Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: Firewall bootstrap rotation #195

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

WIP: Firewall bootstrap rotation #195

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 65 additions & 0 deletions controllers/firewall_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,9 @@ import (
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/types"
"k8s.io/apimachinery/pkg/util/intstr"
"k8s.io/apimachinery/pkg/util/json"
"k8s.io/client-go/tools/record"
bootstraptokenutil "k8s.io/cluster-bootstrap/token/util"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/builder"
"sigs.k8s.io/controller-runtime/pkg/client"
Expand Down Expand Up @@ -108,6 +110,13 @@ func (r *FirewallReconciler) Reconcile(ctx context.Context, req ctrl.Request) (c
return ctrl.Result{}, err
}
}

err := r.reconcileSeedBootstrapToken(ctx, f)
if err != nil {
r.Log.Error(err, "failed to reconcile seed bootstrap token")
return ctrl.Result{}, err
}

if r.TokenUpdater != nil && f.Status.ShootAccess != nil {
r.TokenUpdater.UpdateShootAccess(f.Status.ShootAccess)
}
Expand Down Expand Up @@ -308,3 +317,59 @@ func (r *FirewallReconciler) reconcileSSHKeys(fw *firewallv2.Firewall) error {

return nil
}

const seedBootstrapTokenFile = "/etc/metal/seed-bootstrap-token-secret"

func (r *FirewallReconciler) reconcileSeedBootstrapToken(ctx context.Context, fw *firewallv2.Firewall) error {
bootstrapTokenID, ok := fw.Labels[firewallv2.FirewallBootstrapTokenIDLabel]
if !ok {
return nil
}

bootstrapTokenSecret := &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: bootstraptokenutil.BootstrapTokenSecretName(bootstrapTokenID),
Namespace: metav1.NamespaceSystem,
},
}
err := r.SeedClient.Get(ctx, client.ObjectKeyFromObject(bootstrapTokenSecret), bootstrapTokenSecret)
if apierrors.IsUnauthorized(err) {
r.Log.Info("seed client is outdated, refresh")
return r.refreshSeedClientConnection()
}
if err != nil {
return fmt.Errorf("failed to fetch seed bootstrap token: %w", err)
}

raw, err := json.Marshal(bootstrapTokenSecret)
if err != nil {
return fmt.Errorf("failed to serialize seed bootstrap token: %w", err)
}

err = os.WriteFile(seedBootstrapTokenFile, raw, 0600)
if err != nil {
return fmt.Errorf("failed to write seed bootstrap token: %w", err)
}
return nil
}

func (r *FirewallReconciler) refreshSeedClientConnection() error {
raw, err := os.ReadFile(seedBootstrapTokenFile)
if os.IsNotExist(err) {
r.Log.Error(err, "cannot refresh broken seed client, bootstrap token file missing")
return err
}
if err != nil {
return err
}

var bootstrapTokenSecret *corev1.Secret
err = json.Unmarshal(raw, &bootstrapTokenSecret)
if err != nil {
r.Log.Error(err, "cannot refresh broken seed client, bootstrap token file malformed")
return err
}

// TODO: use to fetch something
return nil
}
3 changes: 2 additions & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ require (
github.com/google/go-cmp v0.6.0
github.com/google/nftables v0.2.1-0.20240414091927-5e242ec57806
github.com/ks2211/go-suricata v0.0.0-20200823200910-986ce1470707
github.com/metal-stack/firewall-controller-manager v0.4.3
github.com/metal-stack/firewall-controller-manager v0.4.4-0.20241115121111-5d30716c300f
github.com/metal-stack/metal-go v0.37.2
github.com/metal-stack/metal-lib v0.18.4
github.com/metal-stack/metal-networker v0.45.2
Expand All @@ -23,6 +23,7 @@ require (
k8s.io/apiextensions-apiserver v0.29.3
k8s.io/apimachinery v0.31.0
k8s.io/client-go v0.29.3
k8s.io/cluster-bootstrap v0.29.3
sigs.k8s.io/controller-runtime v0.17.5
)

Expand Down
6 changes: 4 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,8 +111,8 @@ github.com/mdlayher/netlink v1.7.2 h1:/UtM3ofJap7Vl4QWCPDGXY8d3GIY2UGSDbK+QWmY8/
github.com/mdlayher/netlink v1.7.2/go.mod h1:xraEF7uJbxLhc5fpHL4cPe221LI2bdttWlU+ZGLfQSw=
github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos=
github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
github.com/metal-stack/firewall-controller-manager v0.4.3 h1:WU5bqD710gUtzyA2NdWJuSveCbOhllQ7ybpgUg7aJW8=
github.com/metal-stack/firewall-controller-manager v0.4.3/go.mod h1:J/3LHcvfJCpEEC4yk+WD0exh3btaScCaFkzbnbOsqrY=
github.com/metal-stack/firewall-controller-manager v0.4.4-0.20241115121111-5d30716c300f h1:rqjQZOU596wJN0yDDnAb8MT8ps7dzaJqMtbJH80k5FY=
github.com/metal-stack/firewall-controller-manager v0.4.4-0.20241115121111-5d30716c300f/go.mod h1:GbjvsY4Jn0U/YodluRyur6OITJW1wQgcGX/PO0XUxl4=
github.com/metal-stack/metal-go v0.37.2 h1:SDIuV43y09kmwtHfsReOZoZ7c2F+lNP4iIhazfJL5tQ=
github.com/metal-stack/metal-go v0.37.2/go.mod h1:3MJTYCS4YJz8D8oteTKhjpaAKNMMjMKYDrIy9awHGtQ=
github.com/metal-stack/metal-hammer v0.13.5 h1:uwEKOTUCeDXDBDH/Y6P58fkC2kwFqZb/akLbAhwmVuA=
Expand Down Expand Up @@ -282,6 +282,8 @@ k8s.io/apimachinery v0.29.3 h1:2tbx+5L7RNvqJjn7RIuIKu9XTsIZ9Z5wX2G22XAa5EU=
k8s.io/apimachinery v0.29.3/go.mod h1:hx/S4V2PNW4OMg3WizRrHutyB5la0iCUbZym+W0EQIU=
k8s.io/client-go v0.29.3 h1:R/zaZbEAxqComZ9FHeQwOh3Y1ZUs7FaHKZdQtIc2WZg=
k8s.io/client-go v0.29.3/go.mod h1:tkDisCvgPfiRpxGnOORfkljmS+UrW+WtXAy2fTvXJB0=
k8s.io/cluster-bootstrap v0.29.3 h1:DIMDZSN8gbFMy9CS2mAS2Iqq/fIUG783WN/1lqi5TF8=
k8s.io/cluster-bootstrap v0.29.3/go.mod h1:aPAg1VtXx3uRrx5qU2jTzR7p1rf18zLXWS+pGhiqPto=
k8s.io/component-base v0.29.3 h1:Oq9/nddUxlnrCuuR2K/jp6aflVvc0uDvxMzAWxnGzAo=
k8s.io/component-base v0.29.3/go.mod h1:Yuj33XXjuOk2BAaHsIGHhCKZQAgYKhqIxIjIr2UXYio=
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
Expand Down