Add TLS support to more control plane services

pkg/controlplane/heat.go

@@ -14,11 +14,11 @@ func Heat(instance *openstackv1beta1.ControlPlane) *openstackv1beta1.Heat {
 
 	spec.API.Ingress = ingressDefaults(spec.API.Ingress, instance, "heat")
 	spec.API.NodeSelector = controllerNodeSelector(spec.API.NodeSelector, instance)
-	// spec.API.TLS = tlsServerDefaults(spec.API.TLS, instance)
+	spec.API.TLS = tlsServerDefaults(spec.API.TLS, instance)
 
 	spec.CFN.Ingress = ingressDefaults(spec.CFN.Ingress, instance, "heat-cfn")
 	spec.CFN.NodeSelector = controllerNodeSelector(spec.CFN.NodeSelector, instance)
-	// spec.CFN.TLS = tlsServerDefaults(spec.CFN.TLS, instance)
+	spec.CFN.TLS = tlsServerDefaults(spec.CFN.TLS, instance)
 
 	spec.DBSyncJob.NodeSelector = controllerNodeSelector(spec.DBSyncJob.NodeSelector, instance)
 

pkg/controlplane/nova.go

@@ -14,7 +14,7 @@ func Nova(instance *openstackv1beta1.ControlPlane) *openstackv1beta1.Nova {
 
 	spec.API.Ingress = ingressDefaults(spec.API.Ingress, instance, "nova")
 	spec.API.NodeSelector = controllerNodeSelector(spec.API.NodeSelector, instance)
-	// spec.API.TLS = tlsServerDefaults(spec.API.TLS, instance)
+	spec.API.TLS = tlsServerDefaults(spec.API.TLS, instance)
 
 	spec.Cells = novaCellDefaults(spec.Cells, instance)
 

pkg/heat/api.go

@@ -9,6 +9,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 
 	openstackv1beta1 "github.com/ianunruh/openstack-operator/api/v1beta1"
+	"github.com/ianunruh/openstack-operator/pkg/httpd"
 	"github.com/ianunruh/openstack-operator/pkg/pki"
 	"github.com/ianunruh/openstack-operator/pkg/template"
 )
@@ -36,6 +37,7 @@ func APIDeployment(instance *openstackv1beta1.Heat, env []corev1.EnvVar, volumes
 	}
 
 	volumeMounts := []corev1.VolumeMount{
+		template.SubPathVolumeMount("etc-heat", "/etc/apache2/sites-available/000-default.conf", "httpd-heat-api.conf"),
 		template.SubPathVolumeMount("etc-heat", "/etc/heat/heat.conf", "heat.conf"),
 		template.SubPathVolumeMount("etc-heat", "/var/lib/kolla/config_files/config.json", "kolla-heat-api.json"),
 	}
@@ -53,10 +55,11 @@ func APIDeployment(instance *openstackv1beta1.Heat, env []corev1.EnvVar, volumes
 		},
 		Containers: []corev1.Container{
 			{
-				Name:    "api",
-				Image:   spec.Image,
-				Command: []string{"/usr/local/bin/kolla_start"},
-				Env:     env,
+				Name:      "api",
+				Image:     spec.Image,
+				Command:   []string{"/usr/local/bin/kolla_start"},
+				Lifecycle: httpd.Lifecycle(),
+				Env:       env,
 				Ports: []corev1.ContainerPort{
 					{Name: "http", ContainerPort: 8004},
 				},
@@ -66,10 +69,6 @@ func APIDeployment(instance *openstackv1beta1.Heat, env []corev1.EnvVar, volumes
 				VolumeMounts:  volumeMounts,
 			},
 		},
-		SecurityContext: &corev1.PodSecurityContext{
-			RunAsUser: &appUID,
-			FSGroup:   &appUID,
-		},
 		Volumes: volumes,
 	})
 

pkg/heat/app.go

@@ -33,8 +33,12 @@ func ConfigMap(instance *openstackv1beta1.Heat) *corev1.ConfigMap {
 
 	cm.Data["heat.conf"] = template.MustOutputINI(cfg).String()
 
+	cm.Data["httpd-heat-api.conf"] = template.MustRenderFile(AppLabel, "httpd-heat-api.conf", httpdParamsFrom(instance))
 	cm.Data["kolla-heat-api.json"] = template.MustReadFile(AppLabel, "kolla-heat-api.json")
+
+	cm.Data["httpd-heat-api-cfn.conf"] = template.MustRenderFile(AppLabel, "httpd-heat-api-cfn.conf", httpdParamsFrom(instance))
 	cm.Data["kolla-heat-api-cfn.json"] = template.MustReadFile(AppLabel, "kolla-heat-api-cfn.json")
+
 	cm.Data["kolla-heat-engine.json"] = template.MustReadFile(AppLabel, "kolla-heat-engine.json")
 
 	return cm
@@ -45,3 +49,13 @@ func Ensure(ctx context.Context, c client.Client, instance *openstackv1beta1.Hea
 		instance.Spec = intended.Spec
 	})
 }
+
+type httpdParams struct {
+	TLS bool
+}
+
+func httpdParamsFrom(instance *openstackv1beta1.Heat) httpdParams {
+	return httpdParams{
+		TLS: instance.Spec.API.TLS.Secret != "",
+	}
+}

pkg/heat/cfn.go

@@ -9,6 +9,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 
 	openstackv1beta1 "github.com/ianunruh/openstack-operator/api/v1beta1"
+	"github.com/ianunruh/openstack-operator/pkg/httpd"
 	"github.com/ianunruh/openstack-operator/pkg/pki"
 	"github.com/ianunruh/openstack-operator/pkg/template"
 )
@@ -36,6 +37,7 @@ func CFNDeployment(instance *openstackv1beta1.Heat, env []corev1.EnvVar, volumes
 	}
 
 	volumeMounts := []corev1.VolumeMount{
+		template.SubPathVolumeMount("etc-heat", "/etc/apache2/sites-available/000-default.conf", "httpd-heat-api-cfn.conf"),
 		template.SubPathVolumeMount("etc-heat", "/etc/heat/heat.conf", "heat.conf"),
 		template.SubPathVolumeMount("etc-heat", "/var/lib/kolla/config_files/config.json", "kolla-heat-api-cfn.json"),
 	}
@@ -53,10 +55,11 @@ func CFNDeployment(instance *openstackv1beta1.Heat, env []corev1.EnvVar, volumes
 		},
 		Containers: []corev1.Container{
 			{
-				Name:    "cfn",
-				Image:   spec.Image,
-				Command: []string{"/usr/local/bin/kolla_start"},
-				Env:     env,
+				Name:      "cfn",
+				Image:     spec.Image,
+				Command:   []string{"/usr/local/bin/kolla_start"},
+				Lifecycle: httpd.Lifecycle(),
+				Env:       env,
 				Ports: []corev1.ContainerPort{
 					{Name: "http", ContainerPort: 8000},
 				},
@@ -66,10 +69,6 @@ func CFNDeployment(instance *openstackv1beta1.Heat, env []corev1.EnvVar, volumes
 				VolumeMounts:  volumeMounts,
 			},
 		},
-		SecurityContext: &corev1.PodSecurityContext{
-			RunAsUser: &appUID,
-			FSGroup:   &appUID,
-		},
 		Volumes: volumes,
 	})
 

pkg/nova/api.go

@@ -9,6 +9,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 
 	openstackv1beta1 "github.com/ianunruh/openstack-operator/api/v1beta1"
+	"github.com/ianunruh/openstack-operator/pkg/httpd"
 	"github.com/ianunruh/openstack-operator/pkg/pki"
 	"github.com/ianunruh/openstack-operator/pkg/template"
 )
@@ -38,6 +39,7 @@ func APIDeployment(instance *openstackv1beta1.Nova, env []corev1.EnvVar, volumes
 	}
 
 	volumeMounts := []corev1.VolumeMount{
+		template.SubPathVolumeMount("etc-nova", "/etc/apache2/sites-available/000-default.conf", "httpd.conf"),
 		template.SubPathVolumeMount("etc-nova", "/etc/nova/nova.conf", "nova.conf"),
 		template.SubPathVolumeMount("etc-nova", "/var/lib/kolla/config_files/config.json", "kolla-nova-api.json"),
 	}
@@ -55,10 +57,11 @@ func APIDeployment(instance *openstackv1beta1.Nova, env []corev1.EnvVar, volumes
 		},
 		Containers: []corev1.Container{
 			{
-				Name:    "api",
-				Image:   spec.Image,
-				Command: []string{"/usr/local/bin/kolla_start"},
-				Env:     env,
+				Name:      "api",
+				Image:     spec.Image,
+				Command:   []string{"/usr/local/bin/kolla_start"},
+				Lifecycle: httpd.Lifecycle(),
+				Env:       env,
 				Ports: []corev1.ContainerPort{
 					{Name: "http", ContainerPort: 8774},
 				},
@@ -68,10 +71,6 @@ func APIDeployment(instance *openstackv1beta1.Nova, env []corev1.EnvVar, volumes
 				VolumeMounts:  volumeMounts,
 			},
 		},
-		SecurityContext: &corev1.PodSecurityContext{
-			RunAsUser: &appUID,
-			FSGroup:   &appUID,
-		},
 		Volumes: volumes,
 	})
 

pkg/nova/app.go

@@ -29,6 +29,8 @@ func ConfigMap(instance *openstackv1beta1.Nova, cinder *openstackv1beta1.Cinder)
 
 	cm.Data["nova.conf"] = template.MustOutputINI(cfg).String()
 
+	cm.Data["httpd.conf"] = template.MustRenderFile(AppLabel, "httpd.conf", httpdParamsFrom(instance))
+
 	cm.Data["kolla-nova-api.json"] = template.MustReadFile(AppLabel, "kolla-nova-api.json")
 	cm.Data["kolla-nova-conductor.json"] = template.MustReadFile(AppLabel, "kolla-nova-conductor.json")
 	cm.Data["kolla-nova-scheduler.json"] = template.MustReadFile(AppLabel, "kolla-nova-scheduler.json")
@@ -72,3 +74,13 @@ func Ensure(ctx context.Context, c client.Client, instance *openstackv1beta1.Nov
 		instance.Spec = intended.Spec
 	})
 }
+
+type httpdParams struct {
+	TLS bool
+}
+
+func httpdParamsFrom(instance *openstackv1beta1.Nova) httpdParams {
+	return httpdParams{
+		TLS: instance.Spec.API.TLS.Secret != "",
+	}
+}

templates/heat/httpd-heat-api-cfn.conf

@@ -0,0 +1,28 @@
+Listen 8000
+
+{{ if .TLS }}
+LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
+{{ end }}
+
+<VirtualHost *:8000>
+    WSGIScriptAlias / /var/lib/kolla/venv/bin/heat-wsgi-api-cfn
+    WSGIDaemonProcess heat-api-cfn processes=1 threads=10 user=heat group=heat display-name=%{GROUP}
+    WSGIProcessGroup heat-api-cfn
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+
+    ErrorLogFormat "%{cu}t %M"
+
+    ErrorLog /dev/stdout
+    CustomLog /dev/stdout combined
+
+    <Directory /var/lib/kolla/venv/bin>
+        Require all granted
+    </Directory>
+
+    {{ if .TLS }}
+    SSLEngine on
+    SSLCertificateFile /etc/heat/certs/tls.crt
+    SSLCertificateKeyFile /etc/heat/certs/tls.key
+    {{ end }}
+</VirtualHost>

templates/heat/httpd-heat-api.conf

@@ -0,0 +1,28 @@
+Listen 8004
+
+{{ if .TLS }}
+LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
+{{ end }}
+
+<VirtualHost *:8004>
+    WSGIScriptAlias / /var/lib/kolla/venv/bin/heat-wsgi-api
+    WSGIDaemonProcess heat-api processes=1 threads=10 user=heat group=heat display-name=%{GROUP}
+    WSGIProcessGroup heat-api
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+
+    ErrorLogFormat "%{cu}t %M"
+
+    ErrorLog /dev/stdout
+    CustomLog /dev/stdout combined
+
+    <Directory /var/lib/kolla/venv/bin>
+        Require all granted
+    </Directory>
+
+    {{ if .TLS }}
+    SSLEngine on
+    SSLCertificateFile /etc/heat/certs/tls.crt
+    SSLCertificateKeyFile /etc/heat/certs/tls.key
+    {{ end }}
+</VirtualHost>

templates/heat/kolla-heat-api-cfn.json

@@ -1,3 +1,3 @@
 {
-    "command": "heat-api-cfn"
+    "command": "/usr/sbin/apachectl -DFOREGROUND"
 }

templates/heat/kolla-heat-api.json

@@ -1,3 +1,3 @@
 {
-    "command": "heat-api"
+    "command": "/usr/sbin/apachectl -DFOREGROUND"
 }

templates/nova/httpd.conf

@@ -0,0 +1,28 @@
+Listen 8774
+
+{{ if .TLS }}
+LoadModule ssl_module /usr/lib/apache2/modules/mod_ssl.so
+{{ end }}
+
+<VirtualHost *:8774>
+    WSGIScriptAlias / /var/lib/kolla/venv/bin/nova-api-wsgi
+    WSGIDaemonProcess nova-api processes=1 threads=10 user=nova group=nova display-name=%{GROUP}
+    WSGIProcessGroup nova-api
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIPassAuthorization On
+
+    ErrorLogFormat "%{cu}t %M"
+
+    ErrorLog /dev/stdout
+    CustomLog /dev/stdout combined
+
+    <Directory /var/lib/kolla/venv/bin>
+        Require all granted
+    </Directory>
+
+    {{ if .TLS }}
+    SSLEngine on
+    SSLCertificateFile /etc/nova/certs/tls.crt
+    SSLCertificateKeyFile /etc/nova/certs/tls.key
+    {{ end }}
+</VirtualHost>

templates/nova/kolla-nova-api.json

@@ -1,3 +1,3 @@
 {
-    "command": "nova-api"
+    "command": "/usr/sbin/apachectl -DFOREGROUND"
 }