@@ -8,9 +8,11 @@ import (
88
99 "github.com/securesign/operator/internal/images"
1010
11+ rhtasv1alpha1 "github.com/securesign/operator/api/v1alpha1"
1112 "github.com/securesign/operator/internal/action"
1213 "github.com/securesign/operator/internal/constants"
1314 "github.com/securesign/operator/internal/controller/rekor/actions"
15+ tufConstants "github.com/securesign/operator/internal/controller/tuf/constants"
1416 "github.com/securesign/operator/internal/labels"
1517 cutils "github.com/securesign/operator/internal/utils"
1618 "github.com/securesign/operator/internal/utils/kubernetes"
@@ -20,12 +22,12 @@ import (
2022 "k8s.io/apimachinery/pkg/api/meta"
2123 "k8s.io/apimachinery/pkg/api/resource"
2224 metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
25+ "k8s.io/apimachinery/pkg/types"
2326 "sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
24-
25- rhtasv1alpha1 "github.com/securesign/operator/api/v1alpha1"
2627)
2728
2829const storageVolumeName = "monitor-storage"
30+ const tufRepoVolumeName = "tuf-repository"
2931
3032func NewStatefulSetAction () action.Action [* rhtasv1alpha1.Rekor ] {
3133 return & statefulSetAction {}
@@ -51,6 +53,7 @@ func (i statefulSetAction) Handle(ctx context.Context, instance *rhtasv1alpha1.R
5153 )
5254
5355 rekorServerHost := fmt .Sprintf ("http://%s.%s.svc" , actions .ServerComponentName , instance .Namespace )
56+ tufServerHost := fmt .Sprintf ("http://%s.%s.svc" , "tuf" , instance .Namespace )
5457
5558 labels := labels .For (actions .MonitorComponentName , actions .MonitorStatefulSetName , instance .Name )
5659 if result , err = kubernetes .CreateOrUpdate (ctx , i .Client ,
@@ -60,8 +63,8 @@ func (i statefulSetAction) Handle(ctx context.Context, instance *rhtasv1alpha1.R
6063 Namespace : instance .Namespace ,
6164 },
6265 },
63- i .ensureMonitorStatefulSet (instance , actions .RBACName , labels , rekorServerHost ),
64- i .ensureInitContainer (rekorServerHost ),
66+ i .ensureMonitorStatefulSet (ctx , instance , actions .RBACName , labels , rekorServerHost , tufServerHost ),
67+ i .ensureInitContainer (tufServerHost ),
6568 ensure .ControllerReference [* v1.StatefulSet ](instance , i .Client ),
6669 ensure .Labels [* v1.StatefulSet ](slices .Collect (maps .Keys (labels )), labels ),
6770 func (object * v1.StatefulSet ) error {
@@ -90,7 +93,7 @@ func (i statefulSetAction) Handle(ctx context.Context, instance *rhtasv1alpha1.R
9093 return i .Continue ()
9194}
9295
93- func (i statefulSetAction ) ensureMonitorStatefulSet (instance * rhtasv1alpha1.Rekor , sa string , labels map [string ]string , rekorServerHost string ) func (* v1.StatefulSet ) error {
96+ func (i statefulSetAction ) ensureMonitorStatefulSet (ctx context. Context , instance * rhtasv1alpha1.Rekor , sa string , labels map [string ]string , rekorServerHost string , tufServerHost string ) func (* v1.StatefulSet ) error {
9497 return func (ss * v1.StatefulSet ) error {
9598
9699 spec := & ss .Spec
@@ -110,7 +113,13 @@ func (i statefulSetAction) ensureMonitorStatefulSet(instance *rhtasv1alpha1.Reko
110113 container .Command = []string {
111114 "/bin/sh" ,
112115 "-c" ,
113- fmt .Sprintf (`/rekor_monitor --file=/data/checkpoint_log.txt --once=false --interval=%s --url=%s` , interval .String (), rekorServerHost ),
116+ fmt .Sprintf (`
117+ /rekor_monitor --file=/data/checkpoint_log.txt \
118+ --once=false \
119+ --interval=%s \
120+ --url=%s \
121+ --tuf-repository=%s \
122+ --tuf-root-path="/tuf-repository/root.json"` , interval .String (), rekorServerHost , tufServerHost ),
114123 }
115124
116125 container .Ports = []core.ContainerPort {
@@ -141,19 +150,44 @@ func (i statefulSetAction) ensureMonitorStatefulSet(instance *rhtasv1alpha1.Reko
141150 },
142151 },
143152 }
153+
154+ var cm core.ConfigMap
155+ if err := i .Client .Get (ctx , types.NamespacedName {
156+ Namespace : instance .Namespace ,
157+ Name : tufConstants .TufPvcConfigName ,
158+ }, & cm ); err != nil {
159+ i .Logger .Info ("TUF PVC ConfigMap not yet available, waiting..." , "name" , tufConstants .TufPvcConfigName )
160+ return i .Requeue ().Err
161+ }
162+ pvcName , ok := cm .Data ["pvcName" ]
163+ if ! ok || pvcName == "" {
164+ return fmt .Errorf ("PVC name not found in ConfigMap %q" , tufConstants .TufPvcConfigName )
165+ }
166+
167+ tufRepositoryVolume := kubernetes .FindVolumeByNameOrCreate (& template .Spec , tufRepoVolumeName )
168+ if tufRepositoryVolume .PersistentVolumeClaim == nil {
169+ tufRepositoryVolume .PersistentVolumeClaim = & core.PersistentVolumeClaimVolumeSource {}
170+ }
171+ tufRepositoryVolume .PersistentVolumeClaim .ClaimName = pvcName
172+ tufRepositoryVolume .PersistentVolumeClaim .ReadOnly = true
173+
174+ tufVolumeMount := kubernetes .FindVolumeMountByNameOrCreate (container , tufRepoVolumeName )
175+ tufVolumeMount .MountPath = "/tuf-repository"
176+ tufVolumeMount .ReadOnly = true
177+
144178 return nil
145179 }
146180}
147181
148- func (i statefulSetAction ) ensureInitContainer (rekorServerHost string ) func (* v1.StatefulSet ) error {
182+ func (i statefulSetAction ) ensureInitContainer (tufHost string ) func (* v1.StatefulSet ) error {
149183 return func (ss * v1.StatefulSet ) error {
150- initContainer := kubernetes .FindInitContainerByNameOrCreate (& ss .Spec .Template .Spec , "wait-for-rekor-server " )
184+ initContainer := kubernetes .FindInitContainerByNameOrCreate (& ss .Spec .Template .Spec , "wait-for-tuf " )
151185 initContainer .Image = images .Registry .Get (images .RekorMonitor )
152186
153187 initContainer .Command = []string {
154188 "/bin/sh" ,
155189 "-c" ,
156- fmt .Sprintf (`until curl -sf %s > /dev/null 2>&1; do echo 'Waiting for rekor-server to be ready...'; sleep 5; done` , rekorServerHost ),
190+ fmt .Sprintf (`until curl %s > /dev/null 2>&1; do echo 'Waiting for tuf to be ready...'; sleep 5; done` , tufHost ),
157191 }
158192
159193 return nil
0 commit comments