Skip to content

STOR-2770: Generate Azure Disk and File CSI Driver Operator metrics serving certs by HCP controller #7970

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mpatlasov wants to merge 1 commit into
base: main
Choose a base branch
from
+112 −0
Open

STOR-2770: Generate Azure Disk and File CSI Driver Operator metrics serving certs by HCP controller #7970

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1731,6 +1731,20 @@ func (r *HostedControlPlaneReconciler) reconcilePKI(ctx context.Context, hcp *hy
return fmt.Errorf("failed to reconcile %s secret: %w", azureWorkloadIdentityWebhookServingCert.Name, err)
}

// Azure-disk CSI driver Operator metrics Serving Cert
AzureDiskCsiDriverOperatorServingCert := manifests.AzureDiskCSIDriverOperatorServingCertSecret(hcp.Namespace)
AzureDiskCsiDriverOperatorService := manifests.AzureDiskCSIDriverOperatorMetricsService(hcp.Namespace)
err := removeServiceCAAnnotationAndSecret(ctx, r.Client, AzureDiskCsiDriverOperatorService, AzureDiskCsiDriverOperatorServingCert)
if err != nil {
r.Log.Error(err, "failed to remove service ca annotation and secret: %w")
}
if _, err = createOrUpdate(ctx, r, AzureDiskCsiDriverOperatorServingCert, func() error {
z := pki.ReconcileAzureDiskCsiDriverOperatorMetricsServingCertSecret(AzureDiskCsiDriverOperatorServingCert, rootCASecret, p.OwnerRef)
return z
}); err != nil {
return fmt.Errorf("failed to reconcile azure-disk csi driver operator serving cert: %w", err)
}

azureDiskCsiDriverControllerMetricsService := manifests.AzureDiskCsiDriverControllerMetricsService(hcp.Namespace)
if err = r.Get(ctx, client.ObjectKeyFromObject(azureDiskCsiDriverControllerMetricsService), azureDiskCsiDriverControllerMetricsService); err != nil {
if !apierrors.IsNotFound(err) {
Expand All @@ -1753,6 +1767,20 @@ func (r *HostedControlPlaneReconciler) reconcilePKI(ctx context.Context, hcp *hy
}
}

// Azure-file CSI driver Operator metrics Serving Cert
AzureFileCsiDriverOperatorServingCert := manifests.AzureFileCSIDriverOperatorServingCertSecret(hcp.Namespace)
AzureFileCsiDriverOperatorService := manifests.AzureFileCSIDriverOperatorMetricsService(hcp.Namespace)
err = removeServiceCAAnnotationAndSecret(ctx, r.Client, AzureFileCsiDriverOperatorService, AzureFileCsiDriverOperatorServingCert)
if err != nil {
r.Log.Error(err, "failed to remove service ca annotation and secret: %w")
}
if _, err = createOrUpdate(ctx, r, AzureFileCsiDriverOperatorServingCert, func() error {
z := pki.ReconcileAzureFileCsiDriverOperatorMetricsServingCertSecret(AzureFileCsiDriverOperatorServingCert, rootCASecret, p.OwnerRef)
return z
}); err != nil {
return fmt.Errorf("failed to reconcile azure-file csi driver operator serving cert: %w", err)
}

azureFileCsiDriverControllerMetricsService := manifests.AzureFileCsiDriverControllerMetricsService(hcp.Namespace)
if err = r.Get(ctx, client.ObjectKeyFromObject(azureFileCsiDriverControllerMetricsService), azureFileCsiDriverControllerMetricsService); err != nil {
if !apierrors.IsNotFound(err) {
Expand Down
19 changes: 19 additions & 0 deletions ...plane-operator/controllers/hostedcontrolplane/manifests/azure_disk_csi_driver_operator.go
View file
Open in desktop
Copy link
Contributor

@jsafrane jsafrane Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would personally put the manifests into azure.go, with other azure-specific objects. But I'd let HyperShift folks decide.

Copy link
Contributor Author

@mpatlasov mpatlasov Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed! My logic was like that: If NTO implements func ClusterNodeTuningOperatorMetricsService() in control-plane-operator/controllers/hostedcontrolplane/manifests/nto.go, then we have to implement func AzureDiskCSIDriverOperatorMetricsService() in control-plane-operator/controllers/hostedcontrolplane/manifests/azure_disk_csi_driver_operator.go. I can re-work if HyperShift folks prefer another place for manifests.

Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
package manifests

import (
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

// Metrics
func AzureDiskCSIDriverOperatorMetricsService(namespace string) *corev1.Service {
return &corev1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: "azure-disk-csi-driver-operator",
Namespace: namespace,
},
Spec: corev1.ServiceSpec{
ClusterIP: "None",
},
}
}
19 changes: 19 additions & 0 deletions ...plane-operator/controllers/hostedcontrolplane/manifests/azure_file_csi_driver_operator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
package manifests

import (
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

// Metrics
func AzureFileCSIDriverOperatorMetricsService(namespace string) *corev1.Service {
return &corev1.Service{
ObjectMeta: metav1.ObjectMeta{
Name: "azure-file-csi-driver-operator",
Namespace: namespace,
},
Spec: corev1.ServiceSpec{
ClusterIP: "None",
},
}
}
8 changes: 8 additions & 0 deletions control-plane-operator/controllers/hostedcontrolplane/manifests/pki.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -324,6 +324,14 @@ func ClusterNodeTuningOperatorServingCertSecret(ns string) *corev1.Secret {
return secretFor(ns, "node-tuning-operator-tls")
}

func AzureDiskCSIDriverOperatorServingCertSecret(ns string) *corev1.Secret {
return secretFor(ns, "azure-disk-csi-driver-operator-serving-cert")
}

func AzureFileCSIDriverOperatorServingCertSecret(ns string) *corev1.Secret {
return secretFor(ns, "azure-file-csi-driver-operator-serving-cert")
}

func OLMPackageServerCertSecret(ns string) *corev1.Secret { return secretFor(ns, "packageserver-cert") }

func OLMOperatorServingCertSecret(ns string) *corev1.Secret {
Expand Down
19 changes: 19 additions & 0 deletions control-plane-operator/controllers/hostedcontrolplane/pki/azure_disk_csi_driver_operator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
package pki

import (
"fmt"

"github.com/openshift/hypershift/support/config"

corev1 "k8s.io/api/core/v1"
)

func ReconcileAzureDiskCsiDriverOperatorMetricsServingCertSecret(secret, ca *corev1.Secret, ownerRef config.OwnerRef) error {
Copy link
Contributor

@jsafrane jsafrane Mar 20, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: ReconcileAzureDiskCSIDriverOperatorMetricsServingCertSecret

Abbreviations in the middle of an idenitifer are all uppercase. https://google.github.io/styleguide/go/decisions#initialisms

This applies to the whole PR.

Copy link
Contributor Author

@mpatlasov mpatlasov Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jsafrane , I can easily substitute Csi with CSI in my PR -- that would be simple non-intrusive change. But func AzureDiskCsiDriverControllerMetricsServingCert() was introduced 2 years ago in this commit.

It's not nice to mix pre-existing AzureDiskCsiDriverControllerMetricsServingCert and new ReconcileAzureDiskCSIDriverOperatorMetricsServingCertSecret in the same project and go-file. (cc @bryan-cox )

Copy link
Contributor Author

@mpatlasov mpatlasov Mar 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jsafrane , After more thinking I came to a trivial idea: let's merge this PR with Csi (because it's consistent with pre-existing AzureDiskCsiDriverControllerMetricsServingCert), and after that I'll open NO-JIRA PR replacing Csi with CSI everywhere (openshift/hypershift). cc @bryan-cox

dnsNames := []string{
fmt.Sprintf("azure-disk-csi-driver-operator.%s.svc", secret.Namespace),
fmt.Sprintf("azure-disk-csi-driver-operator.%s.svc.cluster.local", secret.Namespace),
"azure-disk-csi-driver-operator",
"localhost",
}
return reconcileSignedCertWithAddresses(secret, ca, ownerRef, "azure-disk-csi-driver-operator", []string{"openshift"}, X509UsageClientServerAuth, dnsNames, nil)
}
19 changes: 19 additions & 0 deletions control-plane-operator/controllers/hostedcontrolplane/pki/azure_file_csi_driver_operator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
package pki

import (
"fmt"

"github.com/openshift/hypershift/support/config"

corev1 "k8s.io/api/core/v1"
)

func ReconcileAzureFileCsiDriverOperatorMetricsServingCertSecret(secret, ca *corev1.Secret, ownerRef config.OwnerRef) error {
dnsNames := []string{
fmt.Sprintf("azure-file-csi-driver-operator.%s.svc", secret.Namespace),
fmt.Sprintf("azure-file-csi-driver-operator.%s.svc.cluster.local", secret.Namespace),
"azure-file-csi-driver-operator",
"localhost",
}
return reconcileSignedCertWithAddresses(secret, ca, ownerRef, "azure-file-csi-driver-operator", []string{"openshift"}, X509UsageClientServerAuth, dnsNames, nil)
}