Skip to content

Commit 8906334

Browse files
committed
Updates to use the latest Rekor Monitor
1 parent b590ddb commit 8906334

File tree

10 files changed

+163
-58
lines changed

10 files changed

+163
-58
lines changed

api/v1alpha1/common.go

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,9 @@ type MonitoringWithTLogConfig struct {
4343
// Configuration for Rekor transparency log monitoring
4444
//+optional
4545
TLog TlogMonitoring `json:"tlog"`
46+
// TUF service configuration
47+
//+optional
48+
Tuf TufService `json:"tuf,omitempty"`
4649
}
4750

4851
// TrillianService configuration to connect Trillian server
@@ -58,6 +61,18 @@ type TrillianService struct {
5861
Port *int32 `json:"port,omitempty"`
5962
}
6063

64+
// TufService configuration to connect TUF server
65+
type TufService struct {
66+
// Address to TUF Server End point
67+
//+optional
68+
Address string `json:"address,omitempty"`
69+
// Port of TUF Server End point
70+
//+kubebuilder:validation:Minimum:=1
71+
//+kubebuilder:validation:Maximum:=65535
72+
//+optional
73+
Port *int32 `json:"port,omitempty"`
74+
}
75+
6176
// CtlogService configuration to connect Ctlog server
6277
type CtlogService struct {
6378
// Address to Ctlog Log Server End point

api/v1alpha1/zz_generated.deepcopy.go

Lines changed: 21 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

config/crd/bases/rhtas.redhat.com_rekors.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1281,6 +1281,19 @@ spec:
12811281
required:
12821282
- enabled
12831283
type: object
1284+
tuf:
1285+
description: TUF service configuration
1286+
properties:
1287+
address:
1288+
description: Address to TUF Server End point
1289+
type: string
1290+
port:
1291+
description: Port of TUF Server End point
1292+
format: int32
1293+
maximum: 65535
1294+
minimum: 1
1295+
type: integer
1296+
type: object
12841297
required:
12851298
- enabled
12861299
type: object

config/crd/bases/rhtas.redhat.com_securesigns.yaml

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3894,6 +3894,19 @@ spec:
38943894
required:
38953895
- enabled
38963896
type: object
3897+
tuf:
3898+
description: TUF service configuration
3899+
properties:
3900+
address:
3901+
description: Address to TUF Server End point
3902+
type: string
3903+
port:
3904+
description: Port of TUF Server End point
3905+
format: int32
3906+
maximum: 65535
3907+
minimum: 1
3908+
type: integer
3909+
type: object
38973910
required:
38983911
- enabled
38993912
type: object

config/default/images.env

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,4 @@ RELATED_IMAGE_CTLOG=registry.redhat.io/rhtas/certificate-transparency-rhel9@sha2
1313
RELATED_IMAGE_HTTP_SERVER=registry.redhat.io/ubi9/httpd-24@sha256:8536169e5537fe6c330eba814248abdcf39cdd8f7e7336034d74e6fda9544050
1414
RELATED_IMAGE_TIMESTAMP_AUTHORITY=registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:be623422f3f636c39397a66416b02a79f1d59cf593ca258e1701d1728755dde9
1515
RELATED_IMAGE_CLIENT_SERVER=registry.redhat.io/rhtas/client-server-rhel9@sha256:c81aaa8f300021d7cdbb964524fc5e89ea2c79fdab5507f0ec036bf96b219332
16-
RELATED_IMAGE_REKOR_MONITOR=registry.redhat.io/rhtas/rekor-monitor-rhel9@sha256:1944eff9f103d84380b9efac6adec9cb22613643968e51f07db58df977b6b982
16+
RELATED_IMAGE_REKOR_MONITOR=registry.redhat.io/rhtas/rekor-monitor-rhel9@sha256:b7f9f8b24fe7db4e124f9e5e9289bc2d180a810e253f48feb7e1177bbef6d4d0

go.mod

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,17 @@ require (
7575
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
7676
github.com/prometheus/client_golang v1.23.2 // indirect
7777
github.com/prometheus/client_model v0.6.2 // indirect
78+
<<<<<<< HEAD
7879
github.com/prometheus/common v0.67.3 // indirect
7980
github.com/prometheus/procfs v0.19.2 // indirect
81+
=======
82+
github.com/prometheus/common v0.67.1 // indirect
83+
<<<<<<< HEAD
84+
github.com/prometheus/procfs v0.17.0 // indirect
85+
>>>>>>> a51ad306 (create TUF PVC configMap and use it in Rekor monitor statefulSet)
86+
=======
87+
github.com/prometheus/procfs v0.19.1 // indirect
88+
>>>>>>> 4acadffb (add missing changes)
8089
github.com/sirupsen/logrus v1.9.3 // indirect
8190
github.com/spf13/pflag v1.0.10 // indirect
8291
github.com/vbatts/tar-split v0.12.2 // indirect

go.sum

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,10 +127,22 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
127127
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
128128
github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
129129
github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
130+
<<<<<<< HEAD
131+
<<<<<<< HEAD
130132
github.com/openshift/api v0.0.0-20251119073004-138912d4ee99 h1:VGkPn3iO7ZapVYtUd7Lj1tE2ZwRfOOUVFzoA/sWlWDc=
131133
github.com/openshift/api v0.0.0-20251119073004-138912d4ee99/go.mod h1:d5uzF0YN2nQQFA0jIEWzzOZ+edmo6wzlGLvx5Fhz4uY=
132134
github.com/operator-framework/api v0.36.0 h1:6+duRhamCvB540JbvNp/1+Pot7luff7HqdAOm9bAntg=
133135
github.com/operator-framework/api v0.36.0/go.mod h1:QSmHMx8XpGsNWvjU5CUelVZC916VLp/TZhfYvGKpghM=
136+
=======
137+
github.com/openshift/api v0.0.0-20251016080153-44baf885fd37 h1:LuZb5xyKz8PZXqV80NOLfda9DDLdax/XNjqc2pL4Efg=
138+
github.com/openshift/api v0.0.0-20251016080153-44baf885fd37/go.mod h1:d5uzF0YN2nQQFA0jIEWzzOZ+edmo6wzlGLvx5Fhz4uY=
139+
=======
140+
github.com/openshift/api v0.0.0-20251023193535-8691c3014652 h1:iFo7XEz9/q6qxZey/MCCBTqCC88DXbtUz7mUWtGkQzg=
141+
github.com/openshift/api v0.0.0-20251023193535-8691c3014652/go.mod h1:d5uzF0YN2nQQFA0jIEWzzOZ+edmo6wzlGLvx5Fhz4uY=
142+
>>>>>>> 4acadffb (add missing changes)
143+
github.com/operator-framework/api v0.35.0 h1:xKrffuGEagk3CWy6zqdK5YmIErlBtWUblNNK+q7ld7c=
144+
github.com/operator-framework/api v0.35.0/go.mod h1:A9UNu/pdcO1RauMHvV54unp4DNm/Y5fMVbGDpnIIF+M=
145+
>>>>>>> a51ad306 (create TUF PVC configMap and use it in Rekor monitor statefulSet)
134146
github.com/operator-framework/operator-lib v0.19.0 h1:az6ogYj21rtU0SF9uYctRLyKp2dtlqTsmpfehFy6Ce8=
135147
github.com/operator-framework/operator-lib v0.19.0/go.mod h1:KxycAjFnHt0DBtHmH3Jm7yHcY5sdrshPKTqM/HKAQ08=
136148
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -144,10 +156,22 @@ github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h
144156
github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
145157
github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
146158
github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
159+
<<<<<<< HEAD
147160
github.com/prometheus/common v0.67.3 h1:shd26MlnwTw5jksTDhC7rTQIteBxy+ZZDr3t7F2xN2Q=
148161
github.com/prometheus/common v0.67.3/go.mod h1:gP0fq6YjjNCLssJCQp0yk4M8W6ikLURwkdd/YKtTbyI=
149162
github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
150163
github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
164+
=======
165+
github.com/prometheus/common v0.67.1 h1:OTSON1P4DNxzTg4hmKCc37o4ZAZDv0cfXLkOt0oEowI=
166+
github.com/prometheus/common v0.67.1/go.mod h1:RpmT9v35q2Y+lsieQsdOh5sXZ6ajUGC8NjZAmr8vb0Q=
167+
<<<<<<< HEAD
168+
github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
169+
github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
170+
>>>>>>> a51ad306 (create TUF PVC configMap and use it in Rekor monitor statefulSet)
171+
=======
172+
github.com/prometheus/procfs v0.19.1 h1:QVtROpTkphuXuNlnCv3m1ut3JytkXHtQ3xvck/YmzMM=
173+
github.com/prometheus/procfs v0.19.1/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
174+
>>>>>>> 4acadffb (add missing changes)
151175
github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
152176
github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
153177
github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=

internal/controller/rekor/actions/monitor/statefulset.go

Lines changed: 51 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88

99
"github.com/securesign/operator/internal/images"
1010

11+
rhtasv1alpha1 "github.com/securesign/operator/api/v1alpha1"
1112
"github.com/securesign/operator/internal/action"
1213
"github.com/securesign/operator/internal/constants"
1314
"github.com/securesign/operator/internal/controller/rekor/actions"
@@ -21,11 +22,13 @@ import (
2122
"k8s.io/apimachinery/pkg/api/resource"
2223
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2324
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
24-
25-
rhtasv1alpha1 "github.com/securesign/operator/api/v1alpha1"
2625
)
2726

28-
const storageVolumeName = "monitor-storage"
27+
const (
28+
storageVolumeName = "monitor-storage"
29+
tufRepoVolumeName = "tuf-repository"
30+
mountPath = "/data"
31+
)
2932

3033
func NewStatefulSetAction() action.Action[*rhtasv1alpha1.Rekor] {
3134
return &statefulSetAction{}
@@ -50,6 +53,7 @@ func (i statefulSetAction) Handle(ctx context.Context, instance *rhtasv1alpha1.R
5053
result controllerutil.OperationResult
5154
)
5255

56+
tufServerHost := i.resolveTufUrl(instance)
5357
rekorServerHost := fmt.Sprintf("http://%s.%s.svc", actions.ServerComponentName, instance.Namespace)
5458

5559
labels := labels.For(actions.MonitorComponentName, actions.MonitorStatefulSetName, instance.Name)
@@ -60,8 +64,8 @@ func (i statefulSetAction) Handle(ctx context.Context, instance *rhtasv1alpha1.R
6064
Namespace: instance.Namespace,
6165
},
6266
},
63-
i.ensureMonitorStatefulSet(instance, actions.RBACName, labels, rekorServerHost),
64-
i.ensureInitContainer(rekorServerHost),
67+
i.ensureMonitorStatefulSet(instance, actions.RBACName, labels, rekorServerHost, tufServerHost),
68+
i.ensureInitContainer(rekorServerHost, tufServerHost),
6569
ensure.ControllerReference[*v1.StatefulSet](instance, i.Client),
6670
ensure.Labels[*v1.StatefulSet](slices.Collect(maps.Keys(labels)), labels),
6771
func(object *v1.StatefulSet) error {
@@ -90,7 +94,18 @@ func (i statefulSetAction) Handle(ctx context.Context, instance *rhtasv1alpha1.R
9094
return i.Continue()
9195
}
9296

93-
func (i statefulSetAction) ensureMonitorStatefulSet(instance *rhtasv1alpha1.Rekor, sa string, labels map[string]string, rekorServerHost string) func(*v1.StatefulSet) error {
97+
func (i statefulSetAction) resolveTufUrl(instance *rhtasv1alpha1.Rekor) string {
98+
if instance.Spec.Monitoring.Tuf.Address != "" {
99+
url := instance.Spec.Monitoring.Tuf.Address
100+
if instance.Spec.Monitoring.Tuf.Port != nil {
101+
url = fmt.Sprintf("%s:%d", url, *instance.Spec.Monitoring.Tuf.Port)
102+
}
103+
return url
104+
}
105+
return fmt.Sprintf("http://tuf.%s.svc", instance.Namespace)
106+
}
107+
108+
func (i statefulSetAction) ensureMonitorStatefulSet(instance *rhtasv1alpha1.Rekor, sa string, labels map[string]string, rekorServerHost string, tufServerHost string) func(*v1.StatefulSet) error {
94109
return func(ss *v1.StatefulSet) error {
95110

96111
spec := &ss.Spec
@@ -110,7 +125,9 @@ func (i statefulSetAction) ensureMonitorStatefulSet(instance *rhtasv1alpha1.Reko
110125
container.Command = []string{
111126
"/bin/sh",
112127
"-c",
113-
fmt.Sprintf(`/rekor_monitor --file=/data/checkpoint_log.txt --once=false --interval=%s --url=%s`, interval.String(), rekorServerHost),
128+
fmt.Sprintf(
129+
`/rekor_monitor --file=/data/checkpoint_log.txt --once=false --interval=%s --url=%s --tuf-repository=%s --tuf-root-path="%s/root.json"`,
130+
interval.String(), rekorServerHost, tufServerHost, mountPath),
114131
}
115132

116133
container.Ports = []core.ContainerPort{
@@ -120,9 +137,15 @@ func (i statefulSetAction) ensureMonitorStatefulSet(instance *rhtasv1alpha1.Reko
120137
Protocol: core.ProtocolTCP,
121138
},
122139
}
140+
container.Env = []core.EnvVar{
141+
{
142+
Name: "HOME",
143+
Value: mountPath,
144+
},
145+
}
123146

124147
volumeMount := kubernetes.FindVolumeMountByNameOrCreate(container, storageVolumeName)
125-
volumeMount.MountPath = "/data"
148+
volumeMount.MountPath = mountPath
126149

127150
spec.VolumeClaimTemplates = []core.PersistentVolumeClaim{
128151
{
@@ -141,19 +164,35 @@ func (i statefulSetAction) ensureMonitorStatefulSet(instance *rhtasv1alpha1.Reko
141164
},
142165
},
143166
}
167+
144168
return nil
145169
}
146170
}
147171

148-
func (i statefulSetAction) ensureInitContainer(rekorServerHost string) func(*v1.StatefulSet) error {
172+
func (i statefulSetAction) ensureInitContainer(rekorServerHost string, tufHost string) func(*v1.StatefulSet) error {
149173
return func(ss *v1.StatefulSet) error {
150-
initContainer := kubernetes.FindInitContainerByNameOrCreate(&ss.Spec.Template.Spec, "wait-for-rekor-server")
174+
initContainer := kubernetes.FindInitContainerByNameOrCreate(&ss.Spec.Template.Spec, "tuf-init")
151175
initContainer.Image = images.Registry.Get(images.RekorMonitor)
152-
176+
volumeMount := kubernetes.FindVolumeMountByNameOrCreate(initContainer, storageVolumeName)
177+
volumeMount.MountPath = mountPath
153178
initContainer.Command = []string{
154179
"/bin/sh",
155180
"-c",
156-
fmt.Sprintf(`until curl -sf %s > /dev/null 2>&1; do echo 'Waiting for rekor-server to be ready...'; sleep 5; done`, rekorServerHost),
181+
fmt.Sprintf(`
182+
echo "Waiting for rekor-server...";
183+
until curl -sf %s > /dev/null 2>&1; do
184+
echo "rekor-server not ready...";
185+
sleep 5;
186+
done;
187+
echo "Waiting for TUF server...";
188+
until curl %s > /dev/null 2>&1; do
189+
echo "TUF server not ready...";
190+
sleep 5;
191+
done;
192+
echo "Downloading root.json";
193+
curl %s/root.json > %s/root.json
194+
echo "tuf-init completed."
195+
`, rekorServerHost, tufHost, tufHost, mountPath),
157196
}
158197

159198
return nil

test/e2e/rekor_monitor_log_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -254,8 +254,8 @@ var _ = Describe("Rekor Monitor Log", Ordered, func() {
254254
g.Expect(err).ToNot(HaveOccurred())
255255
g.Expect(strings.Contains(logContent, "Root hash consistency verified")).To(BeFalse(),
256256
fmt.Sprintf("Expected 'Root hash consistency verified' NOT to be in logs, but got: %s", logContent))
257-
g.Expect(strings.Contains(logContent, "empty log")).To(BeTrue(),
258-
fmt.Sprintf("Expected 'empty log' to be in logs, but got: %s", logContent))
257+
g.Expect(strings.Contains(logContent, "skipping write of checkpoint: size is 0")).To(BeTrue(),
258+
fmt.Sprintf("Expected 'skipping write of checkpoint: size is 0' to be in logs, but got: %s", logContent))
259259
}, 30*time.Second, 1*time.Second).Should(Succeed(),
260260
"Monitor log should be empty and not contain root hash consistency verification")
261261
})

0 commit comments

Comments
 (0)