Skip to content

Commit 5133521

Browse files
jimmidysonjimmidyson
committed
feat: Auto renewal of control plane certificates patch
This commit enables configuration of automatic certificate renewal via the Kubeadm Control Plane provider as detailed in https://cluster-api.sigs.k8s.io/tasks/certs/auto-rotate-certificates-in-kcp.html. Although there is a reasonably sized refactoring (including renames) the API types in the api module, the variable schema as opposed to CAPI clusters via the external patches hook contains only the changes for auto-renewal of certificates. I feel this is OK as the main clients of the API are the Cluster authors rather than other projects using this via code at this point at least.
1 parent da32b0f commit 5133521

26 files changed

+628
-160
lines changed

‎api/v1alpha1/clusterconfig_types.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ type AWSClusterConfigSpec struct {
7676
Addons *AWSAddons `json:"addons,omitempty"`
7777

7878
// +kubebuilder:validation:Optional
79-
ControlPlane *AWSControlPlaneNodeConfigSpec `json:"controlPlane,omitempty"`
79+
ControlPlane *AWSControlPlaneSpec `json:"controlPlane,omitempty"`
8080

8181
// Extra Subject Alternative Names for the API Server signing cert.
8282
// +kubebuilder:validation:Optional
@@ -111,7 +111,7 @@ type DockerClusterConfigSpec struct {
111111
Addons *DockerAddons `json:"addons,omitempty"`
112112

113113
// +kubebuilder:validation:Optional
114-
ControlPlane *DockerNodeConfigSpec `json:"controlPlane,omitempty"`
114+
ControlPlane *DockerControlPlaneSpec `json:"controlPlane,omitempty"`
115115

116116
// Extra Subject Alternative Names for the API Server signing cert.
117117
// For the Docker provider, the following default SANs will always be added:
@@ -151,7 +151,7 @@ type NutanixClusterConfigSpec struct {
151151
Addons *NutanixAddons `json:"addons,omitempty"`
152152

153153
// +kubebuilder:validation:Optional
154-
ControlPlane *NutanixNodeConfigSpec `json:"controlPlane,omitempty"`
154+
ControlPlane *NutanixControlPlaneSpec `json:"controlPlane,omitempty"`
155155

156156
// Subject Alternative Names for the API Server signing cert.
157157
// For the Nutanix provider, the following default SANs will always be added:

‎api/v1alpha1/controlplane_types.go‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// Copyright 2024 Nutanix. All rights reserved.
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
package v1alpha1
5+
6+
type GenericControlPlaneSpec struct {
7+
// AutoRenewCertificates specifies the configuration for auto-renewing the
8+
// certificates of the control plane.
9+
// +kubebuilder:validation:Optional
10+
AutoRenewCertificates *AutoRenewCertificatesSpec `json:"autoRenewCertificates,omitempty"`
11+
}
12+
13+
type AutoRenewCertificatesSpec struct {
14+
// DaysBeforeExpiry indicates a rollout needs to be performed if the
15+
// certificates of the control plane will expire within the specified days.
16+
// +kubebuilder:validation:Required
17+
// +kubebuilder:validation:Minimum=7
18+
DaysBeforeExpiry int32 `json:"daysBeforeExpiry,omitempty"`
19+
}
20+
21+
// DockerControlPlaneSpec defines the desired state of the control plane for a Docker cluster.
22+
type DockerControlPlaneSpec struct {
23+
// +kubebuilder:validation:Optional
24+
Docker *DockerNodeSpec `json:"docker,omitempty"`
25+
26+
GenericControlPlaneSpec `json:",inline"`
27+
28+
GenericNodeSpec `json:",inline"`
29+
}
30+
31+
// NutanixControlPlaneSpec defines the desired state of the control plane for a Nutanix cluster.
32+
type NutanixControlPlaneSpec struct {
33+
// +kubebuilder:validation:Optional
34+
Nutanix *NutanixNodeSpec `json:"nutanix,omitempty"`
35+
36+
GenericControlPlaneSpec `json:",inline"`
37+
38+
GenericNodeSpec `json:",inline"`
39+
}
40+
41+
// AWSControlPlaneSpec defines the desired state of the control plane for an AWS cluster.
42+
type AWSControlPlaneSpec struct {
43+
// +kubebuilder:validation:Optional
44+
AWS *AWSControlPlaneNodeSpec `json:"aws,omitempty"`
45+
46+
GenericControlPlaneSpec `json:",inline"`
47+
48+
GenericNodeSpec `json:",inline"`
49+
}

‎api/v1alpha1/crds/caren.nutanix.com_awsclusterconfigs.yaml‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -295,11 +295,23 @@ spec:
295295
type: string
296296
type: object
297297
controlPlane:
298-
description: |-
299-
AWSControlPlaneConfigSpec defines the desired state of AWSNodeConfig.
300-
Place any configuration that can be applied to individual Nodes here.
301-
Otherwise, it should go into the ClusterConfigSpec.
298+
description: AWSControlPlaneSpec defines the desired state of the control plane for an AWS cluster.
302299
properties:
300+
autoRenewCertificates:
301+
description: |-
302+
AutoRenewCertificates specifies the configuration for auto-renewing the
303+
certificates of the control plane.
304+
properties:
305+
daysBeforeExpiry:
306+
description: |-
307+
DaysBeforeExpiry indicates a rollout needs to be performed if the
308+
certificates of the control plane will expire within the specified days.
309+
format: int32
310+
minimum: 7
311+
type: integer
312+
required:
313+
- daysBeforeExpiry
314+
type: object
303315
aws:
304316
properties:
305317
additionalSecurityGroups:

‎api/v1alpha1/crds/caren.nutanix.com_dockerclusterconfigs.yaml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,8 +251,23 @@ spec:
251251
type: object
252252
type: object
253253
controlPlane:
254-
description: DockerNodeConfigSpec defines the desired state of DockerNodeSpec.
254+
description: DockerControlPlaneSpec defines the desired state of the control plane for a Docker cluster.
255255
properties:
256+
autoRenewCertificates:
257+
description: |-
258+
AutoRenewCertificates specifies the configuration for auto-renewing the
259+
certificates of the control plane.
260+
properties:
261+
daysBeforeExpiry:
262+
description: |-
263+
DaysBeforeExpiry indicates a rollout needs to be performed if the
264+
certificates of the control plane will expire within the specified days.
265+
format: int32
266+
minimum: 7
267+
type: integer
268+
required:
269+
- daysBeforeExpiry
270+
type: object
256271
docker:
257272
properties:
258273
customImage:

‎api/v1alpha1/crds/caren.nutanix.com_dockernodeconfigs.yaml‎ renamed to ‎api/v1alpha1/crds/caren.nutanix.com_dockerworkernodeconfigs.yaml‎

Lines changed: 24 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,21 @@ kind: CustomResourceDefinition
66
metadata:
77
annotations:
88
controller-gen.kubebuilder.io/version: (devel)
9-
name: dockernodeconfigs.caren.nutanix.com
9+
name: dockerworkernodeconfigs.caren.nutanix.com
1010
spec:
1111
group: caren.nutanix.com
1212
names:
13-
kind: DockerNodeConfig
14-
listKind: DockerNodeConfigList
15-
plural: dockernodeconfigs
16-
singular: dockernodeconfig
13+
kind: DockerWorkerNodeConfig
14+
listKind: DockerWorkerNodeConfigList
15+
plural: dockerworkernodeconfigs
16+
singular: dockerworkernodeconfig
1717
scope: Namespaced
1818
versions:
1919
- name: v1alpha1
2020
schema:
2121
openAPIV3Schema:
22-
description: DockerNodeConfig is the Schema for the dockernodeconfigs API.
22+
description: DockerWorkerNodeConfig is the Schema for the dockerworkernodeconfigs
23+
API.
2324
properties:
2425
apiVersion:
2526
description: |-
@@ -39,8 +40,24 @@ spec:
3940
metadata:
4041
type: object
4142
spec:
42-
description: DockerNodeConfigSpec defines the desired state of DockerNodeSpec.
43+
description: DockerControlPlaneSpec defines the desired state of the control
44+
plane for a Docker cluster.
4345
properties:
46+
autoRenewCertificates:
47+
description: |-
48+
AutoRenewCertificates specifies the configuration for auto-renewing the
49+
certificates of the control plane.
50+
properties:
51+
daysBeforeExpiry:
52+
description: |-
53+
DaysBeforeExpiry indicates a rollout needs to be performed if the
54+
certificates of the control plane will expire within the specified days.
55+
format: int32
56+
minimum: 7
57+
type: integer
58+
required:
59+
- daysBeforeExpiry
60+
type: object
4461
docker:
4562
properties:
4663
customImage:

‎api/v1alpha1/crds/caren.nutanix.com_nutanixclusterconfigs.yaml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,8 +251,23 @@ spec:
251251
type: object
252252
type: object
253253
controlPlane:
254-
description: NutanixNodeSpec defines the desired state of NutanixNodeSpec.
254+
description: NutanixControlPlaneSpec defines the desired state of the control plane for a Nutanix cluster.
255255
properties:
256+
autoRenewCertificates:
257+
description: |-
258+
AutoRenewCertificates specifies the configuration for auto-renewing the
259+
certificates of the control plane.
260+
properties:
261+
daysBeforeExpiry:
262+
description: |-
263+
DaysBeforeExpiry indicates a rollout needs to be performed if the
264+
certificates of the control plane will expire within the specified days.
265+
format: int32
266+
minimum: 7
267+
type: integer
268+
required:
269+
- daysBeforeExpiry
270+
type: object
256271
nutanix:
257272
properties:
258273
machineDetails:

‎api/v1alpha1/crds/caren.nutanix.com_nutanixnodeconfigs.yaml‎ renamed to ‎api/v1alpha1/crds/caren.nutanix.com_nutanixworkernodeconfigs.yaml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,20 @@ kind: CustomResourceDefinition
66
metadata:
77
annotations:
88
controller-gen.kubebuilder.io/version: (devel)
9-
name: nutanixnodeconfigs.caren.nutanix.com
9+
name: nutanixworkernodeconfigs.caren.nutanix.com
1010
spec:
1111
group: caren.nutanix.com
1212
names:
13-
kind: NutanixNodeConfig
14-
listKind: NutanixNodeConfigList
15-
plural: nutanixnodeconfigs
16-
singular: nutanixnodeconfig
13+
kind: NutanixWorkerNodeConfig
14+
listKind: NutanixWorkerNodeConfigList
15+
plural: nutanixworkernodeconfigs
16+
singular: nutanixworkernodeconfig
1717
scope: Namespaced
1818
versions:
1919
- name: v1alpha1
2020
schema:
2121
openAPIV3Schema:
22-
description: NutanixNodeConfig is the Schema for the nutanixnodeconfigs API.
22+
description: NutanixWorkerNodeConfig is the Schema for the nutanixworkernodeconfigs API.
2323
properties:
2424
apiVersion:
2525
description: |-
@@ -39,7 +39,7 @@ spec:
3939
metadata:
4040
type: object
4141
spec:
42-
description: NutanixNodeSpec defines the desired state of NutanixNodeSpec.
42+
description: NutanixWorkerNodeConfigSpec defines the desired state of NutanixNodeSpec.
4343
properties:
4444
nutanix:
4545
properties:

‎api/v1alpha1/nodeconfig_types.go‎

Lines changed: 21 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@ import (
1313
)
1414

1515
var (
16-
//go:embed crds/caren.nutanix.com_dockernodeconfigs.yaml
16+
//go:embed crds/caren.nutanix.com_dockerworkernodeconfigs.yaml
1717
dockerNodeConfigCRDDefinition []byte
1818
//go:embed crds/caren.nutanix.com_awsworkernodeconfigs.yaml
1919
awsNodeConfigCRDDefinition []byte
20-
//go:embed crds/caren.nutanix.com_nutanixnodeconfigs.yaml
20+
//go:embed crds/caren.nutanix.com_nutanixworkernodeconfigs.yaml
2121
nutanixNodeConfigCRDDefinition []byte
2222

2323
dockerNodeConfigVariableSchema = variables.MustSchemaFromCRDYAML(
@@ -54,33 +54,25 @@ type AWSWorkerNodeConfigSpec struct {
5454
GenericNodeSpec `json:",inline"`
5555
}
5656

57-
// AWSControlPlaneConfigSpec defines the desired state of AWSNodeConfig.
58-
// Place any configuration that can be applied to individual Nodes here.
59-
// Otherwise, it should go into the ClusterConfigSpec.
60-
type AWSControlPlaneNodeConfigSpec struct {
61-
// +kubebuilder:validation:Optional
62-
AWS *AWSControlPlaneNodeSpec `json:"aws,omitempty"`
63-
64-
GenericNodeSpec `json:",inline"`
65-
}
66-
6757
// +kubebuilder:object:root=true
6858

69-
// DockerNodeConfig is the Schema for the dockernodeconfigs API.
70-
type DockerNodeConfig struct {
59+
// DockerWorkerNodeConfig is the Schema for the dockerworkernodeconfigs API.
60+
type DockerWorkerNodeConfig struct {
7161
metav1.TypeMeta `json:",inline"`
7262
metav1.ObjectMeta `json:"metadata,omitempty"`
7363

7464
// +kubebuilder:validation:Optional
75-
Spec DockerNodeConfigSpec `json:"spec,omitempty"`
65+
Spec DockerControlPlaneSpec `json:"spec,omitempty"`
7666
}
7767

78-
func (s DockerNodeConfig) VariableSchema() clusterv1.VariableSchema { //nolint:gocritic,lll // Passed by value for no potential side-effect.
68+
func (s DockerWorkerNodeConfig) VariableSchema() clusterv1.VariableSchema { //nolint:gocritic,lll // Passed by value for no potential side-effect.
7969
return dockerNodeConfigVariableSchema
8070
}
8171

82-
// DockerNodeConfigSpec defines the desired state of DockerNodeSpec.
83-
type DockerNodeConfigSpec struct {
72+
// DockerWorkerNodeConfigSpec defines the desired state of DockerNodeConfig.
73+
// Place any configuration that can be applied to individual Nodes here.
74+
// Otherwise, it should go into the ClusterConfigSpec.
75+
type DockerWorkerNodeConfigSpec struct {
8476
// +kubebuilder:validation:Optional
8577
Docker *DockerNodeSpec `json:"docker,omitempty"`
8678

@@ -89,21 +81,21 @@ type DockerNodeConfigSpec struct {
8981

9082
// +kubebuilder:object:root=true
9183

92-
// NutanixNodeConfig is the Schema for the nutanixnodeconfigs API.
93-
type NutanixNodeConfig struct {
84+
// NutanixWorkerNodeConfig is the Schema for the nutanixworkernodeconfigs API.
85+
type NutanixWorkerNodeConfig struct {
9486
metav1.TypeMeta `json:",inline"`
9587
metav1.ObjectMeta `json:"metadata,omitempty"`
9688

9789
// +kubebuilder:validation:Optional
98-
Spec NutanixNodeConfigSpec `json:"spec,omitempty"`
90+
Spec NutanixWorkerNodeConfigSpec `json:"spec,omitempty"`
9991
}
10092

101-
func (s NutanixNodeConfig) VariableSchema() clusterv1.VariableSchema { //nolint:gocritic,lll // Passed by value for no potential side-effect.
93+
func (s NutanixWorkerNodeConfig) VariableSchema() clusterv1.VariableSchema { //nolint:gocritic,lll // Passed by value for no potential side-effect.
10294
return nutanixNodeConfigVariableSchema
10395
}
10496

105-
// NutanixNodeSpec defines the desired state of NutanixNodeSpec.
106-
type NutanixNodeConfigSpec struct {
97+
// NutanixWorkerNodeConfigSpec defines the desired state of NutanixNodeSpec.
98+
type NutanixWorkerNodeConfigSpec struct {
10799
// +kubebuilder:validation:Optional
108100
Nutanix *NutanixNodeSpec `json:"nutanix,omitempty"`
109101

@@ -156,5 +148,9 @@ const (
156148

157149
//nolint:gochecknoinits // Idiomatic to use init functions to register APIs with scheme.
158150
func init() {
159-
SchemeBuilder.Register(&AWSWorkerNodeConfig{}, &DockerNodeConfig{}, &NutanixNodeConfig{})
151+
SchemeBuilder.Register(
152+
&AWSWorkerNodeConfig{},
153+
&DockerWorkerNodeConfig{},
154+
&NutanixWorkerNodeConfig{},
155+
)
160156
}

0 commit comments

Comments
 (0)