Skip to content

Commit 75b13cb

Browse files
sebrandon1sebrandon1
committed
CNF-13731: Add HTTP01ChallengeProxy
Fix HTTP01ChallengeProxy integration test structure and enable feature gate in TechPreviewNoUpgrade - Fixed test file structure to include required crdName metadata for integration tests - Enabled HTTP01ChallengeProxy feature gate in both DevPreviewNoUpgrade and TechPreviewNoUpgrade - Regenerated feature gate manifests via make update - Resolved CI failure: missing required field crdName in test spec
1 parent cc869c8 commit 75b13cb

20 files changed

+998
-1
lines changed

‎config/v1/tests/apiservers.config.openshift.io/HTTP01ChallengeProxy.yaml

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
2+
name: "APIServer"
3+
crdName: apiservers.config.openshift.io
4+
tests:
5+
onCreate:
6+
- name: Should be able to create with HTTP01ChallengeProxy DefaultDeployment mode
7+
initial: |
8+
apiVersion: config.openshift.io/v1
9+
kind: APIServer
10+
spec:
11+
http01ChallengeProxy:
12+
mode: DefaultDeployment
13+
expected: |
14+
apiVersion: config.openshift.io/v1
15+
kind: APIServer
16+
spec:
17+
audit:
18+
profile: Default
19+
http01ChallengeProxy:
20+
mode: DefaultDeployment
21+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with port 8888
22+
initial: |
23+
apiVersion: config.openshift.io/v1
24+
kind: APIServer
25+
spec:
26+
http01ChallengeProxy:
27+
mode: CustomDeployment
28+
customDeployment:
29+
internalPort: 8888
30+
expected: |
31+
apiVersion: config.openshift.io/v1
32+
kind: APIServer
33+
spec:
34+
audit:
35+
profile: Default
36+
http01ChallengeProxy:
37+
mode: CustomDeployment
38+
customDeployment:
39+
internalPort: 8888
40+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with minimum port 1024
41+
initial: |
42+
apiVersion: config.openshift.io/v1
43+
kind: APIServer
44+
spec:
45+
http01ChallengeProxy:
46+
mode: CustomDeployment
47+
customDeployment:
48+
internalPort: 1024
49+
expected: |
50+
apiVersion: config.openshift.io/v1
51+
kind: APIServer
52+
spec:
53+
audit:
54+
profile: Default
55+
http01ChallengeProxy:
56+
mode: CustomDeployment
57+
customDeployment:
58+
internalPort: 1024
59+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with maximum port 65535
60+
initial: |
61+
apiVersion: config.openshift.io/v1
62+
kind: APIServer
63+
spec:
64+
http01ChallengeProxy:
65+
mode: CustomDeployment
66+
customDeployment:
67+
internalPort: 65535
68+
expected: |
69+
apiVersion: config.openshift.io/v1
70+
kind: APIServer
71+
spec:
72+
audit:
73+
profile: Default
74+
http01ChallengeProxy:
75+
mode: CustomDeployment
76+
customDeployment:
77+
internalPort: 65535
78+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with valid port 9999
79+
initial: |
80+
apiVersion: config.openshift.io/v1
81+
kind: APIServer
82+
spec:
83+
http01ChallengeProxy:
84+
mode: CustomDeployment
85+
customDeployment:
86+
internalPort: 9999
87+
expected: |
88+
apiVersion: config.openshift.io/v1
89+
kind: APIServer
90+
spec:
91+
audit:
92+
profile: Default
93+
http01ChallengeProxy:
94+
mode: CustomDeployment
95+
customDeployment:
96+
internalPort: 9999
97+
- name: Should reject DefaultDeployment mode with customDeployment field
98+
initial: |
99+
apiVersion: config.openshift.io/v1
100+
kind: APIServer
101+
spec:
102+
http01ChallengeProxy:
103+
mode: DefaultDeployment
104+
customDeployment:
105+
internalPort: 8888
106+
expectedError: "customDeployment is required when mode is CustomDeployment and forbidden otherwise"
107+
- name: Should reject CustomDeployment mode with customDeployment but missing internalPort
108+
initial: |
109+
apiVersion: config.openshift.io/v1
110+
kind: APIServer
111+
spec:
112+
http01ChallengeProxy:
113+
mode: CustomDeployment
114+
customDeployment: {}
115+
expectedError: "spec.http01ChallengeProxy.customDeployment.internalPort: Required value"
116+
- name: Should reject CustomDeployment mode with port below minimum 1023
117+
initial: |
118+
apiVersion: config.openshift.io/v1
119+
kind: APIServer
120+
spec:
121+
http01ChallengeProxy:
122+
mode: CustomDeployment
123+
customDeployment:
124+
internalPort: 1023
125+
expectedError: "spec.http01ChallengeProxy.customDeployment.internalPort: Invalid value: 1023: must be greater than or equal to 1024"
126+
- name: Should reject CustomDeployment mode with port above maximum 65536
127+
initial: |
128+
apiVersion: config.openshift.io/v1
129+
kind: APIServer
130+
spec:
131+
http01ChallengeProxy:
132+
mode: CustomDeployment
133+
customDeployment:
134+
internalPort: 65536
135+
expectedError: "spec.http01ChallengeProxy.customDeployment.internalPort: Invalid value: 65536: must be less than or equal to 65535"

‎config/v1/types_apiserver.go

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,12 @@ type APIServerSpec struct {
6868
// +optional
6969
// +kubebuilder:default={profile: Default}
7070
Audit Audit `json:"audit"`
71+
// http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
72+
// that redirects traffic from the API endpoint on port 80 to ingress routers.
73+
// This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
74+
// +openshift:enable:FeatureGate=HTTP01ChallengeProxy
75+
// +optional
76+
HTTP01ChallengeProxy *HTTP01ChallengeProxySpec `json:"http01ChallengeProxy,omitempty"`
7177
}
7278

7379
// AuditProfileType defines the audit policy profile type.
@@ -234,6 +240,36 @@ const (
234240
EncryptionTypeKMS EncryptionType = "KMS"
235241
)
236242

243+
// +union
244+
// +kubebuilder:validation:XValidation:rule="self.mode == 'CustomDeployment' ? has(self.customDeployment) : !has(self.customDeployment)",message="customDeployment is required when mode is CustomDeployment and forbidden otherwise"
245+
type HTTP01ChallengeProxySpec struct {
246+
// mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
247+
// DefaultDeployment enables the proxy with default configuration.
248+
// CustomDeployment enables the proxy with user-specified configuration.
249+
// +kubebuilder:validation:Enum=DefaultDeployment;CustomDeployment
250+
// +kubebuilder:default=DefaultDeployment
251+
// +optional
252+
// +unionDiscriminator
253+
Mode string `json:"mode,omitempty"`
254+
255+
// customDeployment contains configuration options when mode is CustomDeployment.
256+
// This field is only valid when mode is CustomDeployment.
257+
// +optional
258+
// +unionMember
259+
CustomDeployment HTTP01ChallengeProxyCustomDeploymentSpec `json:"customDeployment,omitzero,omitempty"`
260+
}
261+
262+
// +kubebuilder:validation:MinProperties=1
263+
type HTTP01ChallengeProxyCustomDeploymentSpec struct {
264+
// internalPort specifies the internal port used by the proxy service.
265+
// Valid values are 1024-65535.
266+
// This port must be specified to avoid conflicts with other workloads on the host.
267+
// +kubebuilder:validation:Minimum=1024
268+
// +kubebuilder:validation:Maximum=65535
269+
// +required
270+
InternalPort int32 `json:"internalPort"`
271+
}
272+
237273
type APIServerStatus struct {
238274
}
239275

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,46 @@ spec:
249249
forbidden otherwise
250250
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251251
!has(self.kms)'
252+
http01ChallengeProxy:
253+
description: |-
254+
http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
255+
that redirects traffic from the API endpoint on port 80 to ingress routers.
256+
This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
257+
properties:
258+
customDeployment:
259+
description: |-
260+
customDeployment contains configuration options when mode is CustomDeployment.
261+
This field is only valid when mode is CustomDeployment.
262+
minProperties: 1
263+
properties:
264+
internalPort:
265+
description: |-
266+
internalPort specifies the internal port used by the proxy service.
267+
Valid values are 1024-65535.
268+
This port must be specified to avoid conflicts with other workloads on the host.
269+
format: int32
270+
maximum: 65535
271+
minimum: 1024
272+
type: integer
273+
required:
274+
- internalPort
275+
type: object
276+
mode:
277+
default: DefaultDeployment
278+
description: |-
279+
mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
280+
DefaultDeployment enables the proxy with default configuration.
281+
CustomDeployment enables the proxy with user-specified configuration.
282+
enum:
283+
- DefaultDeployment
284+
- CustomDeployment
285+
type: string
286+
type: object
287+
x-kubernetes-validations:
288+
- message: customDeployment is required when mode is CustomDeployment
289+
and forbidden otherwise
290+
rule: 'self.mode == ''CustomDeployment'' ? has(self.customDeployment)
291+
: !has(self.customDeployment)'
252292
servingCerts:
253293
description: |-
254294
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,46 @@ spec:
249249
forbidden otherwise
250250
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251251
!has(self.kms)'
252+
http01ChallengeProxy:
253+
description: |-
254+
http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
255+
that redirects traffic from the API endpoint on port 80 to ingress routers.
256+
This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
257+
properties:
258+
customDeployment:
259+
description: |-
260+
customDeployment contains configuration options when mode is CustomDeployment.
261+
This field is only valid when mode is CustomDeployment.
262+
minProperties: 1
263+
properties:
264+
internalPort:
265+
description: |-
266+
internalPort specifies the internal port used by the proxy service.
267+
Valid values are 1024-65535.
268+
This port must be specified to avoid conflicts with other workloads on the host.
269+
format: int32
270+
maximum: 65535
271+
minimum: 1024
272+
type: integer
273+
required:
274+
- internalPort
275+
type: object
276+
mode:
277+
default: DefaultDeployment
278+
description: |-
279+
mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
280+
DefaultDeployment enables the proxy with default configuration.
281+
CustomDeployment enables the proxy with user-specified configuration.
282+
enum:
283+
- DefaultDeployment
284+
- CustomDeployment
285+
type: string
286+
type: object
287+
x-kubernetes-validations:
288+
- message: customDeployment is required when mode is CustomDeployment
289+
and forbidden otherwise
290+
rule: 'self.mode == ''CustomDeployment'' ? has(self.customDeployment)
291+
: !has(self.customDeployment)'
252292
servingCerts:
253293
description: |-
254294
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

‎config/v1/zz_generated.deepcopy.go

Lines changed: 38 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/v1/zz_generated.featuregated-crd-manifests.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ apiservers.config.openshift.io:
66
Capability: ""
77
Category: ""
88
FeatureGates:
9+
- HTTP01ChallengeProxy
910
- KMSEncryptionProvider
1011
FilenameOperatorName: config-operator
1112
FilenameOperatorOrdering: "01"

0 commit comments

Comments
 (0)