satellites: add TLS handshake daemon for DRBD

Adds a new switch .spec.internalTLS.tlsHandshakeDaemon on the LinstorSatelliteConfiguration. If enabled, it configures another sidecar on the Satellite that runs "tlshd" with the same key material as the LINSTOR Satellite. With this enabled, users can set "DrbdOptions/Net/tls: yes" on their storage class to enable TLS encryption for DRBD connections. Signed-off-by: Moritz Wanzenböck <[email protected]>
piraeusdatastore · Oct 30, 2023 · d818594 · d818594
1 parent 0b7273a
commit d818594
Show file tree

Hide file tree

Showing 17 changed files with 129 additions and 14 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add a new option `.spec.internalTLS.tlsHandshakeDaemon` to enable deployment of `tlshd` alongside the LINSTOR
+  Satellite.
+
 ### Changed
 
 - Fixed service resources relying on default protocol version.

diff --git a/api/v1/linstorsatellite_types.go b/api/v1/linstorsatellite_types.go
@@ -54,7 +54,7 @@ type LinstorSatelliteSpec struct {
 	// +kubebuilder:validation:Optional
 	// + Without "nullable" the k8s API does not accept patches with 'internalTLS: {}', which seems to be a bug.
 	// +nullable
-	InternalTLS *TLSConfig `json:"internalTLS,omitempty"`
+	InternalTLS *TLSConfigWithHandshakeDaemon `json:"internalTLS,omitempty"`
 }
 
 // LinstorSatelliteStatus defines the observed state of LinstorSatellite

diff --git a/api/v1/linstorsatelliteconfiguration_types.go b/api/v1/linstorsatelliteconfiguration_types.go
@@ -54,7 +54,7 @@ type LinstorSatelliteConfigurationSpec struct {
 	// +kubebuilder:validation:Optional
 	// + See LinstorSatelliteSpec.InternalTLS for why nullable is needed.
 	// +nullable
-	InternalTLS *TLSConfig `json:"internalTLS,omitempty"`
+	InternalTLS *TLSConfigWithHandshakeDaemon `json:"internalTLS,omitempty"`
 }
 
 // LinstorSatelliteConfigurationStatus defines the observed state of LinstorSatelliteConfiguration

diff --git a/api/v1/tls.go b/api/v1/tls.go
@@ -14,3 +14,14 @@ type TLSConfig struct {
 	//+kubebuilder:validation:Optional
 	CertManager *cmmetav1.ObjectReference `json:"certManager,omitempty"`
 }
+
+type TLSConfigWithHandshakeDaemon struct {
+	TLSConfig `json:",inline"`
+
+	// TLSHandshakeDaemon enables tlshd for establishing TLS session for use by DRBD.
+	//
+	// If enables, adds a new sidecar to the LINSTOR Satellite that runs the tlshd handshake daemon.
+	// The daemon uses the tls certificate and key to establish secure connections on behalf of DRBD.
+	//+kubebuilder:validation:Optional
+	TLSHandshakeDaemon bool `json:"tlsHandshakeDaemon,omitempty"`
+}
diff --git a/api/v1/zz_generated.deepcopy.go b/api/v1/zz_generated.deepcopy.go
diff --git a/charts/piraeus/templates/config.yaml b/charts/piraeus/templates/config.yaml
@@ -34,6 +34,9 @@ data:
       drbd-shutdown-guard:
         tag: v1.0.0
         image: drbd-shutdown-guard
+      ktls-utils:
+        tag: v0.10
+        image: ktls-utils
       drbd-module-loader:
         tag: v9.2.5
         # The special "match" attribute is used to select an image based on the node's reported OS.

diff --git a/charts/piraeus/templates/crds.yaml b/charts/piraeus/templates/crds.yaml
@@ -561,6 +561,13 @@ spec:
                     description: SecretName references a secret holding the TLS key
                       and certificates.
                     type: string
+                  tlsHandshakeDaemon:
+                    description: "TLSHandshakeDaemon enables tlshd for establishing
+                      TLS session for use by DRBD. \n If enables, adds a new sidecar
+                      to the LINSTOR Satellite that runs the tlshd handshake daemon.
+                      The daemon uses the tls certificate and key to establish secure
+                      connections on behalf of DRBD."
+                    type: boolean
                 type: object
               nodeSelector:
                 additionalProperties:
@@ -909,6 +916,13 @@ spec:
                     description: SecretName references a secret holding the TLS key
                       and certificates.
                     type: string
+                  tlsHandshakeDaemon:
+                    description: "TLSHandshakeDaemon enables tlshd for establishing
+                      TLS session for use by DRBD. \n If enables, adds a new sidecar
+                      to the LINSTOR Satellite that runs the tlshd handshake daemon.
+                      The daemon uses the tls certificate and key to establish secure
+                      connections on behalf of DRBD."
+                    type: boolean
                 type: object
               patches:
                 description: "Patches is a list of kustomize patches to apply. \n

diff --git a/config/crd/bases/piraeus.io_linstorsatelliteconfigurations.yaml b/config/crd/bases/piraeus.io_linstorsatelliteconfigurations.yaml
@@ -65,6 +65,13 @@ spec:
                     description: SecretName references a secret holding the TLS key
                       and certificates.
                     type: string
+                  tlsHandshakeDaemon:
+                    description: "TLSHandshakeDaemon enables tlshd for establishing
+                      TLS session for use by DRBD. \n If enables, adds a new sidecar
+                      to the LINSTOR Satellite that runs the tlshd handshake daemon.
+                      The daemon uses the tls certificate and key to establish secure
+                      connections on behalf of DRBD."
+                    type: boolean
                 type: object
               nodeSelector:
                 additionalProperties:

diff --git a/config/crd/bases/piraeus.io_linstorsatellites.yaml b/config/crd/bases/piraeus.io_linstorsatellites.yaml
@@ -89,6 +89,13 @@ spec:
                     description: SecretName references a secret holding the TLS key
                       and certificates.
                     type: string
+                  tlsHandshakeDaemon:
+                    description: "TLSHandshakeDaemon enables tlshd for establishing
+                      TLS session for use by DRBD. \n If enables, adds a new sidecar
+                      to the LINSTOR Satellite that runs the tlshd handshake daemon.
+                      The daemon uses the tls certificate and key to establish secure
+                      connections on behalf of DRBD."
+                    type: boolean
                 type: object
               patches:
                 description: "Patches is a list of kustomize patches to apply. \n

diff --git a/config/manager/0_piraeus_datastore_images.yaml b/config/manager/0_piraeus_datastore_images.yaml
@@ -25,6 +25,9 @@ components:
   drbd-shutdown-guard:
     tag: v1.0.0
     image: drbd-shutdown-guard
+  ktls-utils:
+    tag: v0.10
+    image: ktls-utils
   drbd-module-loader:
     tag: v9.2.5
     # The special "match" attribute is used to select an image based on the node's reported OS.

diff --git a/internal/controller/linstorcluster_test.go b/internal/controller/linstorcluster_test.go
@@ -104,7 +104,7 @@ var _ = Describe("LinstorCluster controller", func() {
 						Patches: []piraeusiov1.Patch{
 							{Target: &piraeusiov1.Selector{Kind: "ServiceAccount"}, Patch: "sa-patch1"},
 						},
-						InternalTLS: &piraeusiov1.TLSConfig{},
+						InternalTLS: &piraeusiov1.TLSConfigWithHandshakeDaemon{},
 					},
 				})
 				Expect(err).NotTo(HaveOccurred())
@@ -175,7 +175,7 @@ var _ = Describe("LinstorCluster controller", func() {
 						{Name: "pool1", LvmPool: &piraeusiov1.LinstorStoragePoolLvm{}},
 						{Name: "pool2", LvmThinPool: &piraeusiov1.LinstorStoragePoolLvmThin{VolumeGroup: "vg1", ThinPool: "thin1"}, Source: &piraeusiov1.LinstorStoragePoolSource{HostDevices: []string{"/dev/vdb"}}},
 					},
-					InternalTLS: &piraeusiov1.TLSConfig{},
+					InternalTLS: &piraeusiov1.TLSConfigWithHandshakeDaemon{},
 				}
 
 				specZoneB := &piraeusiov1.LinstorSatelliteSpec{
@@ -191,7 +191,7 @@ var _ = Describe("LinstorCluster controller", func() {
 						{Name: "pool1", LvmPool: &piraeusiov1.LinstorStoragePoolLvm{}},
 						{Name: "pool2", LvmThinPool: &piraeusiov1.LinstorStoragePoolLvmThin{}},
 					},
-					InternalTLS: &piraeusiov1.TLSConfig{},
+					InternalTLS: &piraeusiov1.TLSConfigWithHandshakeDaemon{},
 				}
 
 				Expect(&satNode1A.Spec).To(Equal(specZoneA))

diff --git a/internal/controller/linstorsatellite_controller.go b/internal/controller/linstorsatellite_controller.go
@@ -213,6 +213,15 @@ func (r *LinstorSatelliteReconciler) kustomizeNodeResources(ctx context.Context,
 
 			patches = append(patches, p...)
 		}
+
+		if lsatellite.Spec.InternalTLS.TLSHandshakeDaemon {
+			p, err := SatelliteLinstorHandshakeDaemonPatch()
+			if err != nil {
+				return nil, err
+			}
+
+			patches = append(patches, p...)
+		}
 	}
 
 	var bindMountPaths []string

diff --git a/internal/controller/linstorsatellite_test.go b/internal/controller/linstorsatellite_test.go
@@ -87,7 +87,7 @@ var _ = Describe("LinstorSatelliteReconciler", func() {
 				TypeMeta:   TypeMeta,
 				ObjectMeta: metav1.ObjectMeta{Name: ExampleNodeName},
 				Spec: piraeusiov1.LinstorSatelliteSpec{
-					InternalTLS: &piraeusiov1.TLSConfig{},
+					InternalTLS: &piraeusiov1.TLSConfigWithHandshakeDaemon{},
 				},
 			}, client.Apply, client.FieldOwner("test"))
 			Expect(err).NotTo(HaveOccurred())

diff --git a/internal/controller/patches.go b/internal/controller/patches.go
@@ -145,6 +145,14 @@ func SatelliteLinstorInternalTLSCertManagerPatch(secretName string, issuer *cmme
 	)
 }
 
+func SatelliteLinstorHandshakeDaemonPatch() ([]kusttypes.Patch, error) {
+	return render(
+		satellite.Resources,
+		"patches/tlshd.yaml",
+		nil,
+	)
+}
+
 func SatelliteCommonNodePatch(nodeName string) ([]kusttypes.Patch, error) {
 	return render(
 		satellite.Resources,

diff --git a/internal/controller/patches_test.go b/internal/controller/patches_test.go
@@ -55,6 +55,12 @@ func TestPatches(t *testing.T) {
 				return controller.SatelliteLinstorInternalTLSPatch("secret")
 			},
 		},
+		{
+			name: "SatelliteLinstorHandshakeDaemonPatch",
+			call: func() ([]kusttypes.Patch, error) {
+				return controller.SatelliteLinstorHandshakeDaemonPatch()
+			},
+		},
 		{
 			name: "SatelliteCommonNodePatch",
 			call: func() ([]kusttypes.Patch, error) {

diff --git a/pkg/merge/linstorsatelliteconfiguration_test.go b/pkg/merge/linstorsatelliteconfiguration_test.go
@@ -27,9 +27,9 @@ var (
 				{Name: "prop1", Value: "config1"},
 				{Name: "prop2", Value: "config1"},
 			},
-			InternalTLS: &piraeusv1.TLSConfig{
+			InternalTLS: &piraeusv1.TLSConfigWithHandshakeDaemon{TLSConfig: piraeusv1.TLSConfig{
 				SecretName: "config1",
-			},
+			}},
 		},
 	}
 	Config2 = piraeusv1.LinstorSatelliteConfiguration{
@@ -66,9 +66,9 @@ var (
 				{Name: "prop2", Value: "config3"},
 				{Name: "prop3", Value: "config3"},
 			},
-			InternalTLS: &piraeusv1.TLSConfig{
+			InternalTLS: &piraeusv1.TLSConfigWithHandshakeDaemon{TLSConfig: piraeusv1.TLSConfig{
 				SecretName: "config3",
-			},
+			}},
 		},
 	}
 )
@@ -118,9 +118,9 @@ func TestMergeSatelliteConfigurations(t *testing.T) {
 						{Name: "prop2", Value: "config3"},
 						{Name: "prop3", Value: "config3"},
 					},
-					InternalTLS: &piraeusv1.TLSConfig{
+					InternalTLS: &piraeusv1.TLSConfigWithHandshakeDaemon{TLSConfig: piraeusv1.TLSConfig{
 						SecretName: "config3",
-					},
+					}},
 				},
 			},
 		},

diff --git a/pkg/resources/satellite/patches/tlshd.yaml b/pkg/resources/satellite/patches/tlshd.yaml
@@ -0,0 +1,26 @@
+---
+- target:
+    version: v1
+    kind: Pod
+    name: satellite
+  patch: |
+    apiVersion: v1
+    kind: Pod
+    metadata:
+      name: satellite
+    spec:
+      containers:
+        - name: ktls-utils
+          image: ktls-utils
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+              drop:
+                - ALL
+            privileged: true
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: internal-tls
+              mountPath: /etc/tlshd.d
+              readOnly: true