Fix s3CaInjector looking for spoke Ramen ConfigMaps

Chart.yaml

@@ -9,4 +9,4 @@ keywords:
   - ramen
   - regionaldr
 name: opp-policy-chart
-version: 0.1.1
+version: 0.1.2

README.md

@@ -1,17 +1,19 @@
 # opp-policy-chart
 
-![Version: 0.1.1](https://img.shields.io/badge/Version-0.1.1-informational?style=flat-square)
+![Version: 0.1.2](https://img.shields.io/badge/Version-0.1.2-informational?style=flat-square)
 
 ACM/OCM policy chart for Submariner, s3-ssl CA sync, and Ramen s3StoreProfiles CA injection (from vp-manage-proxy-cluster-ca) supporting Regional Disaster Recovery.
 
 Always deployed with **regionaldr-with-virt** (Ramen DR / virt workloads). This chart adds Submariner, s3-ssl CA sync, and Ramen `s3StoreProfiles` CA injection (sourced from **vp-manage-proxy-cluster-ca**) on the hub, with optional distribution to ManagedClusters.
 Also pair with **odf-dr-chart** (MirrorPeer / ODF).
 
 **s3-ssl** sync/precheck/policies use the **full** Proxy trustedCA ConfigMap (`vp-pattern-proxy-ca-bundle` / `ca-bundle.crt`) — the same object `Proxy/cluster.spec.trustedCA` must reference.
-**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only.
+**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches hub `openshift-operators/ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch spoke `openshift-dr-system/ramen-dr-cluster-operator-config`. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only.
 
 ## Notable changes
 
+v0.1.2 - Patch spoke Ramen ConfigMaps in `openshift-dr-system` (`s3CaInjector.ramen.managedNamespace`); hub remains `openshift-operators`
+
 v0.1.1 - Restart Ramen operator pods after s3CaInjector patches caCertificates (reload Proxy trustedCA for DRCluster S3 validation)
 
 v0.1.0 - Fold s3-ca-injector into this chart (hub + optional spoke inject via ACM kubeconfigs); prefer over standalone vp-ramen-s3-ca-injector; s3-ssl uses the full Proxy trustedCA ConfigMap, s3CaInjector uses the differential Bundle
@@ -63,8 +65,9 @@ v0.0.1 - Initial release
 | s3CaInjector.ramen.failIfNoProfiles | bool | `true` | When true, fail the one-shot Job if profiles never appear. CronJob soft-exits. |
 | s3CaInjector.ramen.hubConfigMapName | string | `"ramen-hub-operator-config"` | Hub Ramen ConfigMap name. |
 | s3CaInjector.ramen.managedConfigMapName | string | `"ramen-dr-cluster-operator-config"` | Managed-cluster Ramen ConfigMap name. |
+| s3CaInjector.ramen.managedNamespace | string | `"openshift-dr-system"` | Namespace of managed-cluster Ramen operator ConfigMaps (dr-cluster operator). |
 | s3CaInjector.ramen.minProfiles | int | `2` | Minimum s3StoreProfiles before patching. |
-| s3CaInjector.ramen.namespace | string | `"openshift-operators"` | Namespace of hub and managed Ramen operator ConfigMaps. |
+| s3CaInjector.ramen.namespace | string | `"openshift-operators"` | Namespace of the hub Ramen operator ConfigMap. |
 | s3Ssl.caBundle.key | string | `"ca-bundle.crt"` | Data key holding PEM for Proxy trustedCA (usually ca-bundle.crt). |
 | s3Ssl.caBundle.name | string | `"vp-pattern-proxy-ca-bundle"` | Full Proxy trustedCA ConfigMap (vp-manage-proxy-cluster-ca configMapName). Not the differential Bundle. |
 | s3Ssl.caBundle.namespace | string | `"openshift-config"` | Namespace of the vp-proxy trust ConfigMap (vp-manage-proxy-cluster-ca targetNamespace). |

README.md.gotmpl

@@ -9,10 +9,12 @@ Always deployed with **regionaldr-with-virt** (Ramen DR / virt workloads). This
 Also pair with **odf-dr-chart** (MirrorPeer / ODF).
 
 **s3-ssl** sync/precheck/policies use the **full** Proxy trustedCA ConfigMap (`vp-pattern-proxy-ca-bundle` / `ca-bundle.crt`) — the same object `Proxy/cluster.spec.trustedCA` must reference.
-**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches `ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch `ramen-dr-cluster-operator-config` on spokes. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only.
+**s3CaInjector** reads the **differential** Bundle (`vp-pattern-proxy-ca-bundle-differential` / `cabundle` — hub + spoke API/ingress CAs only), patches hub `openshift-operators/ramen-hub-operator-config`, then (when `s3CaInjector.distributeToManagedClusters` is true) uses ACM kubeconfigs to patch spoke `openshift-dr-system/ramen-dr-cluster-operator-config`. After a successful patch it restarts Ramen operator pods so they reload cluster Proxy trust (profile `caCertificates` alone are not used by Ramen `ListKeys`). Set `distributeToManagedClusters: false` for hub-only.
 
 ## Notable changes
 
+v0.1.2 - Patch spoke Ramen ConfigMaps in `openshift-dr-system` (`s3CaInjector.ramen.managedNamespace`); hub remains `openshift-operators`
+
 v0.1.1 - Restart Ramen operator pods after s3CaInjector patches caCertificates (reload Proxy trustedCA for DRCluster S3 validation)
 
 v0.1.0 - Fold s3-ca-injector into this chart (hub + optional spoke inject via ACM kubeconfigs); prefer over standalone vp-ramen-s3-ca-injector; s3-ssl uses the full Proxy trustedCA ConfigMap, s3CaInjector uses the differential Bundle

scripts/ansible/s3-ca-injector.yml

@@ -3,7 +3,8 @@
 # Hub always; managed clusters when DISTRIBUTE_TO_MANAGED_CLUSTERS=true (default).
 # Skips ConfigMap apply when every profile already has the desired caCertificates.
 # On patch, inject-ramen-s3-ca.sh restarts Ramen operator pods so they reload Proxy trust.
-# Env: PRIMARY_CLUSTER, SECONDARY_CLUSTER, CA_BUNDLE_*, RAMEN_*, DISTRIBUTE_TO_MANAGED_CLUSTERS,
+# Env: PRIMARY_CLUSTER, SECONDARY_CLUSTER, CA_BUNDLE_*, RAMEN_NAMESPACE (hub),
+#      RAMEN_MANAGED_NAMESPACE (spokes), RAMEN_*_CONFIGMAP, DISTRIBUTE_TO_MANAGED_CLUSTERS,
 #      ALLOW_MISSING_PROFILES, CA_WAIT_SECONDS, RAMEN_WAIT_SECONDS, POLL_INTERVAL, MIN_PROFILES
 - name: S3 CA inject into Ramen s3StoreProfiles
   hosts: localhost
@@ -16,6 +17,7 @@
     ca_bundle_namespace: "{{ lookup('env', 'CA_BUNDLE_NAMESPACE') | default('openshift-config', true) }}"
     ca_bundle_key: "{{ lookup('env', 'CA_BUNDLE_KEY') | default('cabundle', true) }}"
     ramen_namespace: "{{ lookup('env', 'RAMEN_NAMESPACE') | default('openshift-operators', true) }}"
+    ramen_managed_namespace: "{{ lookup('env', 'RAMEN_MANAGED_NAMESPACE') | default('openshift-dr-system', true) }}"
     ramen_hub_configmap: "{{ lookup('env', 'RAMEN_HUB_CONFIGMAP') | default('ramen-hub-operator-config', true) }}"
     ramen_managed_configmap: "{{ lookup('env', 'RAMEN_MANAGED_CONFIGMAP') | default('ramen-dr-cluster-operator-config', true) }}"
     ramen_config_key: "{{ lookup('env', 'RAMEN_CONFIG_KEY') | default('ramen_manager_config.yaml', true) }}"
@@ -39,7 +41,7 @@
           - "s3-ca-injector starting (source=vp-manage-proxy-cluster-ca)"
           - "ca_bundle={{ ca_bundle_namespace }}/{{ ca_bundle_name }} key={{ ca_bundle_key }}"
           - "hub_cm={{ ramen_namespace }}/{{ ramen_hub_configmap }}"
-          - "managed_cm={{ ramen_namespace }}/{{ ramen_managed_configmap }}"
+          - "managed_cm={{ ramen_managed_namespace }}/{{ ramen_managed_configmap }}"
           - "distribute_to_managed={{ distribute_to_managed }}"
           - "primary={{ primary_cluster }} secondary={{ secondary_cluster }}"
 
@@ -137,7 +139,7 @@
         export CA_NAMESPACE="{{ ca_bundle_namespace }}"
         export CA_CONFIGMAP="{{ ca_bundle_name }}"
         export CA_KEY="{{ ca_bundle_key }}"
-        export RAMEN_NAMESPACE="{{ ramen_namespace }}"
+        export RAMEN_NAMESPACE="{{ ramen_managed_namespace }}"
         export RAMEN_CONFIGMAP="{{ ramen_managed_configmap }}"
         export RAMEN_CONFIG_KEY="{{ ramen_config_key }}"
         export MIN_PROFILES="{{ min_profiles }}"
@@ -148,18 +150,18 @@
         export WORK_DIR="{{ work_dir }}/{{ item }}"
         export KUBECONFIG="{{ work_dir }}/{{ item }}-kubeconfig.yaml"
         mkdir -p "$WORK_DIR"
-        echo "=== s3-ca-injector: {{ item }} ({{ ramen_managed_configmap }}) ==="
+        echo "=== s3-ca-injector: {{ item }} ({{ ramen_managed_namespace }}/{{ ramen_managed_configmap }}) ==="
         /bin/bash "{{ inject_script }}"
       args:
         executable: /bin/bash
       loop: "{{ managed_clusters }}"
       loop_control:
         label: "{{ item }}"
       register: spoke_inject
-      changed_when: "'Patched caCertificates' in item.stdout"
+      changed_when: "'Patched caCertificates' in spoke_inject.stdout"
       when: distribute_to_managed | bool
 
-    - name: s3-ca-injector complete
+    - name: S3 CA injector complete
       ansible.builtin.debug:
         msg: >-
           Hub Ramen profiles checked/patched from vp-proxy differential CA

templates/_helpers.tpl

@@ -135,6 +135,12 @@ checksum/opp-policy-ansible: {{ include "opp.ansibleConfigChecksum" . | quote }}
 {{- $r.namespace | default "openshift-operators" -}}
 {{- end -}}
 
+{{- define "opp.ramenManagedNamespace" -}}
+{{- $inj := .Values.s3CaInjector | default dict -}}
+{{- $r := $inj.ramen | default dict -}}
+{{- $r.managedNamespace | default "openshift-dr-system" -}}
+{{- end -}}
+
 {{- define "opp.ramenHubConfigMapName" -}}
 {{- $inj := .Values.s3CaInjector | default dict -}}
 {{- $r := $inj.ramen | default dict -}}

templates/_s3_ca_injector.tpl

@@ -13,6 +13,8 @@
   value: {{ include "opp.s3CaInjectorCaBundleKey" . | quote }}
 - name: RAMEN_NAMESPACE
   value: {{ include "opp.ramenNamespace" . | quote }}
+- name: RAMEN_MANAGED_NAMESPACE
+  value: {{ include "opp.ramenManagedNamespace" . | quote }}
 - name: RAMEN_HUB_CONFIGMAP
   value: {{ include "opp.ramenHubConfigMapName" . | quote }}
 - name: RAMEN_MANAGED_CONFIGMAP

values.yaml

@@ -72,8 +72,10 @@ s3CaInjector:
     # -- Data key holding PEM (differentialBundle.targetKey; must not contain '.').
     key: cabundle
   ramen:
-    # -- Namespace of hub and managed Ramen operator ConfigMaps.
+    # -- Namespace of the hub Ramen operator ConfigMap.
     namespace: openshift-operators
+    # -- Namespace of managed-cluster Ramen operator ConfigMaps (dr-cluster operator).
+    managedNamespace: openshift-dr-system
     # -- Hub Ramen ConfigMap name.
     hubConfigMapName: ramen-hub-operator-config
     # -- Managed-cluster Ramen ConfigMap name.