Skip to content

Commit 34d645a

Browse files
sebrandon1sebrandon1
committed
CNF-13731: Add HTTP01ChallengeProxy
Fix HTTP01ChallengeProxy integration test structure and enable feature gate in TechPreviewNoUpgrade - Fixed test file structure to include required crdName metadata for integration tests - Enabled HTTP01ChallengeProxy feature gate in both DevPreviewNoUpgrade and TechPreviewNoUpgrade - Regenerated feature gate manifests via make update - Resolved CI failure: missing required field crdName in test spec Make internalPort optional to resolve API compatibility error - Changed internalPort from required to optional (*int32 with omitempty) - This resolves the NoNewRequiredFields API compatibility violation - Updated test case to reflect optional field behavior - Users can now omit internalPort for custom deployments - Regenerated deepcopy functions and OpenAPI schemas Address comments 1 Update codegen crds Adjust back to required Remove pointer Address comments for linter
1 parent 4a165b2 commit 34d645a

22 files changed

+1098
-4
lines changed

‎config/v1/tests/apiservers.config.openshift.io/HTTP01ChallengeProxy.yaml

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
2+
name: "APIServer"
3+
crdName: apiservers.config.openshift.io
4+
featureGates:
5+
- HTTP01ChallengeProxy
6+
tests:
7+
onCreate:
8+
- name: Should be able to create with HTTP01ChallengeProxy DefaultDeployment mode
9+
initial: |
10+
apiVersion: config.openshift.io/v1
11+
kind: APIServer
12+
spec:
13+
http01ChallengeProxy:
14+
mode: DefaultDeployment
15+
expected: |
16+
apiVersion: config.openshift.io/v1
17+
kind: APIServer
18+
spec:
19+
audit:
20+
profile: Default
21+
http01ChallengeProxy:
22+
mode: DefaultDeployment
23+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with port 8888
24+
initial: |
25+
apiVersion: config.openshift.io/v1
26+
kind: APIServer
27+
spec:
28+
http01ChallengeProxy:
29+
mode: CustomDeployment
30+
customDeployment:
31+
internalPort: 8888
32+
expected: |
33+
apiVersion: config.openshift.io/v1
34+
kind: APIServer
35+
spec:
36+
audit:
37+
profile: Default
38+
http01ChallengeProxy:
39+
mode: CustomDeployment
40+
customDeployment:
41+
internalPort: 8888
42+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with minimum port 1024
43+
initial: |
44+
apiVersion: config.openshift.io/v1
45+
kind: APIServer
46+
spec:
47+
http01ChallengeProxy:
48+
mode: CustomDeployment
49+
customDeployment:
50+
internalPort: 1024
51+
expected: |
52+
apiVersion: config.openshift.io/v1
53+
kind: APIServer
54+
spec:
55+
audit:
56+
profile: Default
57+
http01ChallengeProxy:
58+
mode: CustomDeployment
59+
customDeployment:
60+
internalPort: 1024
61+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with maximum port 65535
62+
initial: |
63+
apiVersion: config.openshift.io/v1
64+
kind: APIServer
65+
spec:
66+
http01ChallengeProxy:
67+
mode: CustomDeployment
68+
customDeployment:
69+
internalPort: 65535
70+
expected: |
71+
apiVersion: config.openshift.io/v1
72+
kind: APIServer
73+
spec:
74+
audit:
75+
profile: Default
76+
http01ChallengeProxy:
77+
mode: CustomDeployment
78+
customDeployment:
79+
internalPort: 65535
80+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with valid port 9999
81+
initial: |
82+
apiVersion: config.openshift.io/v1
83+
kind: APIServer
84+
spec:
85+
http01ChallengeProxy:
86+
mode: CustomDeployment
87+
customDeployment:
88+
internalPort: 9999
89+
expected: |
90+
apiVersion: config.openshift.io/v1
91+
kind: APIServer
92+
spec:
93+
audit:
94+
profile: Default
95+
http01ChallengeProxy:
96+
mode: CustomDeployment
97+
customDeployment:
98+
internalPort: 9999
99+
- name: Should reject DefaultDeployment mode with customDeployment field
100+
initial: |
101+
apiVersion: config.openshift.io/v1
102+
kind: APIServer
103+
spec:
104+
http01ChallengeProxy:
105+
mode: DefaultDeployment
106+
customDeployment:
107+
internalPort: 8888
108+
expectedError: "customDeployment is required when mode is CustomDeployment and forbidden otherwise"
109+
- name: Should reject CustomDeployment mode without internalPort
110+
initial: |
111+
apiVersion: config.openshift.io/v1
112+
kind: APIServer
113+
spec:
114+
http01ChallengeProxy:
115+
mode: CustomDeployment
116+
customDeployment: {}
117+
expectedError: "spec.http01ChallengeProxy.customDeployment.internalPort: Required value"
118+
- name: Should reject CustomDeployment mode with port below minimum 1023
119+
initial: |
120+
apiVersion: config.openshift.io/v1
121+
kind: APIServer
122+
spec:
123+
http01ChallengeProxy:
124+
mode: CustomDeployment
125+
customDeployment:
126+
internalPort: 1023
127+
expectedError: "Invalid value: 1023: spec.http01ChallengeProxy.customDeployment.internalPort in body should be greater than or equal to 1024"
128+
- name: Should reject CustomDeployment mode with port above maximum 65536
129+
initial: |
130+
apiVersion: config.openshift.io/v1
131+
kind: APIServer
132+
spec:
133+
http01ChallengeProxy:
134+
mode: CustomDeployment
135+
customDeployment:
136+
internalPort: 65536
137+
expectedError: "should be less than or equal to 65535"

‎config/v1/types_apiserver.go

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,12 @@ type APIServerSpec struct {
6868
// +optional
6969
// +kubebuilder:default={profile: Default}
7070
Audit Audit `json:"audit"`
71+
// http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
72+
// that redirects traffic from the API endpoint on port 80 to ingress routers.
73+
// This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
74+
// +openshift:enable:FeatureGate=HTTP01ChallengeProxy
75+
// +optional
76+
HTTP01ChallengeProxy HTTP01ChallengeProxySpec `json:"http01ChallengeProxy,omitzero,omitempty"`
7177
}
7278

7379
// AuditProfileType defines the audit policy profile type.
@@ -114,6 +120,7 @@ type Audit struct {
114120
// If unset, the 'Default' profile is used as the default.
115121
//
116122
// +kubebuilder:default=Default
123+
// +optional
117124
Profile AuditProfileType `json:"profile,omitempty"`
118125
// customRules specify profiles per group. These profile take precedence over the
119126
// top-level profile field if they apply. They are evaluation from top to bottom and
@@ -234,6 +241,45 @@ const (
234241
EncryptionTypeKMS EncryptionType = "KMS"
235242
)
236243

244+
// HTTP01ChallengeProxyMode defines how the HTTP01 challenge proxy should be deployed.
245+
// +kubebuilder:validation:Enum=DefaultDeployment;CustomDeployment
246+
type HTTP01ChallengeProxyMode string
247+
248+
const (
249+
// HTTP01ChallengeProxyModeDefaultDeployment enables the proxy with default configuration.
250+
HTTP01ChallengeProxyModeDefaultDeployment HTTP01ChallengeProxyMode = "DefaultDeployment"
251+
// HTTP01ChallengeProxyModeCustomDeployment enables the proxy with user-specified configuration.
252+
HTTP01ChallengeProxyModeCustomDeployment HTTP01ChallengeProxyMode = "CustomDeployment"
253+
)
254+
255+
// +union
256+
// +kubebuilder:validation:XValidation:rule="self.mode == 'CustomDeployment' ? has(self.customDeployment) : !has(self.customDeployment)",message="customDeployment is required when mode is CustomDeployment and forbidden otherwise"
257+
type HTTP01ChallengeProxySpec struct {
258+
// mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
259+
// DefaultDeployment enables the proxy with default configuration.
260+
// CustomDeployment enables the proxy with user-specified configuration.
261+
// +required
262+
// +unionDiscriminator
263+
Mode HTTP01ChallengeProxyMode `json:"mode,omitempty"`
264+
265+
// customDeployment contains configuration options when mode is CustomDeployment.
266+
// This field is only valid when mode is CustomDeployment.
267+
// +optional
268+
// +unionMember
269+
CustomDeployment HTTP01ChallengeProxyCustomDeploymentSpec `json:"customDeployment,omitzero,omitempty"`
270+
}
271+
272+
type HTTP01ChallengeProxyCustomDeploymentSpec struct {
273+
// internalPort specifies the internal port used by the proxy service.
274+
// Valid values are 1024-65535.
275+
// When not specified for CustomDeployment mode, users should ensure their chosen port
276+
// does not conflict with other workloads on the host.
277+
// +kubebuilder:validation:Minimum=1024
278+
// +kubebuilder:validation:Maximum=65535
279+
// +required
280+
InternalPort int32 `json:"internalPort,omitempty"`
281+
}
282+
237283
type APIServerStatus struct {
238284
}
239285

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,47 @@ spec:
249249
forbidden otherwise
250250
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251251
!has(self.kms)'
252+
http01ChallengeProxy:
253+
description: |-
254+
http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
255+
that redirects traffic from the API endpoint on port 80 to ingress routers.
256+
This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
257+
properties:
258+
customDeployment:
259+
description: |-
260+
customDeployment contains configuration options when mode is CustomDeployment.
261+
This field is only valid when mode is CustomDeployment.
262+
properties:
263+
internalPort:
264+
description: |-
265+
internalPort specifies the internal port used by the proxy service.
266+
Valid values are 1024-65535.
267+
When not specified for CustomDeployment mode, users should ensure their chosen port
268+
does not conflict with other workloads on the host.
269+
format: int32
270+
maximum: 65535
271+
minimum: 1024
272+
type: integer
273+
required:
274+
- internalPort
275+
type: object
276+
mode:
277+
description: |-
278+
mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
279+
DefaultDeployment enables the proxy with default configuration.
280+
CustomDeployment enables the proxy with user-specified configuration.
281+
enum:
282+
- DefaultDeployment
283+
- CustomDeployment
284+
type: string
285+
required:
286+
- mode
287+
type: object
288+
x-kubernetes-validations:
289+
- message: customDeployment is required when mode is CustomDeployment
290+
and forbidden otherwise
291+
rule: 'self.mode == ''CustomDeployment'' ? has(self.customDeployment)
292+
: !has(self.customDeployment)'
252293
servingCerts:
253294
description: |-
254295
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,47 @@ spec:
249249
forbidden otherwise
250250
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251251
!has(self.kms)'
252+
http01ChallengeProxy:
253+
description: |-
254+
http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
255+
that redirects traffic from the API endpoint on port 80 to ingress routers.
256+
This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
257+
properties:
258+
customDeployment:
259+
description: |-
260+
customDeployment contains configuration options when mode is CustomDeployment.
261+
This field is only valid when mode is CustomDeployment.
262+
properties:
263+
internalPort:
264+
description: |-
265+
internalPort specifies the internal port used by the proxy service.
266+
Valid values are 1024-65535.
267+
When not specified for CustomDeployment mode, users should ensure their chosen port
268+
does not conflict with other workloads on the host.
269+
format: int32
270+
maximum: 65535
271+
minimum: 1024
272+
type: integer
273+
required:
274+
- internalPort
275+
type: object
276+
mode:
277+
description: |-
278+
mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
279+
DefaultDeployment enables the proxy with default configuration.
280+
CustomDeployment enables the proxy with user-specified configuration.
281+
enum:
282+
- DefaultDeployment
283+
- CustomDeployment
284+
type: string
285+
required:
286+
- mode
287+
type: object
288+
x-kubernetes-validations:
289+
- message: customDeployment is required when mode is CustomDeployment
290+
and forbidden otherwise
291+
rule: 'self.mode == ''CustomDeployment'' ? has(self.customDeployment)
292+
: !has(self.customDeployment)'
252293
servingCerts:
253294
description: |-
254295
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,47 @@ spec:
249249
forbidden otherwise
250250
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251251
!has(self.kms)'
252+
http01ChallengeProxy:
253+
description: |-
254+
http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
255+
that redirects traffic from the API endpoint on port 80 to ingress routers.
256+
This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
257+
properties:
258+
customDeployment:
259+
description: |-
260+
customDeployment contains configuration options when mode is CustomDeployment.
261+
This field is only valid when mode is CustomDeployment.
262+
properties:
263+
internalPort:
264+
description: |-
265+
internalPort specifies the internal port used by the proxy service.
266+
Valid values are 1024-65535.
267+
When not specified for CustomDeployment mode, users should ensure their chosen port
268+
does not conflict with other workloads on the host.
269+
format: int32
270+
maximum: 65535
271+
minimum: 1024
272+
type: integer
273+
required:
274+
- internalPort
275+
type: object
276+
mode:
277+
description: |-
278+
mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
279+
DefaultDeployment enables the proxy with default configuration.
280+
CustomDeployment enables the proxy with user-specified configuration.
281+
enum:
282+
- DefaultDeployment
283+
- CustomDeployment
284+
type: string
285+
required:
286+
- mode
287+
type: object
288+
x-kubernetes-validations:
289+
- message: customDeployment is required when mode is CustomDeployment
290+
and forbidden otherwise
291+
rule: 'self.mode == ''CustomDeployment'' ? has(self.customDeployment)
292+
: !has(self.customDeployment)'
252293
servingCerts:
253294
description: |-
254295
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

‎config/v1/zz_generated.deepcopy.go

Lines changed: 34 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)