Use CA in cloudprofile for STACKIT clients

charts/gardener-extension-provider-stackit/templates/deployment.yaml

@@ -130,10 +130,6 @@ spec:
         volumeMounts:
         - name: config
           mountPath: /etc/{{ include "name" . }}/config
-        - name: custom-certs
-          mountPath: /etc/ssl/certs/customca.crt
-          readOnly: true
-          subPath: customca.crt
         {{- if .Values.imageVectorOverwrite }}
         - name: imagevector-overwrite
           mountPath: /charts_overwrite/
@@ -144,10 +140,6 @@ spec:
         configMap:
           name: {{ include "name" . }}-configmap
           defaultMode: 420
-      - name: custom-certs
-        secret:
-          secretName: {{ include "name" . }}-ca
-          optional: true
       {{- if .Values.imageVectorOverwrite }}
       - name: imagevector-overwrite
         configMap:

charts/gardener-extension-provider-stackit/values.yaml

@@ -75,9 +75,6 @@ config:
       capacity: 25Gi
       provisioner: block-storage.csi.stackit.cloud
       volumeBindingMode: WaitForFirstConsumer
-  stackitAPIEndpoints:
-    # Must be base64 encoded
-    caBundle: ""
   registryCaches:
   # - server: reg.example.com
   #   cache: reg-cache.example.com

charts/internal/cloud-provider-config/templates/stackit-ca-bundle.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.CABundle }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudprofile-ca-bundle
+  namespace: {{ .Release.Namespace }}
+type: Opaque
+data:
+  {{- if .Values.CABundle }}
+  stackit-ca.crt: {{ .Values.CABundle | b64enc }}
+  {{- end }}
+{{- end }}

charts/internal/cloud-provider-config/values.yaml

@@ -1,4 +1,5 @@
 stackitOnly: false
+CABundle: ""
 # [Global]
 authUrl: fooURL
 domainName: fooDomain

charts/internal/seed-controlplane/charts/stackit-blockstorage-csi-driver/templates/deployment-csi-driver-controller.yaml

@@ -89,13 +89,9 @@ spec:
           mountPath: {{ .Values.socketPath }}
         - name: cloud-provider-config
           mountPath: /etc/config
-        # Host certificates are mounted to accommodate OpenStack endpoints that might be served with a certificate
-        # signed by a CA that is not globally trusted.
-        - mountPath: /usr/share/ca-certificates
-          name: usr-share-ca-certificates
-          readOnly: true
-        - mountPath: /etc/ssl
-          name: etc-ssl
+        - mountPath: /etc/ssl/certs/stackit-ca.crt
+          name: stackit-ca
+          subPath: stackit-ca.crt
           readOnly: true
         securityContext:
           allowPrivilegeEscalation: false
@@ -344,15 +340,11 @@ spec:
                 path: token
               name: shoot-access-csi-resizer
               optional: false
-      - name: usr-share-ca-certificates
-        hostPath:
-          path: /usr/share/ca-certificates
       - name: cloud-provider-config
         configMap:
           defaultMode: 420
           name: {{ .Values.prefix }}-cloud-provider-config
-      # Host certificates are mounted to accommodate OpenStack endpoints that might be served with a certificate
-      # signed by a CA that is not globally trusted.
-      - name: etc-ssl
-        hostPath:
-          path: /etc/ssl
+      - name: stackit-ca
+        secret:
+          optional: true
+          secretName: cloudprofile-ca-bundle

charts/internal/seed-controlplane/charts/stackit-cloud-controller-manager/templates/stackit-cloud-controller-manager.yaml

@@ -89,9 +89,9 @@ spec:
           name: config-volume
         - mountPath: /etc/serviceaccount
           name: sa-secret
-        - mountPath: /etc/ssl/certs/keystone-ca.crt
-          name: cloud-config-ca
-          subPath: keystone-ca.crt
+        - mountPath: /etc/ssl/certs/stackit-ca.crt
+          name: stackit-ca
+          subPath: stackit-ca.crt
           readOnly: true
         securityContext:
           allowPrivilegeEscalation: false
@@ -111,9 +111,9 @@ spec:
           items:
             - key: "serviceaccount.json"
               path: "serviceaccount.json"
-      - name: cloud-config-ca
+      - name: stackit-ca
         secret:
-          secretName: cloud-provider-config
+          secretName: cloudprofile-ca-bundle
           optional: true
       - name: kubeconfig
         projected:

charts/internal/seed-controlplane/charts/stackit-cloud-controller-manager/values.yaml

@@ -5,9 +5,10 @@ config:
   stackitProjectID: foo
   stackitNetworkID: foo
   stackitRegion: foo
-  #loadBalancerApiUrl: foo.bar.example.com/v1
-  #iaasApiUrl: foo.bar.example.com/v1
-  #tokenUrl: foo.bar.example.com/v1
+  loadBalancerApiUrl: ""
+  iaasApiUrl: ""
+  tokenUrl: ""
+  loadBalancerEmergencyToken: ""
   port: 10258
   metricsPort: 9090
 podAnnotations: {}

hack/api-reference/api.md

@@ -430,7 +430,7 @@ string
 </td>
 <td>
 <em>(Optional)</em>
-<p>CABundle is the CA certificate bundle for API endpoints.<br />This field is currently ignored and reserved for future use.</p>
+<p>CABundle is the CA certificate bundle for API endpoints.<br />This field is currently ignored and reserved for future use.<br />Deprecated: Will be removed soon. This field is not used anymore</p>
 </td>
 </tr>
 <tr>

pkg/admission/mutator/namespacedcloudprofile.go

@@ -64,11 +64,6 @@ func (p *namespacedCloudProfile) Mutate(_ context.Context, newObj, _ client.Obje
 		statusConfig.APIEndpoints = specConfig.APIEndpoints
 	}
 
-	// Overwrite CA bundle from spec
-	if specConfig.CABundle != nil {
-		statusConfig.CABundle = specConfig.CABundle
-	}
-
 	modifiedStatusConfig, err := json.Marshal(statusConfig)
 	if err != nil {
 		return err

pkg/admission/mutator/namespacedcloudprofile_test.go

@@ -96,25 +96,6 @@ var _ = Describe("NamespacedCloudProfile Mutator", func() {
 				Expect(mergedConfig.APIEndpoints.LoadBalancer).To(PointTo(Equal("https://custom-lb.example.com")))
 			})
 
-			It("should correctly merge caBundle from spec", func() {
-				namespacedCloudProfile.Status.CloudProfileSpec.ProviderConfig = &runtime.RawExtension{Raw: []byte(`{
-"apiVersion":"stackit.provider.extensions.gardener.cloud/v1alpha1",
-"kind":"CloudProfileConfig",
-"machineImages":[
-  {"name":"image-1","versions":[{"version":"1.0","image":"image-name-1"}]}
-]}`)}
-				namespacedCloudProfile.Spec.ProviderConfig = &runtime.RawExtension{Raw: []byte(`{
-"apiVersion":"stackit.provider.extensions.gardener.cloud/v1alpha1",
-"kind":"CloudProfileConfig",
-"caBundle":"-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----"}`)}
-
-				Expect(namespacedCloudProfileMutator.Mutate(ctx, namespacedCloudProfile, nil)).To(Succeed())
-
-				mergedConfig, err := helper.CloudProfileConfigFromRawExtension(namespacedCloudProfile.Status.CloudProfileSpec.ProviderConfig)
-				Expect(err).ToNot(HaveOccurred())
-				Expect(mergedConfig.CABundle).To(PointTo(Equal("-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----")))
-			})
-
 			It("should correctly merge extended machineImages", func() {
 				namespacedCloudProfile.Status.CloudProfileSpec.ProviderConfig = &runtime.RawExtension{Raw: []byte(`{
 "apiVersion":"stackit.provider.extensions.gardener.cloud/v1alpha1",

pkg/admission/validator/namespacedcloudprofile.go

@@ -76,12 +76,11 @@ func (p *namespacedCloudProfile) validateNamespacedCloudProfileProviderConfig(pr
 		},
 		MachineImages: providerConfig.MachineImages,
 		APIEndpoints:  providerConfig.APIEndpoints,
-		CABundle:      providerConfig.CABundle,
 	}
 	if !equality.Semantic.DeepEqual(validationProviderConfig, providerConfig) {
 		allErrs = append(allErrs, field.Forbidden(
 			field.NewPath("spec.providerConfig"),
-			"must only set machineImages, stackitAPIEndpoints, and stackitCABundle",
+			"must only set machineImages and stackitAPIEndpoints",
 		))
 	}
 

pkg/admission/validator/namespacedcloudprofile_test.go

@@ -281,7 +281,7 @@ var _ = Describe("NamespacedCloudProfile Validator", func() {
 			Expect(err).To(ConsistOf(PointTo(MatchFields(IgnoreExtras, Fields{
 				"Type":   Equal(field.ErrorTypeForbidden),
 				"Field":  Equal("spec.providerConfig"),
-				"Detail": Equal("must only set machineImages, stackitAPIEndpoints, and stackitCABundle"),
+				"Detail": Equal("must only set machineImages and stackitAPIEndpoints"),
 			}))))
 		})
 
@@ -297,24 +297,11 @@ var _ = Describe("NamespacedCloudProfile Validator", func() {
 			Expect(namespacedCloudProfileValidator.Validate(ctx, namespacedCloudProfile, nil)).To(Succeed())
 		})
 
-		It("should succeed for NamespacedCloudProfile specifying only caBundle", func() {
-			namespacedCloudProfile.Spec.ProviderConfig = &runtime.RawExtension{Raw: []byte(`{
-"apiVersion":"stackit.provider.extensions.gardener.cloud/v1alpha1",
-"kind":"CloudProfileConfig",
-"caBundle":"-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----"
-}`)}
-
-			Expect(fakeClient.Create(ctx, cloudProfile)).To(Succeed())
-
-			Expect(namespacedCloudProfileValidator.Validate(ctx, namespacedCloudProfile, nil)).To(Succeed())
-		})
-
-		It("should succeed for NamespacedCloudProfile specifying apiEndpoints, caBundle, and machineImages together", func() {
+		It("should succeed for NamespacedCloudProfile specifying apiEndpoints, and machineImages together", func() {
 			namespacedCloudProfile.Spec.ProviderConfig = &runtime.RawExtension{Raw: []byte(`{
 "apiVersion":"stackit.provider.extensions.gardener.cloud/v1alpha1",
 "kind":"CloudProfileConfig",
 "apiEndpoints":{"iaas":"https://custom-iaas.example.com"},
-"caBundle":"-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----",
 "machineImages":[
   {"name":"image-1","versions":[{"version":"1.0","image":"image-name-1","regions":[{"name":"image-region-1","id":"id-img-reg-1"}]}]}
 ]

pkg/apis/stackit/v1alpha1/types_cloudprofile.go

@@ -33,6 +33,8 @@ type CloudProfileConfig struct {
 	APIEndpoints *APIEndpoints `json:"apiEndpoints,omitempty"`
 	// CABundle is the CA certificate bundle for API endpoints.
 	// This field is currently ignored and reserved for future use.
+	//
+	// Deprecated: Will be removed soon. This field is not used anymore
 	// +optional
 	CABundle *string `json:"caBundle,omitempty"`
 	// Bastion are the bastion options for configuring the bastion server

pkg/controller/controlplane/valuesprovider.go

@@ -135,6 +135,7 @@ var (
 		Objects: []*chart.Object{
 			{Type: &corev1.Secret{}, Name: openstack.CloudProviderConfigName},
 			{Type: &corev1.Secret{}, Name: openstack.CloudProviderDiskConfigName},
+			{Type: &corev1.Secret{}, Name: openstack.CloudProfileCASecretName},
 		},
 	}
 
@@ -681,6 +682,16 @@ func getConfigChartValues(
 		}
 	}
 
+	// Deploy the cloudprofile-ca-bundle when at least one of stackit-mcm, stackit-csi or stackit-ccm is deployed
+	if feature.UseStackitMachineControllerManager(cluster) ||
+		getCSIDriver(controlPlaneConfig) == stackitv1alpha1.STACKIT ||
+		getCCMController(controlPlaneConfig) == stackitv1alpha1.STACKIT {
+		if cluster.CloudProfile != nil && cluster.CloudProfile.Spec.CABundle != nil {
+			caBundle := ptr.Deref(cluster.CloudProfile.Spec.CABundle, "")
+			values["CABundle"] = caBundle
+		}
+	}
+
 	return values, nil
 }
 

pkg/openstack/types.go

@@ -57,6 +57,8 @@ const (
 	// DNSCABundle is a constant for the key in a DNS secret that holds the Openstack CA Bundle for the KeyStone server.
 	DNSCABundle = "OS_CACERT"
 
+	// CloudProfileCASecretName is the name of the secret containing the CloudPorifle caBundle
+	CloudProfileCASecretName = "cloudprofile-ca-bundle"
 	// CloudProviderConfigName is the name of the secret containing the cloud provider config.
 	CloudProviderConfigName = "cloud-provider-config"
 	// CloudProviderDiskConfigName is the name of the secret containing the cloud provider config for disk/volume handling. It is used by kube-controller-manager.

pkg/stackit/client/dns.go

@@ -13,8 +13,11 @@ import (
 	"github.com/stackitcloud/gardener-extension-provider-stackit/v2/pkg/stackit"
 )
 
-func NewDNSClient(_ context.Context, endpoints stackitv1alpha1.APIEndpoints, credentials *stackit.Credentials) (DNSClient, error) {
-	options := clientOptions(endpoints, credentials)
+func NewDNSClient(_ context.Context, endpoints stackitv1alpha1.APIEndpoints, credentials *stackit.Credentials, caBundle string) (DNSClient, error) {
+	options, err := clientOptions(endpoints, credentials, caBundle)
+	if err != nil {
+		return nil, err
+	}
 
 	if endpoints.DNS != nil {
 		options = append(options, sdkconfig.WithEndpoint(*endpoints.DNS))
@@ -24,6 +27,7 @@ func NewDNSClient(_ context.Context, endpoints stackitv1alpha1.APIEndpoints, cre
 	if err != nil {
 		return nil, err
 	}
+
 	return &dnsClient{
 		api:       apiClient.DefaultAPI,
 		projectID: credentials.ProjectID,

pkg/stackit/client/factory.go

@@ -2,6 +2,10 @@ package client
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"fmt"
+	"net/http"
 
 	extensionscontroller "github.com/gardener/gardener/extensions/pkg/controller"
 	sdkconfig "github.com/stackitcloud/stackit-sdk-go/core/config"
@@ -33,18 +37,25 @@ type Factory interface {
 type factory struct {
 	StackitRegion       string
 	StackitAPIEndpoints stackitv1alpha1.APIEndpoints
+	CABundleB64         string
 }
 
 func New(region string, cluster *extensionscontroller.Cluster) Factory {
 	var apiEndpoints stackitv1alpha1.APIEndpoints
+	var caBundle string
 
 	if cloudProfileConfig, err := helper.CloudProfileConfigFromCluster(cluster); err == nil {
 		apiEndpoints = ptr.Deref(cloudProfileConfig.APIEndpoints, stackitv1alpha1.APIEndpoints{})
 	}
 
+	if cluster.CloudProfile != nil && cluster.CloudProfile.Spec.CABundle != nil {
+		caBundle = ptr.Deref(cluster.CloudProfile.Spec.CABundle, "")
+	}
+
 	return &factory{
 		StackitRegion:       region,
 		StackitAPIEndpoints: apiEndpoints,
+		CABundleB64:         caBundle,
 	}
 }
 
@@ -54,7 +65,7 @@ func (f factory) LoadBalancing(ctx context.Context, c client.Client, secretRef c
 		return nil, err
 	}
 
-	return NewLoadBalancingClient(ctx, f.StackitRegion, f.StackitAPIEndpoints, credentials)
+	return NewLoadBalancingClient(ctx, f.StackitRegion, f.StackitAPIEndpoints, credentials, f.CABundleB64)
 }
 
 func (f factory) IaaS(ctx context.Context, c client.Client, secretRef corev1.SecretReference) (IaaSClient, error) {
@@ -63,7 +74,7 @@ func (f factory) IaaS(ctx context.Context, c client.Client, secretRef corev1.Sec
 		return nil, err
 	}
 
-	return NewIaaSClient(f.StackitRegion, f.StackitAPIEndpoints, credentials)
+	return NewIaaSClient(f.StackitRegion, f.StackitAPIEndpoints, credentials, f.CABundleB64)
 }
 
 func (f factory) DNS(ctx context.Context, c client.Client, secretRef corev1.SecretReference) (DNSClient, error) {
@@ -72,10 +83,28 @@ func (f factory) DNS(ctx context.Context, c client.Client, secretRef corev1.Secr
 		return nil, err
 	}
 
-	return NewDNSClient(ctx, f.StackitAPIEndpoints, credentials)
+	return NewDNSClient(ctx, f.StackitAPIEndpoints, credentials, f.CABundleB64)
+}
+
+// newHTTPClientWithCustomCA creates an http.Client with a custom CA
+func newHTTPClientWithCustomCA(caBundle []byte) (*http.Client, error) {
+	caCertPool, err := x509.SystemCertPool()
+	if err != nil {
+		// we could also fall back here and use an empty pool via x509.NewCertPool()
+		return nil, fmt.Errorf("failed to load system cert pool: %w", err)
+	}
+	if ok := caCertPool.AppendCertsFromPEM(caBundle); !ok {
+		return nil, fmt.Errorf("failed to append CA bundle to cert pool")
+	}
+
+	return &http.Client{Transport: &http.Transport{
+		TLSClientConfig: &tls.Config{
+			RootCAs: caCertPool,
+		},
+	}}, nil
 }
 
-func clientOptions(endpoints stackitv1alpha1.APIEndpoints, credentials *stackit.Credentials) []sdkconfig.ConfigurationOption {
+func clientOptions(endpoints stackitv1alpha1.APIEndpoints, credentials *stackit.Credentials, caBundle string) ([]sdkconfig.ConfigurationOption, error) {
 	result := []sdkconfig.ConfigurationOption{
 		sdkconfig.WithUserAgent(UserAgent),
 		sdkconfig.WithServiceAccountKey(credentials.SaKeyJSON),
@@ -85,5 +114,13 @@ func clientOptions(endpoints stackitv1alpha1.APIEndpoints, credentials *stackit.
 		result = append(result, sdkconfig.WithTokenEndpoint(*endpoints.TokenEndpoint))
 	}
 
-	return result
+	if caBundle != "" {
+		customHttpClient, err := newHTTPClientWithCustomCA([]byte(caBundle))
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, sdkconfig.WithHTTPClient(customHttpClient))
+	}
+
+	return result, nil
 }