Skip to content

Commit 0b955f2

Browse files
sebrandon1sebrandon1
committed
CNF-13731: Add HTTP01ChallengeProxy
1 parent 7605f9b commit 0b955f2

20 files changed

+949
-1
lines changed

‎config/v1/tests/apiservers.config.openshift.io/HTTP01ChallengeProxy.yaml

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
apiVersion: config.openshift.io/v1
2+
kind: APIServer
3+
metadata:
4+
name: cluster
5+
spec:
6+
http01ChallengeProxy:
7+
mode: DefaultDeployment
8+
---
9+
apiVersion: config.openshift.io/v1
10+
kind: APIServer
11+
metadata:
12+
name: cluster
13+
spec:
14+
http01ChallengeProxy:
15+
mode: CustomDeployment
16+
customDeployment:
17+
internalPort: 8888
18+
---
19+
apiVersion: config.openshift.io/v1
20+
kind: APIServer
21+
metadata:
22+
name: cluster
23+
spec:
24+
http01ChallengeProxy:
25+
mode: CustomDeployment
26+
customDeployment:
27+
internalPort: 1024
28+
---
29+
apiVersion: config.openshift.io/v1
30+
kind: APIServer
31+
metadata:
32+
name: cluster
33+
spec:
34+
http01ChallengeProxy:
35+
mode: CustomDeployment
36+
customDeployment:
37+
internalPort: 65535
38+
---
39+
apiVersion: config.openshift.io/v1
40+
kind: APIServer
41+
metadata:
42+
name: cluster
43+
spec:
44+
http01ChallengeProxy:
45+
mode: CustomDeployment
46+
customDeployment:
47+
internalPort: 9999
48+
---
49+
apiVersion: config.openshift.io/v1
50+
kind: APIServer
51+
metadata:
52+
name: cluster
53+
spec:
54+
http01ChallengeProxy:
55+
mode: DefaultDeployment
56+
customDeployment:
57+
internalPort: 8888
58+
---
59+
apiVersion: config.openshift.io/v1
60+
kind: APIServer
61+
metadata:
62+
name: cluster
63+
spec:
64+
http01ChallengeProxy:
65+
mode: CustomDeployment
66+
customDeployment: {}
67+
---
68+
apiVersion: config.openshift.io/v1
69+
kind: APIServer
70+
metadata:
71+
name: cluster
72+
spec:
73+
http01ChallengeProxy:
74+
mode: CustomDeployment
75+
customDeployment:
76+
internalPort: 1023
77+
---
78+
apiVersion: config.openshift.io/v1
79+
kind: APIServer
80+
metadata:
81+
name: cluster
82+
spec:
83+
http01ChallengeProxy:
84+
mode: CustomDeployment
85+
customDeployment:
86+
internalPort: 65536

‎config/v1/types_apiserver.go

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,12 @@ type APIServerSpec struct {
6868
// +optional
6969
// +kubebuilder:default={profile: Default}
7070
Audit Audit `json:"audit"`
71+
// http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
72+
// that redirects traffic from the API endpoint on port 80 to ingress routers.
73+
// This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
74+
// +openshift:enable:FeatureGate=HTTP01ChallengeProxy
75+
// +optional
76+
HTTP01ChallengeProxy *HTTP01ChallengeProxySpec `json:"http01ChallengeProxy,omitempty"`
7177
}
7278

7379
// AuditProfileType defines the audit policy profile type.
@@ -234,6 +240,36 @@ const (
234240
EncryptionTypeKMS EncryptionType = "KMS"
235241
)
236242

243+
// +union
244+
// +kubebuilder:validation:XValidation:rule="self.mode == 'CustomDeployment' ? has(self.customDeployment) : !has(self.customDeployment)",message="customDeployment is required when mode is CustomDeployment and forbidden otherwise"
245+
type HTTP01ChallengeProxySpec struct {
246+
// mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
247+
// DefaultDeployment enables the proxy with default configuration.
248+
// CustomDeployment enables the proxy with user-specified configuration.
249+
// +kubebuilder:validation:Enum=DefaultDeployment;CustomDeployment
250+
// +kubebuilder:default=DefaultDeployment
251+
// +optional
252+
// +unionDiscriminator
253+
Mode string `json:"mode,omitempty"`
254+
255+
// customDeployment contains configuration options when mode is CustomDeployment.
256+
// This field is only valid when mode is CustomDeployment.
257+
// +optional
258+
// +unionMember
259+
CustomDeployment HTTP01ChallengeProxyCustomDeploymentSpec `json:"customDeployment,omitzero,omitempty"`
260+
}
261+
262+
// +kubebuilder:validation:MinProperties=1
263+
type HTTP01ChallengeProxyCustomDeploymentSpec struct {
264+
// internalPort specifies the internal port used by the proxy service.
265+
// Valid values are 1024-65535.
266+
// This port must be specified to avoid conflicts with other workloads on the host.
267+
// +kubebuilder:validation:Minimum=1024
268+
// +kubebuilder:validation:Maximum=65535
269+
// +required
270+
InternalPort int32 `json:"internalPort"`
271+
}
272+
237273
type APIServerStatus struct {
238274
}
239275

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,46 @@ spec:
249249
forbidden otherwise
250250
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251251
!has(self.kms)'
252+
http01ChallengeProxy:
253+
description: |-
254+
http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
255+
that redirects traffic from the API endpoint on port 80 to ingress routers.
256+
This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
257+
properties:
258+
customDeployment:
259+
description: |-
260+
customDeployment contains configuration options when mode is CustomDeployment.
261+
This field is only valid when mode is CustomDeployment.
262+
minProperties: 1
263+
properties:
264+
internalPort:
265+
description: |-
266+
internalPort specifies the internal port used by the proxy service.
267+
Valid values are 1024-65535.
268+
This port must be specified to avoid conflicts with other workloads on the host.
269+
format: int32
270+
maximum: 65535
271+
minimum: 1024
272+
type: integer
273+
required:
274+
- internalPort
275+
type: object
276+
mode:
277+
default: DefaultDeployment
278+
description: |-
279+
mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
280+
DefaultDeployment enables the proxy with default configuration.
281+
CustomDeployment enables the proxy with user-specified configuration.
282+
enum:
283+
- DefaultDeployment
284+
- CustomDeployment
285+
type: string
286+
type: object
287+
x-kubernetes-validations:
288+
- message: customDeployment is required when mode is CustomDeployment
289+
and forbidden otherwise
290+
rule: 'self.mode == ''CustomDeployment'' ? has(self.customDeployment)
291+
: !has(self.customDeployment)'
252292
servingCerts:
253293
description: |-
254294
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,46 @@ spec:
249249
forbidden otherwise
250250
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251251
!has(self.kms)'
252+
http01ChallengeProxy:
253+
description: |-
254+
http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
255+
that redirects traffic from the API endpoint on port 80 to ingress routers.
256+
This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
257+
properties:
258+
customDeployment:
259+
description: |-
260+
customDeployment contains configuration options when mode is CustomDeployment.
261+
This field is only valid when mode is CustomDeployment.
262+
minProperties: 1
263+
properties:
264+
internalPort:
265+
description: |-
266+
internalPort specifies the internal port used by the proxy service.
267+
Valid values are 1024-65535.
268+
This port must be specified to avoid conflicts with other workloads on the host.
269+
format: int32
270+
maximum: 65535
271+
minimum: 1024
272+
type: integer
273+
required:
274+
- internalPort
275+
type: object
276+
mode:
277+
default: DefaultDeployment
278+
description: |-
279+
mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
280+
DefaultDeployment enables the proxy with default configuration.
281+
CustomDeployment enables the proxy with user-specified configuration.
282+
enum:
283+
- DefaultDeployment
284+
- CustomDeployment
285+
type: string
286+
type: object
287+
x-kubernetes-validations:
288+
- message: customDeployment is required when mode is CustomDeployment
289+
and forbidden otherwise
290+
rule: 'self.mode == ''CustomDeployment'' ? has(self.customDeployment)
291+
: !has(self.customDeployment)'
252292
servingCerts:
253293
description: |-
254294
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

‎config/v1/zz_generated.deepcopy.go

Lines changed: 38 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/v1/zz_generated.featuregated-crd-manifests.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ apiservers.config.openshift.io:
66
Capability: ""
77
Category: ""
88
FeatureGates:
9+
- HTTP01ChallengeProxy
910
- KMSEncryptionProvider
1011
FilenameOperatorName: config-operator
1112
FilenameOperatorOrdering: "01"

0 commit comments

Comments
 (0)