From 5f3cdb9947a551ba1eae32a01f0e673eeaadac21 Mon Sep 17 00:00:00 2001 From: DrummyFloyd Date: Fri, 1 Mar 2024 03:19:41 +0100 Subject: [PATCH] fix(ess): missing mtls injection Signed-off-by: DrummyFloyd --- cmd/provider/main.go | 10 ++++++++++ internal/controller/workspace/workspace.go | 3 +-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/cmd/provider/main.go b/cmd/provider/main.go index e4cd04ba..89cf81f6 100644 --- a/cmd/provider/main.go +++ b/cmd/provider/main.go @@ -22,6 +22,7 @@ import ( "path/filepath" "time" + "github.com/crossplane/crossplane-runtime/pkg/certificates" "github.com/crossplane/crossplane-runtime/pkg/controller" "github.com/crossplane/crossplane-runtime/pkg/feature" "go.uber.org/zap/zapcore" @@ -59,6 +60,7 @@ func main() { namespace = app.Flag("namespace", "Namespace used to set as default scope in default secret store config.").Default("crossplane-system").Envar("POD_NAMESPACE").String() enableExternalSecretStores = app.Flag("enable-external-secret-stores", "Enable support for ExternalSecretStores.").Default("false").Envar("ENABLE_EXTERNAL_SECRET_STORES").Bool() enableManagementPolicies = app.Flag("enable-management-policies", "Enable support for Management Policies.").Default("true").Envar("ENABLE_MANAGEMENT_POLICIES").Bool() + essTLSCertsPath = app.Flag("ess-tls-cert-dir", "Path of ESS TLS certificates.").Envar("ESS_TLS_CERTS_DIR").String() ) kingpin.MustParse(app.Parse(os.Args[1:])) @@ -118,6 +120,14 @@ func main() { if *enableExternalSecretStores { o.Features.Enable(features.EnableAlphaExternalSecretStores) log.Info("Alpha feature enabled", "flag", features.EnableAlphaExternalSecretStores) + o.ESSOptions = &controller.ESSOptions{} + if *essTLSCertsPath != "" { + log.Info("ESS TLS certificates path is set. Loading mTLS configuration.") + tCfg, err := certificates.LoadMTLSConfig(filepath.Join(*essTLSCertsPath, "ca.crt"), filepath.Join(*essTLSCertsPath, "tls.crt"), filepath.Join(*essTLSCertsPath, "tls.key"), false) + kingpin.FatalIfError(err, "Cannot load ESS TLS config.") + + o.ESSOptions.TLSConfig = tCfg + } // Ensure default store config exists. kingpin.FatalIfError(resource.Ignore(kerrors.IsAlreadyExists, mgr.GetClient().Create(context.Background(), &v1beta1.StoreConfig{ diff --git a/internal/controller/workspace/workspace.go b/internal/controller/workspace/workspace.go index 50d76c93..a0815554 100644 --- a/internal/controller/workspace/workspace.go +++ b/internal/controller/workspace/workspace.go @@ -122,7 +122,7 @@ func Setup(mgr ctrl.Manager, o controller.Options, timeout, pollJitter time.Dura cps := []managed.ConnectionPublisher{managed.NewAPISecretPublisher(mgr.GetClient(), mgr.GetScheme())} if o.Features.Enabled(features.EnableAlphaExternalSecretStores) { - cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), v1beta1.StoreConfigGroupVersionKind)) + cps = append(cps, connection.NewDetailsManager(mgr.GetClient(), v1beta1.StoreConfigGroupVersionKind, connection.WithTLSConfig(o.ESSOptions.TLSConfig))) } c := &connector{ @@ -355,7 +355,6 @@ func (c *external) Observe(ctx context.Context, mg resource.Managed) (managed.Ex } // Include any non-sensitive outputs in our status op, err := c.tf.Outputs(ctx) - if err != nil { return managed.ExternalObservation{}, errors.Wrap(err, errOutputs) }