ESO-83: Moves CertManagerConfig to ExternalSecretsConfig instead of WebhookConfig

Author: bharath-b-rh

api/v1alpha1/external_secrets_manager_types.go

@@ -61,6 +61,7 @@ type ExternalSecretsManagerSpec struct {
 	GlobalConfig *GlobalConfig `json:"globalConfig,omitempty"`
 
 	// features is for enabling the optional operator features.
+	// +kubebuilder:validation:Optional
 	Features []Feature `json:"features,omitempty"`
 }
 
@@ -153,7 +154,7 @@ type Condition struct {
 	Type string `json:"type"`
 
 	// status of the condition
-	Status metav1.ConditionStatus `json:"status" `
+	Status metav1.ConditionStatus `json:"status"`
 
 	// message provides details about the state.
 	Message string `json:"message"`

api/v1alpha1/external_secrets_types.go

@@ -81,19 +81,24 @@ type ExternalSecretsConfig struct {
 	// +kubebuilder:validation:Optional
 	LogLevel int32 `json:"logLevel,omitempty"`
 
-	// bitwardenSecretManagerProvider is for enabling the bitwarden secrets manager provider and
-	// for setting up the additional service required for connecting with the bitwarden server.
-	// +kubebuilder:validation:Optional
-	BitwardenSecretManagerProvider *BitwardenSecretManagerProvider `json:"bitwardenSecretManagerProvider,omitempty"`
-
 	// operatingNamespace is for restricting the external-secrets operations to provided namespace.
 	// And when enabled `ClusterSecretStore` and `ClusterExternalSecret` are implicitly disabled.
 	// +kubebuilder:validation:Optional
 	OperatingNamespace string `json:"operatingNamespace,omitempty"`
 
+	// bitwardenSecretManagerProvider is for enabling the bitwarden secrets manager provider and
+	// for setting up the additional service required for connecting with the bitwarden server.
+	// +kubebuilder:validation:Optional
+	BitwardenSecretManagerProvider *BitwardenSecretManagerProvider `json:"bitwardenSecretManagerProvider,omitempty"`
+
 	// webhookConfig is for configuring external-secrets webhook specifics.
 	WebhookConfig *WebhookConfig `json:"webhookConfig,omitempty"`
 
+	// CertManagerConfig is for configuring cert-manager specifics, which will be used for generating
+	// certificates for webhook and bitwarden-sdk-server components.
+	// +kubebuilder:validation:Optional
+	CertManagerConfig *CertManagerConfig `json:"certManagerConfig,omitempty"`
+
 	// resources is for defining the resource requirements.
 	// Cannot be updated.
 	// ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
@@ -159,19 +164,16 @@ type WebhookConfig struct {
 	// +kubebuilder:default:="5m"
 	// +kubebuilder:validation:Optional
 	CertificateCheckInterval metav1.Duration `json:"certificateCheckInterval,omitempty"`
-
-	// CertManagerConfig is for configuring cert-manager specifics.
-	// +kubebuilder:validation:Optional
-	CertManagerConfig *CertManagerConfig `json:"certManagerConfig,omitempty"`
 }
 
 // CertManagerConfig is for configuring cert-manager specifics.
-// +kubebuilder:validation:XValidation:rule="!has(oldSelf.issuerRef) && !has(self.issuerRef) || has(oldSelf.issuerRef) && has(self.issuerRef)",message="issuerRef may only be configured during creation"
+// +kubebuilder:validation:XValidation:rule="has(self.addInjectorAnnotations) && self.addInjectorAnnotations != 'false' ? self.enabled != 'false' : true",message="certManagerConfig must have enabled set, to set addInjectorAnnotations"
 type CertManagerConfig struct {
 	// enabled is for enabling the use of cert-manager for obtaining and renewing the
 	// certificates used for webhook server, instead of built-in certificates.
 	// Use `true` or `false` to indicate the preference.
 	// +kubebuilder:default:="false"
+	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="enabled is immutable once set"
 	// +kubebuilder:validation:Enum:="true";"false"
 	// +kubebuilder:validation:Required
 	Enabled string `json:"enabled,omitempty"`
@@ -198,6 +200,7 @@ type CertManagerConfig struct {
 
 	// certificateRenewBefore is the ahead time to renew the webhook certificate
 	// before expiry.
+	// +kubebuilder:default:="30m"
 	// +kubebuilder:validation:Optional
 	CertificateRenewBefore *metav1.Duration `json:"certificateRenewBefore,omitempty"`
 }

api/v1alpha1/meta.go

@@ -16,18 +16,20 @@ type ConditionalStatus struct {
 // ObjectReference is a reference to an object with a given name, kind and group.
 type ObjectReference struct {
 	// Name of the resource being referred to.
+	// +kubebuilder:validation:Required
 	Name string `json:"name"`
 	// Kind of the resource being referred to.
-	// +optional
+	// +kubebuilder:validation:Optional
 	Kind string `json:"kind,omitempty"`
 	// Group of the resource being referred to.
-	// +optional
+	// +kubebuilder:validation:Optional
 	Group string `json:"group,omitempty"`
 }
 
 // SecretReference is a reference to the secret with the given name, which should exist
 // in the same namespace where it will be utilized.
 type SecretReference struct {
 	// Name of the secret resource being referred to.
+	// +kubebuilder:validation:Required
 	Name string `json:"name"`
 }

api/v1alpha1/zz_generated.deepcopy.go

@@ -1033,6 +1033,74 @@ spec:
                         - name
                         type: object
                     type: object
+                  certManagerConfig:
+                    description: |-
+                      CertManagerConfig is for configuring cert-manager specifics, which will be used for generating
+                      certificates for webhook and bitwarden-sdk-server components.
+                    properties:
+                      addInjectorAnnotations:
+                        default: "false"
+                        description: |-
+                          addInjectorAnnotations is for adding the `cert-manager.io/inject-ca-from` annotation to the
+                          webhooks and CRDs to automatically setup webhook to the cert-manager CA. This requires
+                          CA Injector to be enabled in cert-manager. Use `true` or `false` to indicate the preference.
+                        enum:
+                        - "true"
+                        - "false"
+                        type: string
+                      certificateDuration:
+                        default: 8760h
+                        description: certificateDuration is the validity period of
+                          the webhook certificate.
+                        type: string
+                      certificateRenewBefore:
+                        default: 30m
+                        description: |-
+                          certificateRenewBefore is the ahead time to renew the webhook certificate
+                          before expiry.
+                        type: string
+                      enabled:
+                        default: "false"
+                        description: |-
+                          enabled is for enabling the use of cert-manager for obtaining and renewing the
+                          certificates used for webhook server, instead of built-in certificates.
+                          Use `true` or `false` to indicate the preference.
+                        enum:
+                        - "true"
+                        - "false"
+                        type: string
+                        x-kubernetes-validations:
+                        - message: enabled is immutable once set
+                          rule: self == oldSelf
+                      issuerRef:
+                        description: |-
+                          issuerRef contains details to the referenced object used for
+                          obtaining the certificates. It must exist in the external-secrets
+                          namespace if not using a cluster-scoped cert-manager issuer.
+                        properties:
+                          group:
+                            description: Group of the resource being referred to.
+                            type: string
+                          kind:
+                            description: Kind of the resource being referred to.
+                            type: string
+                          name:
+                            description: Name of the resource being referred to.
+                            type: string
+                        required:
+                        - name
+                        type: object
+                        x-kubernetes-validations:
+                        - message: issuerRef is immutable once set
+                          rule: self == oldSelf
+                    required:
+                    - enabled
+                    - issuerRef
+                    type: object
+                    x-kubernetes-validations:
+                    - message: certManagerConfig must have enabled set, to set addInjectorAnnotations
+                      rule: 'has(self.addInjectorAnnotations) && self.addInjectorAnnotations
+                        != ''false'' ? self.enabled != ''false'' : true'
                   logLevel:
                     default: 1
                     description: logLevel supports value range as per [kubernetes
@@ -1162,70 +1230,6 @@ spec:
                     description: webhookConfig is for configuring external-secrets
                       webhook specifics.
                     properties:
-                      certManagerConfig:
-                        description: CertManagerConfig is for configuring cert-manager
-                          specifics.
-                        properties:
-                          addInjectorAnnotations:
-                            default: "false"
-                            description: |-
-                              addInjectorAnnotations is for adding the `cert-manager.io/inject-ca-from` annotation to the
-                              webhooks and CRDs to automatically setup webhook to the cert-manager CA. This requires
-                              CA Injector to be enabled in cert-manager. Use `true` or `false` to indicate the preference.
-                            enum:
-                            - "true"
-                            - "false"
-                            type: string
-                          certificateDuration:
-                            default: 8760h
-                            description: certificateDuration is the validity period
-                              of the webhook certificate.
-                            type: string
-                          certificateRenewBefore:
-                            description: |-
-                              certificateRenewBefore is the ahead time to renew the webhook certificate
-                              before expiry.
-                            type: string
-                          enabled:
-                            default: "false"
-                            description: |-
-                              enabled is for enabling the use of cert-manager for obtaining and renewing the
-                              certificates used for webhook server, instead of built-in certificates.
-                              Use `true` or `false` to indicate the preference.
-                            enum:
-                            - "true"
-                            - "false"
-                            type: string
-                          issuerRef:
-                            description: |-
-                              issuerRef contains details to the referenced object used for
-                              obtaining the certificates. It must exist in the external-secrets
-                              namespace if not using a cluster-scoped cert-manager issuer.
-                            properties:
-                              group:
-                                description: Group of the resource being referred
-                                  to.
-                                type: string
-                              kind:
-                                description: Kind of the resource being referred to.
-                                type: string
-                              name:
-                                description: Name of the resource being referred to.
-                                type: string
-                            required:
-                            - name
-                            type: object
-                            x-kubernetes-validations:
-                            - message: issuerRef is immutable once set
-                              rule: self == oldSelf
-                        required:
-                        - enabled
-                        - issuerRef
-                        type: object
-                        x-kubernetes-validations:
-                        - message: issuerRef may only be configured during creation
-                          rule: '!has(oldSelf.issuerRef) && !has(self.issuerRef) ||
-                            has(oldSelf.issuerRef) && has(self.issuerRef)'
                       certificateCheckInterval:
                         default: 5m
                         description: |-