generated from giantswarm/template-operator
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
get rid of mtp in favor of an ingress
- Loading branch information
1 parent
e5f546c
commit b1fb295
Showing
9 changed files
with
217 additions
and
35 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
70 changes: 70 additions & 0 deletions
70
pkg/resource/loki-ingress-auth-secret/ingress-auth-secret.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| package lokiingressauthsecret | ||
|
|
||
| import ( | ||
| "github.com/pkg/errors" | ||
| "golang.org/x/crypto/bcrypt" | ||
| v1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
|
|
||
| "github.com/giantswarm/logging-operator/pkg/common" | ||
| loggedcluster "github.com/giantswarm/logging-operator/pkg/logged-cluster" | ||
| loggingcredentials "github.com/giantswarm/logging-operator/pkg/resource/logging-credentials" | ||
| ) | ||
|
|
||
| const ( | ||
| //#nosec G101 | ||
| lokiIngressAuthSecretName = "loki-ingress-auth" | ||
| lokiIngressAuthSecretNamespace = "loki" | ||
| // DefaultReadOrgIDs - make sure to have at least 2 tenants, to prevent writing with this user | ||
| DefaultReadOrgIDs = "giantswarm|default" | ||
| ) | ||
|
|
||
| // lokiIngressAuthSecretMetadata returns metadata for the loki ingress auth secret metadata | ||
| func lokiIngressAuthSecretMetadata() metav1.ObjectMeta { | ||
| metadata := metav1.ObjectMeta{ | ||
| Name: lokiIngressAuthSecretName, | ||
| Namespace: lokiIngressAuthSecretNamespace, | ||
| Labels: map[string]string{}, | ||
| } | ||
|
|
||
| common.AddCommonLabels(metadata.Labels) | ||
| return metadata | ||
| } | ||
|
|
||
| func lokiIngressAuthSecret() v1.Secret { | ||
| return v1.Secret{ | ||
| ObjectMeta: lokiIngressAuthSecretMetadata(), | ||
| } | ||
| } | ||
|
|
||
| // listWriteUsers returns a map of users found in a credentialsSecret | ||
| func listWriteUsers(credentialsSecret *v1.Secret) []string { | ||
| var usersList []string | ||
| for myUser := range credentialsSecret.Data { | ||
| // bypass read user | ||
| if myUser != common.ReadUser { | ||
| usersList = append(usersList, myUser) | ||
| } | ||
| } | ||
|
|
||
| return usersList | ||
| } | ||
|
|
||
| // generateLokiIngressAuthSecret returns a secret for the loki ingress auth | ||
| func generateLokiIngressAuthSecret(lc loggedcluster.Interface, credentialsSecret *v1.Secret) (map[string][]byte, error) { | ||
| users := make(map[string][]byte) | ||
| // Loop on write users | ||
| for _, writeUser := range listWriteUsers(credentialsSecret) { | ||
| writePassword, err := loggingcredentials.GetPassword(lc, credentialsSecret, writeUser) | ||
| if err != nil { | ||
| return nil, errors.WithStack(err) | ||
| } | ||
| password, err := bcrypt.GenerateFromPassword([]byte(writePassword), bcrypt.DefaultCost) | ||
| if err != nil { | ||
| return nil, errors.WithStack(err) | ||
| } | ||
| users[writeUser] = password | ||
| } | ||
|
|
||
| return users, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| package lokiingressauthsecret | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| "github.com/pkg/errors" | ||
| v1 "k8s.io/api/core/v1" | ||
| "k8s.io/apimachinery/pkg/types" | ||
|
|
||
| loggedcluster "github.com/giantswarm/logging-operator/pkg/logged-cluster" | ||
| loggingcredentials "github.com/giantswarm/logging-operator/pkg/resource/logging-credentials" | ||
|
|
||
| ctrl "sigs.k8s.io/controller-runtime" | ||
| "sigs.k8s.io/controller-runtime/pkg/client" | ||
| "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil" | ||
| "sigs.k8s.io/controller-runtime/pkg/log" | ||
| ) | ||
|
|
||
| // Reconciler implements a reconciler.Interface to handle | ||
| // loki ingress auth secret: a secret for the loki ingress that adds support for basic auth for the write path | ||
| type Reconciler struct { | ||
| client.Client | ||
| } | ||
|
|
||
| // ReconcileCreate ensures loki ingress auth map is created with the right credentials on CAPI | ||
| func (r *Reconciler) ReconcileCreate(ctx context.Context, lc loggedcluster.Interface) (ctrl.Result, error) { | ||
| // If we are not on CAPI, we don't need to create the secret as we are using the multi-tenant-proxy | ||
| if !lc.IsCAPI() { | ||
| return ctrl.Result{}, nil | ||
| } | ||
|
|
||
| return r.createOrUpdateSecret(ctx, lc) | ||
| } | ||
|
|
||
| // ReconcileDelete - Delete the loki ingress auth secret on capi | ||
| func (r *Reconciler) ReconcileDelete(ctx context.Context, lc loggedcluster.Interface) (ctrl.Result, error) { | ||
| // If we are not on CAPI, we don't need to create the secret as we are using the multi-tenant-proxy | ||
| if !lc.IsCAPI() { | ||
| return ctrl.Result{}, nil | ||
| } | ||
|
|
||
| return r.createOrUpdateSecret(ctx, lc) | ||
| } | ||
|
|
||
| func (r *Reconciler) createOrUpdateSecret(ctx context.Context, lc loggedcluster.Interface) (ctrl.Result, error) { | ||
| logger := log.FromContext(ctx) | ||
|
|
||
| // Retrieve currently generated write path credentials | ||
| var objectKey = types.NamespacedName{ | ||
| Name: loggingcredentials.LoggingCredentialsSecretMeta().Name, | ||
| Namespace: loggingcredentials.LoggingCredentialsSecretMeta().Namespace, | ||
| } | ||
|
|
||
| var writePathCredentials v1.Secret | ||
| if err := r.Client.Get(ctx, objectKey, &writePathCredentials); err != nil { | ||
| return ctrl.Result{}, errors.WithStack(err) | ||
| } | ||
|
|
||
| secret := lokiIngressAuthSecret() | ||
| _, err := controllerutil.CreateOrUpdate(ctx, r.Client, &secret, func() error { | ||
| // Generate loki ingress auth secret | ||
| data, err := generateLokiIngressAuthSecret(lc, &writePathCredentials) | ||
| if err != nil { | ||
| logger.Error(err, "failed to generate loki ingress auth secret") | ||
| return errors.WithStack(err) | ||
| } | ||
| secret.Data = data | ||
|
|
||
| return nil | ||
| }) | ||
| if err != nil { | ||
| logger.Error(err, "failed to create loki ingress auth secret") | ||
| return ctrl.Result{}, errors.WithStack(err) | ||
| } | ||
|
|
||
| return ctrl.Result{}, nil | ||
| } |
Oops, something went wrong.