Skip to content

Commit f1ce7b6

Browse files
pooknullpooknull
committed
Merge remote-tracking branch 'origin/main' into K8SPXC-1214
2 parents 9860c4b + cbdd7ae commit f1ce7b6

File tree

12 files changed

+332
-36
lines changed

12 files changed

+332
-36
lines changed

‎config/crd/bases/pxc.percona.com_perconaxtradbclusters.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4417,6 +4417,29 @@ spec:
44174417
runtimeClassName:
44184418
type: string
44194419
type: object
4420+
passwordGenerationOptions:
4421+
properties:
4422+
maxLength:
4423+
default: 20
4424+
maximum: 32
4425+
minimum: 8
4426+
type: integer
4427+
minLength:
4428+
default: 16
4429+
maximum: 32
4430+
minimum: 8
4431+
type: integer
4432+
symbols:
4433+
default: '!#$%&()*+,-.<=>?@[]^_{}~'
4434+
maxLength: 32
4435+
type: string
4436+
required:
4437+
- maxLength
4438+
- minLength
4439+
- symbols
4440+
type: object
4441+
x-kubernetes-validations:
4442+
- rule: self.maxLength > self.minLength
44204443
pause:
44214444
type: boolean
44224445
platform:

‎deploy/backup/restore.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,9 @@ spec:
3333
# credentialsSecret: my-cluster-name-backup-s3
3434
# endpointUrl: https://s3.us-west-2.amazonaws.com/
3535
# region: us-west-2
36+
# caBundle:
37+
# name: minio-ca-bundle
38+
# key: tls.crt
3639
# azure:
3740
# container: <your-container-name>
3841
# credentialsSecret: my-cluster-name-backup-azure
@@ -48,3 +51,6 @@ spec:
4851
# credentialsSecret: my-cluster-name-backup-s3
4952
# endpointUrl: https://s3.us-west-2.amazonaws.com/
5053
# region: us-west-2
54+
# caBundle:
55+
# name: minio-ca-bundle
56+
# key: tls.crt

‎deploy/bundle.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5457,6 +5457,29 @@ spec:
54575457
runtimeClassName:
54585458
type: string
54595459
type: object
5460+
passwordGenerationOptions:
5461+
properties:
5462+
maxLength:
5463+
default: 20
5464+
maximum: 32
5465+
minimum: 8
5466+
type: integer
5467+
minLength:
5468+
default: 16
5469+
maximum: 32
5470+
minimum: 8
5471+
type: integer
5472+
symbols:
5473+
default: '!#$%&()*+,-.<=>?@[]^_{}~'
5474+
maxLength: 32
5475+
type: string
5476+
required:
5477+
- maxLength
5478+
- minLength
5479+
- symbols
5480+
type: object
5481+
x-kubernetes-validations:
5482+
- rule: self.maxLength > self.minLength
54605483
pause:
54615484
type: boolean
54625485
platform:

‎deploy/cr.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -761,3 +761,7 @@ spec:
761761
count: 5
762762
deleteFromStorage: true
763763
storageName: fs-pvc
764+
# passwordGenerationOptions:
765+
# symbols: "!#$%&()*+,-.<=>?@[]^_{}~"
766+
# maxLength: 20
767+
# minLength: 16

‎deploy/crd.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5457,6 +5457,29 @@ spec:
54575457
runtimeClassName:
54585458
type: string
54595459
type: object
5460+
passwordGenerationOptions:
5461+
properties:
5462+
maxLength:
5463+
default: 20
5464+
maximum: 32
5465+
minimum: 8
5466+
type: integer
5467+
minLength:
5468+
default: 16
5469+
maximum: 32
5470+
minimum: 8
5471+
type: integer
5472+
symbols:
5473+
default: '!#$%&()*+,-.<=>?@[]^_{}~'
5474+
maxLength: 32
5475+
type: string
5476+
required:
5477+
- maxLength
5478+
- minLength
5479+
- symbols
5480+
type: object
5481+
x-kubernetes-validations:
5482+
- rule: self.maxLength > self.minLength
54605483
pause:
54615484
type: boolean
54625485
platform:

‎deploy/cw-bundle.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5457,6 +5457,29 @@ spec:
54575457
runtimeClassName:
54585458
type: string
54595459
type: object
5460+
passwordGenerationOptions:
5461+
properties:
5462+
maxLength:
5463+
default: 20
5464+
maximum: 32
5465+
minimum: 8
5466+
type: integer
5467+
minLength:
5468+
default: 16
5469+
maximum: 32
5470+
minimum: 8
5471+
type: integer
5472+
symbols:
5473+
default: '!#$%&()*+,-.<=>?@[]^_{}~'
5474+
maxLength: 32
5475+
type: string
5476+
required:
5477+
- maxLength
5478+
- minLength
5479+
- symbols
5480+
type: object
5481+
x-kubernetes-validations:
5482+
- rule: self.maxLength > self.minLength
54605483
pause:
54615484
type: boolean
54625485
platform:

‎pkg/apis/pxc/v1/pxc_types.go‎

Lines changed: 53 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -30,26 +30,27 @@ import (
3030

3131
// PerconaXtraDBClusterSpec defines the desired state of PerconaXtraDBCluster
3232
type PerconaXtraDBClusterSpec struct {
33-
Platform version.Platform `json:"platform,omitempty"`
34-
CRVersion string `json:"crVersion,omitempty"`
35-
Pause bool `json:"pause,omitempty"`
36-
SecretsName string `json:"secretsName,omitempty"`
37-
VaultSecretName string `json:"vaultSecretName,omitempty"`
38-
SSLSecretName string `json:"sslSecretName,omitempty"`
39-
SSLInternalSecretName string `json:"sslInternalSecretName,omitempty"`
40-
LogCollectorSecretName string `json:"logCollectorSecretName,omitempty"`
41-
TLS *TLSSpec `json:"tls,omitempty"`
42-
PXC *PXCSpec `json:"pxc,omitempty"`
43-
ProxySQL *ProxySQLSpec `json:"proxysql,omitempty"`
44-
HAProxy *HAProxySpec `json:"haproxy,omitempty"`
45-
PMM *PMMSpec `json:"pmm,omitempty"`
46-
LogCollector *LogCollectorSpec `json:"logcollector,omitempty"`
47-
Backup *BackupSpec `json:"backup,omitempty"`
48-
UpdateStrategy appsv1.StatefulSetUpdateStrategyType `json:"updateStrategy,omitempty"`
49-
UpgradeOptions UpgradeOptions `json:"upgradeOptions,omitempty"`
50-
AllowUnsafeConfig bool `json:"allowUnsafeConfigurations,omitempty"`
51-
Unsafe UnsafeFlags `json:"unsafeFlags,omitempty"`
52-
VolumeExpansionEnabled bool `json:"enableVolumeExpansion,omitempty"`
33+
Platform version.Platform `json:"platform,omitempty"`
34+
CRVersion string `json:"crVersion,omitempty"`
35+
Pause bool `json:"pause,omitempty"`
36+
SecretsName string `json:"secretsName,omitempty"`
37+
PasswordGenerationOptions *PasswordGenerationOptions `json:"passwordGenerationOptions,omitempty"`
38+
VaultSecretName string `json:"vaultSecretName,omitempty"`
39+
SSLSecretName string `json:"sslSecretName,omitempty"`
40+
SSLInternalSecretName string `json:"sslInternalSecretName,omitempty"`
41+
LogCollectorSecretName string `json:"logCollectorSecretName,omitempty"`
42+
TLS *TLSSpec `json:"tls,omitempty"`
43+
PXC *PXCSpec `json:"pxc,omitempty"`
44+
ProxySQL *ProxySQLSpec `json:"proxysql,omitempty"`
45+
HAProxy *HAProxySpec `json:"haproxy,omitempty"`
46+
PMM *PMMSpec `json:"pmm,omitempty"`
47+
LogCollector *LogCollectorSpec `json:"logcollector,omitempty"`
48+
Backup *BackupSpec `json:"backup,omitempty"`
49+
UpdateStrategy appsv1.StatefulSetUpdateStrategyType `json:"updateStrategy,omitempty"`
50+
UpgradeOptions UpgradeOptions `json:"upgradeOptions,omitempty"`
51+
AllowUnsafeConfig bool `json:"allowUnsafeConfigurations,omitempty"`
52+
Unsafe UnsafeFlags `json:"unsafeFlags,omitempty"`
53+
VolumeExpansionEnabled bool `json:"enableVolumeExpansion,omitempty"`
5354

5455
// Deprecated, should be removed in the future. Use InitContainer.Image instead
5556
InitImage string `json:"initImage,omitempty"`
@@ -62,6 +63,37 @@ type PerconaXtraDBClusterSpec struct {
6263
Users []User `json:"users,omitempty"`
6364
}
6465

66+
// +kubebuilder:validation:XValidation:rule="self.maxLength > self.minLength"
67+
type PasswordGenerationOptions struct {
68+
// Special symbols to include in password generation
69+
// +kubebuilder:validation:Required
70+
// +kubebuilder:validation:MaxLength=32
71+
// +kubebuilder:default="!#$%&()*+,-.<=>?@[]^_{}~"
72+
Symbols string `json:"symbols"`
73+
// Max password length
74+
// +kubebuilder:validation:Required
75+
// +kubebuilder:validation:Maximum=32
76+
// +kubebuilder:validation:Minimum=8
77+
// +kubebuilder:default=20
78+
MaxLength int `json:"maxLength"`
79+
// Min password length
80+
// +kubebuilder:validation:Required
81+
// +kubebuilder:validation:Maximum=32
82+
// +kubebuilder:validation:Minimum=8
83+
// +kubebuilder:default=16
84+
MinLength int `json:"minLength"`
85+
}
86+
87+
func (cr *PerconaXtraDBCluster) setPasswordGenerationOptionsDefaults() {
88+
if cr.Spec.PasswordGenerationOptions == nil {
89+
cr.Spec.PasswordGenerationOptions = &PasswordGenerationOptions{
90+
Symbols: "!#$%&()*+,-.<=>?@[]^_{}~",
91+
MaxLength: 20,
92+
MinLength: 16,
93+
}
94+
}
95+
}
96+
6597
type SecretKeySelector struct {
6698
Name string `json:"name"`
6799
Key string `json:"key,omitempty"`
@@ -1194,6 +1226,7 @@ func (cr *PerconaXtraDBCluster) CheckNSetDefaults(serverVersion *version.ServerV
11941226

11951227
cr.setProbesDefaults()
11961228
cr.setPodSecurityContext()
1229+
cr.setPasswordGenerationOptionsDefaults()
11971230

11981231
if cr.Spec.EnableCRValidationWebhook == nil {
11991232
falseVal := false

‎pkg/apis/pxc/v1/zz_generated.deepcopy.go‎

Lines changed: 20 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/controller/pxc/secrets.go‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ func (r *ReconcilePerconaXtraDBCluster) reconcileUsersSecret(ctx context.Context
3939
if err := validatePasswords(secretObj); err != nil {
4040
return nil, errors.Wrap(err, "validate passwords")
4141
}
42-
isChanged, err := setUserSecretDefaults(secretObj)
42+
isChanged, err := setUserSecretDefaults(secretObj, cr.Spec.PasswordGenerationOptions)
4343
if err != nil {
4444
return nil, errors.Wrap(err, "set user secret defaults")
4545
}
@@ -64,7 +64,7 @@ func (r *ReconcilePerconaXtraDBCluster) reconcileUsersSecret(ctx context.Context
6464
Type: corev1.SecretTypeOpaque,
6565
}
6666

67-
if _, err = setUserSecretDefaults(secretObj); err != nil {
67+
if _, err = setUserSecretDefaults(secretObj, cr.Spec.PasswordGenerationOptions); err != nil {
6868
return nil, errors.Wrap(err, "set user secret defaults")
6969
}
7070

@@ -77,14 +77,14 @@ func (r *ReconcilePerconaXtraDBCluster) reconcileUsersSecret(ctx context.Context
7777
return secretObj, nil
7878
}
7979

80-
func setUserSecretDefaults(secret *corev1.Secret) (isChanged bool, err error) {
80+
func setUserSecretDefaults(secret *corev1.Secret, secretsOptions *api.PasswordGenerationOptions) (isChanged bool, err error) {
8181
if secret.Data == nil {
8282
secret.Data = make(map[string][]byte)
8383
}
8484
users := []string{users.Root, users.Xtrabackup, users.Monitor, users.ProxyAdmin, users.Operator, users.Replication}
8585
for _, user := range users {
8686
if pass, ok := secret.Data[user]; !ok || len(pass) == 0 {
87-
secret.Data[user], err = generatePass()
87+
secret.Data[user], err = generatePass(secretsOptions)
8888
if err != nil {
8989
return false, errors.Wrapf(err, "create %s users password", user)
9090
}
@@ -96,20 +96,18 @@ func setUserSecretDefaults(secret *corev1.Secret) (isChanged bool, err error) {
9696
}
9797

9898
const (
99-
passwordMaxLen = 20
100-
passwordMinLen = 16
101-
passSymbols = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" +
99+
passBaseSymbols = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" +
102100
"abcdefghijklmnopqrstuvwxyz" +
103-
"0123456789" +
104-
"!#$%&()*+,-.<=>?@[]^_{}~"
101+
"0123456789"
105102
)
106103

107-
// generatePass generates a random password
108-
func generatePass() ([]byte, error) {
104+
// generatePass generates a random password with or without special symbols
105+
func generatePass(secretsOptions *api.PasswordGenerationOptions) ([]byte, error) {
109106
mrand.Seed(time.Now().UnixNano())
110-
ln := mrand.Intn(passwordMaxLen-passwordMinLen) + passwordMinLen
107+
ln := mrand.Intn(secretsOptions.MaxLength-secretsOptions.MinLength) + secretsOptions.MinLength
111108
b := make([]byte, ln)
112109
for i := 0; i < ln; i++ {
110+
passSymbols := passBaseSymbols + secretsOptions.Symbols
113111
randInt, err := rand.Int(rand.Reader, big.NewInt(int64(len(passSymbols))))
114112
if err != nil {
115113
return nil, errors.Wrap(err, "get rand int")

0 commit comments

Comments
 (0)