TrustStore CRD #557

nightkr · 2025-01-29T13:37:02Z

Description

Fixes #410.

rust/p12 is imported from hjiayz/p12@9983420 (fff63d1), can't really do much about CLA failures from before that point (and beyond that I've kept the changes fairly minimal to enable our use case). Discussed at https://stackable-workspace.slack.com/archives/C033A863YPL/p1741869321744189.

Definition of Done Checklist

Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
Please make sure all these things are done and tick the boxes

Author

Give feedback

Changes are OpenShift compatible
CRD changes approved
CRD documentation for all fields, following the style guide.
Helm chart can be installed and deployed operator works
Integration tests passed (for non trivial changes)
Changes need to be "offline" compatible
Options

Reviewer

Give feedback

Code contains useful comments
Code contains useful logging statements
(Integration-)Test cases added
Documentation added or updated. Follows the style guide.
Changelog updated
Cargo.toml only contains references to git tags (not specific commits or branches)
Options

Acceptance

Give feedback

Feature Tracker has been updated
Proper release label has been added
Roadmap has been updated
Options

Signed-off-by: Marc-Antoine Perennou <[email protected]>

Drop ring dependency and update RustCrypto

Signed-off-by: Marc-Antoine Perennou <[email protected]>

update crypto dependencies

git-subtree-dir: rust/p12 git-subtree-mainline: 21fe8ed git-subtree-split: 9983420

…it out

stackable-bot · 2025-03-13T15:52:26Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
0 out of 4 committers have signed the CLA.

❌ Keruspe
❌ ubamrein
❌ jcaesar
❌ hjiayz

hjiayz seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

siegfriedweber

The following questions are open:

I did not review the complete p12 directory, but only the changes to v0.6.3.

siegfriedweber · 2025-03-26T16:03:10Z

docs/modules/secret-operator/examples/secretclass-tls.yaml

@@ -17,3 +17,4 @@ spec:
        pod: {}
        # or...
        name: my-namespace
+      trustStoreConfigMapName: tls-ca # <4>


This example is used as introduction to SecretClasses, so I would not show special cases. Using k8sSearch for trust stores is not the main use case. I would leave it out. If not, then I would at least mention that this property is optional.

siegfriedweber · 2025-03-26T16:04:35Z

docs/modules/secret-operator/pages/secretclass.adoc

@@ -426,14 +435,16 @@ spec:
        pod: {}
        # or...
        name: my-namespace
+      trustStoreConfigMapName: tls-ca # <4>


Suggested change

trustStoreConfigMapName: tls-ca # <4>

trustStoreConfigMapName: tls-ca

siegfriedweber · 2025-03-26T16:19:37Z

docs/modules/secret-operator/pages/truststore.adoc

+NOTE: Make sure to have a procedure for updating the retrieved certificates. The Secret Operator will automatically rotate
+      the xref:secretclass.adoc#backend-autotls[autoTls] certificate authority as needed, but all trust roots will require
+      some form of update occasionally.


The style guide proposes one sentence per line (https://docs.stackable.tech/home/nightly/contributor/docs/style-guide/#_overall_structure_asciidoc_recommended_practices).

siegfriedweber · 2025-03-27T11:00:30Z

rust/operator-binary/src/truststore_controller.rs

+};
+
+const CONTROLLER_NAME: &str = "truststore";
+const FULL_CONTROLLER_NAME: &str = "truststore.secrets.stackable.tech";


nit: In other operators, const_format is used to avoid duplication (concatcp!(CONTROLLER_NAME, ".", OPERATOR_NAME)).

siegfriedweber · 2025-03-27T11:03:57Z

rust/operator-binary/src/truststore_controller.rs

+            async move {
+                report_controller_reconciled(
+                    &event_recorder,
+                    &format!("{CONTROLLER_NAME}.{OPERATOR_NAME}"),


nit: Use FULL_CONTROLLER_NAME instead.

siegfriedweber · 2025-03-27T11:06:28Z

rust/operator-binary/src/truststore_controller.rs

+                }
+            },
+        )
+        // TODO: merge this into the other ConfigMap watch


nit: Just remove this comment if you do not plan to implement it.

siegfriedweber · 2025-03-27T11:16:39Z

rust/operator-binary/src/truststore_controller.rs

+        // TODO
+        None


Matching each error (and returning None) would be better, so that future errors with secondary objects are not forgotten.

hjiayz and others added 30 commits April 11, 2020 09:46

first commit

f44e0f1

first commit

9ab36c8

allow parse not support type

157460f

allow parse not support type

ed6fdd0

allow parse not support type

8762bd0

allow parse not support type

3585bc3

0.1.2

4be4e3c

update pbepkcs12

55f4ead

update pbepkcs12

810faa0

sdsi cert

49c79c1

0.1.3

88a4226

fix

e2a7503

switch to RustCrypto HmacSha1

d750eae

Signed-off-by: Marc-Antoine Perennou <[email protected]>

switch to getrandom

5ef132e

Signed-off-by: Marc-Antoine Perennou <[email protected]>

update RustCrypto deps

464e982

Signed-off-by: Marc-Antoine Perennou <[email protected]>

drop unused block-cipher-trait

de4272f

Signed-off-by: Marc-Antoine Perennou <[email protected]>

block-modes: update to 0.5.0

b5e2e50

Signed-off-by: Marc-Antoine Perennou <[email protected]>

rustfmt

2e8a35a

Signed-off-by: Marc-Antoine Perennou <[email protected]>

update rustcrypto

017b50e

Signed-off-by: Marc-Antoine Perennou <[email protected]>

Merge pull request #1 from Keruspe/master

6ad0857

Drop ring dependency and update RustCrypto

version 0.2.0

f48e223

update crypto dependencies

02c5c97

Signed-off-by: Marc-Antoine Perennou <[email protected]>

update crypto dependencies

e372089

Signed-off-by: Marc-Antoine Perennou <[email protected]>

update yasna

f30063c

Signed-off-by: Marc-Antoine Perennou <[email protected]>

rename to pkcs-12

1c6f637

Signed-off-by: Marc-Antoine Perennou <[email protected]>

version 0.3.0

1d3fbd9

Signed-off-by: Marc-Antoine Perennou <[email protected]>

require yasna with std feature

5c0018e

Signed-off-by: Marc-Antoine Perennou <[email protected]>

version 0.3.1

885484a

Signed-off-by: Marc-Antoine Perennou <[email protected]>

add CI

dc0fad4

Signed-off-by: Marc-Antoine Perennou <[email protected]>

Merge pull request #2 from Keruspe/crypto

5e3179a

update crypto dependencies

nightkr added 11 commits March 10, 2025 13:54

Configure watches for the truststore controller

9791bee

Optimistically try to encode truststore data as string

26b54eb

Clean up error handling

b3656dd

Start factoring out truststore reference watch logic

b569b05

Factor out TrustStore dependency resolution logic

d43274f

Log reconciliation results properly

57e3727

TrustStore smoke test

85b3bfc

Stub out pkcs12 salt for determinism

21fe8ed

Add 'rust/p12/' from commit '9983420fd81ba123ee2c284c8e564734de8b5f00'

fff63d1

git-subtree-dir: rust/p12 git-subtree-mainline: 21fe8ed git-subtree-split: 9983420

Move p12 into subtree folder

75bb19f

Factor out the RNG provider from p12 instead of always just stubbing …

5326498

…it out

nightkr added 5 commits March 14, 2025 12:27

Handle CSI startup errors (again)

f284c9b

Docs

5092971

Changelog

eac6338

Minor cleanup

055c732

Use ProductOperatorRun

8cd87e4

nightkr marked this pull request as ready for review March 17, 2025 15:12

Merge branch 'main' into feature/truststore-crd

2674b67

nightkr requested a review from a team March 17, 2025 15:23

nightkr added 8 commits March 18, 2025 04:00

Fixed an import that got missing in the merge conflict

26a60f4

Add CRD docs for TrustStore

1181174

Fix pre-commit errors

ecd2fd1

Drop unused hex dependency

fd3ab95

Update Ring for rustsec advisory

42d423a

Ignore RUSTSEC-2025-0012 for now

70a809c

Fix broken doclinks

0762b44

Switch p12 to use the workspace version (to unbreak our PR build script)

cb9873a

sbernauer requested a review from siegfriedweber March 24, 2025 08:09

siegfriedweber requested changes Mar 27, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TrustStore CRD #557

TrustStore CRD #557

nightkr commented Jan 29, 2025 •

edited by siegfriedweber

Loading

Author

Reviewer

Acceptance

stackable-bot commented Mar 13, 2025 •

edited

Loading

siegfriedweber left a comment

siegfriedweber Mar 26, 2025

siegfriedweber Mar 26, 2025

siegfriedweber Mar 26, 2025

siegfriedweber Mar 27, 2025

siegfriedweber Mar 27, 2025

siegfriedweber Mar 27, 2025

siegfriedweber Mar 27, 2025

	trustStoreConfigMapName: tls-ca # <4>
	trustStoreConfigMapName: tls-ca

TrustStore CRD #557

Are you sure you want to change the base?

TrustStore CRD #557

Conversation

nightkr commented Jan 29, 2025 • edited by siegfriedweber Loading

Description

Definition of Done Checklist

Author

Reviewer

Acceptance

stackable-bot commented Mar 13, 2025 • edited Loading

siegfriedweber left a comment

Choose a reason for hiding this comment

siegfriedweber Mar 26, 2025

Choose a reason for hiding this comment

siegfriedweber Mar 26, 2025

Choose a reason for hiding this comment

siegfriedweber Mar 26, 2025

Choose a reason for hiding this comment

siegfriedweber Mar 27, 2025

Choose a reason for hiding this comment

siegfriedweber Mar 27, 2025

Choose a reason for hiding this comment

siegfriedweber Mar 27, 2025

Choose a reason for hiding this comment

siegfriedweber Mar 27, 2025

Choose a reason for hiding this comment

nightkr commented Jan 29, 2025 •

edited by siegfriedweber

Loading

stackable-bot commented Mar 13, 2025 •

edited

Loading