Skip to content

Commit 852fe16

Browse files
razvansbernauer
razvan
and
sbernauer
authored
feat: Support setting TLS certificate lifetimes (#676)
* feat: Support setting TLS certificate lifetimes * typo * chore: bump op-rs * cargo update -p rustls * Update rust/crd/src/lib.rs Co-authored-by: Sebastian Bernauer <sebastian.bernauer@stackable.de> * rustfmt --------- Co-authored-by: Sebastian Bernauer <sebastian.bernauer@stackable.de>
1 parent 6465d1b commit 852fe16

File tree

6 files changed

+63
-24
lines changed

6 files changed

+63
-24
lines changed

‎CHANGELOG.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
44

55
## [Unreleased]
66

7+
### Added
8+
9+
- The lifetime of auto generated TLS certificates is now configurable with the role and roleGroup
10+
config property `requestedSecretLifetime`. This helps reduce frequent Pod restarts ([#676]).
11+
712
### Fixed
813

914
- Fix OIDC endpoint construction in case the `rootPath` does have a trailing slash ([#673]).
@@ -13,6 +18,7 @@ All notable changes to this project will be documented in this file.
1318

1419
[#672]: https://github.com/stackabletech/trino-operator/pull/672
1520
[#673]: https://github.com/stackabletech/trino-operator/pull/673
21+
[#676]: https://github.com/stackabletech/trino-operator/pull/676
1622

1723
## [24.11.0] - 2024-11-18
1824

‎Cargo.lock

Lines changed: 7 additions & 18 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,12 @@ serde = { version = "1.0", features = ["derive"] }
2424
serde_json = "1.0"
2525
serde_yaml = "0.9"
2626
snafu = "0.8"
27-
stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.82.0" }
27+
stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "stackable-operator-0.83.0" }
2828
product-config = { git = "https://github.com/stackabletech/product-config.git", tag = "0.7.0" }
2929
strum = { version = "0.26", features = ["derive"] }
3030
tokio = { version = "1.40", features = ["full"] }
3131
tracing = "0.1"
3232

33-
# [patch."https://github.com/stackabletech/operator-rs.git"]
34-
# stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
33+
#[patch."https://github.com/stackabletech/operator-rs.git"]
34+
#stackable-operator = { git = "https://github.com/stackabletech//operator-rs.git", branch = "main" }
3535
# stackable-operator = { path = "../operator-rs/crates/stackable-operator" }

‎deploy/helm/trino-operator/crds/crds.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,10 @@ spec:
297297
queryMaxMemoryPerNode:
298298
nullable: true
299299
type: string
300+
requestedSecretLifetime:
301+
description: Request secret (currently only autoTls certificates) lifetime from the secret operator, e.g. `7d`, or `30d`. This can be shortened by the `maxCertificateLifetime` setting on the SecretClass issuing the TLS certificate.
302+
nullable: true
303+
type: string
300304
resources:
301305
default:
302306
cpu:
@@ -566,6 +570,10 @@ spec:
566570
queryMaxMemoryPerNode:
567571
nullable: true
568572
type: string
573+
requestedSecretLifetime:
574+
description: Request secret (currently only autoTls certificates) lifetime from the secret operator, e.g. `7d`, or `30d`. This can be shortened by the `maxCertificateLifetime` setting on the SecretClass issuing the TLS certificate.
575+
nullable: true
576+
type: string
569577
resources:
570578
default:
571579
cpu:
@@ -864,6 +872,10 @@ spec:
864872
queryMaxMemoryPerNode:
865873
nullable: true
866874
type: string
875+
requestedSecretLifetime:
876+
description: Request secret (currently only autoTls certificates) lifetime from the secret operator, e.g. `7d`, or `30d`. This can be shortened by the `maxCertificateLifetime` setting on the SecretClass issuing the TLS certificate.
877+
nullable: true
878+
type: string
867879
resources:
868880
default:
869881
cpu:
@@ -1133,6 +1145,10 @@ spec:
11331145
queryMaxMemoryPerNode:
11341146
nullable: true
11351147
type: string
1148+
requestedSecretLifetime:
1149+
description: Request secret (currently only autoTls certificates) lifetime from the secret operator, e.g. `7d`, or `30d`. This can be shortened by the `maxCertificateLifetime` setting on the SecretClass issuing the TLS certificate.
1150+
nullable: true
1151+
type: string
11361152
resources:
11371153
default:
11381154
cpu:

‎rust/crd/src/lib.rs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -432,9 +432,15 @@ pub struct TrinoConfig {
432432
/// Time period Pods have to gracefully shut down, e.g. `30m`, `1h` or `2d`. Consult the operator documentation for details.
433433
#[fragment_attrs(serde(default))]
434434
pub graceful_shutdown_timeout: Option<Duration>,
435+
436+
/// Request secret (currently only autoTls certificates) lifetime from the secret operator, e.g. `7d`, or `30d`.
437+
/// This can be shortened by the `maxCertificateLifetime` setting on the SecretClass issuing the TLS certificate.
438+
#[fragment_attrs(serde(default))]
439+
pub requested_secret_lifetime: Option<Duration>,
435440
}
436441

437442
impl TrinoConfig {
443+
const DEFAULT_SECRET_LIFETIME: Duration = Duration::from_days_unchecked(7);
438444
fn default_config(
439445
cluster_name: &str,
440446
role: &TrinoRole,
@@ -472,6 +478,7 @@ impl TrinoConfig {
472478
query_max_memory: None,
473479
query_max_memory_per_node: None,
474480
graceful_shutdown_timeout: Some(graceful_shutdown_timeout),
481+
requested_secret_lifetime: Some(Self::DEFAULT_SECRET_LIFETIME),
475482
}
476483
}
477484
}

‎rust/operator-binary/src/controller.rs

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,9 @@ const DOCKER_IMAGE_BASE_NAME: &str = "trino";
124124
#[strum_discriminants(derive(IntoStaticStr))]
125125
#[allow(clippy::enum_variant_names)]
126126
pub enum Error {
127+
#[snafu(display("missing secret lifetime"))]
128+
MissingSecretLifetime,
129+
127130
#[snafu(display("object defines no namespace"))]
128131
ObjectHasNoNamespace,
129132

@@ -944,13 +947,17 @@ fn build_rolegroup_statefulset(
944947
}),
945948
);
946949

950+
let requested_secret_lifetime = merged_config
951+
.requested_secret_lifetime
952+
.context(MissingSecretLifetimeSnafu)?;
947953
// add volume mounts depending on the client tls, internal tls, catalogs and authentication
948954
tls_volume_mounts(
949955
trino,
950956
&mut pod_builder,
951957
&mut cb_prepare,
952958
&mut cb_trino,
953959
catalogs,
960+
&requested_secret_lifetime,
954961
)?;
955962

956963
let mut prepare_args = vec![];
@@ -1486,13 +1493,18 @@ fn liveness_probe(trino: &TrinoCluster) -> Probe {
14861493
}
14871494
}
14881495

1489-
fn create_tls_volume(volume_name: &str, tls_secret_class: &str) -> Result<Volume> {
1496+
fn create_tls_volume(
1497+
volume_name: &str,
1498+
tls_secret_class: &str,
1499+
requested_secret_lifetime: &Duration,
1500+
) -> Result<Volume> {
14901501
Ok(VolumeBuilder::new(volume_name)
14911502
.ephemeral(
14921503
SecretOperatorVolumeSourceBuilder::new(tls_secret_class)
14931504
.with_pod_scope()
14941505
.with_node_scope()
14951506
.with_format(SecretFormat::TlsPkcs12)
1507+
.with_auto_tls_cert_lifetime(*requested_secret_lifetime)
14961508
.build()
14971509
.context(TlsCertSecretClassVolumeBuildSnafu)?,
14981510
)
@@ -1505,6 +1517,7 @@ fn tls_volume_mounts(
15051517
cb_prepare: &mut ContainerBuilder,
15061518
cb_trino: &mut ContainerBuilder,
15071519
catalogs: &[CatalogConfig],
1520+
requested_secret_lifetime: &Duration,
15081521
) -> Result<()> {
15091522
if let Some(server_tls) = trino.get_server_tls() {
15101523
cb_prepare
@@ -1514,7 +1527,11 @@ fn tls_volume_mounts(
15141527
.add_volume_mount("server-tls-mount", STACKABLE_MOUNT_SERVER_TLS_DIR)
15151528
.context(AddVolumeMountSnafu)?;
15161529
pod_builder
1517-
.add_volume(create_tls_volume("server-tls-mount", server_tls)?)
1530+
.add_volume(create_tls_volume(
1531+
"server-tls-mount",
1532+
server_tls,
1533+
requested_secret_lifetime,
1534+
)?)
15181535
.context(AddVolumeSnafu)?;
15191536
}
15201537

@@ -1546,7 +1563,11 @@ fn tls_volume_mounts(
15461563
.add_volume_mount("internal-tls-mount", STACKABLE_MOUNT_INTERNAL_TLS_DIR)
15471564
.context(AddVolumeMountSnafu)?;
15481565
pod_builder
1549-
.add_volume(create_tls_volume("internal-tls-mount", internal_tls)?)
1566+
.add_volume(create_tls_volume(
1567+
"internal-tls-mount",
1568+
internal_tls,
1569+
requested_secret_lifetime,
1570+
)?)
15501571
.context(AddVolumeSnafu)?;
15511572

15521573
cb_prepare

0 commit comments

Comments
 (0)