Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow noobaa on the client side to be deleted #2850

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Allow noobaa on the client side to be deleted #2850

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 7 additions & 3 deletions services/provider/server/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,15 @@ import (
"encoding/json"
"encoding/pem"
"fmt"
"k8s.io/utils/ptr"
"math"
"net"
"slices"
"strconv"
"strings"
"time"

"k8s.io/utils/ptr"

"github.com/blang/semver/v4"
nbv1 "github.com/noobaa/noobaa-operator/v5/pkg/apis/noobaa/v1alpha1"
quotav1 "github.com/openshift/api/quota/v1"
Expand Down Expand Up @@ -433,17 +434,20 @@ func (s *OCSProviderServer) getExternalResources(ctx context.Context, consumerRe
Kind: "Secret",
Data: mustMarshal(map[string]string{
"auth_token": string(authToken),
"mgmt_addr": noobaaMgmtAddress,
"mgmt_addr": fmt.Sprintf("https://%s:443", noobaaMgmtAddress),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as it's https I'm assuming server & client speaks over TLS, so what certs are being used here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The above is the secret from which noobaa-operator on the client side will connect to the provider side noobaa management address. The certs are being handled on the noobaa-core if I am not wrong.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When it connects, for the simplest case client verifies that it is speaking to correct server isn't it? For that usually certs are presented, IOW did you check the feature is working as expected w/o providing certs explicitly?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes it connects to the provider noobaa with ready status. Below is from a client cluster.

oc get noobaa noobaa -oyaml
apiVersion: noobaa.io/v1alpha1
kind: NooBaa
metadata:
  annotations:
    remote-client-noobaa: "true"
  creationTimestamp: "2024-10-14T12:02:25Z"
  finalizers:
  - noobaa.io/graceful_finalizer
  generation: 2
  labels:
    app: noobaa
  name: noobaa
  namespace: openshift-storage
  ownerReferences:
  - apiVersion: ocs.openshift.io/v1alpha1
    kind: StorageClient
    name: ocs-storage-client
    uid: 1b60d41c-0d62-454e-b04c-e7c59fb79ea2
  resourceVersion: "8113000"
  uid: 4b1bf9b4-e83d-4620-9fdc-8f8b72dbbb5c
spec:
  autoscaler: {}
  bucketLogging: {}
  cleanupPolicy:
    allowNoobaaDeletion: true
  joinSecret:
    name: noobaa-remote-join-secret
    namespace: openshift-storage
  loadBalancerSourceSubnets: {}
  security:
    kms: {}
status:
  accounts:
    admin:
      secretRef: {}
  actualImage: registry.redhat.io/odf4/mcg-core-rhel9@sha256:2a7effe96f6419a7740ba0e3dbd9e1372f226339b70f9d204cbdd0a643fb6af4
  conditions:
  - lastHeartbeatTime: "2024-10-15T09:52:53Z"
    lastTransitionTime: "2024-10-15T09:52:53Z"
    message: noobaa operator completed reconcile - system is ready
    reason: SystemPhaseReady
    status: "True"
    type: Available
  - lastHeartbeatTime: "2024-10-15T09:52:53Z"
    lastTransitionTime: "2024-10-15T09:52:53Z"
    message: noobaa operator completed reconcile - system is ready
    reason: SystemPhaseReady
    status: "False"
    type: Progressing
  - lastHeartbeatTime: "2024-10-15T09:52:53Z"
    lastTransitionTime: "2024-10-14T12:02:25Z"
    message: noobaa operator completed reconcile - system is ready
    reason: SystemPhaseReady
    status: "False"
    type: Degraded
  - lastHeartbeatTime: "2024-10-15T09:52:53Z"
    lastTransitionTime: "2024-10-15T09:52:53Z"
    message: noobaa operator completed reconcile - system is ready
    reason: SystemPhaseReady
    status: "True"
    type: Upgradeable
  observedGeneration: 2
  phase: Ready
  readme: "\n\n\tWelcome to NooBaa!\n\t-----------------\n\tNooBaa Core Version:     master-20240520\n\tNooBaa
    Operator Version: 5.18.0\n\n\tLets get started:\n\n\tTest S3 client:\n\n\t\tkubectl
    port-forward -n openshift-storage service/s3 10443:443 &\n\t\tNOOBAA_ACCESS_KEY=$(kubectl
    get secret noobaa-admin -n openshift-storage -o json | jq -r '.data.AWS_ACCESS_KEY_ID|@base64d')\n\t\tNOOBAA_SECRET_KEY=$(kubectl
    get secret noobaa-admin -n openshift-storage -o json | jq -r '.data.AWS_SECRET_ACCESS_KEY|@base64d')\n\t\talias
    s3='AWS_ACCESS_KEY_ID=$NOOBAA_ACCESS_KEY AWS_SECRET_ACCESS_KEY=$NOOBAA_SECRET_KEY
    aws --endpoint https://localhost:10443 --no-verify-ssl s3'\n\t\ts3 ls\n\n"
  services:
    serviceMgmt: {}
    serviceS3:
      externalDNS:
      - https://s3-openshift-storage.apps.kmajumder-client.ocs.syseng.devcluster.openshift.com:443
      - https://a027bf7c85e6b4807820eb7f881ef92b-1498412627.ap-south-1.elb.amazonaws.com:443
      internalDNS:
      - https://s3.openshift-storage.svc:443
      internalIP:
      - https://172.30.235.24:443
    serviceSts:
      externalDNS:
      - https://sts-openshift-storage.apps.kmajumder-client.ocs.syseng.devcluster.openshift.com:443
      - https://ab57cf70e53734f03adc06ecfc8ec446-26135574.ap-south-1.elb.amazonaws.com:443
      internalDNS:
      - https://sts.openshift-storage.svc:443
      internalIP:
      - https://172.30.90.229:443
    serviceSyslog: {}
    ```

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Below is from a client cluster.

  • ack, based on naming ...apps.kmajumder-client.ocs... I'm assuming this is not local client, thanks.

}),
})

extR = append(extR, &pb.ExternalResource{
Name: "noobaa-remote",
Name: "noobaa",
Kind: "Noobaa",
Data: mustMarshal(&nbv1.NooBaaSpec{
JoinSecret: &v1.SecretReference{
Name: "noobaa-remote-join-secret",
},
CleanupPolicy: nbv1.CleanupPolicySpec{
AllowNoobaaDeletion: true,
},
}),
})
return extR, nil
Expand Down
9 changes: 6 additions & 3 deletions services/provider/server/server_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,14 @@ var noobaaSpec = &nbv1.NooBaaSpec{
JoinSecret: &v1.SecretReference{
Name: "noobaa-remote-join-secret",
},
CleanupPolicy: nbv1.CleanupPolicySpec{
AllowNoobaaDeletion: true,
},
}

var joinSecret = map[string]string{
"auth_token": "authToken",
"mgmt_addr": "noobaaMgmtAddress",
"mgmt_addr": "https://noobaaMgmtAddress:443",
}

var mockExtR = map[string]*externalResource{
Expand Down Expand Up @@ -100,8 +103,8 @@ var mockExtR = map[string]*externalResource{
Kind: "Secret",
Data: joinSecret,
},
"noobaa-remote": {
Name: "noobaa-remote",
"noobaa": {
Name: "noobaa",
Kind: "Noobaa",
Data: noobaaSpec,
},
Expand Down
Loading