Skip to content

Commit cce52ed

Browse files
mjudeikismjudeikis
committed
Add to override issuer on shard certificate tempalte
Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt> On-behalf-of: SAP <mangirdas.judeikis@sap.com>
1 parent bf12804 commit cce52ed

File tree

9 files changed

+193
-1
lines changed

9 files changed

+193
-1
lines changed

‎config/crd/bases/operator.kcp.io_frontproxies.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,9 @@ spec:
188188
description: |-
189189
Requested DNS subject alternative names. The values given here will be merged into the
190190
DNS names determined automatically by the kcp-operator.
191+
If DNSNames is used together with IssuerRef, DNSNames will be uses as-is and not merged.
192+
If IssuerRef is not set, DNSNames will be merged with the defaults. This is to avoid
193+
trying to guess what DNSNames configued issuer might support.
191194
items:
192195
type: string
193196
type: array
@@ -208,6 +211,22 @@ spec:
208211
items:
209212
type: string
210213
type: array
214+
issuerRef:
215+
description: IssuerRef is a reference to the issuer for
216+
this certificate.
217+
properties:
218+
group:
219+
description: Group of the object being referred to.
220+
type: string
221+
kind:
222+
description: Kind of the object being referred to.
223+
type: string
224+
name:
225+
description: Name of the object being referred to.
226+
type: string
227+
required:
228+
- name
229+
type: object
211230
privateKey:
212231
description: |-
213232
Private key options. These include the key algorithm and size, the used

‎config/crd/bases/operator.kcp.io_kubeconfigs.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,9 @@ spec:
6565
description: |-
6666
Requested DNS subject alternative names. The values given here will be merged into the
6767
DNS names determined automatically by the kcp-operator.
68+
If DNSNames is used together with IssuerRef, DNSNames will be uses as-is and not merged.
69+
If IssuerRef is not set, DNSNames will be merged with the defaults. This is to avoid
70+
trying to guess what DNSNames configued issuer might support.
6871
items:
6972
type: string
7073
type: array
@@ -85,6 +88,22 @@ spec:
8588
items:
8689
type: string
8790
type: array
91+
issuerRef:
92+
description: IssuerRef is a reference to the issuer for this
93+
certificate.
94+
properties:
95+
group:
96+
description: Group of the object being referred to.
97+
type: string
98+
kind:
99+
description: Kind of the object being referred to.
100+
type: string
101+
name:
102+
description: Name of the object being referred to.
103+
type: string
104+
required:
105+
- name
106+
type: object
88107
privateKey:
89108
description: |-
90109
Private key options. These include the key algorithm and size, the used

‎config/crd/bases/operator.kcp.io_rootshards.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -274,6 +274,9 @@ spec:
274274
description: |-
275275
Requested DNS subject alternative names. The values given here will be merged into the
276276
DNS names determined automatically by the kcp-operator.
277+
If DNSNames is used together with IssuerRef, DNSNames will be uses as-is and not merged.
278+
If IssuerRef is not set, DNSNames will be merged with the defaults. This is to avoid
279+
trying to guess what DNSNames configued issuer might support.
277280
items:
278281
type: string
279282
type: array
@@ -294,6 +297,22 @@ spec:
294297
items:
295298
type: string
296299
type: array
300+
issuerRef:
301+
description: IssuerRef is a reference to the issuer for
302+
this certificate.
303+
properties:
304+
group:
305+
description: Group of the object being referred to.
306+
type: string
307+
kind:
308+
description: Kind of the object being referred to.
309+
type: string
310+
name:
311+
description: Name of the object being referred to.
312+
type: string
313+
required:
314+
- name
315+
type: object
297316
privateKey:
298317
description: |-
299318
Private key options. These include the key algorithm and size, the used
@@ -1689,6 +1708,9 @@ spec:
16891708
description: |-
16901709
Requested DNS subject alternative names. The values given here will be merged into the
16911710
DNS names determined automatically by the kcp-operator.
1711+
If DNSNames is used together with IssuerRef, DNSNames will be uses as-is and not merged.
1712+
If IssuerRef is not set, DNSNames will be merged with the defaults. This is to avoid
1713+
trying to guess what DNSNames configued issuer might support.
16921714
items:
16931715
type: string
16941716
type: array
@@ -1709,6 +1731,23 @@ spec:
17091731
items:
17101732
type: string
17111733
type: array
1734+
issuerRef:
1735+
description: IssuerRef is a reference to the issuer
1736+
for this certificate.
1737+
properties:
1738+
group:
1739+
description: Group of the object being referred
1740+
to.
1741+
type: string
1742+
kind:
1743+
description: Kind of the object being referred to.
1744+
type: string
1745+
name:
1746+
description: Name of the object being referred to.
1747+
type: string
1748+
required:
1749+
- name
1750+
type: object
17121751
privateKey:
17131752
description: |-
17141753
Private key options. These include the key algorithm and size, the used

‎config/crd/bases/operator.kcp.io_shards.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -258,6 +258,9 @@ spec:
258258
description: |-
259259
Requested DNS subject alternative names. The values given here will be merged into the
260260
DNS names determined automatically by the kcp-operator.
261+
If DNSNames is used together with IssuerRef, DNSNames will be uses as-is and not merged.
262+
If IssuerRef is not set, DNSNames will be merged with the defaults. This is to avoid
263+
trying to guess what DNSNames configued issuer might support.
261264
items:
262265
type: string
263266
type: array
@@ -278,6 +281,22 @@ spec:
278281
items:
279282
type: string
280283
type: array
284+
issuerRef:
285+
description: IssuerRef is a reference to the issuer for
286+
this certificate.
287+
properties:
288+
group:
289+
description: Group of the object being referred to.
290+
type: string
291+
kind:
292+
description: Kind of the object being referred to.
293+
type: string
294+
name:
295+
description: Name of the object being referred to.
296+
type: string
297+
required:
298+
- name
299+
type: object
281300
privateKey:
282301
description: |-
283302
Private key options. These include the key algorithm and size, the used

‎internal/resources/utils/certificates.go‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"maps"
2121

2222
certmanagerv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
23+
cmmeta "github.com/cert-manager/cert-manager/pkg/apis/meta/v1"
2324

2425
"k8s.io/apimachinery/pkg/util/sets"
2526

@@ -65,7 +66,16 @@ func applyCertificateSpecTemplate(cert *certmanagerv1.Certificate, tpl *operator
6566
return cert
6667
}
6768

68-
cert.Spec.DNSNames = mergeSlices(cert.Spec.DNSNames, tpl.DNSNames)
69+
// If DNSNames is provided in the template and issuer is overrided,
70+
// it will replace any existing DNSNames.
71+
// We don't merge as we don't know if issuer supports our default names.
72+
// Its users responsibility to add them back if needed.
73+
if len(tpl.DNSNames) > 0 && tpl.IssuerRef != nil {
74+
cert.Spec.DNSNames = tpl.DNSNames
75+
} else if len(tpl.DNSNames) > 0 {
76+
cert.Spec.DNSNames = mergeSlices(cert.Spec.DNSNames, tpl.DNSNames)
77+
}
78+
6979
cert.Spec.IPAddresses = mergeSlices(cert.Spec.IPAddresses, tpl.IPAddresses)
7080

7181
if tpl.Duration != nil {
@@ -84,6 +94,13 @@ func applyCertificateSpecTemplate(cert *certmanagerv1.Certificate, tpl *operator
8494
cert.Spec.SecretTemplate.Annotations = addNewKeys(cert.Spec.SecretTemplate.Annotations, secretTpl.Annotations)
8595
cert.Spec.SecretTemplate.Labels = addNewKeys(cert.Spec.SecretTemplate.Labels, secretTpl.Labels)
8696
}
97+
if tpl.IssuerRef != nil {
98+
cert.Spec.IssuerRef = cmmeta.ObjectReference{
99+
Name: tpl.IssuerRef.Name,
100+
Kind: tpl.IssuerRef.Kind,
101+
Group: tpl.IssuerRef.Group,
102+
}
103+
}
87104

88105
cert.Spec.PrivateKey = applyCertificatePrivateKeyTemplate(cert.Spec.PrivateKey, tpl.PrivateKey)
89106
cert.Spec.Subject = applyCertificateSubjectTemplate(cert.Spec.Subject, tpl.Subject)

‎sdk/apis/operator/v1alpha1/common.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,8 +134,16 @@ type CertificateSpecTemplate struct {
134134
// +optional
135135
Subject *X509Subject `json:"subject,omitempty"`
136136

137+
// IssuerRef is a reference to the issuer for this certificate.
138+
//
139+
// +optional
140+
IssuerRef *ObjectReference `json:"issuerRef"`
141+
137142
// Requested DNS subject alternative names. The values given here will be merged into the
138143
// DNS names determined automatically by the kcp-operator.
144+
// If DNSNames is used together with IssuerRef, DNSNames will be uses as-is and not merged.
145+
// If IssuerRef is not set, DNSNames will be merged with the defaults. This is to avoid
146+
// trying to guess what DNSNames configued issuer might support.
139147
//
140148
// +optional
141149
DNSNames []string `json:"dnsNames,omitempty"`

‎sdk/apis/operator/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎sdk/applyconfiguration/operator/v1alpha1/certificateissuerref.go‎

Lines changed: 57 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎sdk/applyconfiguration/operator/v1alpha1/certificatespectemplate.go‎

Lines changed: 9 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)