Skip to content

Commit beac1c0

Browse files
committed
Remove the copy-cert init containers
1 parent 0d4ad59 commit beac1c0

File tree

6 files changed

+113
-31
lines changed

6 files changed

+113
-31
lines changed

cmd/self-signer/root.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,17 @@ import (
2626
"github.com/spf13/cobra"
2727
"k8s.io/apimachinery/pkg/runtime"
2828
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
29+
"k8s.io/client-go/rest"
2930
controllerruntime "sigs.k8s.io/controller-runtime"
3031
"sigs.k8s.io/controller-runtime/pkg/client"
3132

3233
"github.com/cockroachdb/helm-charts/pkg/generator"
3334
)
3435

3536
var (
36-
cl client.Client
37-
ctx context.Context
37+
cl client.Client
38+
config *rest.Config
39+
ctx context.Context
3840
)
3941

4042
// rootCmd represents the base command when called without any subcommands
@@ -71,7 +73,7 @@ func init() {
7173
runtimeScheme := runtime.NewScheme()
7274

7375
_ = clientgoscheme.AddToScheme(runtimeScheme)
74-
config := controllerruntime.GetConfigOrDie()
76+
config = controllerruntime.GetConfigOrDie()
7577

7678
cl, err = client.New(config, client.Options{
7779
Scheme: runtimeScheme,
@@ -85,7 +87,7 @@ func init() {
8587
func getInitialConfig(caDuration, caExpiry, nodeDuration, nodeExpiry, clientDuration,
8688
clientExpiry string) (generator.GenerateCert, error) {
8789

88-
genCert := generator.NewGenerateCert(cl)
90+
genCert := generator.NewGenerateCert(config, cl)
8991

9092
if err := genCert.CaCertConfig.SetConfig(caDuration, caExpiry); err != nil {
9193
return genCert, err

cockroachdb/templates/role-certRotateSelfSigner.yaml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ rules:
2222
resourceNames:
2323
- {{ template "cockroachdb.fullname" . }}
2424
- apiGroups: [""]
25-
resources: ["pods"]
25+
resources: ["pods", "pods/logs"]
2626
verbs: ["delete", "get"]
27+
- apiGroups: [""]
28+
resources: ["pods/exec"]
29+
verbs: ["create"]
2730
{{- end }}

cockroachdb/templates/statefulset.yaml

Lines changed: 24 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ spec:
5151
{{- end }}
5252
{{- end }}
5353
serviceAccountName: {{ template "cockroachdb.serviceAccount.name" . }}
54-
{{- if .Values.tls.enabled }}
54+
{{- if and .Values.tls.enabled .Values.statefulset.securityContext.runAsNonRootUser.enabled }}
5555
initContainers:
5656
- name: copy-certs
5757
image: {{ .Values.tls.copyCerts.image | quote }}
@@ -266,11 +266,15 @@ spec:
266266
- name: datadir
267267
mountPath: /cockroach/{{ .Values.conf.path }}/
268268
{{- if .Values.tls.enabled }}
269+
{{- if .Values.statefulset.securityContext.runAsNonRootUser.enabled }}
269270
- name: certs
270271
mountPath: /cockroach/cockroach-certs/
271-
{{- if .Values.tls.certs.provided }}
272+
{{- end }}
272273
- name: certs-secret
274+
{{- if .Values.statefulset.securityContext.runAsNonRootUser.enabled }}
273275
mountPath: /cockroach/certs/
276+
{{- else }}
277+
mountPath: /cockroach/cockroach-certs/
274278
{{- end }}
275279
{{- end }}
276280
{{- range .Values.statefulset.secretMounts }}
@@ -340,34 +344,29 @@ spec:
340344
emptyDir: {}
341345
{{- end }}
342346
{{- if .Values.tls.enabled }}
347+
{{- if .Values.statefulset.securityContext.runAsNonRootUser.enabled}}
343348
- name: certs
344349
emptyDir: {}
350+
{{- end }}
345351
{{- if or .Values.tls.certs.provided .Values.tls.certs.certManager .Values.tls.certs.selfSigner.enabled }}
346352
- name: certs-secret
347-
{{- if or .Values.tls.certs.tlsSecret .Values.tls.certs.certManager .Values.tls.certs.selfSigner.enabled }}
348-
projected:
349-
sources:
350-
- secret:
351-
{{- if .Values.tls.certs.selfSigner.enabled }}
352-
name: {{ template "cockroachdb.fullname" . }}-node-secret
353-
{{ else }}
354-
name: {{ .Values.tls.certs.nodeSecret }}
355-
{{ end -}}
356-
items:
357-
- key: ca.crt
358-
path: ca.crt
359-
mode: 256
360-
- key: tls.crt
361-
path: node.crt
362-
mode: 256
363-
- key: tls.key
364-
path: node.key
365-
mode: 256
366-
{{- else }}
367353
secret:
354+
{{- if .Values.tls.certs.selfSigner.enabled }}
355+
secretName: {{ template "cockroachdb.fullname" . }}-node-secret
356+
{{ else }}
368357
secretName: {{ .Values.tls.certs.nodeSecret }}
358+
{{- end }}
369359
defaultMode: 256
370-
{{- end }}
360+
items:
361+
- key: ca.crt
362+
path: ca.crt
363+
mode: 256
364+
- key: tls.crt
365+
path: node.crt
366+
mode: 256
367+
- key: tls.key
368+
path: node.key
369+
mode: 256
371370
{{- end }}
372371
{{- end }}
373372
{{- range .Values.statefulset.secretMounts }}
@@ -385,10 +384,12 @@ spec:
385384
securityContext:
386385
seccompProfile:
387386
type: "RuntimeDefault"
387+
{{- if .Values.statefulset.securityContext.runAsNonRootUser.enabled }}
388388
fsGroup: 1000
389389
runAsGroup: 1000
390390
runAsUser: 1000
391391
runAsNonRoot: true
392+
{{- end }}
392393
{{- end }}
393394
{{- end }}
394395
{{- if .Values.storage.persistentVolume.enabled }}

cockroachdb/values.yaml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -283,6 +283,8 @@ statefulset:
283283

284284
securityContext:
285285
enabled: true
286+
runAsNonRootUser:
287+
enabled: false
286288

287289
serviceAccount:
288290
# Specifies whether this ServiceAccount should be created.
@@ -580,7 +582,7 @@ tls:
580582
# Image Placeholder for the selfSigner utility. This will be changed once the CI workflows for the image is in place.
581583
image:
582584
repository: cockroachlabs-helm-charts/cockroach-self-signer-cert
583-
tag: "1.5"
585+
tag: "1.6"
584586
pullPolicy: IfNotPresent
585587
credentials: {}
586588
registry: gcr.io

pkg/generator/generate_cert.go

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ import (
2626
"github.com/pkg/errors"
2727
"github.com/sirupsen/logrus"
2828
corev1 "k8s.io/api/core/v1"
29+
"k8s.io/client-go/rest"
2930
"sigs.k8s.io/controller-runtime/pkg/client"
3031

3132
"github.com/cockroachdb/helm-charts/pkg/kube"
@@ -52,6 +53,7 @@ func init() {
5253
// GenerateCert is the structure containing all the certificate related info
5354
type GenerateCert struct {
5455
client client.Client
56+
restConfig *rest.Config
5557
CertsDir string
5658
CaSecret string
5759
CAKey string
@@ -93,9 +95,10 @@ func (c *certConfig) SetConfig(duration, expiryWindow string) error {
9395
return nil
9496
}
9597

96-
func NewGenerateCert(cl client.Client) GenerateCert {
98+
func NewGenerateCert(config *rest.Config, cl client.Client) GenerateCert {
9799
return GenerateCert{
98100
client: cl,
101+
restConfig: config,
99102
CaCertConfig: &certConfig{},
100103
NodeCertConfig: &certConfig{},
101104
ClientCertConfig: &certConfig{},
@@ -370,7 +373,7 @@ func (rc *GenerateCert) generateNodeCert(ctx context.Context, nodeSecretName str
370373
return err
371374
}
372375

373-
if err = kube.RollingUpdate(ctx, rc.client, rc.DiscoveryServiceName, namespace, rc.ReadinessWait, rc.PodUpdateTimeout); err != nil {
376+
if err = kube.SighupSignalToPods(ctx, rc.restConfig, rc.client, rc.DiscoveryServiceName, namespace); err != nil {
374377
return
375378
}
376379
return nil

pkg/kube/helpers.go

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ limitations under the License.
1717
package kube
1818

1919
import (
20+
"bytes"
2021
"context"
2122
"fmt"
2223
"strconv"
@@ -29,6 +30,10 @@ import (
2930
corev1 "k8s.io/api/core/v1"
3031
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
3132
"k8s.io/apimachinery/pkg/types"
33+
"k8s.io/client-go/kubernetes"
34+
"k8s.io/client-go/kubernetes/scheme"
35+
"k8s.io/client-go/rest"
36+
"k8s.io/client-go/tools/remotecommand"
3237
ctrl "sigs.k8s.io/controller-runtime"
3338
"sigs.k8s.io/controller-runtime/pkg/client"
3439
ctrlutil "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -153,6 +158,72 @@ func RollingUpdate(ctx context.Context, cl client.Client, stsName, namespace str
153158
return nil
154159
}
155160

161+
// SighupSignalToPods sends SIGHUP signal to all the pods in the statefulset.
162+
func SighupSignalToPods(ctx context.Context, config *rest.Config, cl client.Client, stsName, namespace string) error {
163+
164+
clientset, err := kubernetes.NewForConfig(config)
165+
if err != nil {
166+
return err
167+
}
168+
169+
var sts v1.StatefulSet
170+
if err := cl.Get(ctx, types.NamespacedName{Namespace: namespace, Name: stsName}, &sts); err != nil {
171+
return err
172+
}
173+
174+
containerName := sts.Spec.Template.Spec.Containers[0].Name
175+
command := []string{"/bin/bash", "-c", "echo 'Send SIGHUP to cockroach'; kill -s 1 $(ls -l /proc/*/exe | grep cockroach | awk '{print $2}')"}
176+
for i := int32(0); i < sts.Status.Replicas; i++ {
177+
replicaName := stsName + "-" + strconv.Itoa(int(i))
178+
179+
stdout, stderr, err := execCommandInPod(clientset, config, namespace, replicaName, containerName, command)
180+
if err != nil {
181+
logrus.Errorf("Failed to send SIGHUP signal to pod [%s], error: %v, stdout: %s, stderr: %s", replicaName, err, stdout, stderr)
182+
}
183+
logrus.Info(stdout)
184+
185+
// Sleeping for 1 second to allow the pod to receive the signal
186+
time.Sleep(1 * time.Second)
187+
}
188+
189+
return nil
190+
}
191+
192+
// execCommandInPod executes the provided command in the given pod and returns the stdout and stderr.
193+
func execCommandInPod(clientset *kubernetes.Clientset, config *rest.Config, namespace, podName, containerName string, command []string) (string, string, error) {
194+
logrus.Infof("Running command %s in pod %s in container %s", command, podName, containerName)
195+
196+
req := clientset.CoreV1().RESTClient().Post().
197+
Resource("pods").
198+
Name(podName).
199+
Namespace(namespace).
200+
SubResource("exec").
201+
Param("container", containerName).
202+
VersionedParams(&corev1.PodExecOptions{
203+
Command: command,
204+
Stdin: false,
205+
Stdout: true,
206+
Stderr: true,
207+
TTY: true,
208+
}, scheme.ParameterCodec)
209+
210+
exec, err := remotecommand.NewSPDYExecutor(config, "POST", req.URL())
211+
if err != nil {
212+
return "", "", err
213+
}
214+
215+
var stdout, stderr bytes.Buffer
216+
err = exec.Stream(remotecommand.StreamOptions{
217+
Stdout: &stdout,
218+
Stderr: &stderr,
219+
})
220+
if err != nil {
221+
return stdout.String(), stderr.String(), err
222+
}
223+
224+
return stdout.String(), stderr.String(), nil
225+
}
226+
156227
func WaitForPodReady(ctx context.Context, cl client.Client, name, namespace string, podUpdateTimeout,
157228
podMaxPollingInterval time.Duration) error {
158229
f := func() error {

0 commit comments

Comments
 (0)