satellites: add TLS handshake daemon for DRBD

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Add a new option `.spec.internalTLS.tlsHandshakeDaemon` to enable deployment of `tlshd` alongside the LINSTOR
+  Satellite.
+
 ### Changed
 
 - Fixed service resources relying on default protocol version.

api/v1/linstorsatellite_types.go

@@ -54,7 +54,7 @@ type LinstorSatelliteSpec struct {
 	// +kubebuilder:validation:Optional
 	// + Without "nullable" the k8s API does not accept patches with 'internalTLS: {}', which seems to be a bug.
 	// +nullable
-	InternalTLS *TLSConfig `json:"internalTLS,omitempty"`
+	InternalTLS *TLSConfigWithHandshakeDaemon `json:"internalTLS,omitempty"`
 }
 
 // LinstorSatelliteStatus defines the observed state of LinstorSatellite

api/v1/linstorsatelliteconfiguration_types.go

@@ -54,7 +54,7 @@ type LinstorSatelliteConfigurationSpec struct {
 	// +kubebuilder:validation:Optional
 	// + See LinstorSatelliteSpec.InternalTLS for why nullable is needed.
 	// +nullable
-	InternalTLS *TLSConfig `json:"internalTLS,omitempty"`
+	InternalTLS *TLSConfigWithHandshakeDaemon `json:"internalTLS,omitempty"`
 }
 
 // LinstorSatelliteConfigurationStatus defines the observed state of LinstorSatelliteConfiguration

api/v1/tls.go

@@ -14,3 +14,14 @@ type TLSConfig struct {
 	//+kubebuilder:validation:Optional
 	CertManager *cmmetav1.ObjectReference `json:"certManager,omitempty"`
 }
+
+type TLSConfigWithHandshakeDaemon struct {
+	TLSConfig `json:",inline"`
+
+	// TLSHandshakeDaemon enables tlshd for establishing TLS sessions for use by DRBD.
+	//
+	// If enabled, adds a new sidecar to the LINSTOR Satellite that runs the tlshd handshake daemon.
+	// The daemon uses the TLS certificate and key to establish secure connections on behalf of DRBD.
+	//+kubebuilder:validation:Optional
+	TLSHandshakeDaemon bool `json:"tlsHandshakeDaemon,omitempty"`
+}

charts/piraeus/templates/config.yaml

@@ -34,6 +34,9 @@ data:
       drbd-shutdown-guard:
         tag: v1.0.0
         image: drbd-shutdown-guard
+      ktls-utils:
+        tag: v0.10
+        image: ktls-utils
       drbd-module-loader:
         tag: v9.2.5
         # The special "match" attribute is used to select an image based on the node's reported OS.

charts/piraeus/templates/crds.yaml

@@ -561,6 +561,13 @@ spec:
                     description: SecretName references a secret holding the TLS key
                       and certificates.
                     type: string
+                  tlsHandshakeDaemon:
+                    description: "TLSHandshakeDaemon enables tlshd for establishing
+                      TLS sessions for use by DRBD. \n If enabled, adds a new sidecar
+                      to the LINSTOR Satellite that runs the tlshd handshake daemon.
+                      The daemon uses the TLS certificate and key to establish secure
+                      connections on behalf of DRBD."
+                    type: boolean
                 type: object
               nodeSelector:
                 additionalProperties:
@@ -909,6 +916,13 @@ spec:
                     description: SecretName references a secret holding the TLS key
                       and certificates.
                     type: string
+                  tlsHandshakeDaemon:
+                    description: "TLSHandshakeDaemon enables tlshd for establishing
+                      TLS sessions for use by DRBD. \n If enabled, adds a new sidecar
+                      to the LINSTOR Satellite that runs the tlshd handshake daemon.
+                      The daemon uses the TLS certificate and key to establish secure
+                      connections on behalf of DRBD."
+                    type: boolean
                 type: object
               patches:
                 description: "Patches is a list of kustomize patches to apply. \n

config/crd/bases/piraeus.io_linstorsatelliteconfigurations.yaml

@@ -65,6 +65,13 @@ spec:
                     description: SecretName references a secret holding the TLS key
                       and certificates.
                     type: string
+                  tlsHandshakeDaemon:
+                    description: "TLSHandshakeDaemon enables tlshd for establishing
+                      TLS sessions for use by DRBD. \n If enabled, adds a new sidecar
+                      to the LINSTOR Satellite that runs the tlshd handshake daemon.
+                      The daemon uses the TLS certificate and key to establish secure
+                      connections on behalf of DRBD."
+                    type: boolean
                 type: object
               nodeSelector:
                 additionalProperties:

config/crd/bases/piraeus.io_linstorsatellites.yaml

@@ -89,6 +89,13 @@ spec:
                     description: SecretName references a secret holding the TLS key
                       and certificates.
                     type: string
+                  tlsHandshakeDaemon:
+                    description: "TLSHandshakeDaemon enables tlshd for establishing
+                      TLS sessions for use by DRBD. \n If enabled, adds a new sidecar
+                      to the LINSTOR Satellite that runs the tlshd handshake daemon.
+                      The daemon uses the TLS certificate and key to establish secure
+                      connections on behalf of DRBD."
+                    type: boolean
                 type: object
               patches:
                 description: "Patches is a list of kustomize patches to apply. \n

config/manager/0_piraeus_datastore_images.yaml

@@ -25,6 +25,9 @@ components:
   drbd-shutdown-guard:
     tag: v1.0.0
     image: drbd-shutdown-guard
+  ktls-utils:
+    tag: v0.10
+    image: ktls-utils
   drbd-module-loader:
     tag: v9.2.5
     # The special "match" attribute is used to select an image based on the node's reported OS.

internal/controller/linstorcluster_test.go

@@ -104,7 +104,7 @@ var _ = Describe("LinstorCluster controller", func() {
 						Patches: []piraeusiov1.Patch{
 							{Target: &piraeusiov1.Selector{Kind: "ServiceAccount"}, Patch: "sa-patch1"},
 						},
-						InternalTLS: &piraeusiov1.TLSConfig{},
+						InternalTLS: &piraeusiov1.TLSConfigWithHandshakeDaemon{},
 					},
 				})
 				Expect(err).NotTo(HaveOccurred())
@@ -175,7 +175,7 @@ var _ = Describe("LinstorCluster controller", func() {
 						{Name: "pool1", LvmPool: &piraeusiov1.LinstorStoragePoolLvm{}},
 						{Name: "pool2", LvmThinPool: &piraeusiov1.LinstorStoragePoolLvmThin{VolumeGroup: "vg1", ThinPool: "thin1"}, Source: &piraeusiov1.LinstorStoragePoolSource{HostDevices: []string{"/dev/vdb"}}},
 					},
-					InternalTLS: &piraeusiov1.TLSConfig{},
+					InternalTLS: &piraeusiov1.TLSConfigWithHandshakeDaemon{},
 				}
 
 				specZoneB := &piraeusiov1.LinstorSatelliteSpec{
@@ -191,7 +191,7 @@ var _ = Describe("LinstorCluster controller", func() {
 						{Name: "pool1", LvmPool: &piraeusiov1.LinstorStoragePoolLvm{}},
 						{Name: "pool2", LvmThinPool: &piraeusiov1.LinstorStoragePoolLvmThin{}},
 					},
-					InternalTLS: &piraeusiov1.TLSConfig{},
+					InternalTLS: &piraeusiov1.TLSConfigWithHandshakeDaemon{},
 				}
 
 				Expect(&satNode1A.Spec).To(Equal(specZoneA))

internal/controller/linstorsatellite_controller.go

@@ -213,6 +213,15 @@ func (r *LinstorSatelliteReconciler) kustomizeNodeResources(ctx context.Context,
 
 			patches = append(patches, p...)
 		}
+
+		if lsatellite.Spec.InternalTLS.TLSHandshakeDaemon {
+			p, err := SatelliteLinstorHandshakeDaemonPatch()
+			if err != nil {
+				return nil, err
+			}
+
+			patches = append(patches, p...)
+		}
 	}
 
 	var bindMountPaths []string

internal/controller/linstorsatellite_test.go

@@ -87,7 +87,7 @@ var _ = Describe("LinstorSatelliteReconciler", func() {
 				TypeMeta:   TypeMeta,
 				ObjectMeta: metav1.ObjectMeta{Name: ExampleNodeName},
 				Spec: piraeusiov1.LinstorSatelliteSpec{
-					InternalTLS: &piraeusiov1.TLSConfig{},
+					InternalTLS: &piraeusiov1.TLSConfigWithHandshakeDaemon{},
 				},
 			}, client.Apply, client.FieldOwner("test"))
 			Expect(err).NotTo(HaveOccurred())
@@ -100,6 +100,29 @@ var _ = Describe("LinstorSatelliteReconciler", func() {
 			}, DefaultTimeout, DefaultCheckInterval).Should(Succeed())
 		})
 
+		It("should create pod with ktls-utils if enabled", func(ctx context.Context) {
+			err := k8sClient.Patch(ctx, &piraeusiov1.LinstorSatellite{
+				TypeMeta:   TypeMeta,
+				ObjectMeta: metav1.ObjectMeta{Name: ExampleNodeName},
+				Spec: piraeusiov1.LinstorSatelliteSpec{
+					InternalTLS: &piraeusiov1.TLSConfigWithHandshakeDaemon{
+						TLSHandshakeDaemon: true,
+					},
+				},
+			}, client.Apply, client.FieldOwner("test"))
+			Expect(err).NotTo(HaveOccurred())
+
+			Eventually(func(g Gomega) {
+				var pod corev1.Pod
+				err := k8sClient.Get(ctx, types.NamespacedName{Namespace: Namespace, Name: ExampleNodeName}, &pod)
+				g.Expect(err).NotTo(HaveOccurred())
+				g.Expect(pod.Spec.Volumes).To(ContainElement(HaveField("Secret.SecretName", ExampleNodeName+"-tls")))
+				container := GetContainer(pod.Spec.Containers, "ktls-utils")
+				g.Expect(container).NotTo(BeNil())
+				g.Expect(container.VolumeMounts).To(ContainElement(HaveField("Name", "internal-tls")))
+			}, DefaultTimeout, DefaultCheckInterval).Should(Succeed())
+		})
+
 		It("should mount host directory for file storage", func(ctx context.Context) {
 			err := k8sClient.Patch(ctx, &piraeusiov1.LinstorSatellite{
 				TypeMeta:   TypeMeta,

internal/controller/patches.go

@@ -145,6 +145,14 @@ func SatelliteLinstorInternalTLSCertManagerPatch(secretName string, issuer *cmme
 	)
 }
 
+func SatelliteLinstorHandshakeDaemonPatch() ([]kusttypes.Patch, error) {
+	return render(
+		satellite.Resources,
+		"patches/tlshd.yaml",
+		nil,
+	)
+}
+
 func SatelliteCommonNodePatch(nodeName string) ([]kusttypes.Patch, error) {
 	return render(
 		satellite.Resources,

internal/controller/patches_test.go

@@ -55,6 +55,12 @@ func TestPatches(t *testing.T) {
 				return controller.SatelliteLinstorInternalTLSPatch("secret")
 			},
 		},
+		{
+			name: "SatelliteLinstorHandshakeDaemonPatch",
+			call: func() ([]kusttypes.Patch, error) {
+				return controller.SatelliteLinstorHandshakeDaemonPatch()
+			},
+		},
 		{
 			name: "SatelliteCommonNodePatch",
 			call: func() ([]kusttypes.Patch, error) {

pkg/merge/linstorsatelliteconfiguration_test.go

@@ -27,9 +27,9 @@ var (
 				{Name: "prop1", Value: "config1"},
 				{Name: "prop2", Value: "config1"},
 			},
-			InternalTLS: &piraeusv1.TLSConfig{
+			InternalTLS: &piraeusv1.TLSConfigWithHandshakeDaemon{TLSConfig: piraeusv1.TLSConfig{
 				SecretName: "config1",
-			},
+			}},
 		},
 	}
 	Config2 = piraeusv1.LinstorSatelliteConfiguration{
@@ -66,9 +66,9 @@ var (
 				{Name: "prop2", Value: "config3"},
 				{Name: "prop3", Value: "config3"},
 			},
-			InternalTLS: &piraeusv1.TLSConfig{
+			InternalTLS: &piraeusv1.TLSConfigWithHandshakeDaemon{TLSConfig: piraeusv1.TLSConfig{
 				SecretName: "config3",
-			},
+			}},
 		},
 	}
 )
@@ -118,9 +118,9 @@ func TestMergeSatelliteConfigurations(t *testing.T) {
 						{Name: "prop2", Value: "config3"},
 						{Name: "prop3", Value: "config3"},
 					},
-					InternalTLS: &piraeusv1.TLSConfig{
+					InternalTLS: &piraeusv1.TLSConfigWithHandshakeDaemon{TLSConfig: piraeusv1.TLSConfig{
 						SecretName: "config3",
-					},
+					}},
 				},
 			},
 		},

pkg/resources/satellite/patches/tlshd.yaml

@@ -0,0 +1,26 @@
+---
+- target:
+    version: v1
+    kind: Pod
+    name: satellite
+  patch: |
+    apiVersion: v1
+    kind: Pod
+    metadata:
+      name: satellite
+    spec:
+      containers:
+        - name: ktls-utils
+          image: ktls-utils
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+              drop:
+                - ALL
+            privileged: true
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - name: internal-tls
+              mountPath: /etc/tlshd.d
+              readOnly: true