From 098164b67fa87698455f17a826df5a542cc12173 Mon Sep 17 00:00:00 2001 From: Martin Jackson Date: Wed, 5 Aug 2026 16:35:02 -0500 Subject: [PATCH] Restart ramen pods after CA injection to ensure CA trust works --- Chart.yaml | 2 +- README.md | 6 ++++-- README.md.gotmpl | 4 +++- scripts/ansible/s3-ca-injector.yml | 4 +++- scripts/inject-ramen-s3-ca.sh | 25 ++++++++++++++++++++++++- templates/rbac-s3-ca-injector.yaml | 4 ++++ 6 files changed, 39 insertions(+), 6 deletions(-) diff --git a/Chart.yaml b/Chart.yaml index 9f689ee..54fc042 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -9,4 +9,4 @@ keywords: - ramen - regionaldr name: opp-policy-chart -version: 0.1.0 +version: 0.1.1 diff --git a/README.md b/README.md index 4afc4c2..3d0cb7b 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # opp-policy-chart -![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) +![Version: 0.1.1](https://img.shields.io/badge/Version-0.1.1-informational?style=flat-square) ACM/OCM policy chart for Submariner, s3-ssl CA sync, and Ramen s3StoreProfiles CA injection (from vp-manage-proxy-cluster-ca) supporting Regional Disaster Recovery. @@ -8,10 +8,12 @@ Always deployed with **regionaldr-with-virt** (Ramen DR / virt workloads). This Also pair with **odf-dr-chart** (MirrorPeer / ODF). **s3-ssl** sync/precheck/policies use the **full** Proxy trustedCA ConfigMap (`vp-pattern-proxy-ca-bundle` / `ca-bundle.crt`) — the same object `Proxy/cluster.spec.trustedCA` must reference. -**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. Set `distributeToManagedClusters: false` for hub-only. +**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only. ## Notable changes +v0.1.1 - Restart Ramen operator pods after s3CaInjector patches caCertificates (reload Proxy trustedCA for DRCluster S3 validation) + v0.1.0 - Fold s3-ca-injector into this chart (hub + optional spoke inject via ACM kubeconfigs); prefer over standalone vp-ramen-s3-ca-injector; s3-ssl uses the full Proxy trustedCA ConfigMap, s3CaInjector uses the differential Bundle v0.0.4 - Add Submariner and s3-ssl (from odf-dr); s3-ssl sources CA from vp-proxy ConfigMap diff --git a/README.md.gotmpl b/README.md.gotmpl index 733ab21..ed01a2b 100644 --- a/README.md.gotmpl +++ b/README.md.gotmpl @@ -9,10 +9,12 @@ Always deployed with **regionaldr-with-virt** (Ramen DR / virt workloads). This Also pair with **odf-dr-chart** (MirrorPeer / ODF). **s3-ssl** sync/precheck/policies use the **full** Proxy trustedCA ConfigMap (`vp-pattern-proxy-ca-bundle` / `ca-bundle.crt`) — the same object `Proxy/cluster.spec.trustedCA` must reference. -**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. Set `distributeToManagedClusters: false` for hub-only. +**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only. ## Notable changes +v0.1.1 - Restart Ramen operator pods after s3CaInjector patches caCertificates (reload Proxy trustedCA for DRCluster S3 validation) + v0.1.0 - Fold s3-ca-injector into this chart (hub + optional spoke inject via ACM kubeconfigs); prefer over standalone vp-ramen-s3-ca-injector; s3-ssl uses the full Proxy trustedCA ConfigMap, s3CaInjector uses the differential Bundle v0.0.4 - Add Submariner and s3-ssl (from odf-dr); s3-ssl sources CA from vp-proxy ConfigMap diff --git a/scripts/ansible/s3-ca-injector.yml b/scripts/ansible/s3-ca-injector.yml index 1bb5e7d..1be43e1 100644 --- a/scripts/ansible/s3-ca-injector.yml +++ b/scripts/ansible/s3-ca-injector.yml @@ -2,6 +2,7 @@ # Inject caCertificates into Ramen s3StoreProfiles from hub vp-proxy differential CA. # Hub always; managed clusters when DISTRIBUTE_TO_MANAGED_CLUSTERS=true (default). # Skips ConfigMap apply when every profile already has the desired caCertificates. +# On patch, inject-ramen-s3-ca.sh restarts Ramen operator pods so they reload Proxy trust. # Env: PRIMARY_CLUSTER, SECONDARY_CLUSTER, CA_BUNDLE_*, RAMEN_*, DISTRIBUTE_TO_MANAGED_CLUSTERS, # ALLOW_MISSING_PROFILES, CA_WAIT_SECONDS, RAMEN_WAIT_SECONDS, POLL_INTERVAL, MIN_PROFILES - name: S3 CA inject into Ramen s3StoreProfiles @@ -167,4 +168,5 @@ {% else %} ; managed-cluster distribution skipped (distributeToManagedClusters=false) {% endif %} - (ConfigMap apply skipped when caCertificates already match) + (ConfigMap apply skipped when caCertificates already match; + Ramen operator pods restarted when a patch was applied) diff --git a/scripts/inject-ramen-s3-ca.sh b/scripts/inject-ramen-s3-ca.sh index 8f06398..c7f055b 100755 --- a/scripts/inject-ramen-s3-ca.sh +++ b/scripts/inject-ramen-s3-ca.sh @@ -3,6 +3,8 @@ # Prefer CA_FILE (hub-read PEM shared across targets). Else wait for CA ConfigMap in-cluster. # Never creates profiles. Soft-exit when ALLOW_MISSING_PROFILES=true and profiles are absent. # Skips ConfigMap apply when every profile already has the desired caCertificates value. +# After a successful patch, restarts Ramen operator pods so they reload process trust +# (Proxy trustedCA). Profile caCertificates alone are not used by Ramen ListKeys. # Honors KUBECONFIG for managed-cluster targets (empty/unset = hub in-cluster). set -euo pipefail @@ -218,13 +220,34 @@ verify_patch() { die "post-apply verification failed for ${RAMEN_NAMESPACE}/${RAMEN_CONFIGMAP}" } +# Ramen's S3 ListKeys client uses the process trust store (cluster Proxy trustedCA), +# not s3StoreProfiles.caCertificates. Restart operators after we patch so pods +# remount/reload trust that s3-ssl / vp-proxy just distributed. +restart_ramen_operators() { + local ns label pods + local -a labels=("app=ramen-hub-operator" "app=ramen-dr-cluster-operator") + + log "Restarting Ramen operator pods after caCertificates patch..." + for ns in openshift-operators openshift-dr-system; do + for label in "${labels[@]}"; do + pods=$(oc get pods -n "$ns" -l "$label" -o name 2>/dev/null || true) + if [[ -n "$pods" ]]; then + log " Deleting ${label} pods in ${ns}" + # shellcheck disable=SC2086 + oc delete -n "$ns" $pods --ignore-not-found=true || true + fi + done + done +} + resolve_ca_bundle wait_for_ramen_profiles rm -f "$WORK_DIR/.ca-patched" patch_profiles if [[ -f "$WORK_DIR/.ca-patched" ]]; then verify_patch + restart_ramen_operators else - log "Skip verify (no ConfigMap apply)" + log "Skip verify and restart (no ConfigMap apply)" fi log "Done." diff --git a/templates/rbac-s3-ca-injector.yaml b/templates/rbac-s3-ca-injector.yaml index 16617d0..424d8e6 100644 --- a/templates/rbac-s3-ca-injector.yaml +++ b/templates/rbac-s3-ca-injector.yaml @@ -24,6 +24,10 @@ rules: - apiGroups: [""] resources: ["configmaps", "secrets"] verbs: ["get", "list", "watch", "patch", "update"] +# Restart Ramen operator pods after caCertificates patch (hub SA only; spokes use ACM kubeconfigs). +- apiGroups: [""] + resources: ["pods"] + verbs: ["get", "list", "delete"] - apiGroups: ["cluster.open-cluster-management.io"] resources: ["managedclusters"] verbs: ["get", "list"]