Updated mariadb to serve over tls - Githubissues

opendatahub-io / data-science-pipelines-operator

Apache License 2.0

13 stars 55 forks source link

Updated mariadb to serve over tls #696

Closed VaniHaripriya closed 2 months ago

VaniHaripriya commented 3 months ago

The issue resolved by this Pull Request:

Resolves #RHOAIENG-4972

Description of your changes:

Updated MariaDB config to server over TLS.
Added the oc annotation to generate the certs.
Added a config map with the ssl info.

Testing instructions

Deploy DSPO and the dspa using the below yaml file for two scenarios. After deployment, verify that the health checks are successful.
Create a pipeline run and ensure that it completes successfully.

Execute the following command inside the MariaDB pod terminal to verify that the TLS setup is correctly configured.

mysql -u $MYSQL_USER -p$MYSQL_PASSWORD -h 127.0.0.1 -D $MYSQL_DATABASE

MariaDB [mlpipeline]> SHOW GLOBAL VARIABLES LIKE 'have_ssl';
+---------------+-------+
| Variable_name | Value |
+---------------+-------+
| have_ssl      | YES   |
+---------------+-------+
1 row in set (0.001 sec)

TLS Enabled

Deploy the following DSPA

apiVersion: datasciencepipelinesapplications.opendatahub.io/v1alpha1
kind: DataSciencePipelinesApplication
metadata:
name: sample
spec:
podToPodTLS: true
dspVersion: v2
apiServer:
enableSamplePipeline: true
cABundle:
  configMapKey: ca.crt
  configMapName: kube-root-ca.crt
objectStorage:   
enableExternalRoute: true
minio:
  deploy: true
  image: 'quay.io/opendatahub/minio:RELEASE.2019-08-14T20-37-41Z-license-compliance'  
mlpipelineUI:
image: quay.io/opendatahub/ds-pipelines-frontend:latest

TLS Disabled

1. Deploy the following DSPA ``` apiVersion: datasciencepipelinesapplications.opendatahub.io/v1alpha1 kind: DataSciencePipelinesApplication metadata: name: sample spec: podToPodTLS: false dspVersion: v2 apiServer: enableSamplePipeline: true cABundle: configMapKey: ca.crt configMapName: kube-root-ca.crt objectStorage: enableExternalRoute: true minio: deploy: true image: 'quay.io/opendatahub/minio:RELEASE.2019-08-14T20-37-41Z-license-compliance' mlpipelineUI: image: quay.io/opendatahub/ds-pipelines-frontend:latest ```

Checklist

[x] The commits are squashed in a cohesive manner and have meaningful messages.
[x] Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
[x] The developer has manually tested the changes and verified that the changes work

dsp-developers commented 3 months ago

A new image has been built to help with testing out this PR: quay.io/opendatahub/data-science-pipelines-operator:pr-696 An OCP cluster where you are logged in as cluster admin is required.

To use this image run the following:

cd $(mktemp -d)
git clone git@github.com:opendatahub-io/data-science-pipelines-operator.git
cd data-science-pipelines-operator/
git fetch origin pull/696/head
git checkout -b pullrequest f3a81ee0eba65788cceed4f723428d6946594abf
oc new-project opendatahub
make deploy IMG="quay.io/opendatahub/data-science-pipelines-operator:pr-696"

More instructions here on how to deploy and test a Data Science Pipelines Application.

dsp-developers commented 3 months ago

Change to PR detected. A new PR build was completed. A new image has been built to help with testing out this PR: quay.io/opendatahub/data-science-pipelines-operator:pr-696

dsp-developers commented 3 months ago

Change to PR detected. A new PR build was completed. A new image has been built to help with testing out this PR: quay.io/opendatahub/data-science-pipelines-operator:pr-696

dsp-developers commented 3 months ago

Change to PR detected. A new PR build was completed. A new image has been built to help with testing out this PR: quay.io/opendatahub/data-science-pipelines-operator:pr-696

dsp-developers commented 3 months ago

Change to PR detected. A new PR build was completed. A new image has been built to help with testing out this PR: quay.io/opendatahub/data-science-pipelines-operator:pr-696

dsp-developers commented 3 months ago

Change to PR detected. A new PR build was completed. A new image has been built to help with testing out this PR: quay.io/opendatahub/data-science-pipelines-operator:pr-696

dsp-developers commented 3 months ago

Change to PR detected. A new PR build was completed. A new image has been built to help with testing out this PR: quay.io/opendatahub/data-science-pipelines-operator:pr-696

dsp-developers commented 3 months ago

Change to PR detected. A new PR build was completed. A new image has been built to help with testing out this PR: quay.io/opendatahub/data-science-pipelines-operator:pr-696

dsp-developers commented 3 months ago

Change to PR detected. A new PR build was completed. A new image has been built to help with testing out this PR: quay.io/opendatahub/data-science-pipelines-operator:pr-696

hbelmiro commented 3 months ago

/verified

anishasthana commented 2 months ago

/retest

gregsheremeta commented 2 months ago

some nitpicks, but /lgtm

gregsheremeta commented 2 months ago

/lgtm

nice work!

HumairAK commented 2 months ago

awesome thanks folks!

/approve

openshift-ci[bot] commented 2 months ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: HumairAK

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/opendatahub-io/data-science-pipelines-operator/blob/main/OWNERS)~~ [HumairAK] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment