MON-3701: clean-up injection of trusted CA bundles

Signed-off-by: Simon Pasquier <[email protected]>

Author: simonpasquier

assets/alertmanager/alertmanager.yaml

@@ -143,10 +143,19 @@ spec:
     runAsUser: 65534
   serviceAccountName: alertmanager-main
   version: 0.26.0
+  volumeMounts:
+  - mountPath: /etc/pki/ca-trust/extracted/pem/
+    name: alertmanager-trusted-ca-bundle
   volumes:
   - configMap:
       name: metrics-client-ca
     name: metrics-client-ca
+  - configMap:
+      items:
+      - key: ca-bundle.crt
+        path: tls-ca-bundle.pem
+      name: alertmanager-trusted-ca-bundle
+    name: alertmanager-trusted-ca-bundle
   web:
     httpConfig:
       headers:

jsonnet/components/alertmanager.libsonnet

@@ -16,7 +16,6 @@ function(params)
     trustedCaBundle: generateCertInjection.trustedCNOCaBundleCM(cfg.namespace, 'alertmanager-trusted-ca-bundle'),
 
     // OpenShift route to access the Alertmanager UI.
-
     route: {
       apiVersion: 'v1',
       kind: 'Route',
@@ -411,6 +410,22 @@ function(params)
               name: 'metrics-client-ca',
             },
           },
+          {
+            name: $.trustedCaBundle.metadata.name,
+            configMap: {
+              name: $.trustedCaBundle.metadata.name,
+              items: [{
+                key: 'ca-bundle.crt',
+                path: 'tls-ca-bundle.pem',
+              }],
+            },
+          },
+        ],
+        volumeMounts+: [
+          {
+            name: $.trustedCaBundle.metadata.name,
+            mountPath: '/etc/pki/ca-trust/extracted/pem/',
+          },
         ],
       },
     },

jsonnet/utils/generate-certificate-injection.libsonnet

@@ -15,6 +15,7 @@
     },
     data: {},
   },
+
   // This CA bundle is injected by the service-ca-operator.
   SCOCaBundleCM(cfgNamespace, cfgName):: {
     apiVersion: 'v1',
@@ -28,6 +29,7 @@
     },
     data: {},
   },
+
   SCOCaBundleVolume(volName):: {
     name: volName,
     configmap: {

pkg/manifests/manifests.go

@@ -586,7 +586,7 @@ func setupStartupProbe(a *monv1.Alertmanager) {
 	)
 }
 
-func (f *Factory) AlertmanagerMain(trustedCABundleCM *v1.ConfigMap) (*monv1.Alertmanager, error) {
+func (f *Factory) AlertmanagerMain() (*monv1.Alertmanager, error) {
 	a, err := f.NewAlertmanager(f.assets.MustNewAssetSlice(AlertmanagerMain))
 	if err != nil {
 		return nil, err
@@ -651,18 +651,6 @@ func (f *Factory) AlertmanagerMain(trustedCABundleCM *v1.ConfigMap) (*monv1.Aler
 			f.config.ClusterMonitoringConfiguration.AlertmanagerMainConfig.TopologySpreadConstraints
 	}
 
-	if trustedCABundleCM != nil {
-		volumeName := "alertmanager-trusted-ca-bundle"
-		a.Spec.VolumeMounts = append(a.Spec.VolumeMounts, trustedCABundleVolumeMount(volumeName))
-
-		volume := trustedCABundleVolume(trustedCABundleCM.Name, volumeName)
-		volume.VolumeSource.ConfigMap.Items = append(volume.VolumeSource.ConfigMap.Items, v1.KeyToPath{
-			Key:  TrustedCABundleKey,
-			Path: "tls-ca-bundle.pem",
-		})
-		a.Spec.Volumes = append(a.Spec.Volumes, volume)
-	}
-
 	for i, c := range a.Spec.Containers {
 		switch c.Name {
 		case "kube-rbac-proxy", "kube-rbac-proxy-metric", "kube-rbac-proxy-web":

pkg/manifests/manifests_test.go

@@ -251,7 +251,7 @@ func TestUnconfiguredManifests(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	_, err = f.AlertmanagerMain(nil)
+	_, err = f.AlertmanagerMain()
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -3041,9 +3041,7 @@ func TestAlertmanagerMainStartupProbe(t *testing.T) {
 				t.Fatal(err)
 			}
 			f := NewFactory("openshift-monitoring", "openshift-user-workload-monitoring", c, tc.infrastructure, &fakeProxyReader{}, NewAssets(assetsPath), &APIServerConfig{}, &configv1.Console{})
-			a, err := f.AlertmanagerMain(
-				&v1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "foo"}},
-			)
+			a, err := f.AlertmanagerMain()
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -3115,9 +3113,7 @@ ingress:
 	})
 
 	f := NewFactory("openshift-monitoring", "openshift-user-workload-monitoring", c, defaultInfrastructureReader(), &fakeProxyReader{}, NewAssets(assetsPath), &APIServerConfig{}, &configv1.Console{Status: configv1.ConsoleStatus{ConsoleURL: "https://console-openshift-console.apps.foo.devcluster.openshift.com"}})
-	a, err := f.AlertmanagerMain(
-		&v1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "foo"}},
-	)
+	a, err := f.AlertmanagerMain()
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -4360,9 +4356,7 @@ func TestNonHighlyAvailableInfrastructure(t *testing.T) {
 		{
 			name: "Alertmanager",
 			getSpec: func(f *Factory) (spec, error) {
-				a, err := f.AlertmanagerMain(
-					&v1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "foo"}},
-				)
+				a, err := f.AlertmanagerMain()
 				if err != nil {
 					return spec{}, err
 				}

pkg/tasks/alertmanager.go

@@ -185,17 +185,12 @@ func (t *AlertmanagerTask) create(ctx context.Context) error {
 			return fmt.Errorf("initializing Alertmanager CA bundle ConfigMap failed: %w", err)
 		}
 
-		cbs := &caBundleSyncer{
-			client:  t.client,
-			factory: t.factory,
-			prefix:  "alertmanager",
-		}
-		trustedCA, err = cbs.syncTrustedCABundle(ctx, trustedCA)
+		err = t.client.CreateOrUpdateConfigMap(ctx, trustedCA)
 		if err != nil {
-			return fmt.Errorf("syncing Alertmanager trusted CA bundle ConfigMap failed: %w", err)
+			return fmt.Errorf("reconciling Alertmanager trusted CA bundle ConfigMap failed: %w", err)
 		}
 
-		a, err := t.factory.AlertmanagerMain(trustedCA)
+		a, err := t.factory.AlertmanagerMain()
 		if err != nil {
 			return fmt.Errorf("initializing Alertmanager object failed: %w", err)
 		}
@@ -239,6 +234,12 @@ func (t *AlertmanagerTask) create(ctx context.Context) error {
 		return fmt.Errorf("deleting Alertmanager proxy Secret failed: %w", err)
 	}
 
+	// TODO(simonpasquier): remove this step after OCP 4.16 is released.
+	err = t.client.DeleteHashedConfigMap(ctx, "openshift-monitoring", "alertmanager-trusted-ca-bundle", "")
+	if err != nil {
+		return fmt.Errorf("deleting all hashed Alertmanager trusted CA bundle ConfigMap failed: %w", err)
+	}
+
 	return nil
 }
 
@@ -356,7 +357,7 @@ func (t *AlertmanagerTask) destroy(ctx context.Context) error {
 			return fmt.Errorf("deleting Alertmanager trusted CA bundle failed: %w", err)
 		}
 
-		a, err := t.factory.AlertmanagerMain(trustedCA)
+		a, err := t.factory.AlertmanagerMain()
 		if err != nil {
 			return fmt.Errorf("initializing Alertmanager object failed: %w", err)
 		}