ESO-186: Make the operator HTTP(s) proxy aware

bundle/manifests/external-secrets-operator-trusted-ca-bundle_v1_configmap.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/managed-by: kustomize
+    app.kubernetes.io/name: external-secrets-operator
+    config.openshift.io/inject-trusted-cabundle: "true"
+    control-plane: controller-manager
+  name: external-secrets-operator-trusted-ca-bundle

bundle/manifests/external-secrets-operator.clusterserviceversion.yaml

@@ -220,13 +220,13 @@ metadata:
     categories: Security
     console.openshift.io/disable-operand-delete: "true"
     containerImage: openshift.io/external-secrets-operator:latest
-    createdAt: "2025-10-07T03:20:14Z"
+    createdAt: "2025-10-07T09:42:32Z"
     features.operators.openshift.io/cnf: "false"
     features.operators.openshift.io/cni: "false"
     features.operators.openshift.io/csi: "false"
     features.operators.openshift.io/disconnected: "false"
     features.operators.openshift.io/fips-compliant: "true"
-    features.operators.openshift.io/proxy-aware: "false"
+    features.operators.openshift.io/proxy-aware: "true"
     features.operators.openshift.io/tls-profiles: "false"
     features.operators.openshift.io/token-auth-aws: "false"
     features.operators.openshift.io/token-auth-azure: "false"
@@ -763,6 +763,9 @@ spec:
                   seccompProfile:
                     type: RuntimeDefault
                 volumeMounts:
+                - mountPath: /etc/pki/tls/certs
+                  name: trusted-ca-bundle
+                  readOnly: true
                 - mountPath: /etc/metrics-certs
                   name: metrics-serving-cert
                   readOnly: true
@@ -773,6 +776,9 @@ spec:
               serviceAccountName: external-secrets-operator-controller-manager
               terminationGracePeriodSeconds: 10
               volumes:
+              - configMap:
+                  name: external-secrets-operator-trusted-ca-bundle
+                name: trusted-ca-bundle
               - name: metrics-serving-cert
                 secret:
                   secretName: metrics-serving-cert

config/default/manager_metrics_patch.yaml

@@ -3,18 +3,12 @@
 - op: add
   path: /spec/template/spec/containers/0/args/-
   value: --metrics-cert-dir=/etc/metrics-certs
-- op: add
-  path: /spec/template/spec/containers/0/volumeMounts
-  value: []
 - op: add
   path: /spec/template/spec/containers/0/volumeMounts/-
   value:
     name: metrics-serving-cert
     mountPath: /etc/metrics-certs
     readOnly: true
-- op: add
-  path: /spec/template/spec/volumes
-  value: []
 - op: add
   path: /spec/template/spec/volumes/-
   value:

config/manager/kustomization.yaml

@@ -6,3 +6,18 @@ images:
 - name: controller
   newName: openshift.io/external-secrets-operator
   newTag: latest
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+- name: trusted-ca-bundle
+  options:
+    labels:
+      app.kubernetes.io/managed-by: kustomize
+      app.kubernetes.io/name: external-secrets-operator
+      config.openshift.io/inject-trusted-cabundle: "true"
+      control-plane: controller-manager
+patches:
+- path: trusted-ca-patch.yaml
+  target:
+    kind: Deployment
+    name: controller-manager

config/manager/trusted-ca-patch.yaml

@@ -0,0 +1,18 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller-manager
+  namespace: system
+spec:
+  template:
+    spec:
+      containers:
+        - name: manager
+          volumeMounts:
+            - name: trusted-ca-bundle
+              mountPath: /etc/pki/tls/certs
+              readOnly: true
+      volumes:
+        - name: trusted-ca-bundle
+          configMap:
+            name: trusted-ca-bundle

config/manifests/bases/external-secrets-operator.clusterserviceversion.yaml

@@ -13,7 +13,7 @@ metadata:
     features.operators.openshift.io/csi: "false"
     features.operators.openshift.io/disconnected: "false"
     features.operators.openshift.io/fips-compliant: "true"
-    features.operators.openshift.io/proxy-aware: "false"
+    features.operators.openshift.io/proxy-aware: "true"
     features.operators.openshift.io/tls-profiles: "false"
     features.operators.openshift.io/token-auth-aws: "false"
     features.operators.openshift.io/token-auth-azure: "false"

pkg/controller/common/utils.go

@@ -206,22 +206,10 @@ func deploymentSpecModified(desired, fetched *appsv1.Deployment) bool {
 		return true
 	}
 
-	if desired.Spec.Template.Spec.Volumes != nil && len(desired.Spec.Template.Spec.Volumes) != len(fetched.Spec.Template.Spec.Volumes) {
+	// Check volumes
+	if !volumesEqual(desired.Spec.Template.Spec.Volumes, fetched.Spec.Template.Spec.Volumes) {
 		return true
 	}
-	for _, desiredVolume := range desired.Spec.Template.Spec.Volumes {
-		if desiredVolume.Secret != nil && desiredVolume.Secret.Items != nil {
-			for _, fetchedVolume := range fetched.Spec.Template.Spec.Volumes {
-				if !reflect.DeepEqual(desiredVolume.Secret.Items, fetchedVolume.Secret.Items) {
-					return true
-				}
-				if desiredVolume.Secret.SecretName != fetchedVolume.Secret.SecretName {
-					return true
-				}
-			}
-
-		}
-	}
 
 	if desired.Spec.Template.Spec.NodeSelector != nil && !reflect.DeepEqual(desired.Spec.Template.Spec.NodeSelector, fetched.Spec.Template.Spec.NodeSelector) {
 		return true
@@ -235,20 +223,62 @@ func deploymentSpecModified(desired, fetched *appsv1.Deployment) bool {
 		return true
 	}
 
+	// Check regular containers
 	if len(desired.Spec.Template.Spec.Containers) != len(fetched.Spec.Template.Spec.Containers) {
 		return true
 	}
+	fetchedContainers := make(map[string]*corev1.Container)
+	for i := range fetched.Spec.Template.Spec.Containers {
+		fetchedContainers[fetched.Spec.Template.Spec.Containers[i].Name] = &fetched.Spec.Template.Spec.Containers[i]
+	}
+	for i := range desired.Spec.Template.Spec.Containers {
+		desiredContainer := &desired.Spec.Template.Spec.Containers[i]
+		fetchedContainer, exists := fetchedContainers[desiredContainer.Name]
+		if !exists {
+			return true
+		}
+		if containerSpecModified(desiredContainer, fetchedContainer) {
+			return true
+		}
+	}
+
+	// Check init containers
+	if len(desired.Spec.Template.Spec.InitContainers) != len(fetched.Spec.Template.Spec.InitContainers) {
+		return true
+	}
+	fetchedInitContainers := make(map[string]*corev1.Container)
+	for i := range fetched.Spec.Template.Spec.InitContainers {
+		fetchedInitContainers[fetched.Spec.Template.Spec.InitContainers[i].Name] = &fetched.Spec.Template.Spec.InitContainers[i]
+	}
+	for i := range desired.Spec.Template.Spec.InitContainers {
+		desiredInitContainer := &desired.Spec.Template.Spec.InitContainers[i]
+		fetchedInitContainer, exists := fetchedInitContainers[desiredInitContainer.Name]
+		if !exists {
+			return true
+		}
+		if containerSpecModified(desiredInitContainer, fetchedInitContainer) {
+			return true
+		}
+	}
 
-	desiredContainer := desired.Spec.Template.Spec.Containers[0]
-	fetchedContainer := fetched.Spec.Template.Spec.Containers[0]
+	return false
+}
 
+func containerSpecModified(desiredContainer, fetchedContainer *corev1.Container) bool {
+	// Check basic container properties
 	if !reflect.DeepEqual(desiredContainer.Args, fetchedContainer.Args) ||
 		desiredContainer.Name != fetchedContainer.Name ||
 		desiredContainer.Image != fetchedContainer.Image ||
 		desiredContainer.ImagePullPolicy != fetchedContainer.ImagePullPolicy {
 		return true
 	}
 
+	// Check environment variables
+	if !reflect.DeepEqual(desiredContainer.Env, fetchedContainer.Env) {
+		return true
+	}
+
+	// Check ports
 	if len(desiredContainer.Ports) != len(fetchedContainer.Ports) {
 		return true
 	}
@@ -285,18 +315,77 @@ func deploymentSpecModified(desired, fetched *appsv1.Deployment) bool {
 		return true
 	}
 
-	if desiredContainer.VolumeMounts != nil && !reflect.DeepEqual(desiredContainer.VolumeMounts, fetchedContainer.VolumeMounts) {
+	// Check volume mounts
+	if !reflect.DeepEqual(desiredContainer.VolumeMounts, fetchedContainer.VolumeMounts) {
 		return true
 	}
 
-	if reflect.DeepEqual(desiredContainer.Resources, corev1.ResourceRequirements{}) &&
-		!reflect.DeepEqual(desiredContainer.Resources, fetchedContainer.Resources) {
+	// Check resources
+	if !reflect.DeepEqual(desiredContainer.Resources, fetchedContainer.Resources) {
 		return true
 	}
 
 	return false
 }
 
+func volumesEqual(desired, fetched []corev1.Volume) bool {
+	if len(desired) == 0 && len(fetched) == 0 {
+		return true
+	}
+	if len(desired) != len(fetched) {
+		return false
+	}
+
+	// Create a map of fetched volumes by name for easier lookup
+	fetchedMap := make(map[string]corev1.Volume)
+	for _, v := range fetched {
+		fetchedMap[v.Name] = v
+	}
+
+	// Check each desired volume exists and matches in fetched
+	for _, desiredVol := range desired {
+		fetchedVol, exists := fetchedMap[desiredVol.Name]
+		if !exists {
+			return false
+		}
+
+		// Compare volume sources
+		// Check ConfigMap volume
+		if desiredVol.ConfigMap != nil {
+			if fetchedVol.ConfigMap == nil {
+				return false
+			}
+			if desiredVol.ConfigMap.Name != fetchedVol.ConfigMap.Name {
+				return false
+			}
+		}
+
+		// Check Secret volume
+		if desiredVol.Secret != nil {
+			if fetchedVol.Secret == nil {
+				return false
+			}
+			if desiredVol.Secret.SecretName != fetchedVol.Secret.SecretName {
+				return false
+			}
+			if desiredVol.Secret.Items != nil && !reflect.DeepEqual(desiredVol.Secret.Items, fetchedVol.Secret.Items) {
+				return false
+			}
+		}
+
+		// Check EmptyDir volume
+		if desiredVol.EmptyDir != nil {
+			if fetchedVol.EmptyDir == nil {
+				return false
+			}
+		}
+
+		// Add other volume types as needed (PVC, HostPath, etc.)
+	}
+
+	return true
+}
+
 func serviceSpecModified(desired, fetched *corev1.Service) bool {
 	if desired.Spec.Type != fetched.Spec.Type ||
 		!reflect.DeepEqual(desired.Spec.Ports, fetched.Spec.Ports) ||

pkg/controller/external_secrets/configmap.go

@@ -0,0 +1,91 @@
+package external_secrets
+
+import (
+	"fmt"
+
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	operatorv1alpha1 "github.com/openshift/external-secrets-operator/api/v1alpha1"
+	"github.com/openshift/external-secrets-operator/pkg/controller/common"
+)
+
+// ensureTrustedCABundleConfigMap creates or ensures the trusted CA bundle ConfigMap exists
+// in the operand namespace when proxy configuration is present. The ConfigMap is labeled
+// with the injection label required by the Cluster Network Operator (CNO), which watches
+// for this label and injects the cluster's trusted CA bundle into the ConfigMap's data.
+// This function ensures the correct labels are present so that CNO can manage the CA bundle
+// content as expected.
+func (r *Reconciler) ensureTrustedCABundleConfigMap(esc *operatorv1alpha1.ExternalSecretsConfig, resourceLabels map[string]string) error {
+	proxyConfig := r.getProxyConfiguration(esc)
+
+	// Only create ConfigMap if proxy is configured
+	if proxyConfig == nil {
+		// TODO: ConfigMap removal when proxy configuration is removed
+		// will be revisited in a follow-up implementation.
+		r.log.V(4).Info("no proxy configuration found, skipping trusted CA bundle ConfigMap creation")
+		return nil
+	}
+
+	namespace := getNamespace(esc)
+	expectedLabels := getTrustedCABundleLabels(resourceLabels)
+
+	desiredConfigMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      trustedCABundleConfigMapName,
+			Namespace: namespace,
+			Labels:    expectedLabels,
+		},
+	}
+
+	configMapName := fmt.Sprintf("%s/%s", desiredConfigMap.GetNamespace(), desiredConfigMap.GetName())
+	r.log.V(4).Info("reconciling trusted CA bundle ConfigMap resource", "name", configMapName)
+
+	// Check if the ConfigMap already exists
+	existingConfigMap := &corev1.ConfigMap{}
+	exist, err := r.Exists(r.ctx, client.ObjectKeyFromObject(desiredConfigMap), existingConfigMap)
+	if err != nil {
+		return common.FromClientError(err, "failed to check %s trusted CA bundle ConfigMap resource already exists", configMapName)
+	}
+
+	if !exist {
+		// Create the ConfigMap
+		if err := r.Create(r.ctx, desiredConfigMap); err != nil {
+			return common.FromClientError(err, "failed to create %s trusted CA bundle ConfigMap resource", configMapName)
+		}
+		r.eventRecorder.Eventf(esc, corev1.EventTypeNormal, "Reconciled", "trusted CA bundle ConfigMap resource %s created", configMapName)
+		return nil
+	}
+
+	// ConfigMap exists, ensure it has the correct labels
+	// Do not update the data of the ConfigMap since it is managed by CNO
+	// Check if metadata (labels) has been modified.
+	// NOTE: Currently ObjectMetadataModified only checks labels, but if it's extended
+	// in the future to check annotations as well, CNO may race with this update since
+	// CNO adds `openshift.io/owning-component: Networking / cluster-network-operator` annotations on this ConfigMap.
+	if exist && common.ObjectMetadataModified(desiredConfigMap, existingConfigMap) {
+		r.log.V(1).Info("trusted CA bundle ConfigMap has been modified, updating to desired state", "name", configMapName)
+		// Update the labels since
+		existingConfigMap.Labels = desiredConfigMap.Labels
+
+		if err := r.UpdateWithRetry(r.ctx, existingConfigMap); err != nil {
+			return common.FromClientError(err, "failed to update %s trusted CA bundle ConfigMap resource", configMapName)
+		}
+		r.eventRecorder.Eventf(esc, corev1.EventTypeNormal, "Reconciled", "trusted CA bundle ConfigMap resource %s reconciled back to desired state", configMapName)
+	} else {
+		r.log.V(4).Info("trusted CA bundle ConfigMap resource already exists and is in expected state", "name", configMapName)
+	}
+
+	return nil
+}
+
+// getTrustedCABundleLabels merges resource labels with the injection label
+func getTrustedCABundleLabels(resourceLabels map[string]string) map[string]string {
+	labels := make(map[string]string)
+	for k, v := range resourceLabels {
+		labels[k] = v
+	}
+	labels[trustedCABundleInjectLabel] = "true"
+	return labels
+}