Skip to content

Commit 67e12d5

Browse files
sebrandon1sebrandon1
committed
CNF-13731: Add HTTP01ChallengeProxy
1 parent c7fbd08 commit 67e12d5

File tree

3 files changed

+149
-0
lines changed

3 files changed

+149
-0
lines changed

‎config/v1/tests/apiservers.config.openshift.io/HTTP01ChallengeProxy.yaml

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
2+
name: "APIServer"
3+
crdName: apiservers.config.openshift.io
4+
featureGate: HTTP01ChallengeProxy
5+
tests:
6+
onCreate:
7+
- name: Should be able to create with HTTP01ChallengeProxy DefaultDeployment mode
8+
initial: |
9+
apiVersion: config.openshift.io/v1
10+
kind: APIServer
11+
spec:
12+
http01ChallengeProxy:
13+
mode: DefaultDeployment
14+
expected: |
15+
apiVersion: config.openshift.io/v1
16+
kind: APIServer
17+
spec:
18+
audit:
19+
profile: Default
20+
http01ChallengeProxy:
21+
mode: DefaultDeployment
22+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode
23+
initial: |
24+
apiVersion: config.openshift.io/v1
25+
kind: APIServer
26+
spec:
27+
http01ChallengeProxy:
28+
mode: CustomDeployment
29+
customDeployment:
30+
internalPort: 8888
31+
expected: |
32+
apiVersion: config.openshift.io/v1
33+
kind: APIServer
34+
spec:
35+
audit:
36+
profile: Default
37+
http01ChallengeProxy:
38+
mode: CustomDeployment
39+
customDeployment:
40+
internalPort: 8888
41+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with custom port
42+
initial: |
43+
apiVersion: config.openshift.io/v1
44+
kind: APIServer
45+
spec:
46+
http01ChallengeProxy:
47+
mode: CustomDeployment
48+
customDeployment:
49+
internalPort: 9999
50+
expected: |
51+
apiVersion: config.openshift.io/v1
52+
kind: APIServer
53+
spec:
54+
audit:
55+
profile: Default
56+
http01ChallengeProxy:
57+
mode: CustomDeployment
58+
customDeployment:
59+
internalPort: 9999
60+
- name: Should reject CustomDeployment mode without customDeployment field
61+
initial: |
62+
apiVersion: config.openshift.io/v1
63+
kind: APIServer
64+
spec:
65+
http01ChallengeProxy:
66+
mode: CustomDeployment
67+
expectedError: "customDeployment is required when mode is CustomDeployment and forbidden otherwise"
68+
- name: Should reject DefaultDeployment mode with customDeployment field
69+
initial: |
70+
apiVersion: config.openshift.io/v1
71+
kind: APIServer
72+
spec:
73+
http01ChallengeProxy:
74+
mode: DefaultDeployment
75+
customDeployment:
76+
internalPort: 8888
77+
expectedError: "customDeployment is required when mode is CustomDeployment and forbidden otherwise"
78+
- name: Should reject invalid mode
79+
initial: |
80+
apiVersion: config.openshift.io/v1
81+
kind: APIServer
82+
spec:
83+
http01ChallengeProxy:
84+
mode: InvalidMode
85+
expectedError: "spec.http01ChallengeProxy.mode: Unsupported value: \"InvalidMode\": supported values: \"DefaultDeployment\", \"CustomDeployment\""
86+
- name: Should reject port below minimum
87+
initial: |
88+
apiVersion: config.openshift.io/v1
89+
kind: APIServer
90+
spec:
91+
http01ChallengeProxy:
92+
mode: CustomDeployment
93+
customDeployment:
94+
internalPort: 1023
95+
expectedError: "spec.http01ChallengeProxy.customDeployment.internalPort: Invalid value: 1023: spec.http01ChallengeProxy.customDeployment.internalPort in body should be greater than or equal to 1024"
96+
- name: Should reject port above maximum
97+
initial: |
98+
apiVersion: config.openshift.io/v1
99+
kind: APIServer
100+
spec:
101+
http01ChallengeProxy:
102+
mode: CustomDeployment
103+
customDeployment:
104+
internalPort: 65536
105+
expectedError: "spec.http01ChallengeProxy.customDeployment.internalPort: Invalid value: 65536: spec.http01ChallengeProxy.customDeployment.internalPort in body should be less than or equal to 65535"

‎config/v1/types_apiserver.go

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,12 @@ type APIServerSpec struct {
6868
// +optional
6969
// +kubebuilder:default={profile: Default}
7070
Audit Audit `json:"audit"`
71+
// http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
72+
// that redirects traffic from the API endpoint on port 80 to ingress routers.
73+
// This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
74+
// +openshift:enable:FeatureGate=HTTP01ChallengeProxy
75+
// +optional
76+
HTTP01ChallengeProxy *HTTP01ChallengeProxySpec `json:"http01ChallengeProxy,omitempty"`
7177
}
7278

7379
// AuditProfileType defines the audit policy profile type.
@@ -234,6 +240,36 @@ const (
234240
EncryptionTypeKMS EncryptionType = "KMS"
235241
)
236242

243+
// +union
244+
// +kubebuilder:validation:XValidation:rule="self.mode == 'CustomDeployment' ? has(self.customDeployment) : !has(self.customDeployment)",message="customDeployment is required when mode is CustomDeployment and forbidden otherwise"
245+
type HTTP01ChallengeProxySpec struct {
246+
// mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
247+
// DefaultDeployment enables the proxy with default configuration.
248+
// CustomDeployment enables the proxy with user-specified configuration.
249+
// +kubebuilder:validation:Enum=DefaultDeployment;CustomDeployment
250+
// +required
251+
// +unionDiscriminator
252+
Mode string `json:"mode,omitempty"`
253+
254+
// customDeployment contains configuration options when mode is CustomDeployment.
255+
// This field is only valid when mode is CustomDeployment.
256+
// +optional
257+
// +unionMember
258+
CustomDeployment *HTTP01ChallengeProxyCustomDeploymentSpec `json:"customDeployment,omitempty"`
259+
}
260+
261+
// +kubebuilder:validation:MinProperties=1
262+
type HTTP01ChallengeProxyCustomDeploymentSpec struct {
263+
// internalPort specifies the internal port used by the proxy service.
264+
// Valid values are 1024-65535. Defaults to 8888.
265+
// This port is used to avoid conflicts with other workloads that may require port 8888 on the host.
266+
// +kubebuilder:validation:Minimum=1024
267+
// +kubebuilder:validation:Maximum=65535
268+
// +kubebuilder:default=8888
269+
// +optional
270+
InternalPort int32 `json:"internalPort,omitempty"`
271+
}
272+
237273
type APIServerStatus struct {
238274
}
239275

‎features/features.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -866,4 +866,12 @@ var (
866866
enhancementPR("https://github.com/openshift/enhancements/pull/1492").
867867
enableIn(configv1.DevPreviewNoUpgrade, configv1.TechPreviewNoUpgrade).
868868
mustRegister()
869+
870+
FeatureGateHTTP01ChallengeProxy = newFeatureGate("HTTP01ChallengeProxy").
871+
reportProblemsToJiraComponent("kube-apiserver").
872+
contactPerson("sebrandon1").
873+
productScope(ocpSpecific).
874+
enhancementPR("https://github.com/openshift/enhancements/pull/1773").
875+
enableIn(configv1.TechPreviewNoUpgrade).
876+
mustRegister()
869877
)

0 commit comments

Comments
 (0)