Skip to content

Commit d45dc52

Browse files
author
abhisbyk
committed
Disabling the cert renewal logic if tcpsCertRenewInterval is not given in the yaml file, default 2 years
Signed-off-by: abhisbyk <abhishek.by.kumar@oracle.com>
1 parent 04765b2 commit d45dc52

File tree

6 files changed

+97
-34
lines changed

6 files changed

+97
-34
lines changed

‎apis/database/v1alpha1/singleinstancedatabase_types.go‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -57,17 +57,17 @@ type SingleInstanceDatabaseSpec struct {
5757
// +k8s:openapi-gen=true
5858
// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]+$`
5959
// +kubebuilder:validation:MaxLength:=12
60-
Sid string `json:"sid,omitempty"`
61-
Charset string `json:"charset,omitempty"`
62-
Pdbname string `json:"pdbName,omitempty"`
63-
LoadBalancer bool `json:"loadBalancer,omitempty"`
64-
ServicePort int `json:"servicePort,omitempty"`
65-
ServiceAnnotations map[string]string `json:"serviceAnnotations,omitempty"`
66-
FlashBack bool `json:"flashBack,omitempty"`
67-
ArchiveLog bool `json:"archiveLog,omitempty"`
68-
ForceLogging bool `json:"forceLog,omitempty"`
69-
EnableTCPS bool `json:"enableTCPS,omitempty"`
70-
CertRenewDuration string `json:"certRenewDuration,omitempty"`
60+
Sid string `json:"sid,omitempty"`
61+
Charset string `json:"charset,omitempty"`
62+
Pdbname string `json:"pdbName,omitempty"`
63+
LoadBalancer bool `json:"loadBalancer,omitempty"`
64+
ServicePort int `json:"servicePort,omitempty"`
65+
ServiceAnnotations map[string]string `json:"serviceAnnotations,omitempty"`
66+
FlashBack bool `json:"flashBack,omitempty"`
67+
ArchiveLog bool `json:"archiveLog,omitempty"`
68+
ForceLogging bool `json:"forceLog,omitempty"`
69+
EnableTCPS bool `json:"enableTCPS,omitempty"`
70+
TcpsCertRenewInterval string `json:"tcpsCertRenewInterval,omitempty"`
7171

7272
CloneFrom string `json:"cloneFrom,omitempty"`
7373
ReadinessCheckPeriod int `json:"readinessCheckPeriod,omitempty"`

‎apis/database/v1alpha1/singleinstancedatabase_webhook.go‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -246,25 +246,21 @@ func (r *SingleInstanceDatabase) ValidateCreate() error {
246246
}
247247

248248
// Certificate Renew Duration Validation
249-
if r.Spec.CertRenewDuration != "" {
250-
duration, err := time.ParseDuration(r.Spec.CertRenewDuration)
249+
if r.Spec.TcpsCertRenewInterval != "" {
250+
duration, err := time.ParseDuration(r.Spec.TcpsCertRenewInterval)
251251
if err != nil {
252252
allErrs = append(allErrs,
253-
field.Invalid(field.NewPath("spec").Child("certRenewDuration"), r.Spec.CertRenewDuration,
254-
"Please provide valid string to parse the certRenewDuration."))
253+
field.Invalid(field.NewPath("spec").Child("tcpsCertRenewInterval"), r.Spec.TcpsCertRenewInterval,
254+
"Please provide valid string to parse the tcpsCertRenewInterval."))
255255
}
256256
maxLimit, _ := time.ParseDuration("26280h")
257257
minLimit, _ := time.ParseDuration("1m")
258258
if duration > maxLimit || duration < minLimit {
259259
allErrs = append(allErrs,
260-
field.Invalid(field.NewPath("spec").Child("certRenewDuration"), r.Spec.CertRenewDuration,
261-
"Please specify certRenewDuration in the range: 1m to 26280h"))
260+
field.Invalid(field.NewPath("spec").Child("tcpsCertRenewInterval"), r.Spec.TcpsCertRenewInterval,
261+
"Please specify tcpsCertRenewInterval in the range: 1m to 26280h"))
262262
}
263-
} else {
264-
// Setting the default value
265-
r.Spec.CertRenewDuration = "26280h"
266263
}
267-
268264
if len(allErrs) == 0 {
269265
return nil
270266
}

‎config/samples/sidb/singleinstancedatabase.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,9 +47,9 @@ spec:
4747
## Enable TCPS
4848
enableTCPS: false
4949

50-
## Certificate Renewal Duration: The time after which certificates will be renewed if TCPS connections are enabled; can be in hours(h), minutes(m) and seconds(s)
51-
## Maximum value is 26280h (3 years), Minimum value is 1m
52-
#certRenewDuration: 26280h
50+
## TCPS Certificate Renewal Interval: The time after which TCPS certificate will be renewed if TCPS connections are enabled; can be in hours(h), minutes(m) and seconds(s)
51+
## Maximum value is 26280h (3 years), Minimum value is 1m; Default value is 17520h (2 years)
52+
certRenewDuration: 17520h
5353

5454
## NA if cloning from a SourceDB (cloneFrom is set)
5555
## Specify both sgaSize and pgaSize (in MB) or dont specify both

‎config/samples/sidb/singleinstancedatabase_tcps.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#
2+
# Copyright (c) 2022, Oracle and/or its affiliates.
3+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
4+
#
5+
6+
apiVersion: v1
7+
kind: Secret
8+
metadata:
9+
name: db-admin-secret
10+
namespace: default
11+
type: Opaque
12+
stringData:
13+
# Specify your DB password here
14+
oracle_pwd:
15+
16+
---
17+
18+
apiVersion: database.oracle.com/v1alpha1
19+
kind: SingleInstanceDatabase
20+
metadata:
21+
# Creates base sidb-sample. Use singleinstancedatabase_clone.yaml for cloning
22+
# and singleinstancedatabase_patch.yaml for patching
23+
name: sidb-sample
24+
namespace: default
25+
spec:
26+
27+
## Use only alphanumeric characters for sid
28+
sid: ORCL1
29+
30+
## DB edition.
31+
edition: enterprise
32+
33+
## Secret containing SIDB password mapped to secretKey
34+
adminPassword:
35+
secretName: db-admin-secret
36+
37+
## DB character set
38+
charset: AL32UTF8
39+
40+
## PDB name
41+
pdbName: orclpdb1
42+
43+
## Enable/Disable ArchiveLog. Should be true to allow DB cloning
44+
archiveLog: true
45+
46+
## Enable TCPS
47+
enableTCPS: true
48+
49+
## TCPS Certificate Renewal Interval: The time after which TCPS certificate will be renewed if TCPS connections are enabled; can be in hours(h), minutes(m) and seconds(s)
50+
## Maximum value is 26280h (3 years), Minimum value is 1m; Default value is 17520h (2 years)
51+
certRenewDuration: 17520h
52+
53+
## Database image details
54+
image:
55+
pullFrom: container-registry.oracle.com/database/enterprise:latest
56+
pullSecrets: oracle-container-registry-secret
57+
58+
## size is the required minimum size of the persistent volume
59+
## storageClass is specified for automatic volume provisioning
60+
## accessMode can only accept one of ReadWriteOnce, ReadWriteMany
61+
persistence:
62+
size: 100Gi
63+
## oci-bv applies to OCI block volumes. Use "standard" storageClass for dynamic provisioning in Minikube. Update as appropriate for other cloud service providers
64+
storageClass: "oci-bv"
65+
accessMode: "ReadWriteOnce"
66+
67+
## Count of Database Pods.
68+
replicas: 1

‎controllers/database/singleinstancedatabase_controller.go‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1841,7 +1841,7 @@ func (r *SingleInstanceDatabaseReconciler) configTcps(m *dbapi.SingleInstanceDat
18411841
eventMsg = "TCPS Enabled."
18421842
r.Recorder.Eventf(m, corev1.EventTypeNormal, eventReason, eventMsg)
18431843

1844-
requeueDuration, _ := time.ParseDuration(m.Spec.CertRenewDuration)
1844+
requeueDuration, _ := time.ParseDuration(m.Spec.TcpsCertRenewInterval)
18451845
requeueDuration += func() time.Duration { requeueDuration, _ := time.ParseDuration("1s"); return requeueDuration }()
18461846
futureRequeue = ctrl.Result{Requeue: true, RequeueAfter: requeueDuration}
18471847

@@ -1874,12 +1874,11 @@ func (r *SingleInstanceDatabaseReconciler) configTcps(m *dbapi.SingleInstanceDat
18741874
eventMsg = "TCPS Disabled."
18751875
r.Recorder.Eventf(m, corev1.EventTypeNormal, eventReason, eventMsg)
18761876

1877-
} else if m.Spec.EnableTCPS && m.Status.IsTcpsEnabled {
1877+
} else if m.Spec.EnableTCPS && m.Status.IsTcpsEnabled && m.Spec.TcpsCertRenewInterval != "" {
18781878
// Cert Renewal Logic
1879-
// Certificates are renewed when 10 days remain for certs expiry
18801879
certCreationTimestamp, _ := time.Parse(time.RFC3339, m.Status.CertCreationTimestamp)
18811880
duration := time.Since(certCreationTimestamp)
1882-
allowdDuration, _ := time.ParseDuration(m.Spec.CertRenewDuration)
1881+
allowdDuration, _ := time.ParseDuration(m.Spec.TcpsCertRenewInterval)
18831882
if duration > allowdDuration {
18841883
m.Status.Status = dbcommons.StatusUpdating
18851884
r.Status().Update(ctx, m)
@@ -1898,16 +1897,16 @@ func (r *SingleInstanceDatabaseReconciler) configTcps(m *dbapi.SingleInstanceDat
18981897
eventMsg := "TCPS Certificates Renewed at time %s,"
18991898
r.Recorder.Eventf(m, corev1.EventTypeNormal, eventReason, eventMsg, time.Now().Format(time.RFC3339))
19001899

1901-
requeueDuration, _ := time.ParseDuration(m.Spec.CertRenewDuration)
1900+
requeueDuration, _ := time.ParseDuration(m.Spec.TcpsCertRenewInterval)
19021901
requeueDuration += func() time.Duration { requeueDuration, _ := time.ParseDuration("1s"); return requeueDuration }()
19031902
futureRequeue = ctrl.Result{Requeue: true, RequeueAfter: requeueDuration}
19041903
}
1905-
if m.Status.CertRenewDuration != m.Spec.CertRenewDuration {
1906-
requeueDuration, _ := time.ParseDuration(m.Spec.CertRenewDuration)
1904+
if m.Status.CertRenewDuration != m.Spec.TcpsCertRenewInterval {
1905+
requeueDuration, _ := time.ParseDuration(m.Spec.TcpsCertRenewInterval)
19071906
requeueDuration += func() time.Duration { requeueDuration, _ := time.ParseDuration("1s"); return requeueDuration }()
19081907
futureRequeue = ctrl.Result{Requeue: true, RequeueAfter: requeueDuration}
19091908

1910-
m.Status.CertRenewDuration = m.Spec.CertRenewDuration
1909+
m.Status.CertRenewDuration = m.Spec.TcpsCertRenewInterval
19111910
}
19121911
// update clientWallet
19131912
err := r.updateClientWallet(m, readyPod, ctx, req)

‎docs/sidb/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -551,8 +551,8 @@ The following steps are required to connect the Database using TCPS:
551551
```
552552
**NOTE:**
553553
- Only database server authentication is supported (no mTLS).
554-
- When TCPS is enabled, a self-signed certificate is generated and stored inside the wallets. For users' convenience, a client-side wallet is generated and stored at `/opt/oracle/oradata/clientWallet/$ORACLE_SID` location.
555-
- The self-signed certificate used with TCPS has validity for 3 years. After the certificate is expired, it will be renewed by the `OraOperator` automatically. You need to download the wallet again after the auto-renewal.
554+
- When TCPS is enabled, a self-signed certificate is generated and stored inside the wallets. For users' convenience, a client-side wallet is generated and stored at `/opt/oracle/oradata/clientWallet/$ORACLE_SID` location in the pod.
555+
- The self-signed certificate used with TCPS has validity for 2 years. After the certificate is expired, it will be renewed by the `OraOperator` automatically. You need to download the wallet again after the auto-renewal.
556556
557557
### Specifying Custom Ports
558558
As mentioned in the section [Setup Database with LoadBalancer](#setup-database-with-loadbalancer), there are two kubernetes services possible for the database: NodePort and LoadBalancer. You can specify which port to use with these services by editing the `servicePort` field of the [config/samples/sidb/singleinstancedatabase.yaml](../../config/samples/sidb/singleinstancedatabase.yaml) file.

0 commit comments

Comments
 (0)