88
99 "github.com/securesign/operator/internal/images"
1010
11+ rhtasv1alpha1 "github.com/securesign/operator/api/v1alpha1"
1112 "github.com/securesign/operator/internal/action"
1213 "github.com/securesign/operator/internal/constants"
1314 "github.com/securesign/operator/internal/controller/rekor/actions"
@@ -21,11 +22,13 @@ import (
2122 "k8s.io/apimachinery/pkg/api/resource"
2223 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2324 "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
24-
25- rhtasv1alpha1 "github.com/securesign/operator/api/v1alpha1"
2625)
2726
28- const storageVolumeName = "monitor-storage"
27+ const (
28+ storageVolumeName = "monitor-storage"
29+ tufRepoVolumeName = "tuf-repository"
30+ mountPath = "/data"
31+ )
2932
3033func NewStatefulSetAction () action.Action [* rhtasv1alpha1.Rekor ] {
3134 return & statefulSetAction {}
@@ -50,6 +53,7 @@ func (i statefulSetAction) Handle(ctx context.Context, instance *rhtasv1alpha1.R
5053 result controllerutil.OperationResult
5154 )
5255
56+ tufServerHost := i .resolveTufUrl (instance )
5357 rekorServerHost := fmt .Sprintf ("http://%s.%s.svc" , actions .ServerComponentName , instance .Namespace )
5458
5559 labels := labels .For (actions .MonitorComponentName , actions .MonitorStatefulSetName , instance .Name )
@@ -60,8 +64,8 @@ func (i statefulSetAction) Handle(ctx context.Context, instance *rhtasv1alpha1.R
6064 Namespace : instance .Namespace ,
6165 },
6266 },
63- i .ensureMonitorStatefulSet (instance , actions .RBACName , labels , rekorServerHost ),
64- i .ensureInitContainer (rekorServerHost ),
67+ i .ensureMonitorStatefulSet (instance , actions .RBACName , labels , rekorServerHost , tufServerHost ),
68+ i .ensureInitContainer (rekorServerHost , tufServerHost ),
6569 ensure .ControllerReference [* v1.StatefulSet ](instance , i .Client ),
6670 ensure .Labels [* v1.StatefulSet ](slices .Collect (maps .Keys (labels )), labels ),
6771 func (object * v1.StatefulSet ) error {
@@ -90,7 +94,18 @@ func (i statefulSetAction) Handle(ctx context.Context, instance *rhtasv1alpha1.R
9094 return i .Continue ()
9195}
9296
93- func (i statefulSetAction ) ensureMonitorStatefulSet (instance * rhtasv1alpha1.Rekor , sa string , labels map [string ]string , rekorServerHost string ) func (* v1.StatefulSet ) error {
97+ func (i statefulSetAction ) resolveTufUrl (instance * rhtasv1alpha1.Rekor ) string {
98+ if instance .Spec .Monitoring .Tuf .Address != "" {
99+ url := instance .Spec .Monitoring .Tuf .Address
100+ if instance .Spec .Monitoring .Tuf .Port != nil {
101+ url = fmt .Sprintf ("%s:%d" , url , * instance .Spec .Monitoring .Tuf .Port )
102+ }
103+ return url
104+ }
105+ return fmt .Sprintf ("http://tuf.%s.svc" , instance .Namespace )
106+ }
107+
108+ func (i statefulSetAction ) ensureMonitorStatefulSet (instance * rhtasv1alpha1.Rekor , sa string , labels map [string ]string , rekorServerHost string , tufServerHost string ) func (* v1.StatefulSet ) error {
94109 return func (ss * v1.StatefulSet ) error {
95110
96111 spec := & ss .Spec
@@ -110,7 +125,9 @@ func (i statefulSetAction) ensureMonitorStatefulSet(instance *rhtasv1alpha1.Reko
110125 container .Command = []string {
111126 "/bin/sh" ,
112127 "-c" ,
113- fmt .Sprintf (`/rekor_monitor --file=/data/checkpoint_log.txt --once=false --interval=%s --url=%s` , interval .String (), rekorServerHost ),
128+ fmt .Sprintf (
129+ `/rekor_monitor --file=/data/checkpoint_log.txt --once=false --interval=%s --url=%s --tuf-repository=%s --tuf-root-path="%s/root.json"` ,
130+ interval .String (), rekorServerHost , tufServerHost , mountPath ),
114131 }
115132
116133 container .Ports = []core.ContainerPort {
@@ -120,9 +137,15 @@ func (i statefulSetAction) ensureMonitorStatefulSet(instance *rhtasv1alpha1.Reko
120137 Protocol : core .ProtocolTCP ,
121138 },
122139 }
140+ container .Env = []core.EnvVar {
141+ {
142+ Name : "HOME" ,
143+ Value : mountPath ,
144+ },
145+ }
123146
124147 volumeMount := kubernetes .FindVolumeMountByNameOrCreate (container , storageVolumeName )
125- volumeMount .MountPath = "/data"
148+ volumeMount .MountPath = mountPath
126149
127150 spec .VolumeClaimTemplates = []core.PersistentVolumeClaim {
128151 {
@@ -141,19 +164,35 @@ func (i statefulSetAction) ensureMonitorStatefulSet(instance *rhtasv1alpha1.Reko
141164 },
142165 },
143166 }
167+
144168 return nil
145169 }
146170}
147171
148- func (i statefulSetAction ) ensureInitContainer (rekorServerHost string ) func (* v1.StatefulSet ) error {
172+ func (i statefulSetAction ) ensureInitContainer (rekorServerHost string , tufHost string ) func (* v1.StatefulSet ) error {
149173 return func (ss * v1.StatefulSet ) error {
150- initContainer := kubernetes .FindInitContainerByNameOrCreate (& ss .Spec .Template .Spec , "wait-for-rekor-server " )
174+ initContainer := kubernetes .FindInitContainerByNameOrCreate (& ss .Spec .Template .Spec , "tuf-init " )
151175 initContainer .Image = images .Registry .Get (images .RekorMonitor )
152-
176+ volumeMount := kubernetes .FindVolumeMountByNameOrCreate (initContainer , storageVolumeName )
177+ volumeMount .MountPath = mountPath
153178 initContainer .Command = []string {
154179 "/bin/sh" ,
155180 "-c" ,
156- fmt .Sprintf (`until curl -sf %s > /dev/null 2>&1; do echo 'Waiting for rekor-server to be ready...'; sleep 5; done` , rekorServerHost ),
181+ fmt .Sprintf (`
182+ echo "Waiting for rekor-server...";
183+ until curl -sf %s > /dev/null 2>&1; do
184+ echo "rekor-server not ready...";
185+ sleep 5;
186+ done;
187+ echo "Waiting for TUF server...";
188+ until curl %s > /dev/null 2>&1; do
189+ echo "TUF server not ready...";
190+ sleep 5;
191+ done;
192+ echo "Downloading root.json";
193+ curl %s/root.json > %s/root.json
194+ echo "tuf-init completed."
195+ ` , rekorServerHost , tufHost , tufHost , mountPath ),
157196 }
158197
159198 return nil
0 commit comments