4e22508 100644 --- a/operator/config/samples/buildsys_v1alpha1_kojibuilder.yaml +++ b/operator/config/samples/buildsys_v1alpha1_kojibuilder.yaml @@ -4,6 +4,7 @@ metadata: name: sample spec: image: quay.io/fedora/koji-builder:f34 + type: repo replicas: 1 configmap: koji-builder-configmap cacert_secret: koji-hub-ca-cert @@ -12,12 +13,8 @@ spec: koji_hub_host: 'koji-hub' koji_hub_port: 8443 max_jobs: 5 - vendor: MBox host_archs: - x86_64 - host_channels: - - default - - createrepo host_name: mbbox.default ssl_verify: false shared_pvc: koji-hub-mnt-pvc