Merge pull request #2477 from SanjalKatiyar/fix_key_rotation

allow disabling key rotation
red-hat-storage · Feb 22, 2024 · 5c83893 · 5c83893
2 parents f8a0c2c + 5626e03
commit 5c83893
Show file tree

Hide file tree

Showing 9 changed files with 32 additions and 22 deletions.
diff --git a/api/v1/storagecluster_types.go b/api/v1/storagecluster_types.go
@@ -459,8 +459,7 @@ type EncryptionSpec struct {
 type KeyRotationSpec struct {
 	// Enable represents whether the key rotation is enabled.
 	// +optional
-	// +kubebuilder:default=false
-	Enable bool `json:"enable,omitempty"`
+	Enable *bool `json:"enable,omitempty"`
 	// Schedule represents the cron schedule for key rotation.
 	// +optional
 	// +kubebuilder:default="@weekly"

diff --git a/api/v1/zz_generated.deepcopy.go b/api/v1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/ocs.openshift.io_storageclusters.yaml b/config/crd/bases/ocs.openshift.io_storageclusters.yaml
@@ -546,7 +546,6 @@ spec:
                     description: KeyRotation defines options for Key Rotation.
                     properties:
                       enable:
-                        default: false
                         description: Enable represents whether the key rotation is
                           enabled.
                         type: boolean

diff --git a/controllers/storagecluster/cephcluster.go b/controllers/storagecluster/cephcluster.go
@@ -202,10 +202,6 @@ func (obj *ocsCephCluster) ensureCreated(r *StorageClusterReconciler, sc *ocsv1.
 				return reconcile.Result{}, err
 			}
 		}
-
-		isEnabled, rotationSchedule := util.GetKeyRotationSpec(sc)
-		cephCluster.Spec.Security.KeyRotation.Enabled = isEnabled
-		cephCluster.Spec.Security.KeyRotation.Schedule = rotationSchedule
 	}
 
 	// Set StorageCluster instance as the owner and controller
@@ -558,6 +554,11 @@ func newCephCluster(sc *ocsv1.StorageCluster, cephImage string, serverVersion *v
 		}
 		cephCluster.Spec.Security.KeyManagementService.ConnectionDetails = kmsConfigMap.Data
 	}
+
+	isEnabled, rotationSchedule := util.GetKeyRotationSpec(sc)
+	cephCluster.Spec.Security.KeyRotation.Enabled = isEnabled
+	cephCluster.Spec.Security.KeyRotation.Schedule = rotationSchedule
+
 	return cephCluster, nil
 }
 

diff --git a/controllers/util/util.go b/controllers/util/util.go
@@ -29,13 +29,17 @@ func DetectDuplicateInStringSlice(slice []string) bool {
 
 func GetKeyRotationSpec(sc *ocsv1.StorageCluster) (bool, string) {
 	schedule := sc.Spec.Encryption.KeyRotation.Schedule
-	if (sc.Spec.Encryption.Enable || sc.Spec.Encryption.ClusterWide) && !sc.Spec.Encryption.KeyManagementService.Enable {
-		if schedule == "" {
-			// default schedule
-			schedule = "@weekly"
+	if schedule == "" {
+		// default schedule
+		schedule = "@weekly"
+	}
+
+	if sc.Spec.Encryption.KeyRotation.Enable == nil {
+		if (sc.Spec.Encryption.Enable || sc.Spec.Encryption.ClusterWide) && !sc.Spec.Encryption.KeyManagementService.Enable {
+			// use key-rotation by default if cluster-wide encryption is opted without KMS & "enable" spec is missing
+			return true, schedule
 		}
-		// use key-rotation by default if cluster-wide encryption is opted without KMS
-		return true, schedule
+		return false, schedule
 	}
-	return sc.Spec.Encryption.KeyRotation.Enable, schedule
+	return *sc.Spec.Encryption.KeyRotation.Enable, schedule
 }
diff --git a/deploy/csv-templates/crds/ocs/ocs.openshift.io_storageclusters.yaml b/deploy/csv-templates/crds/ocs/ocs.openshift.io_storageclusters.yaml
@@ -546,7 +546,6 @@ spec:
                     description: KeyRotation defines options for Key Rotation.
                     properties:
                       enable:
-                        default: false
                         description: Enable represents whether the key rotation is
                           enabled.
                         type: boolean

diff --git a/deploy/ocs-operator/manifests/storagecluster.crd.yaml b/deploy/ocs-operator/manifests/storagecluster.crd.yaml
@@ -545,7 +545,6 @@ spec:
                     description: KeyRotation defines options for Key Rotation.
                     properties:
                       enable:
-                        default: false
                         description: Enable represents whether the key rotation is
                           enabled.
                         type: boolean

diff --git a/vendor/github.com/red-hat-storage/ocs-operator/api/v4/v1/storagecluster_types.go b/vendor/github.com/red-hat-storage/ocs-operator/api/v4/v1/storagecluster_types.go
diff --git a/vendor/github.com/red-hat-storage/ocs-operator/api/v4/v1/zz_generated.deepcopy.go b/vendor/github.com/red-hat-storage/ocs-operator/api/v4/v1/zz_generated.deepcopy.go