Skip to content

Commit cc88726

Browse files
cardoecardoe
committed
feat: use mariadb operator for OpenStack db secrets
Generate and inject the database connection info via a secret generated by the MariaDB operator to create a connection string that matches what oslo.config reads. Unfortunately OpenStack Helm doesn't always respect the mount for the db_sync job so this won't work until that's fixed upstream and we bump to releases with those fixes for all the services.
1 parent b247517 commit cc88726

15 files changed

+515
-9
lines changed

‎components/glance/glance-mariadb-db.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,26 @@ spec:
5050
grantOption: true
5151
host: "%"
5252
retryInterval: 5s
53+
---
54+
apiVersion: k8s.mariadb.com/v1alpha1
55+
kind: Connection
56+
metadata:
57+
name: glance-db-conn
58+
spec:
59+
mariaDbRef:
60+
name: mariadb
61+
username: glance
62+
passwordSecretKeyRef:
63+
name: glance-db-password
64+
key: password
65+
database: glance
66+
secretName: glance-db-conn
67+
secretTemplate:
68+
key: db_conn.conf
69+
format: |
70+
[database]
71+
connection = mysql+pymysql://{{ .Username }}:{{ .Password }}@{{ .Host }}:{{ .Port }}/{{ .Database }}{{ .Params }}
72+
healthCheck:
73+
interval: 30s
74+
retryInterval: 3s
75+
serviceName: mariadb

‎components/glance/values.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,38 @@ pod:
8989
periodSeconds: 10
9090
timeoutSeconds: 8
9191
failureThreshold: 6
92+
mounts:
93+
# oslo.config autoloads certain paths in alphabetical order
94+
# which gives us the opportunity to inject secrets and extra
95+
# configs here. likely the best paths are:
96+
# /etc/${project}/${prog}.conf.d/*.conf
97+
# /etc/${project}/${project}.conf.d/*.conf
98+
# the first would be best for per service separation but since each
99+
# service is in its own pod they won't overlap. further more there
100+
# is an issue with that see https://bugs.launchpad.net/oslo.config/+bug/2098514
101+
# so we'll use the bottom one
102+
glance_api:
103+
glance_api:
104+
volumeMounts:
105+
- mountPath: /etc/glance/glance.conf.d/db_conn.conf
106+
name: glance-db-conn
107+
subPath: db_conf.conf
108+
readOnly: true
109+
volumes:
110+
- name: glance-db-conn
111+
secret:
112+
secretName: glance-db-conn
113+
glance_db_sync:
114+
glance_db_sync:
115+
volumeMounts:
116+
- mountPath: /etc/glance/glance.conf.d/db_conn.conf
117+
name: glance-db-conn
118+
subPath: db_conf.conf
119+
readOnly: true
120+
volumes:
121+
- name: glance-db-conn
122+
secret:
123+
secretName: glance-db-conn
92124

93125
conf:
94126
glance_api_uwsgi:

‎components/horizon/horizon-mariadb-db.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,26 @@ spec:
5050
grantOption: true
5151
host: "%"
5252
retryInterval: 5s
53+
---
54+
apiVersion: k8s.mariadb.com/v1alpha1
55+
kind: Connection
56+
metadata:
57+
name: horizon-db-conn
58+
spec:
59+
mariaDbRef:
60+
name: mariadb
61+
username: horizon
62+
passwordSecretKeyRef:
63+
name: horizon-db-password
64+
key: password
65+
database: horizon
66+
secretName: horizon-db-conn
67+
secretTemplate:
68+
key: db_conn.conf
69+
format: |
70+
[database]
71+
connection = mysql+pymysql://{{ .Username }}:{{ .Password }}@{{ .Host }}:{{ .Port }}/{{ .Database }}{{ .Params }}
72+
healthCheck:
73+
interval: 30s
74+
retryInterval: 3s
75+
serviceName: mariadb

‎components/horizon/values.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,38 @@ pod:
7676
# this should be set to no more than (pod.replicas.horizon - 1)
7777
# usually set on per-deployment basis.
7878
min_available: 0
79+
mounts:
80+
# oslo.config autoloads certain paths in alphabetical order
81+
# which gives us the opportunity to inject secrets and extra
82+
# configs here. likely the best paths are:
83+
# /etc/${project}/${prog}.conf.d/*.conf
84+
# /etc/${project}/${project}.conf.d/*.conf
85+
# the first would be best for per service separation but since each
86+
# service is in its own pod they won't overlap. further more there
87+
# is an issue with that see https://bugs.launchpad.net/oslo.config/+bug/2098514
88+
# so we'll use the bottom one
89+
horizon:
90+
horizon:
91+
volumeMounts:
92+
- mountPath: /etc/horizon/horizon.conf.d/db_conn.conf
93+
name: horizon-db-conn
94+
subPath: db_conf.conf
95+
readOnly: true
96+
volumes:
97+
- name: horizon-db-conn
98+
secret:
99+
secretName: horizon-db-conn
100+
horizon_db_sync:
101+
horizon_db_sync:
102+
volumeMounts:
103+
- mountPath: /etc/horizon/horizon.conf.d/db_conn.conf
104+
name: horizon-db-conn
105+
subPath: db_conf.conf
106+
readOnly: true
107+
volumes:
108+
- name: horizon-db-conn
109+
secret:
110+
secretName: horizon-db-conn
79111

80112
# We don't want to enable OpenStack Helm's
81113
# helm.sh/hooks because they set them as

‎components/ironic/ironic-mariadb-db.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,26 @@ spec:
5050
grantOption: true
5151
host: "%"
5252
retryInterval: 5s
53+
---
54+
apiVersion: k8s.mariadb.com/v1alpha1
55+
kind: Connection
56+
metadata:
57+
name: ironic-db-conn
58+
spec:
59+
mariaDbRef:
60+
name: mariadb
61+
username: ironic
62+
passwordSecretKeyRef:
63+
name: ironic-db-password
64+
key: password
65+
database: ironic
66+
secretName: ironic-db-conn
67+
secretTemplate:
68+
key: db_conn.conf
69+
format: |
70+
[database]
71+
connection = mysql+pymysql://{{ .Username }}:{{ .Password }}@{{ .Host }}:{{ .Port }}/{{ .Database }}{{ .Params }}
72+
healthCheck:
73+
interval: 30s
74+
retryInterval: 3s
75+
serviceName: mariadb

‎components/ironic/values.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,16 +163,54 @@ manifests:
163163

164164
pod:
165165
mounts:
166+
# oslo.config autoloads certain paths in alphabetical order
167+
# which gives us the opportunity to inject secrets and extra
168+
# configs here. likely the best paths are:
169+
# /etc/${project}/${prog}.conf.d/*.conf
170+
# /etc/${project}/${project}.conf.d/*.conf
171+
# the first would be best for per service separation but since each
172+
# service is in its own pod they won't overlap. further more there
173+
# is an issue with that see https://bugs.launchpad.net/oslo.config/+bug/2098514
174+
# so we'll use the bottom one
175+
ironic_api:
176+
ironic_api:
177+
volumeMounts:
178+
- mountPath: /etc/ironic/ironic.conf.d/db_conn.conf
179+
name: ironic-db-conn
180+
subPath: db_conf.conf
181+
readOnly: true
182+
volumes:
183+
- name: ironic-db-conn
184+
secret:
185+
secretName: ironic-db-conn
186+
ironic_db_sync:
187+
ironic_db_sync:
188+
volumeMounts:
189+
- mountPath: /etc/ironic/ironic.conf.d/db_conn.conf
190+
name: ironic-db-conn
191+
subPath: db_conf.conf
192+
readOnly: true
193+
volumes:
194+
- name: ironic-db-conn
195+
secret:
196+
secretName: ironic-db-conn
166197
ironic_conductor:
167198
ironic_conductor:
168199
volumeMounts:
200+
- mountPath: /etc/ironic/ironic.conf.d/db_conn.conf
201+
name: ironic-db-conn
202+
subPath: db_conf.conf
203+
readOnly: true
169204
- name: dnsmasq-ironic
170205
mountPath: /etc/dnsmasq.d/
171206
- name: dnsmasq-dhcp
172207
mountPath: /var/lib/dnsmasq/
173208
- name: understack-data
174209
mountPath: /var/lib/understack
175210
volumes:
211+
- name: ironic-db-conn
212+
secret:
213+
secretName: ironic-db-conn
176214
- name: dnsmasq-ironic
177215
persistentVolumeClaim:
178216
claimName: dnsmasq-ironic

‎components/keystone/keystone-mariadb-db.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,26 @@ spec:
5050
grantOption: true
5151
host: "%"
5252
retryInterval: 5s
53+
---
54+
apiVersion: k8s.mariadb.com/v1alpha1
55+
kind: Connection
56+
metadata:
57+
name: keystone-db-conn
58+
spec:
59+
mariaDbRef:
60+
name: mariadb
61+
username: keystone
62+
passwordSecretKeyRef:
63+
name: keystone-db-password
64+
key: password
65+
database: keystone
66+
secretName: keystone-db-conn
67+
secretTemplate:
68+
key: db_conn.conf
69+
format: |
70+
[database]
71+
connection = mysql+pymysql://{{ .Username }}:{{ .Password }}@{{ .Host }}:{{ .Port }}/{{ .Database }}{{ .Params }}
72+
healthCheck:
73+
interval: 30s
74+
retryInterval: 3s
75+
serviceName: mariadb

‎components/neutron/neutron-mariadb-db.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,3 +50,26 @@ spec:
5050
grantOption: true
5151
host: "%"
5252
retryInterval: 5s
53+
---
54+
apiVersion: k8s.mariadb.com/v1alpha1
55+
kind: Connection
56+
metadata:
57+
name: neutron-db-conn
58+
spec:
59+
mariaDbRef:
60+
name: mariadb
61+
username: neutron
62+
passwordSecretKeyRef:
63+
name: neutron-db-password
64+
key: password
65+
database: neutron
66+
secretName: neutron-db-conn
67+
secretTemplate:
68+
key: db_conn.conf
69+
format: |
70+
[database]
71+
connection = mysql+pymysql://{{ .Username }}:{{ .Password }}@{{ .Host }}:{{ .Port }}/{{ .Database }}{{ .Params }}
72+
healthCheck:
73+
interval: 30s
74+
retryInterval: 3s
75+
serviceName: mariadb

‎components/neutron/values.yaml‎

Lines changed: 39 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -92,18 +92,22 @@ pod:
9292
# usually set on per-deployment basis.
9393
min_available: 0
9494
mounts:
95+
# oslo.config autoloads certain paths in alphabetical order
96+
# which gives us the opportunity to inject secrets and extra
97+
# configs here. likely the best paths are:
98+
# /etc/${project}/${prog}.conf.d/*.conf
99+
# /etc/${project}/${project}.conf.d/*.conf
100+
# the first would be best for per service separation but since each
101+
# service is in its own pod they won't overlap. further more there
102+
# is an issue with that see https://bugs.launchpad.net/oslo.config/+bug/2098514
103+
# so we'll use the bottom one
95104
neutron_server:
96105
neutron_server:
97106
volumeMounts:
98-
# oslo.config autoloads certain paths in alphabetical order
99-
# which gives us the opportunity to inject secrets and extra
100-
# configs here. likely the best paths are:
101-
# /etc/${project}/${prog}.conf.d/*.conf
102-
# /etc/${project}/${project}.conf.d/*.conf
103-
# the first would be best for per service separation but since each
104-
# service is in its own pod they won't overlap. further more there
105-
# is an issue with that see https://bugs.launchpad.net/oslo.config/+bug/2098514
106-
# so we'll use the bottom one
107+
- mountPath: /etc/neutron/neutron.conf.d/db_conn.conf
108+
name: neutron-db-conn
109+
subPath: db_conf.conf
110+
readOnly: true
107111
- mountPath: /etc/neutron/neutron.conf.d/ml2_understack.conf
108112
name: neutron-nautobot
109113
subPath: ml2_understack.conf
@@ -112,12 +116,38 @@ pod:
112116
name: undersync-token
113117
readOnly: true
114118
volumes:
119+
- name: neutron-db-conn
120+
secret:
121+
secretName: neutron-db-conn
115122
- name: neutron-nautobot
116123
secret:
117124
secretName: neutron-nautobot
118125
- name: undersync-token
119126
secret:
120127
secretName: undersync-token
128+
neutron_ironic_agent:
129+
neutron_ironic_agent:
130+
volumeMounts:
131+
- mountPath: /etc/neutron/neutron.conf.d/db_conn.conf
132+
name: neutron-db-conn
133+
subPath: db_conf.conf
134+
readOnly: true
135+
volumes:
136+
- name: neutron-db-conn
137+
secret:
138+
secretName: neutron-db-conn
139+
neutron_db_sync:
140+
neutron_db_sync:
141+
volumeMounts:
142+
- mountPath: /etc/neutron/neutron.conf.d/db_conn.conf
143+
name: neutron-db-conn
144+
subPath: db_conf.conf
145+
readOnly: true
146+
volumes:
147+
- name: neutron-db-conn
148+
secret:
149+
secretName: neutron-db-conn
150+
121151
# (nicholas.kuechler) updating the jobs list to remove the 'neutron-rabbit-init' job.
122152
dependencies:
123153
dynamic:

‎components/nova/nova-api-mariadb-db.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,3 +30,26 @@ spec:
3030
grantOption: true
3131
host: "%"
3232
retryInterval: 5s
33+
---
34+
apiVersion: k8s.mariadb.com/v1alpha1
35+
kind: Connection
36+
metadata:
37+
name: nova-api-db-conn
38+
spec:
39+
mariaDbRef:
40+
name: mariadb
41+
username: nova
42+
passwordSecretKeyRef:
43+
name: nova-db-password
44+
key: password
45+
database: nova_api
46+
secretName: nova-api-db-conn
47+
secretTemplate:
48+
key: db_conn.conf
49+
format: |
50+
[api_database]
51+
connection = mysql+pymysql://{{ .Username }}:{{ .Password }}@{{ .Host }}:{{ .Port }}/{{ .Database }}{{ .Params }}
52+
healthCheck:
53+
interval: 30s
54+
retryInterval: 3s
55+
serviceName: mariadb

0 commit comments

Comments
 (0)