Support TLS for identtiy endpoint in Rally

Change-Id: I37dddb76ef1b96fe0daf630d0d8a2c843de0a6a2

rally/Chart.yaml

@@ -14,7 +14,7 @@ apiVersion: v1
 appVersion: v1.0.0
 description: OpenStack-Helm rally
 name: rally
-version: 0.2.6
+version: 0.2.7
 home: https://docs.openstack.org/developer/rally
 icon: https://www.openstack.org/themes/openstack/images/project-mascots/rally/OpenStack_Project_rally_vertical.png
 sources:

rally/templates/job-bootstrap.yaml

@@ -21,6 +21,11 @@ limitations under the License.
 
 {{- $serviceAccountName := "rally-bootstrap" }}
 {{ tuple $envAll "bootstrap" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
+
+{{- $tlsSecret := "" -}}
+{{- if or .Values.manifests.certificates .Values.tls.identity -}}
+{{- $tlsSecret = .Values.secrets.tls.identity.api.internal | default "" -}}
+{{- end -}}
 ---
 apiVersion: batch/v1
 kind: Job
@@ -45,7 +50,7 @@ spec:
 {{ tuple $envAll "bootstrap" | include "helm-toolkit.snippets.image" | indent 10 }}
 {{ tuple $envAll $envAll.Values.pod.resources.jobs.bootstrap | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
           env:
-{{- with $env := dict "ksUserSecret" .Values.secrets.identity.admin }}
+{{- with $env := dict "ksUserSecret" .Values.secrets.identity.admin "useCA" (ne $tlsSecret "") }}
 {{- include "helm-toolkit.snippets.keystone_openrc_env_vars" $env | indent 12 }}
 {{- end }}
           command:
@@ -57,6 +62,7 @@ spec:
               mountPath: /tmp/bootstrap.sh
               subPath: bootstrap.sh
               readOnly: true
+{{ dict "enabled" (ne $tlsSecret "") "name" $tlsSecret | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
 {{ if $mounts_rally_bootstrap.volumeMounts }}{{ toYaml $mounts_rally_bootstrap.volumeMounts | indent 12 }}{{ end }}
       volumes:
         - name: pod-tmp
@@ -65,6 +71,7 @@ spec:
           configMap:
             name: rally-bin
             defaultMode: 0555
+{{- dict "enabled" (ne $tlsSecret "") "name" $tlsSecret | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{ if $mounts_rally_bootstrap.volumes }}{{ toYaml $mounts_rally_bootstrap.volumes | indent 8 }}{{ end }}
 {{- end }}
 {{- end }}

rally/templates/job-ks-endpoints.yaml

@@ -18,6 +18,10 @@ limitations under the License.
 {{- $serviceAccountName := "rally-ks-endpoints" }}
 {{ tuple $envAll "ks_endpoints" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
 ---
+{{- $tlsSecret := "" -}}
+{{- if or .Values.manifests.certificates .Values.tls.identity -}}
+{{- $tlsSecret = .Values.secrets.tls.identity.api.internal | default "" -}}
+{{- end }}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -55,8 +59,9 @@ spec:
               mountPath: /tmp/ks-endpoints.sh
               subPath: ks-endpoints.sh
               readOnly: true
+{{ dict "enabled" (ne $tlsSecret "") "name" $tlsSecret | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
           env:
-{{- with $env := dict "ksUserSecret" $envAll.Values.secrets.identity.admin }}
+{{- with $env := dict "ksUserSecret" $envAll.Values.secrets.identity.admin "useCA" (ne $tlsSecret "") }}
 {{- include "helm-toolkit.snippets.keystone_openrc_env_vars" $env | indent 12 }}
 {{- end }}
             - name: OS_SVC_ENDPOINT
@@ -76,4 +81,5 @@ spec:
           configMap:
             name: rally-bin
             defaultMode: 0555
+{{- dict "enabled" (ne $tlsSecret "") "name" $tlsSecret | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{- end }}

rally/templates/job-ks-service.yaml

@@ -18,6 +18,10 @@ limitations under the License.
 {{- $serviceAccountName := "rally-ks-service" }}
 {{ tuple $envAll "ks_service" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
 ---
+{{- $tlsSecret := "" -}}
+{{- if or .Values.manifests.certificates .Values.tls.identity -}}
+{{- $tlsSecret = .Values.secrets.tls.identity.api.internal | default "" -}}
+{{- end }}
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -54,8 +58,9 @@ spec:
               mountPath: /tmp/ks-service.sh
               subPath: ks-service.sh
               readOnly: true
+{{ dict "enabled" (ne $tlsSecret "") "name" $tlsSecret | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
           env:
-{{- with $env := dict "ksUserSecret" $envAll.Values.secrets.identity.admin }}
+{{- with $env := dict "ksUserSecret" $envAll.Values.secrets.identity.admin "useCA" (ne $tlsSecret "") }}
 {{- include "helm-toolkit.snippets.keystone_openrc_env_vars" $env | indent 12 }}
 {{- end }}
             - name: OS_SERVICE_NAME
@@ -70,4 +75,5 @@ spec:
           configMap:
             name: rally-bin
             defaultMode: 0555
+{{- dict "enabled" (ne $tlsSecret "") "name" $tlsSecret | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{- end }}

rally/templates/job-ks-user.yaml

@@ -20,6 +20,10 @@ helm.sh/hook-weight: "1"
 {{- if .Values.manifests.job_ks_user }}
 {{- $ksUserJob := dict "envAll" . "serviceName" "rally" -}}
 
+{{- if or .Values.manifests.certificates .Values.tls.identity -}}
+{{- $_ := set $ksUserJob "tlsSecret" .Values.secrets.tls.identity.api.internal -}}
+{{- end -}}
+
 {{- if .Values.helm3_hook }}
 {{- $_ := set $ksUserJob "jobAnnotations" (include "metadata.annotations.job.ks_user" . | fromYaml) }}
 {{- end }}

rally/templates/job-run-task.yaml

@@ -65,6 +65,11 @@ spec:
           env:
 {{- with $env := dict "ksUserSecret" .Values.secrets.identity.admin }}
 {{- include "helm-toolkit.snippets.keystone_openrc_env_vars" $env | indent 12 }}
+{{- end }}
+
+{{- if or .Values.manifests.certificates .Values.tls.identity }}
+            - name: REQUESTS_CA_BUNDLE
+              value: "/etc/rally/certs/ca.crt"
 {{- end }}
             - name: ENABLED_TESTS
               value: {{ include "helm-toolkit.utils.joinListWithComma" .Values.enabled_tasks }}
@@ -89,6 +94,7 @@ spec:
               readOnly: true
             - name: rally-reports
               mountPath: /var/lib/rally/data
+{{- dict "enabled" (or .Values.manifests.certificates .Values.tls.identity) "name" .Values.secrets.tls.identity.api.internal "path" "/etc/rally/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
       volumes:
         - name: pod-tmp
           emptyDir: {}
@@ -112,4 +118,5 @@ spec:
         - name: rally-reports
           persistentVolumeClaim:
             claimName: {{ .Values.pvc.name }}
+{{- dict "enabled" (or .Values.manifests.certificates .Values.tls.identity) "name" .Values.secrets.tls.identity.api.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{- end }}

rally/values.yaml

@@ -207,6 +207,11 @@ secrets:
     rally: rally-db-user
   oci_image_registry:
     rally: rally-oci-image-registry
+  tls:
+    identity:
+      api:
+        public: keystone-tls-public
+        internal: keystone-tls-api
 
 endpoints:
   cluster_domain_suffix: cluster.local
@@ -4022,6 +4027,9 @@ conf:
 # set helm3_hook: false when using the helm2 binary.
 helm3_hook: true
 
+tls:
+  identity: false
+
 manifests:
   configmap_bin: true
   configmap_etc: true

rally/values_overrides/tls-offloading.yaml

@@ -0,0 +1,14 @@
+---
+endpoints:
+  identity:
+    auth:
+      admin:
+        cacert: /etc/ssl/certs/openstack-helm.crt
+      rally:
+        cacert: /etc/ssl/certs/openstack-helm.crt
+      test:
+        cacert: /etc/ssl/certs/openstack-helm.crt
+
+tls:
+  identity: true
+...

releasenotes/notes/rally.yaml

@@ -9,4 +9,5 @@ rally:
   - 0.2.4 Migrated PodDisruptionBudget resource to policy/v1 API version
   - 0.2.5 Add helm hook for jobs
   - 0.2.6 Added OCI registry authentication
+  - 0.2.7 Support TLS for identity endpoint
 ...