|
| 1 | +package authority |
| 2 | + |
| 3 | +import ( |
| 4 | + "crypto/tls" |
| 5 | + "errors" |
| 6 | + "time" |
| 7 | + |
| 8 | + corev1 "k8s.io/api/core/v1" |
| 9 | + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" |
| 10 | + "k8s.io/apimachinery/pkg/labels" |
| 11 | + "k8s.io/apimachinery/pkg/runtime/schema" |
| 12 | + admissionregistrationv1ac "k8s.io/client-go/applyconfigurations/admissionregistration/v1" |
| 13 | + ctrl "sigs.k8s.io/controller-runtime" |
| 14 | + "sigs.k8s.io/controller-runtime/pkg/cache" |
| 15 | + "sigs.k8s.io/controller-runtime/pkg/client" |
| 16 | +) |
| 17 | + |
| 18 | +const ( |
| 19 | + // DynamicAuthoritySecretLabel will - if set to "true" - make the dynamic |
| 20 | + // authority CA controller inject and maintain a dynamic CA. |
| 21 | + // The label must be added to Secret resource that want to denote that they |
| 22 | + // can be directly injected into injectables that have a |
| 23 | + // `inject-dynamic-ca-from-secret` label. |
| 24 | + // If an injectable references a Secret that does NOT have this annotation, |
| 25 | + // the dynamic ca-injector will refuse to inject the secret. |
| 26 | + DynamicAuthoritySecretLabel = "cert-manager.io/allow-dynamic-ca-injection" |
| 27 | + // WantInjectFromSecretNamespaceLabel is the label that specifies that a |
| 28 | + // particular object wants injection of dynamic CAs from secret in |
| 29 | + // namespace. |
| 30 | + // Must be used in conjunction with WantInjectFromSecretNameLabel. |
| 31 | + WantInjectFromSecretNamespaceLabel = "cert-manager.io/inject-dynamic-ca-from-secret-namespace" |
| 32 | + // WantInjectFromSecretNameLabel is the label that specifies that a |
| 33 | + // particular object wants injection of dynamic CAs from secret with name. |
| 34 | + // Must be used in conjunction with WantInjectFromSecretNamespaceLabel. |
| 35 | + WantInjectFromSecretNameLabel = "cert-manager.io/inject-dynamic-ca-from-secret-name" |
| 36 | + |
| 37 | + // TLSCABundleKey is used as a data key in Secret resources to store a CA |
| 38 | + // certificate bundle. |
| 39 | + TLSCABundleKey = "ca-bundle.crt" |
| 40 | + |
| 41 | + // RenewCertificateSecretAnnotation is an annotation that can be set to |
| 42 | + // an arbitrary value on a certificate secret to trigger a renewal of the |
| 43 | + // certificate managed in the secret. |
| 44 | + RenewCertificateSecretAnnotation = "renew.cert-manager.io/requestedAt" |
| 45 | + // RenewHandledCertificateSecretAnnotation is an annotation that will be set on a |
| 46 | + // certificate secret whenever a new certificate is renewed using the |
| 47 | + // RenewCertificateSecretAnnotation annotation. |
| 48 | + RenewHandledCertificateSecretAnnotation = "renew.cert-manager.io/lastRequestedAt" |
| 49 | +) |
| 50 | + |
| 51 | +type ApplyConfiguration interface { |
| 52 | + GetName() *string |
| 53 | +} |
| 54 | + |
| 55 | +type Injectable interface { |
| 56 | + GroupVersionKind() schema.GroupVersionKind |
| 57 | + InjectCA(obj *unstructured.Unstructured, caBundle []byte) (ApplyConfiguration, error) |
| 58 | +} |
| 59 | + |
| 60 | +type ValidatingWebhookCaBundleInject struct { |
| 61 | +} |
| 62 | + |
| 63 | +func (i *ValidatingWebhookCaBundleInject) GroupVersionKind() schema.GroupVersionKind { |
| 64 | + return schema.GroupVersionKind{ |
| 65 | + Group: "admissionregistration.k8s.io", |
| 66 | + Version: "v1", |
| 67 | + Kind: "ValidatingWebhookConfiguration", |
| 68 | + } |
| 69 | +} |
| 70 | + |
| 71 | +func (i *ValidatingWebhookCaBundleInject) InjectCA(obj *unstructured.Unstructured, caBundle []byte) (ApplyConfiguration, error) { |
| 72 | + // TODO: Can we generalize this function for any resource based on a JSON path? |
| 73 | + |
| 74 | + ac := admissionregistrationv1ac.ValidatingWebhookConfiguration(obj.GetName()) |
| 75 | + |
| 76 | + webhooks, _, err := unstructured.NestedSlice(obj.Object, "webhooks") |
| 77 | + if err != nil { |
| 78 | + return nil, err |
| 79 | + } |
| 80 | + for _, w := range webhooks { |
| 81 | + name, _, err := unstructured.NestedString(w.(map[string]any), "name") |
| 82 | + if err != nil { |
| 83 | + return nil, err |
| 84 | + } |
| 85 | + ac.WithWebhooks( |
| 86 | + admissionregistrationv1ac.ValidatingWebhook(). |
| 87 | + WithName(name). |
| 88 | + WithClientConfig(admissionregistrationv1ac.WebhookClientConfig(). |
| 89 | + WithCABundle(caBundle...), |
| 90 | + ), |
| 91 | + ) |
| 92 | + } |
| 93 | + |
| 94 | + return ac, nil |
| 95 | +} |
| 96 | + |
| 97 | +var _ Injectable = &ValidatingWebhookCaBundleInject{} |
| 98 | + |
| 99 | +type Options struct { |
| 100 | + // The namespace used for certificate secrets. |
| 101 | + Namespace string |
| 102 | + |
| 103 | + // The name of the Secret used to store CA certificates. |
| 104 | + CASecret string |
| 105 | + |
| 106 | + // The amount of time the root CA certificate will be valid for. |
| 107 | + // This must be greater than LeafDuration. |
| 108 | + CADuration time.Duration |
| 109 | + |
| 110 | + DNSNames []string |
| 111 | + |
| 112 | + // The amount of time leaf certificates signed by this authority will be |
| 113 | + // valid for. |
| 114 | + // This must be less than CADuration. |
| 115 | + LeafDuration time.Duration |
| 116 | + |
| 117 | + Injectables []Injectable |
| 118 | +} |
| 119 | + |
| 120 | +type ServingCertificateOperator struct { |
| 121 | + Options Options |
| 122 | + |
| 123 | + certificateHolder *CertificateHolder |
| 124 | +} |
| 125 | + |
| 126 | +func (o *ServingCertificateOperator) ServingCertificate() func(config *tls.Config) { |
| 127 | + if o.certificateHolder == nil { |
| 128 | + o.certificateHolder = &CertificateHolder{} |
| 129 | + } |
| 130 | + return func(config *tls.Config) { |
| 131 | + config.GetCertificate = func(info *tls.ClientHelloInfo) (*tls.Certificate, error) { |
| 132 | + return o.certificateHolder.GetCertificate(info) |
| 133 | + } |
| 134 | + } |
| 135 | +} |
| 136 | + |
| 137 | +// +kubebuilder:rbac:groups=admissionregistration.k8s.io,resources=validatingwebhookconfigurations,verbs=get;list;watch;patch |
| 138 | + |
| 139 | +func (o *ServingCertificateOperator) SetupWithManager(mgr ctrl.Manager) error { |
| 140 | + if o.certificateHolder == nil { |
| 141 | + return errors.New("ServingCertificate not invoked") |
| 142 | + } |
| 143 | + |
| 144 | + if o.Options.CADuration == 0 { |
| 145 | + o.Options.CADuration = 7 * 24 * time.Hour |
| 146 | + } |
| 147 | + if o.Options.LeafDuration == 0 { |
| 148 | + o.Options.LeafDuration = 1 * 24 * time.Hour |
| 149 | + } |
| 150 | + if len(o.Options.Injectables) == 0 { |
| 151 | + o.Options.Injectables = []Injectable{ |
| 152 | + &ValidatingWebhookCaBundleInject{}, |
| 153 | + } |
| 154 | + } |
| 155 | + |
| 156 | + cacheByObject := map[client.Object]cache.ByObject{ |
| 157 | + &corev1.Secret{}: { |
| 158 | + Namespaces: map[string]cache.Config{ |
| 159 | + o.Options.Namespace: {}, |
| 160 | + }, |
| 161 | + Label: labels.SelectorFromSet(labels.Set{ |
| 162 | + DynamicAuthoritySecretLabel: "true", |
| 163 | + }), |
| 164 | + }, |
| 165 | + } |
| 166 | + injectByObject := cache.ByObject{ |
| 167 | + Label: labels.SelectorFromSet(labels.Set{ |
| 168 | + WantInjectFromSecretNamespaceLabel: o.Options.Namespace, |
| 169 | + WantInjectFromSecretNameLabel: o.Options.CASecret, |
| 170 | + }), |
| 171 | + } |
| 172 | + for _, injectable := range o.Options.Injectables { |
| 173 | + cacheByObject[newUnstructured(injectable)] = injectByObject |
| 174 | + } |
| 175 | + controllerCache, err := cache.New(mgr.GetConfig(), cache.Options{ |
| 176 | + HTTPClient: mgr.GetHTTPClient(), |
| 177 | + Scheme: mgr.GetScheme(), |
| 178 | + Mapper: mgr.GetRESTMapper(), |
| 179 | + ReaderFailOnMissingInformer: true, |
| 180 | + ByObject: cacheByObject, |
| 181 | + }) |
| 182 | + if err := mgr.Add(controllerCache); err != nil { |
| 183 | + return err |
| 184 | + } |
| 185 | + |
| 186 | + controllerClient, err := client.New(mgr.GetConfig(), client.Options{ |
| 187 | + HTTPClient: mgr.GetHTTPClient(), |
| 188 | + Scheme: mgr.GetScheme(), |
| 189 | + Mapper: mgr.GetRESTMapper(), |
| 190 | + Cache: &client.CacheOptions{ |
| 191 | + Reader: controllerCache, |
| 192 | + Unstructured: true, |
| 193 | + }, |
| 194 | + }) |
| 195 | + if err != nil { |
| 196 | + return err |
| 197 | + } |
| 198 | + |
| 199 | + r := reconciler{ |
| 200 | + Client: controllerClient, |
| 201 | + Cache: controllerCache, |
| 202 | + Opts: o.Options, |
| 203 | + } |
| 204 | + controllers := []dynamicAuthorityController{ |
| 205 | + &CASecretReconciler{reconciler: r}, |
| 206 | + &LeafCertReconciler{reconciler: r, certificateHolder: o.certificateHolder}, |
| 207 | + } |
| 208 | + for _, injectable := range o.Options.Injectables { |
| 209 | + controllers = append(controllers, &InjectableReconciler{reconciler: r, Injectable: injectable}) |
| 210 | + } |
| 211 | + for _, c := range controllers { |
| 212 | + if err := c.SetupWithManager(mgr); err != nil { |
| 213 | + return err |
| 214 | + } |
| 215 | + } |
| 216 | + |
| 217 | + return nil |
| 218 | +} |
| 219 | + |
| 220 | +type dynamicAuthorityController interface { |
| 221 | + SetupWithManager(ctrl.Manager) error |
| 222 | +} |
| 223 | + |
| 224 | +func newUnstructured(injectable Injectable) *unstructured.Unstructured { |
| 225 | + obj := &unstructured.Unstructured{} |
| 226 | + obj.SetGroupVersionKind(injectable.GroupVersionKind()) |
| 227 | + return obj |
| 228 | +} |
| 229 | + |
| 230 | +func newUnstructuredList(injectable Injectable) *unstructured.UnstructuredList { |
| 231 | + obj := &unstructured.UnstructuredList{} |
| 232 | + obj.SetGroupVersionKind(injectable.GroupVersionKind()) |
| 233 | + return obj |
| 234 | +} |
0 commit comments