Mounting secrets and setting quarkus env vars for TLS support

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>
knative · Dec 16, 2024 · 0a37623 · 0a37623
1 parent 1232c65
commit 0a37623
Show file tree

Hide file tree

Showing 4 changed files with 64 additions and 5 deletions.
diff --git a/pkg/reconciler/integration/sink/integrationsink.go b/pkg/reconciler/integration/sink/integrationsink.go
@@ -250,9 +250,9 @@ func (r *Reconciler) reconcileAddress(ctx context.Context, sink *sinks.Integrati
 }
 
 func (r *Reconciler) getCaCerts(sink *sinks.IntegrationSink) (*string, error) {
-	secret, err := r.secretLister.Secrets(sink.Namespace).Get(resources.DeploymentName(sink) + "-cert")
+	secret, err := r.secretLister.Secrets(sink.Namespace).Get(resources.CertificateName(sink))
 	if err != nil {
-		return nil, fmt.Errorf("failed to get CA certs from %s/%s: %w", sink.Namespace, resources.DeploymentName(sink)+"-cert", err)
+		return nil, fmt.Errorf("failed to get CA certs from %s/%s: %w", sink.Namespace, resources.CertificateName(sink), err)
 	}
 	caCerts, ok := secret.Data[eventingtls.SecretCACert]
 	if !ok {

diff --git a/pkg/reconciler/integration/sink/resources/certificate.go b/pkg/reconciler/integration/sink/resources/certificate.go
@@ -31,14 +31,14 @@ import (
 func MakeCertificate(sink *v1alpha1.IntegrationSink) *cmv1.Certificate {
 	return &cmv1.Certificate{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      DeploymentName(sink) + "-cert",
+			Name:      CertificateName(sink),
 			Namespace: sink.Namespace,
 			OwnerReferences: []metav1.OwnerReference{
 				*kmeta.NewControllerRef(sink),
 			},
 		},
 		Spec: cmv1.CertificateSpec{
-			SecretName: DeploymentName(sink) + "-cert",
+			SecretName: CertificateName(sink),
 			SecretTemplate: &cmv1.CertificateSecretTemplate{
 				Labels: map[string]string{
 					"app.kubernetes.io/component": "knative-eventing",

diff --git a/pkg/reconciler/integration/sink/resources/container_image.go b/pkg/reconciler/integration/sink/resources/container_image.go
@@ -35,6 +35,7 @@ var sinkImageMap = map[string]string{
 }
 
 func MakeDeploymentSpec(sink *v1alpha1.IntegrationSink) *appsv1.Deployment {
+	t := true
 
 	deploy := &appsv1.Deployment{
 		TypeMeta: metav1.TypeMeta{
@@ -58,6 +59,17 @@ func MakeDeploymentSpec(sink *v1alpha1.IntegrationSink) *appsv1.Deployment {
 					Labels: integration.Labels(sink.Name),
 				},
 				Spec: corev1.PodSpec{
+					Volumes: []corev1.Volume{
+						{
+							Name: CertificateName(sink),
+							VolumeSource: corev1.VolumeSource{
+								Secret: &corev1.SecretVolumeSource{
+									SecretName: CertificateName(sink),
+									Optional:   &t,
+								},
+							},
+						},
+					},
 					Containers: []corev1.Container{
 						{
 							Name:            "sink",
@@ -75,6 +87,13 @@ func MakeDeploymentSpec(sink *v1alpha1.IntegrationSink) *appsv1.Deployment {
 									Name:          "https",
 								}},
 							Env: makeEnv(sink),
+							VolumeMounts: []corev1.VolumeMount{
+								{
+									Name:      CertificateName(sink),
+									MountPath: "/etc/" + CertificateName(sink),
+									ReadOnly:  true,
+								},
+							},
 						},
 					},
 				},
@@ -112,7 +131,7 @@ func MakeService(sink *v1alpha1.IntegrationSink) *corev1.Service {
 					Name:       "https",
 					Protocol:   corev1.ProtocolTCP,
 					Port:       443,
-					TargetPort: intstr.IntOrString{IntVal: 443},
+					TargetPort: intstr.IntOrString{IntVal: 8443},
 				},
 			},
 		},
@@ -126,6 +145,20 @@ func DeploymentName(sink *v1alpha1.IntegrationSink) string {
 func makeEnv(sink *v1alpha1.IntegrationSink) []corev1.EnvVar {
 	var envVars []corev1.EnvVar
 
+	//QUARKUS_HTTP_SSL_CERTIFICATE_FILES=/mount/certs/server.crt
+	//QUARKUS_HTTP_SSL_CERTIFICATE_KEY-FILES=/mount/certs/server.key
+
+	envVars = append(envVars, []corev1.EnvVar{
+		{
+			Name:  "QUARKUS_HTTP_SSL_CERTIFICATE_FILES",
+			Value: "/etc/" + CertificateName(sink) + "/tls.crt",
+		},
+		{
+			Name:  "QUARKUS_HTTP_SSL_CERTIFICATE_KEY-FILES",
+			Value: "/etc/" + CertificateName(sink) + "/tls.key",
+		},
+	}...)
+
 	// Log environment variables
 	if sink.Spec.Log != nil {
 		envVars = append(envVars, integration.GenerateEnvVarsFromStruct("CAMEL_KAMELET_LOG_SINK", *sink.Spec.Log)...)

diff --git a/pkg/reconciler/integration/sink/resources/names.go b/pkg/reconciler/integration/sink/resources/names.go
@@ -0,0 +1,26 @@
+/*
+  Copyright 2024 The Knative Authors
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+  	http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+package resources
+
+import (
+	"knative.dev/eventing/pkg/apis/sinks/v1alpha1"
+	"knative.dev/pkg/kmeta"
+)
+
+func CertificateName(sink *v1alpha1.IntegrationSink) string {
+	return kmeta.ChildName(sink.Name, "-server-tls")
+}