Skip to content

Commit df12f02

Browse files
mjudeikismjudeikis
committed
Add ability to provide cert-bundle for extended trust
Signed-off-by: Mangirdas Judeikis <mangirdas@judeikis.lt> On-behalf-of: SAP <mangirdas.judeikis@sap.com>
1 parent bf12804 commit df12f02

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+1254
-1027
lines changed

‎config/crd/bases/operator.kcp.io_frontproxies.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,26 @@ spec:
164164
x-kubernetes-validations:
165165
- message: OIDC requires ServiceAccount auth to be enabled.
166166
rule: '!has(self.oidc) || (has(self.serviceAccount) && self.serviceAccount.enabled)'
167+
caBundleSecretRef:
168+
description: |-
169+
CABundle references a v1.Secret object that contains the CA bundle
170+
that should be used to validate the API server's TLS certificate.
171+
The secret must contain a key named `tls.crt` that holds the PEM encoded CA certificate.
172+
It will be merged into the "external-logical-cluster-admin-kubeconfig" kubeconfig under the `certificate-authority-data` field.
173+
If not specified, the kubeconfig will use the CA bundle of the root shard or front-proxy referenced in the Target field.
174+
It will NOT be used to configure the API server's own TLS certificate or any other component.
175+
properties:
176+
name:
177+
default: ""
178+
description: |-
179+
Name of the referent.
180+
This field is effectively required, but due to backwards compatibility is
181+
allowed to be empty. Instances of this type with an empty value here are
182+
almost certainly wrong.
183+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
184+
type: string
185+
type: object
186+
x-kubernetes-map-type: atomic
167187
certificateTemplates:
168188
additionalProperties:
169189
properties:

‎config/crd/bases/operator.kcp.io_rootshards.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,26 @@ spec:
234234
type: string
235235
type: object
236236
type: object
237+
caBundleSecretRef:
238+
description: |-
239+
CABundle references a v1.Secret object that contains the CA bundle
240+
that should be used to validate the API server's TLS certificate.
241+
The secret must contain a key named `tls.crt` that holds the PEM encoded CA certificate.
242+
It will be merged into the "external-logical-cluster-admin-kubeconfig" kubeconfig under the `certificate-authority-data` field.
243+
If not specified, the kubeconfig will use the CA bundle of the root shard or front-proxy referenced in the Target field.
244+
It will NOT be used to configure the API server's own TLS certificate or any other component.
245+
properties:
246+
name:
247+
default: ""
248+
description: |-
249+
Name of the referent.
250+
This field is effectively required, but due to backwards compatibility is
251+
allowed to be empty. Instances of this type with an empty value here are
252+
almost certainly wrong.
253+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
254+
type: string
255+
type: object
256+
x-kubernetes-map-type: atomic
237257
cache:
238258
description: Cache configures the cache server (with a Kubernetes-like
239259
API) used by a sharded kcp instance.
@@ -485,6 +505,8 @@ spec:
485505
type: object
486506
type: object
487507
clusterDomain:
508+
description: ClusterDomain is the DNS domain for services in the cluster.
509+
Defaults to "cluster.local" if not set.
488510
type: string
489511
deploymentTemplate:
490512
description: 'Optional: DeploymentTemplate configures the Kubernetes
@@ -3198,6 +3220,11 @@ spec:
31983220
type: string
31993221
type: object
32003222
type: object
3223+
shardBaseURL:
3224+
description: |-
3225+
ShardBaseURL is the base URL under which this shard should be reachable. This is used to configure
3226+
the external URL. If not provided, the operator will use kubernetes service address to generate it.
3227+
type: string
32013228
required:
32023229
- cache
32033230
- certificates

‎config/crd/bases/operator.kcp.io_shards.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,26 @@ spec:
234234
type: string
235235
type: object
236236
type: object
237+
caBundleSecretRef:
238+
description: |-
239+
CABundle references a v1.Secret object that contains the CA bundle
240+
that should be used to validate the API server's TLS certificate.
241+
The secret must contain a key named `tls.crt` that holds the PEM encoded CA certificate.
242+
It will be merged into the "external-logical-cluster-admin-kubeconfig" kubeconfig under the `certificate-authority-data` field.
243+
If not specified, the kubeconfig will use the CA bundle of the root shard or front-proxy referenced in the Target field.
244+
It will NOT be used to configure the API server's own TLS certificate or any other component.
245+
properties:
246+
name:
247+
default: ""
248+
description: |-
249+
Name of the referent.
250+
This field is effectively required, but due to backwards compatibility is
251+
allowed to be empty. Instances of this type with an empty value here are
252+
almost certainly wrong.
253+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
254+
type: string
255+
type: object
256+
x-kubernetes-map-type: atomic
237257
certificateTemplates:
238258
additionalProperties:
239259
properties:
@@ -428,6 +448,8 @@ spec:
428448
certificates for this shard.
429449
type: object
430450
clusterDomain:
451+
description: ClusterDomain is the DNS domain for services in the cluster.
452+
Defaults to "cluster.local" if not set.
431453
type: string
432454
deploymentTemplate:
433455
description: 'Optional: DeploymentTemplate configures the Kubernetes
@@ -1702,6 +1724,11 @@ spec:
17021724
type: string
17031725
type: object
17041726
type: object
1727+
shardBaseURL:
1728+
description: |-
1729+
ShardBaseURL is the base URL under which this shard should be reachable. This is used to configure
1730+
the external URL. If not provided, the operator will use kubernetes service address to generate it.
1731+
type: string
17051732
required:
17061733
- etcd
17071734
- rootShard

‎go.mod‎

Lines changed: 43 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -5,30 +5,31 @@ go 1.23.0
55
replace github.com/kcp-dev/kcp-operator/sdk => ./sdk
66

77
require (
8-
github.com/cert-manager/cert-manager v1.16.2
8+
github.com/cert-manager/cert-manager v1.18.2
99
github.com/go-logr/logr v1.4.2
1010
github.com/go-logr/zapr v1.3.0
1111
github.com/go-test/deep v1.1.0
1212
github.com/kcp-dev/code-generator/v2 v2.3.1
1313
github.com/kcp-dev/kcp-operator/sdk v0.0.0-00010101000000-000000000000
1414
github.com/kcp-dev/kcp/sdk v0.27.1
1515
github.com/kcp-dev/logicalcluster/v3 v3.0.5
16-
github.com/stretchr/testify v1.9.0
16+
github.com/stretchr/testify v1.10.0
1717
go.uber.org/zap v1.27.0
1818
k8c.io/reconciler v0.5.0
19-
k8s.io/api v0.31.6
20-
k8s.io/apimachinery v0.31.6
21-
k8s.io/client-go v0.31.6
22-
k8s.io/code-generator v0.31.6
23-
k8s.io/utils v0.0.0-20240921022957-49e7df575cb6
19+
k8s.io/api v0.32.0
20+
k8s.io/apimachinery v0.32.0
21+
k8s.io/client-go v0.32.0
22+
k8s.io/code-generator v0.32.0
23+
k8s.io/utils v0.0.0-20241210054802-24370beab758
2424
sigs.k8s.io/controller-runtime v0.19.0
2525
sigs.k8s.io/controller-tools v0.16.1
2626
sigs.k8s.io/yaml v1.4.0
2727
)
2828

2929
require (
30+
cel.dev/expr v0.19.1 // indirect
3031
github.com/Masterminds/semver/v3 v3.2.1 // indirect
31-
github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
32+
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
3233
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
3334
github.com/beorn7/perks v1.0.1 // indirect
3435
github.com/blang/semver/v4 v4.0.0 // indirect
@@ -39,80 +40,79 @@ require (
3940
github.com/evanphx/json-patch/v5 v5.9.0 // indirect
4041
github.com/fatih/color v1.17.0 // indirect
4142
github.com/felixge/httpsnoop v1.0.4 // indirect
42-
github.com/fsnotify/fsnotify v1.7.0 // indirect
43+
github.com/fsnotify/fsnotify v1.8.0 // indirect
4344
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
4445
github.com/go-logr/stdr v1.2.2 // indirect
4546
github.com/go-openapi/jsonpointer v0.21.0 // indirect
4647
github.com/go-openapi/jsonreference v0.21.0 // indirect
4748
github.com/go-openapi/swag v0.23.0 // indirect
4849
github.com/gobuffalo/flect v1.0.2 // indirect
4950
github.com/gogo/protobuf v1.3.2 // indirect
50-
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
5151
github.com/golang/protobuf v1.5.4 // indirect
52-
github.com/google/cel-go v0.20.1 // indirect
53-
github.com/google/gnostic-models v0.6.8 // indirect
52+
github.com/google/cel-go v0.22.1 // indirect
53+
github.com/google/gnostic-models v0.6.9 // indirect
5454
github.com/google/go-cmp v0.6.0 // indirect
5555
github.com/google/gofuzz v1.2.1-0.20210504230335-f78f29fc09ea // indirect
5656
github.com/google/uuid v1.6.0 // indirect
57-
github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
58-
github.com/imdario/mergo v0.3.16 // indirect
57+
github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 // indirect
5958
github.com/inconshreveable/mousetrap v1.1.0 // indirect
6059
github.com/josharian/intern v1.0.0 // indirect
6160
github.com/json-iterator/go v1.1.12 // indirect
62-
github.com/klauspost/compress v1.17.9 // indirect
63-
github.com/mailru/easyjson v0.7.7 // indirect
61+
github.com/klauspost/compress v1.17.11 // indirect
62+
github.com/mailru/easyjson v0.9.0 // indirect
6463
github.com/mattn/go-colorable v0.1.13 // indirect
6564
github.com/mattn/go-isatty v0.0.20 // indirect
6665
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
6766
github.com/modern-go/reflect2 v1.0.2 // indirect
6867
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
69-
github.com/onsi/gomega v1.34.1 // indirect
68+
github.com/onsi/gomega v1.35.1 // indirect
7069
github.com/pkg/errors v0.9.1 // indirect
7170
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
72-
github.com/prometheus/client_golang v1.20.4 // indirect
71+
github.com/prometheus/client_golang v1.20.5 // indirect
7372
github.com/prometheus/client_model v0.6.1 // indirect
74-
github.com/prometheus/common v0.55.0 // indirect
73+
github.com/prometheus/common v0.61.0 // indirect
7574
github.com/prometheus/procfs v0.15.1 // indirect
7675
github.com/spf13/cobra v1.8.1 // indirect
7776
github.com/spf13/pflag v1.0.6-0.20210604193023-d5e0c0615ace // indirect
7877
github.com/stoewer/go-strcase v1.3.0 // indirect
7978
github.com/x448/float16 v0.8.4 // indirect
80-
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
81-
go.opentelemetry.io/otel v1.29.0 // indirect
82-
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect
83-
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 // indirect
84-
go.opentelemetry.io/otel/metric v1.29.0 // indirect
85-
go.opentelemetry.io/otel/sdk v1.28.0 // indirect
86-
go.opentelemetry.io/otel/trace v1.29.0 // indirect
87-
go.opentelemetry.io/proto/otlp v1.3.1 // indirect
79+
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
80+
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
81+
go.opentelemetry.io/otel v1.33.0 // indirect
82+
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect
83+
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 // indirect
84+
go.opentelemetry.io/otel/metric v1.33.0 // indirect
85+
go.opentelemetry.io/otel/sdk v1.33.0 // indirect
86+
go.opentelemetry.io/otel/trace v1.33.0 // indirect
87+
go.opentelemetry.io/proto/otlp v1.4.0 // indirect
8888
go.uber.org/multierr v1.11.0 // indirect
89-
golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 // indirect
89+
golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 // indirect
9090
golang.org/x/mod v0.24.0 // indirect
9191
golang.org/x/net v0.40.0 // indirect
92-
golang.org/x/oauth2 v0.27.0 // indirect
92+
golang.org/x/oauth2 v0.28.0 // indirect
9393
golang.org/x/sync v0.14.0 // indirect
9494
golang.org/x/sys v0.33.0 // indirect
9595
golang.org/x/term v0.32.0 // indirect
9696
golang.org/x/text v0.25.0 // indirect
97-
golang.org/x/time v0.6.0 // indirect
98-
golang.org/x/tools v0.25.1 // indirect
97+
golang.org/x/time v0.8.0 // indirect
98+
golang.org/x/tools v0.28.0 // indirect
9999
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
100-
google.golang.org/genproto/googleapis/api v0.0.0-20240827150818-7e3bb234dfed // indirect
101-
google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
102-
google.golang.org/grpc v1.66.2 // indirect
103-
google.golang.org/protobuf v1.34.2 // indirect
100+
google.golang.org/genproto/googleapis/api v0.0.0-20241219192143-6b3ec007d9bb // indirect
101+
google.golang.org/genproto/googleapis/rpc v0.0.0-20241219192143-6b3ec007d9bb // indirect
102+
google.golang.org/grpc v1.69.2 // indirect
103+
google.golang.org/protobuf v1.36.0 // indirect
104104
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
105105
gopkg.in/inf.v0 v0.9.1 // indirect
106106
gopkg.in/yaml.v2 v2.4.0 // indirect
107107
gopkg.in/yaml.v3 v3.0.1 // indirect
108-
k8s.io/apiextensions-apiserver v0.31.6 // indirect
109-
k8s.io/apiserver v0.31.6 // indirect
110-
k8s.io/component-base v0.31.6 // indirect
111-
k8s.io/gengo/v2 v2.0.0-20240826214909-a7b603a56eb7 // indirect
108+
k8s.io/apiextensions-apiserver v0.32.0 // indirect
109+
k8s.io/apiserver v0.32.0 // indirect
110+
k8s.io/component-base v0.32.0 // indirect
111+
k8s.io/gengo/v2 v2.0.0-20240911193312-2b36238f13e9 // indirect
112112
k8s.io/klog/v2 v2.130.1 // indirect
113-
k8s.io/kube-openapi v0.0.0-20240903163716-9e1beecbcb38 // indirect
114-
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 // indirect
113+
k8s.io/kube-openapi v0.0.0-20241212222426-2c72e554b1e7 // indirect
114+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.1 // indirect
115115
sigs.k8s.io/gateway-api v1.1.0 // indirect
116-
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
117-
sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
116+
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
117+
sigs.k8s.io/structured-merge-diff/v4 v4.5.0 // indirect
118118
)

0 commit comments

Comments
 (0)