console: configure client console nginx TLS from TLSProfile CR - #705
console: configure client console nginx TLS from TLSProfile CR#705vbnrh wants to merge 2 commits into
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: vbnrh The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
40f0461 to
911f118
Compare
leelavg
left a comment
leelavg
left a comment
There was a problem hiding this comment.
not reviewing, pls look at existing code, configmap controller already gets startuptlsprofile and just use it, see it's being reused for csi addons as well. should be straightforward.
911f118 to
b3ef2fc
Compare
| } | ||
|
|
||
| func GetNginxProxyConf(uniqueIdentifier, exposeAs, endpointURL, endpointHost, certsPath string) (string, error) { | ||
| func buildTLSDirectives(ossl *ocstlsv1.OpenSSLConfig) string { |
There was a problem hiding this comment.
nits:
| func buildTLSDirectives(ossl *ocstlsv1.OpenSSLConfig) string { | |
| func buildRootTLSDirectives(ossl *ocstlsv1.OpenSSLConfig) string { |
There was a problem hiding this comment.
Real detection gap -- thanks. Command substitution and backtick interpolation inside a single-quoted SQL literal are a genuine injection shape distinct from $VAR. Fixed in 76231795ad: added a command-sub/backtick detection regex plus a unified _span_has_real_interpolation helper that checks every $-expansion, $( command-sub, and backtick per span with escape awareness (\$( and \` are bash-literal). Regression test added covering $(printf %s "$UNTRUSTED"), backtick `id`, and the escaped \$( negative. Also added the omitted REINDEX/VACUUM statement keywords in the same commit.
|
|
||
| func GetNginxRootConf() string { | ||
| return nginxRootConf | ||
| func GenerateNginxConf(ossl *ocstlsv1.OpenSSLConfig) string { |
There was a problem hiding this comment.
nits:
| func GenerateNginxConf(ossl *ocstlsv1.OpenSSLConfig) string { | |
| func GetNginxRootConf(ossl *ocstlsv1.OpenSSLConfig) string { |
There was a problem hiding this comment.
Or,
| func GenerateNginxConf(ossl *ocstlsv1.OpenSSLConfig) string { | |
| func GenerateNginxRootConf(ossl *ocstlsv1.OpenSSLConfig) string { |
| } | ||
|
|
||
| err := c.computeDesiredProxyConfigByKey(out) | ||
| err := c.computeDesiredProxyConfigByKey(out, console.BuildProxyTLSDirectives(ossl)) |
There was a problem hiding this comment.
nits (optional): ideally console.BuildProxyTLSDirectives(ossl) should happen inside computeDesiredProxyConfigByKey func. That's the "desired" responsibility of the function, ossl should be the argument.
| ssl_certificate_key /var/serving-cert/tls.key; | ||
|
|
||
| %s |
There was a problem hiding this comment.
can we plz keep formatting aligned with ssl_certificate_key and location strings ??
| {{- if .ProxyTLSDirectives}} | ||
| {{.ProxyTLSDirectives}} | ||
| {{- end}} |
There was a problem hiding this comment.
can we plz keep formatting aligned with rest of the file ??
There was a problem hiding this comment.
Replaced with individual template fields
a4f0867 to
bd7a0c6
Compare
Ref: RHSTOR-8685 Signed-off-by: vbadrina <vbadrina@redhat.com>
Ref: RHSTOR-8685 Signed-off-by: vbadrina <vbadrina@redhat.com>
bd7a0c6 to
b4cfabe
Compare
4 participants
Summary
ocs-client-operator-consolenginx server to read TLS settings from theTLSProfileCRD and injectssl_protocols,ssl_ciphers, andssl_conf_command Groupsdirectives into the nginx ConfigMapTLSProfileinOperatorConfigMapReconciler.SetupWithManager()so nginx config is regenerated when the TLS profile changesfeatures.operators.openshift.io/tls-profiles: "true"CSV annotationChanges
pkg/console/nginx_root.conf: add%splaceholder for TLS directive injectionpkg/console/console.go: replaceGetNginxRootConf()withGenerateNginxConf(ossl)+buildTLSDirectives()internal/controller/operatorconfigmap_controller.go: fetchTLSProfileinensureConsolePlugin(), resolve OpenSSL config for domainocs.openshift.io/ serverclient-console, pass to nginx config generation; add TLSProfile watch with name/namespace/generation predicatespkg/console/console_test.go: unit tests forGenerateNginxConf(nil, TLS 1.3 full, protocol-only)tls-profilesfeature annotationTest plan
go build ./...passesgo test ./pkg/console/...passes (new + existing tests)go test -run 'TestBuildDesiredNginxDataWithProxies' ./internal/controller/...passesmake bundleregenerates cleanlyRef: RHSTOR-8685