Skip to content

Commit d6a8c58

Browse files
sebrandon1sebrandon1
committed
CNF-13731: Add HTTP01ChallengeProxy
Fix HTTP01ChallengeProxy integration test structure and enable feature gate in TechPreviewNoUpgrade - Fixed test file structure to include required crdName metadata for integration tests - Enabled HTTP01ChallengeProxy feature gate in both DevPreviewNoUpgrade and TechPreviewNoUpgrade - Regenerated feature gate manifests via make update - Resolved CI failure: missing required field crdName in test spec Make internalPort optional to resolve API compatibility error - Changed internalPort from required to optional (*int32 with omitempty) - This resolves the NoNewRequiredFields API compatibility violation - Updated test case to reflect optional field behavior - Users can now omit internalPort for custom deployments - Regenerated deepcopy functions and OpenAPI schemas Address comments 1 Update codegen crds Adjust back to required Remove pointer Address comments for linter
1 parent 3d5bf11 commit d6a8c58

22 files changed

+1100
-11
lines changed

‎config/v1/tests/apiservers.config.openshift.io/HTTP01ChallengeProxy.yaml

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
2+
name: "APIServer"
3+
crdName: apiservers.config.openshift.io
4+
tests:
5+
onCreate:
6+
- name: Should be able to create with HTTP01ChallengeProxy DefaultDeployment mode
7+
initial: |
8+
apiVersion: config.openshift.io/v1
9+
kind: APIServer
10+
spec:
11+
http01ChallengeProxy:
12+
mode: DefaultDeployment
13+
expected: |
14+
apiVersion: config.openshift.io/v1
15+
kind: APIServer
16+
spec:
17+
audit:
18+
profile: Default
19+
http01ChallengeProxy:
20+
mode: DefaultDeployment
21+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with port 8888
22+
initial: |
23+
apiVersion: config.openshift.io/v1
24+
kind: APIServer
25+
spec:
26+
http01ChallengeProxy:
27+
mode: CustomDeployment
28+
customDeployment:
29+
internalPort: 8888
30+
expected: |
31+
apiVersion: config.openshift.io/v1
32+
kind: APIServer
33+
spec:
34+
audit:
35+
profile: Default
36+
http01ChallengeProxy:
37+
mode: CustomDeployment
38+
customDeployment:
39+
internalPort: 8888
40+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with minimum port 1024
41+
initial: |
42+
apiVersion: config.openshift.io/v1
43+
kind: APIServer
44+
spec:
45+
http01ChallengeProxy:
46+
mode: CustomDeployment
47+
customDeployment:
48+
internalPort: 1024
49+
expected: |
50+
apiVersion: config.openshift.io/v1
51+
kind: APIServer
52+
spec:
53+
audit:
54+
profile: Default
55+
http01ChallengeProxy:
56+
mode: CustomDeployment
57+
customDeployment:
58+
internalPort: 1024
59+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with maximum port 65535
60+
initial: |
61+
apiVersion: config.openshift.io/v1
62+
kind: APIServer
63+
spec:
64+
http01ChallengeProxy:
65+
mode: CustomDeployment
66+
customDeployment:
67+
internalPort: 65535
68+
expected: |
69+
apiVersion: config.openshift.io/v1
70+
kind: APIServer
71+
spec:
72+
audit:
73+
profile: Default
74+
http01ChallengeProxy:
75+
mode: CustomDeployment
76+
customDeployment:
77+
internalPort: 65535
78+
- name: Should be able to create with HTTP01ChallengeProxy CustomDeployment mode with valid port 9999
79+
initial: |
80+
apiVersion: config.openshift.io/v1
81+
kind: APIServer
82+
spec:
83+
http01ChallengeProxy:
84+
mode: CustomDeployment
85+
customDeployment:
86+
internalPort: 9999
87+
expected: |
88+
apiVersion: config.openshift.io/v1
89+
kind: APIServer
90+
spec:
91+
audit:
92+
profile: Default
93+
http01ChallengeProxy:
94+
mode: CustomDeployment
95+
customDeployment:
96+
internalPort: 9999
97+
- name: Should reject DefaultDeployment mode with customDeployment field
98+
initial: |
99+
apiVersion: config.openshift.io/v1
100+
kind: APIServer
101+
spec:
102+
http01ChallengeProxy:
103+
mode: DefaultDeployment
104+
customDeployment:
105+
internalPort: 8888
106+
expectedError: "customDeployment is required when mode is CustomDeployment and forbidden otherwise"
107+
- name: Should reject CustomDeployment mode without internalPort
108+
initial: |
109+
apiVersion: config.openshift.io/v1
110+
kind: APIServer
111+
spec:
112+
http01ChallengeProxy:
113+
mode: CustomDeployment
114+
customDeployment: {}
115+
expectedError: "spec.http01ChallengeProxy.customDeployment.internalPort: Required value"
116+
- name: Should reject CustomDeployment mode with port below minimum 1023
117+
initial: |
118+
apiVersion: config.openshift.io/v1
119+
kind: APIServer
120+
spec:
121+
http01ChallengeProxy:
122+
mode: CustomDeployment
123+
customDeployment:
124+
internalPort: 1023
125+
expectedError: "internalPort: Invalid value: 1023: must be greater than or equal to 1024"
126+
- name: Should reject CustomDeployment mode with port above maximum 65536
127+
initial: |
128+
apiVersion: config.openshift.io/v1
129+
kind: APIServer
130+
spec:
131+
http01ChallengeProxy:
132+
mode: CustomDeployment
133+
customDeployment:
134+
internalPort: 65536
135+
expectedError: "spec.http01ChallengeProxy.customDeployment.internalPort: Invalid value: 65536: must be less than or equal to 65535"

‎config/v1/types_apiserver.go

Lines changed: 47 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,12 @@ type APIServerSpec struct {
6868
// +optional
6969
// +kubebuilder:default={profile: Default}
7070
Audit Audit `json:"audit"`
71+
// http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
72+
// that redirects traffic from the API endpoint on port 80 to ingress routers.
73+
// This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
74+
// +openshift:enable:FeatureGate=HTTP01ChallengeProxy
75+
// +optional
76+
HTTP01ChallengeProxy HTTP01ChallengeProxySpec `json:"http01ChallengeProxy,omitzero,omitempty"`
7177
}
7278

7379
// AuditProfileType defines the audit policy profile type.
@@ -146,7 +152,7 @@ type AuditCustomRule struct {
146152
// If unset, the 'Default' profile is used as the default.
147153
//
148154
// +required
149-
Profile AuditProfileType `json:"profile"`
155+
Profile AuditProfileType `json:"profile,omitempty"`
150156
}
151157

152158
type APIServerServingCerts struct {
@@ -208,7 +214,7 @@ type APIServerEncryption struct {
208214
// +openshift:enable:FeatureGate=KMSEncryptionProvider
209215
// +unionMember
210216
// +optional
211-
KMS *KMSConfig `json:"kms,omitempty"`
217+
KMS KMSConfig `json:"kms,omitzero,omitempty"`
212218
}
213219

214220
// +openshift:validation:FeatureGateAwareEnum:featureGate="",enum="";identity;aescbc;aesgcm
@@ -234,6 +240,45 @@ const (
234240
EncryptionTypeKMS EncryptionType = "KMS"
235241
)
236242

243+
// HTTP01ChallengeProxyMode defines how the HTTP01 challenge proxy should be deployed.
244+
// +kubebuilder:validation:Enum=DefaultDeployment;CustomDeployment
245+
type HTTP01ChallengeProxyMode string
246+
247+
const (
248+
// HTTP01ChallengeProxyModeDefaultDeployment enables the proxy with default configuration.
249+
HTTP01ChallengeProxyModeDefaultDeployment HTTP01ChallengeProxyMode = "DefaultDeployment"
250+
// HTTP01ChallengeProxyModeCustomDeployment enables the proxy with user-specified configuration.
251+
HTTP01ChallengeProxyModeCustomDeployment HTTP01ChallengeProxyMode = "CustomDeployment"
252+
)
253+
254+
// +union
255+
// +kubebuilder:validation:XValidation:rule="self.mode == 'CustomDeployment' ? has(self.customDeployment) : !has(self.customDeployment)",message="customDeployment is required when mode is CustomDeployment and forbidden otherwise"
256+
type HTTP01ChallengeProxySpec struct {
257+
// mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
258+
// DefaultDeployment enables the proxy with default configuration.
259+
// CustomDeployment enables the proxy with user-specified configuration.
260+
// +required
261+
// +unionDiscriminator
262+
Mode HTTP01ChallengeProxyMode `json:"mode,omitempty"`
263+
264+
// customDeployment contains configuration options when mode is CustomDeployment.
265+
// This field is only valid when mode is CustomDeployment.
266+
// +optional
267+
// +unionMember
268+
CustomDeployment HTTP01ChallengeProxyCustomDeploymentSpec `json:"customDeployment,omitzero,omitempty"`
269+
}
270+
271+
type HTTP01ChallengeProxyCustomDeploymentSpec struct {
272+
// internalPort specifies the internal port used by the proxy service.
273+
// Valid values are 1024-65535.
274+
// When not specified for CustomDeployment mode, users should ensure their chosen port
275+
// does not conflict with other workloads on the host.
276+
// +kubebuilder:validation:Minimum=1024
277+
// +kubebuilder:validation:Maximum=65535
278+
// +required
279+
InternalPort int32 `json:"internalPort,omitempty"`
280+
}
281+
237282
type APIServerStatus struct {
238283
}
239284

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,47 @@ spec:
249249
forbidden otherwise
250250
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251251
!has(self.kms)'
252+
http01ChallengeProxy:
253+
description: |-
254+
http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
255+
that redirects traffic from the API endpoint on port 80 to ingress routers.
256+
This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
257+
properties:
258+
customDeployment:
259+
description: |-
260+
customDeployment contains configuration options when mode is CustomDeployment.
261+
This field is only valid when mode is CustomDeployment.
262+
properties:
263+
internalPort:
264+
description: |-
265+
internalPort specifies the internal port used by the proxy service.
266+
Valid values are 1024-65535.
267+
When not specified for CustomDeployment mode, users should ensure their chosen port
268+
does not conflict with other workloads on the host.
269+
format: int32
270+
maximum: 65535
271+
minimum: 1024
272+
type: integer
273+
required:
274+
- internalPort
275+
type: object
276+
mode:
277+
description: |-
278+
mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
279+
DefaultDeployment enables the proxy with default configuration.
280+
CustomDeployment enables the proxy with user-specified configuration.
281+
enum:
282+
- DefaultDeployment
283+
- CustomDeployment
284+
type: string
285+
required:
286+
- mode
287+
type: object
288+
x-kubernetes-validations:
289+
- message: customDeployment is required when mode is CustomDeployment
290+
and forbidden otherwise
291+
rule: 'self.mode == ''CustomDeployment'' ? has(self.customDeployment)
292+
: !has(self.customDeployment)'
252293
servingCerts:
253294
description: |-
254295
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,47 @@ spec:
249249
forbidden otherwise
250250
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251251
!has(self.kms)'
252+
http01ChallengeProxy:
253+
description: |-
254+
http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
255+
that redirects traffic from the API endpoint on port 80 to ingress routers.
256+
This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
257+
properties:
258+
customDeployment:
259+
description: |-
260+
customDeployment contains configuration options when mode is CustomDeployment.
261+
This field is only valid when mode is CustomDeployment.
262+
properties:
263+
internalPort:
264+
description: |-
265+
internalPort specifies the internal port used by the proxy service.
266+
Valid values are 1024-65535.
267+
When not specified for CustomDeployment mode, users should ensure their chosen port
268+
does not conflict with other workloads on the host.
269+
format: int32
270+
maximum: 65535
271+
minimum: 1024
272+
type: integer
273+
required:
274+
- internalPort
275+
type: object
276+
mode:
277+
description: |-
278+
mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
279+
DefaultDeployment enables the proxy with default configuration.
280+
CustomDeployment enables the proxy with user-specified configuration.
281+
enum:
282+
- DefaultDeployment
283+
- CustomDeployment
284+
type: string
285+
required:
286+
- mode
287+
type: object
288+
x-kubernetes-validations:
289+
- message: customDeployment is required when mode is CustomDeployment
290+
and forbidden otherwise
291+
rule: 'self.mode == ''CustomDeployment'' ? has(self.customDeployment)
292+
: !has(self.customDeployment)'
252293
servingCerts:
253294
description: |-
254295
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,47 @@ spec:
249249
forbidden otherwise
250250
rule: 'has(self.type) && self.type == ''KMS'' ? has(self.kms) :
251251
!has(self.kms)'
252+
http01ChallengeProxy:
253+
description: |-
254+
http01ChallengeProxy contains configuration for the HTTP01 challenge proxy
255+
that redirects traffic from the API endpoint on port 80 to ingress routers.
256+
This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
257+
properties:
258+
customDeployment:
259+
description: |-
260+
customDeployment contains configuration options when mode is CustomDeployment.
261+
This field is only valid when mode is CustomDeployment.
262+
properties:
263+
internalPort:
264+
description: |-
265+
internalPort specifies the internal port used by the proxy service.
266+
Valid values are 1024-65535.
267+
When not specified for CustomDeployment mode, users should ensure their chosen port
268+
does not conflict with other workloads on the host.
269+
format: int32
270+
maximum: 65535
271+
minimum: 1024
272+
type: integer
273+
required:
274+
- internalPort
275+
type: object
276+
mode:
277+
description: |-
278+
mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
279+
DefaultDeployment enables the proxy with default configuration.
280+
CustomDeployment enables the proxy with user-specified configuration.
281+
enum:
282+
- DefaultDeployment
283+
- CustomDeployment
284+
type: string
285+
required:
286+
- mode
287+
type: object
288+
x-kubernetes-validations:
289+
- message: customDeployment is required when mode is CustomDeployment
290+
and forbidden otherwise
291+
rule: 'self.mode == ''CustomDeployment'' ? has(self.customDeployment)
292+
: !has(self.customDeployment)'
252293
servingCerts:
253294
description: |-
254295
servingCert is the TLS cert info for serving secure traffic. If not specified, operator managed certificates

0 commit comments

Comments
 (0)