mirror of
https://github.com/clastix/kamaji.git
synced 2026-04-15 06:56:47 +00:00
86 lines
2.3 KiB
Go
86 lines
2.3 KiB
Go
// Copyright 2022 Clastix Labs
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
package controllers
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"crypto/x509"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/pkg/errors"
|
|
corev1 "k8s.io/api/core/v1"
|
|
k8stypes "k8s.io/apimachinery/pkg/types"
|
|
|
|
"github.com/clastix/kamaji/internal/sql"
|
|
"github.com/clastix/kamaji/internal/types"
|
|
)
|
|
|
|
func (r *TenantControlPlaneReconciler) getStorageConnection(ctx context.Context) (sql.DBConnection, error) {
|
|
var driver sql.Driver
|
|
var dbName string
|
|
|
|
// TODO: https://github.com/clastix/kamaji/issues/67
|
|
switch r.Config.ETCDStorageType {
|
|
case types.ETCD:
|
|
return nil, nil
|
|
case types.KineMySQL:
|
|
driver = sql.MySQL
|
|
dbName = "mysql"
|
|
case types.KinePostgreSQL:
|
|
driver = sql.PostgreSQL
|
|
default:
|
|
return nil, nil
|
|
}
|
|
|
|
secret := &corev1.Secret{}
|
|
namespacedName := k8stypes.NamespacedName{Namespace: r.Config.KineSecretNamespace, Name: r.Config.KineSecretName}
|
|
if err := r.Client.Get(ctx, namespacedName, secret); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if t := "kamaji.clastix.io/kine"; string(secret.Type) != t {
|
|
return nil, fmt.Errorf("expecting a secret of type %s", t)
|
|
}
|
|
|
|
keys := []string{"ca.crt", "server.crt", "server.key", "username", "password"}
|
|
|
|
if secret.Data == nil {
|
|
return nil, fmt.Errorf("the Kine secret %s/%s is missing all the required keys (%s)", secret.GetNamespace(), secret.GetName(), strings.Join(keys, ","))
|
|
}
|
|
|
|
for _, key := range keys {
|
|
if _, ok := secret.Data[key]; !ok {
|
|
return nil, fmt.Errorf("missing required key %s for the Kine secret %s/%s", key, secret.GetNamespace(), secret.GetName())
|
|
}
|
|
}
|
|
|
|
rootCAs := x509.NewCertPool()
|
|
if ok := rootCAs.AppendCertsFromPEM(secret.Data["ca.crt"]); !ok {
|
|
return nil, fmt.Errorf("error create root CA for the DB connector")
|
|
}
|
|
|
|
certificate, err := tls.X509KeyPair(secret.Data["server.crt"], secret.Data["server.key"])
|
|
if err != nil {
|
|
return nil, errors.Wrap(err, "cannot retrieve x.509 key pair from the Kine Secret")
|
|
}
|
|
|
|
return sql.GetDBConnection(
|
|
sql.ConnectionConfig{
|
|
SQLDriver: driver,
|
|
User: string(secret.Data["username"]),
|
|
Password: string(secret.Data["password"]),
|
|
Host: r.Config.KineHost,
|
|
Port: r.Config.KinePort,
|
|
DBName: dbName,
|
|
TLSConfig: &tls.Config{
|
|
ServerName: r.Config.KineHost,
|
|
RootCAs: rootCAs,
|
|
Certificates: []tls.Certificate{certificate},
|
|
},
|
|
},
|
|
)
|
|
}
|