From a052992b97a0a1903282492161f3d82c9f2eef75 Mon Sep 17 00:00:00 2001 From: Martin Jackson Date: Thu, 6 Aug 2026 10:08:20 -0500 Subject: [PATCH 1/3] Fix s3CaInjector looking for spoke Ramen ConfigMaps in the wrong namespace. Managed clusters keep ramen-dr-cluster-operator-config in openshift-dr-system, so use a separate managedNamespace instead of the hub openshift-operators value. Co-authored-by: Cursor --- Chart.yaml | 2 +- README.md | 9 ++++++--- README.md.gotmpl | 4 +++- scripts/ansible/s3-ca-injector.yml | 12 +++++++----- templates/_helpers.tpl | 6 ++++++ templates/_s3_ca_injector.tpl | 2 ++ values.yaml | 4 +++- 7 files changed, 28 insertions(+), 11 deletions(-) diff --git a/Chart.yaml b/Chart.yaml index 54fc042..ec719ae 100644 --- a/Chart.yaml +++ b/Chart.yaml @@ -9,4 +9,4 @@ keywords: - ramen - regionaldr name: opp-policy-chart -version: 0.1.1 +version: 0.1.2 diff --git a/README.md b/README.md index 3d0cb7b..ad74988 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # opp-policy-chart -![Version: 0.1.1](https://img.shields.io/badge/Version-0.1.1-informational?style=flat-square) +![Version: 0.1.2](https://img.shields.io/badge/Version-0.1.2-informational?style=flat-square) ACM/OCM policy chart for Submariner, s3-ssl CA sync, and Ramen s3StoreProfiles CA injection (from vp-manage-proxy-cluster-ca) supporting Regional Disaster Recovery. @@ -8,10 +8,12 @@ Always deployed with **regionaldr-with-virt** (Ramen DR / virt workloads). This Also pair with **odf-dr-chart** (MirrorPeer / ODF). **s3-ssl** sync/precheck/policies use the **full** Proxy trustedCA ConfigMap (`vp-pattern-proxy-ca-bundle` / `ca-bundle.crt`) — the same object `Proxy/cluster.spec.trustedCA` must reference. -**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only. +**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches hub `openshift-operators/ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch spoke `openshift-dr-system/ramen-dr-cluster-operator-config`. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only. ## Notable changes +v0.1.2 - Patch spoke Ramen ConfigMaps in `openshift-dr-system` (`s3CaInjector.ramen.managedNamespace`); hub remains `openshift-operators` + v0.1.1 - Restart Ramen operator pods after s3CaInjector patches caCertificates (reload Proxy trustedCA for DRCluster S3 validation) v0.1.0 - Fold s3-ca-injector into this chart (hub + optional spoke inject via ACM kubeconfigs); prefer over standalone vp-ramen-s3-ca-injector; s3-ssl uses the full Proxy trustedCA ConfigMap, s3CaInjector uses the differential Bundle @@ -63,8 +65,9 @@ v0.0.1 - Initial release | s3CaInjector.ramen.failIfNoProfiles | bool | `true` | When true, fail the one-shot Job if profiles never appear. CronJob soft-exits. | | s3CaInjector.ramen.hubConfigMapName | string | `"ramen-hub-operator-config"` | Hub Ramen ConfigMap name. | | s3CaInjector.ramen.managedConfigMapName | string | `"ramen-dr-cluster-operator-config"` | Managed-cluster Ramen ConfigMap name. | +| s3CaInjector.ramen.managedNamespace | string | `"openshift-dr-system"` | Namespace of managed-cluster Ramen operator ConfigMaps (dr-cluster operator). | | s3CaInjector.ramen.minProfiles | int | `2` | Minimum s3StoreProfiles before patching. | -| s3CaInjector.ramen.namespace | string | `"openshift-operators"` | Namespace of hub and managed Ramen operator ConfigMaps. | +| s3CaInjector.ramen.namespace | string | `"openshift-operators"` | Namespace of the hub Ramen operator ConfigMap. | | s3Ssl.caBundle.key | string | `"ca-bundle.crt"` | Data key holding PEM for Proxy trustedCA (usually ca-bundle.crt). | | s3Ssl.caBundle.name | string | `"vp-pattern-proxy-ca-bundle"` | Full Proxy trustedCA ConfigMap (vp-manage-proxy-cluster-ca configMapName). Not the differential Bundle. | | s3Ssl.caBundle.namespace | string | `"openshift-config"` | Namespace of the vp-proxy trust ConfigMap (vp-manage-proxy-cluster-ca targetNamespace). | diff --git a/README.md.gotmpl b/README.md.gotmpl index ed01a2b..dcf4b32 100644 --- a/README.md.gotmpl +++ b/README.md.gotmpl @@ -9,10 +9,12 @@ Always deployed with **regionaldr-with-virt** (Ramen DR / virt workloads). This Also pair with **odf-dr-chart** (MirrorPeer / ODF). **s3-ssl** sync/precheck/policies use the **full** Proxy trustedCA ConfigMap (`vp-pattern-proxy-ca-bundle` / `ca-bundle.crt`) — the same object `Proxy/cluster.spec.trustedCA` must reference. -**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only. +**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches hub `openshift-operators/ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch spoke `openshift-dr-system/ramen-dr-cluster-operator-config`. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only. ## Notable changes +v0.1.2 - Patch spoke Ramen ConfigMaps in `openshift-dr-system` (`s3CaInjector.ramen.managedNamespace`); hub remains `openshift-operators` + v0.1.1 - Restart Ramen operator pods after s3CaInjector patches caCertificates (reload Proxy trustedCA for DRCluster S3 validation) v0.1.0 - Fold s3-ca-injector into this chart (hub + optional spoke inject via ACM kubeconfigs); prefer over standalone vp-ramen-s3-ca-injector; s3-ssl uses the full Proxy trustedCA ConfigMap, s3CaInjector uses the differential Bundle diff --git a/scripts/ansible/s3-ca-injector.yml b/scripts/ansible/s3-ca-injector.yml index 1be43e1..83c2246 100644 --- a/scripts/ansible/s3-ca-injector.yml +++ b/scripts/ansible/s3-ca-injector.yml @@ -3,7 +3,8 @@ # Hub always; managed clusters when DISTRIBUTE_TO_MANAGED_CLUSTERS=true (default). # Skips ConfigMap apply when every profile already has the desired caCertificates. # On patch, inject-ramen-s3-ca.sh restarts Ramen operator pods so they reload Proxy trust. -# Env: PRIMARY_CLUSTER, SECONDARY_CLUSTER, CA_BUNDLE_*, RAMEN_*, DISTRIBUTE_TO_MANAGED_CLUSTERS, +# Env: PRIMARY_CLUSTER, SECONDARY_CLUSTER, CA_BUNDLE_*, RAMEN_NAMESPACE (hub), +# RAMEN_MANAGED_NAMESPACE (spokes), RAMEN_*_CONFIGMAP, DISTRIBUTE_TO_MANAGED_CLUSTERS, # ALLOW_MISSING_PROFILES, CA_WAIT_SECONDS, RAMEN_WAIT_SECONDS, POLL_INTERVAL, MIN_PROFILES - name: S3 CA inject into Ramen s3StoreProfiles hosts: localhost @@ -16,6 +17,7 @@ ca_bundle_namespace: "{{ lookup('env', 'CA_BUNDLE_NAMESPACE') | default('openshift-config', true) }}" ca_bundle_key: "{{ lookup('env', 'CA_BUNDLE_KEY') | default('cabundle', true) }}" ramen_namespace: "{{ lookup('env', 'RAMEN_NAMESPACE') | default('openshift-operators', true) }}" + ramen_managed_namespace: "{{ lookup('env', 'RAMEN_MANAGED_NAMESPACE') | default('openshift-dr-system', true) }}" ramen_hub_configmap: "{{ lookup('env', 'RAMEN_HUB_CONFIGMAP') | default('ramen-hub-operator-config', true) }}" ramen_managed_configmap: "{{ lookup('env', 'RAMEN_MANAGED_CONFIGMAP') | default('ramen-dr-cluster-operator-config', true) }}" ramen_config_key: "{{ lookup('env', 'RAMEN_CONFIG_KEY') | default('ramen_manager_config.yaml', true) }}" @@ -39,7 +41,7 @@ - "s3-ca-injector starting (source=vp-manage-proxy-cluster-ca)" - "ca_bundle={{ ca_bundle_namespace }}/{{ ca_bundle_name }} key={{ ca_bundle_key }}" - "hub_cm={{ ramen_namespace }}/{{ ramen_hub_configmap }}" - - "managed_cm={{ ramen_namespace }}/{{ ramen_managed_configmap }}" + - "managed_cm={{ ramen_managed_namespace }}/{{ ramen_managed_configmap }}" - "distribute_to_managed={{ distribute_to_managed }}" - "primary={{ primary_cluster }} secondary={{ secondary_cluster }}" @@ -137,7 +139,7 @@ export CA_NAMESPACE="{{ ca_bundle_namespace }}" export CA_CONFIGMAP="{{ ca_bundle_name }}" export CA_KEY="{{ ca_bundle_key }}" - export RAMEN_NAMESPACE="{{ ramen_namespace }}" + export RAMEN_NAMESPACE="{{ ramen_managed_namespace }}" export RAMEN_CONFIGMAP="{{ ramen_managed_configmap }}" export RAMEN_CONFIG_KEY="{{ ramen_config_key }}" export MIN_PROFILES="{{ min_profiles }}" @@ -148,7 +150,7 @@ export WORK_DIR="{{ work_dir }}/{{ item }}" export KUBECONFIG="{{ work_dir }}/{{ item }}-kubeconfig.yaml" mkdir -p "$WORK_DIR" - echo "=== s3-ca-injector: {{ item }} ({{ ramen_managed_configmap }}) ===" + echo "=== s3-ca-injector: {{ item }} ({{ ramen_managed_namespace }}/{{ ramen_managed_configmap }}) ===" /bin/bash "{{ inject_script }}" args: executable: /bin/bash @@ -159,7 +161,7 @@ changed_when: "'Patched caCertificates' in item.stdout" when: distribute_to_managed | bool - - name: s3-ca-injector complete + - name: S3 CA injector complete ansible.builtin.debug: msg: >- Hub Ramen profiles checked/patched from vp-proxy differential CA diff --git a/templates/_helpers.tpl b/templates/_helpers.tpl index 4bb9e4c..2eea38f 100644 --- a/templates/_helpers.tpl +++ b/templates/_helpers.tpl @@ -135,6 +135,12 @@ checksum/opp-policy-ansible: {{ include "opp.ansibleConfigChecksum" . | quote }} {{- $r.namespace | default "openshift-operators" -}} {{- end -}} +{{- define "opp.ramenManagedNamespace" -}} +{{- $inj := .Values.s3CaInjector | default dict -}} +{{- $r := $inj.ramen | default dict -}} +{{- $r.managedNamespace | default "openshift-dr-system" -}} +{{- end -}} + {{- define "opp.ramenHubConfigMapName" -}} {{- $inj := .Values.s3CaInjector | default dict -}} {{- $r := $inj.ramen | default dict -}} diff --git a/templates/_s3_ca_injector.tpl b/templates/_s3_ca_injector.tpl index 3edf1dc..bf580f4 100644 --- a/templates/_s3_ca_injector.tpl +++ b/templates/_s3_ca_injector.tpl @@ -13,6 +13,8 @@ value: {{ include "opp.s3CaInjectorCaBundleKey" . | quote }} - name: RAMEN_NAMESPACE value: {{ include "opp.ramenNamespace" . | quote }} +- name: RAMEN_MANAGED_NAMESPACE + value: {{ include "opp.ramenManagedNamespace" . | quote }} - name: RAMEN_HUB_CONFIGMAP value: {{ include "opp.ramenHubConfigMapName" . | quote }} - name: RAMEN_MANAGED_CONFIGMAP diff --git a/values.yaml b/values.yaml index d26d55a..44bf6ef 100644 --- a/values.yaml +++ b/values.yaml @@ -72,8 +72,10 @@ s3CaInjector: # -- Data key holding PEM (differentialBundle.targetKey; must not contain '.'). key: cabundle ramen: - # -- Namespace of hub and managed Ramen operator ConfigMaps. + # -- Namespace of the hub Ramen operator ConfigMap. namespace: openshift-operators + # -- Namespace of managed-cluster Ramen operator ConfigMaps (dr-cluster operator). + managedNamespace: openshift-dr-system # -- Hub Ramen ConfigMap name. hubConfigMapName: ramen-hub-operator-config # -- Managed-cluster Ramen ConfigMap name. From 8f902da074bbffa21b7909c519934c9426dad83c Mon Sep 17 00:00:00 2001 From: Martin Jackson Date: Thu, 6 Aug 2026 10:22:14 -0500 Subject: [PATCH 2/3] Use stdout better --- scripts/ansible/s3-ca-injector.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/ansible/s3-ca-injector.yml b/scripts/ansible/s3-ca-injector.yml index 83c2246..aaa3831 100644 --- a/scripts/ansible/s3-ca-injector.yml +++ b/scripts/ansible/s3-ca-injector.yml @@ -80,7 +80,7 @@ args: executable: /bin/bash register: hub_inject - changed_when: "'Patched caCertificates' in hub_inject.stdout" + changed_when: "'Patched caCertificates' in stdout" - name: Wait for both managed clusters to be Available ansible.builtin.include_tasks: tasks/wait-dr-managedclusters-available.yml @@ -158,7 +158,7 @@ loop_control: label: "{{ item }}" register: spoke_inject - changed_when: "'Patched caCertificates' in item.stdout" + changed_when: "'Patched caCertificates' in stdout" when: distribute_to_managed | bool - name: S3 CA injector complete From b63f27186aa710b81dbbca1209d8fe43ee36fd4d Mon Sep 17 00:00:00 2001 From: Martin Jackson Date: Thu, 6 Aug 2026 10:25:07 -0500 Subject: [PATCH 3/3] Use registered variable --- scripts/ansible/s3-ca-injector.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/ansible/s3-ca-injector.yml b/scripts/ansible/s3-ca-injector.yml index aaa3831..9b2732d 100644 --- a/scripts/ansible/s3-ca-injector.yml +++ b/scripts/ansible/s3-ca-injector.yml @@ -80,7 +80,7 @@ args: executable: /bin/bash register: hub_inject - changed_when: "'Patched caCertificates' in stdout" + changed_when: "'Patched caCertificates' in hub_inject.stdout" - name: Wait for both managed clusters to be Available ansible.builtin.include_tasks: tasks/wait-dr-managedclusters-available.yml @@ -158,7 +158,7 @@ loop_control: label: "{{ item }}" register: spoke_inject - changed_when: "'Patched caCertificates' in stdout" + changed_when: "'Patched caCertificates' in spoke_inject.stdout" when: distribute_to_managed | bool - name: S3 CA injector complete