OCPBUGS-115269: openstack-manila: Consume CA cert from CCO secret

assets/overlays/openstack-manila/generated/hypershift/controller.yaml

@@ -22,7 +22,7 @@
 # Applied strategic merge patch common/hypershift/controller_add_hypershift_desired_version_annotation.yaml
 # Applied strategic merge patch common/readOnlyRootFilesystem.yaml
 # Applied strategic merge patch overlays/openstack-manila/patches/controller_add_hypershift_volumes.yaml
-# Applied strategic merge patch overlays/openstack-manila/patches/controller_rename_config_map.yaml
+# Applied strategic merge patch overlays/openstack-manila/patches/controller_use_hypershift_config_map.yaml
 # Applied strategic merge patch overlays/openstack-manila/patches/modify_anti_affinity_selector.yaml
 #
 #
@@ -146,11 +146,11 @@ spec:
         volumeMounts:
         - mountPath: /plugin
           name: socket-dir
-        - mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
-          name: cacert
         - mountPath: /etc/openstack
           name: cloud-credentials
           readOnly: true
+        - mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
+          name: legacy-cacert
       - args:
         - --nodeid=$(NODE_ID)
         - --endpoint=unix://plugin/csi-nfs.sock
@@ -378,18 +378,26 @@ spec:
         secret:
           secretName: manila-csi-driver-controller-metrics-serving-cert
       - name: cloud-credentials
-        secret:
-          items:
-          - key: clouds.yaml
-            path: clouds.yaml
-          secretName: manila-cloud-credentials
+        projected:
+          sources:
+          - secret:
+              items:
+              - key: clouds.yaml
+                path: clouds.yaml
+              name: manila-cloud-credentials
+          - secret:
+              items:
+              - key: cacert
+                path: ca.crt
+              name: manila-cloud-credentials
+              optional: true
       - configMap:
           items:
           - key: ca-bundle.pem
             path: ca-bundle.pem
           name: openstack-cloud-config
           optional: true
-        name: cacert
+        name: legacy-cacert
       - name: hosted-kubeconfig
         secret:
           defaultMode: 420

assets/overlays/openstack-manila/generated/hypershift/node.yaml

@@ -82,19 +82,19 @@ spec:
           readOnlyRootFilesystem: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
-        - mountPath: /etc/openstack
-          name: cloud-credentials
-          readOnly: true
         - mountPath: /var/lib/kubelet/plugins/manila.csi.openstack.org
           name: plugin-dir
         - mountPath: /var/lib/kubelet/plugins/csi-nfsplugin
           name: fwd-plugin-dir
-        - mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
-          name: cacert
         - mountPath: /etc/selinux
           name: etc-selinux
         - mountPath: /sys/fs
           name: sys-fs
+        - mountPath: /etc/openstack
+          name: cloud-credentials
+          readOnly: true
+        - mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
+          name: legacy-cacert
       - args:
         - --csi-address=/csi/csi.sock
         - --http-endpoint=127.0.0.1:10305
@@ -214,12 +214,6 @@ spec:
       - name: metrics-serving-cert
         secret:
           secretName: manila-csi-driver-node-metrics-serving-cert
-      - name: cloud-credentials
-        secret:
-          items:
-          - key: clouds.yaml
-            path: clouds.yaml
-          secretName: manila-cloud-credentials
       - hostPath:
           path: /var/lib/kubelet/plugins/manila.csi.openstack.org
           type: DirectoryOrCreate
@@ -228,13 +222,27 @@ spec:
           path: /var/lib/kubelet/plugins/csi-nfsplugin
           type: DirectoryOrCreate
         name: fwd-plugin-dir
+      - name: cloud-credentials
+        projected:
+          sources:
+          - secret:
+              items:
+              - key: clouds.yaml
+                path: clouds.yaml
+              name: manila-cloud-credentials
+          - secret:
+              items:
+              - key: cacert
+                path: ca.crt
+              name: manila-cloud-credentials
+              optional: true
       - configMap:
           items:
           - key: ca-bundle.pem
             path: ca-bundle.pem
           name: cloud-provider-config
           optional: true
-        name: cacert
+        name: legacy-cacert
   updateStrategy:
     rollingUpdate:
       maxUnavailable: 10%

assets/overlays/openstack-manila/generated/standalone/controller.yaml

@@ -110,11 +110,11 @@ spec:
         volumeMounts:
         - mountPath: /plugin
           name: socket-dir
-        - mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
-          name: cacert
         - mountPath: /etc/openstack
           name: cloud-credentials
           readOnly: true
+        - mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
+          name: legacy-cacert
       - args:
         - --nodeid=$(NODE_ID)
         - --endpoint=unix://plugin/csi-nfs.sock
@@ -321,15 +321,23 @@ spec:
         secret:
           secretName: manila-csi-driver-controller-metrics-serving-cert
       - name: cloud-credentials
-        secret:
-          items:
-          - key: clouds.yaml
-            path: clouds.yaml
-          secretName: manila-cloud-credentials
+        projected:
+          sources:
+          - secret:
+              items:
+              - key: clouds.yaml
+                path: clouds.yaml
+              name: manila-cloud-credentials
+          - secret:
+              items:
+              - key: cacert
+                path: ca.crt
+              name: manila-cloud-credentials
+              optional: true
       - configMap:
           items:
           - key: ca-bundle.pem
             path: ca-bundle.pem
           name: cloud-provider-config
           optional: true
-        name: cacert
+        name: legacy-cacert

assets/overlays/openstack-manila/generated/standalone/node.yaml

@@ -82,19 +82,19 @@ spec:
           readOnlyRootFilesystem: true
         terminationMessagePolicy: FallbackToLogsOnError
         volumeMounts:
-        - mountPath: /etc/openstack
-          name: cloud-credentials
-          readOnly: true
         - mountPath: /var/lib/kubelet/plugins/manila.csi.openstack.org
           name: plugin-dir
         - mountPath: /var/lib/kubelet/plugins/csi-nfsplugin
           name: fwd-plugin-dir
-        - mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
-          name: cacert
         - mountPath: /etc/selinux
           name: etc-selinux
         - mountPath: /sys/fs
           name: sys-fs
+        - mountPath: /etc/openstack
+          name: cloud-credentials
+          readOnly: true
+        - mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
+          name: legacy-cacert
       - args:
         - --csi-address=/csi/csi.sock
         - --http-endpoint=127.0.0.1:10305
@@ -214,12 +214,6 @@ spec:
       - name: metrics-serving-cert
         secret:
           secretName: manila-csi-driver-node-metrics-serving-cert
-      - name: cloud-credentials
-        secret:
-          items:
-          - key: clouds.yaml
-            path: clouds.yaml
-          secretName: manila-cloud-credentials
       - hostPath:
           path: /var/lib/kubelet/plugins/manila.csi.openstack.org
           type: DirectoryOrCreate
@@ -228,13 +222,27 @@ spec:
           path: /var/lib/kubelet/plugins/csi-nfsplugin
           type: DirectoryOrCreate
         name: fwd-plugin-dir
+      - name: cloud-credentials
+        projected:
+          sources:
+          - secret:
+              items:
+              - key: clouds.yaml
+                path: clouds.yaml
+              name: manila-cloud-credentials
+          - secret:
+              items:
+              - key: cacert
+                path: ca.crt
+              name: manila-cloud-credentials
+              optional: true
       - configMap:
           items:
           - key: ca-bundle.pem
             path: ca-bundle.pem
           name: cloud-provider-config
           optional: true
-        name: cacert
+        name: legacy-cacert
   updateStrategy:
     rollingUpdate:
       maxUnavailable: 10%

assets/overlays/openstack-manila/patches/controller_add_driver.yaml

@@ -80,11 +80,12 @@ spec:
           volumeMounts:
             - name: socket-dir
               mountPath: /plugin
-            - name: cacert
-              mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
+            # credentials and configuration
             - name: cloud-credentials
               mountPath: /etc/openstack
               readOnly: true
+            - name: legacy-cacert
+              mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
           resources:
             requests:
               cpu: 10m
@@ -114,23 +115,27 @@ spec:
               memory: 50Mi
           terminationMessagePolicy: FallbackToLogsOnError
       volumes:
-        - name: cloud-credentials
-          secret:
-            secretName: manila-cloud-credentials
-            items:
-              - key: clouds.yaml
-                path: clouds.yaml
         - name: socket-dir
           emptyDir: {}
-        - name: cacert
-          # If present, extract ca-bundle.pem to
-          # /etc/kubernetes/static-pod-resources/configmaps/cloud-config
-          # Let the pod start when the ConfigMap does not exist or the certificate
-          # is not preset there. The certificate file will be created once the
-          # ConfigMap is created / the cerificate is added to it.
+        # credentials and configuration
+        - name: cloud-credentials
+          projected:
+            sources:
+              - secret:
+                  items:
+                    - key: clouds.yaml
+                      path: clouds.yaml
+                  name: manila-cloud-credentials
+              - secret:
+                  items:
+                    - key: cacert
+                      path: ca.crt
+                  name: manila-cloud-credentials
+                  optional: true
+        - name: legacy-cacert
           configMap:
             name: cloud-provider-config
             items:
-            - key: ca-bundle.pem
-              path: ca-bundle.pem
+              - key: ca-bundle.pem
+                path: ca-bundle.pem
             optional: true

assets/overlays/openstack-manila/patches/controller_use_hypershift_config_map.yaml

@@ -0,0 +1,11 @@
+spec:
+  template:
+    spec:
+      volumes:
+        - configMap:
+            items:
+              - key: ca-bundle.pem
+                path: ca-bundle.pem
+            name: openstack-cloud-config
+            optional: true
+          name: legacy-cacert

assets/overlays/openstack-manila/patches/node_add_driver.yaml

@@ -59,19 +59,20 @@ spec:
             - name: MANILA_SHARE_PROTO
               value: NFS
           volumeMounts:
-            - name: cloud-credentials
-              mountPath: /etc/openstack
-              readOnly: true
             - name: plugin-dir
               mountPath: /var/lib/kubelet/plugins/manila.csi.openstack.org
             - name: fwd-plugin-dir
               mountPath: /var/lib/kubelet/plugins/csi-nfsplugin
-            - name: cacert
-              mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
             - name: etc-selinux
               mountPath: /etc/selinux
             - name: sys-fs
               mountPath: /sys/fs
+            # credentials and configuration
+            - name: cloud-credentials
+              mountPath: /etc/openstack
+              readOnly: true
+            - name: legacy-cacert
+              mountPath: /etc/kubernetes/static-pod-resources/configmaps/cloud-config
           ports:
             - name: healthz
               containerPort: 10305
@@ -113,12 +114,6 @@ spec:
             - name: fwd-plugin-dir
               mountPath: /var/lib/kubelet/plugins/csi-nfsplugin
       volumes:
-        - name: cloud-credentials
-          secret:
-            secretName: manila-cloud-credentials
-            items:
-              - key: clouds.yaml
-                path: clouds.yaml
         - name: registration-dir
           hostPath:
             path: /var/lib/kubelet/plugins_registry/
@@ -131,17 +126,6 @@ spec:
           hostPath:
             path: /var/lib/kubelet/plugins/csi-nfsplugin
             type: DirectoryOrCreate
-        - name: cacert
-          # Extract ca-bundle.pem to /etc/kubernetes/static-pod-resources/configmaps/cloud-config if present.
-          # Let the pod start when the ConfigMap does not exist or the certificate
-          # is not preset there. The certificate file will be created once the
-          # ConfigMap is created / the cerificate is added to it.
-          configMap:
-            name: cloud-provider-config
-            items:
-            - key: ca-bundle.pem
-              path: ca-bundle.pem
-            optional: true
         - name: etc-selinux
           hostPath:
             path: /etc/selinux
@@ -150,3 +134,25 @@ spec:
           hostPath:
             path: /sys/fs
             type: Directory
+        # credentials and configuration
+        - name: cloud-credentials
+          projected:
+            sources:
+              - secret:
+                  items:
+                    - key: clouds.yaml
+                      path: clouds.yaml
+                  name: manila-cloud-credentials
+              - secret:
+                  items:
+                    - key: cacert
+                      path: ca.crt
+                  name: manila-cloud-credentials
+                  optional: true
+        - name: legacy-cacert
+          configMap:
+            name: cloud-provider-config
+            items:
+              - key: ca-bundle.pem
+                path: ca-bundle.pem
+            optional: true