@@ -75,8 +75,8 @@ type OpenStackControlPlaneSpec struct {
7575 NodeSelector map [string ]string `json:"nodeSelector,omitempty"`
7676
7777 // +kubebuilder:validation:Optional
78- // +kubebuilder:default={endpoint: {public: {enabled: true}, internal: {enabled: false}}}
79- //+operator-sdk:csv:customresourcedefinitions:type=spec
78+ // +operator-sdk:csv:customresourcedefinitions:type=spec
79+ // +kubebuilder:default={ingress: {enabled: true, ca: {duration: "43800h"}, cert: {duration: "8760h"}}, podLevel: {enabled: false, internal:{ca: {duration: "43800h"}, cert: {duration: "8760h"}}, ovn: {ca: {duration: "43800h"}, cert: {duration: "8760h"}}}}
8080 // TLS - Parameters related to the TLS
8181 TLS TLSSection `json:"tls"`
8282
@@ -189,8 +189,11 @@ type OpenStackControlPlaneSpec struct {
189189type TLSSection struct {
190190 // +kubebuilder:validation:optional
191191 //+operator-sdk:csv:customresourcedefinitions:type=spec
192- // The key must be the endpoint type (public, internal)
193- Endpoint map [service.Endpoint ]TLSEndpointConfig `json:"endpoint,omitempty"`
192+ Ingress TLSIngressConfig `json:"ingress,omitempty"`
193+
194+ // +kubebuilder:validation:optional
195+ //+operator-sdk:csv:customresourcedefinitions:type=spec
196+ PodLevel TLSPodLevelConfig `json:"podLevel,omitempty"`
194197
195198 // +kubebuilder:validation:optional
196199 //+operator-sdk:csv:customresourcedefinitions:type=spec
@@ -200,12 +203,67 @@ type TLSSection struct {
200203 tls.Ca `json:",inline"`
201204}
202205
203- // TLSEndpointConfig defines the desired state of TLSEndpoint configuration
204- type TLSEndpointConfig struct {
206+ // TLSIngressConfig defines the desired state of the TLS configuration for the ingress configuration (route)
207+ type TLSIngressConfig struct {
205208 // +kubebuilder:validation:Optional
206209 // +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"}
207210 // Enabled - Whether TLS should be enabled for endpoint type
208211 Enabled bool `json:"enabled"`
212+
213+ // +kubebuilder:validation:optional
214+ //+operator-sdk:csv:customresourcedefinitions:type=spec
215+ CertSection `json:",inline"`
216+ }
217+
218+ // TLSPodLevelConfig defines the desired state of the TLS configuration for TLS termination at the pod level
219+ type TLSPodLevelConfig struct {
220+ // +kubebuilder:validation:Optional
221+ // +operator-sdk:csv:customresourcedefinitions:type=spec,xDescriptors={"urn:alm:descriptor:com.tectonic.ui:booleanSwitch"}
222+ // Enabled - Whether TLS should be enabled for endpoint type
223+ Enabled bool `json:"enabled"`
224+
225+ // +kubebuilder:validation:Optional
226+ // +operator-sdk:csv:customresourcedefinitions:type=spec
227+ // Internal - default CA used for all OpenStackControlPlane and OpenStackDataplane endpoints,
228+ // except OVN related CA and certs
229+ Internal CertSection `json:"internal,omitempty"`
230+
231+ // +kubebuilder:validation:Optional
232+ // +operator-sdk:csv:customresourcedefinitions:type=spec
233+ // Ovn - CA used for all OVN services on OpenStackControlPlane and OpenStackDataplane
234+ Ovn CertSection `json:"ovn,omitempty"`
235+ }
236+
237+ // CertSection defines details for CA config and its certs
238+ type CertSection struct {
239+ // +kubebuilder:validation:Optional
240+ // +operator-sdk:csv:customresourcedefinitions:type=spec
241+ // Cert - defines details for cert config
242+ Cert CertConfig `json:"cert,omitempty"`
243+
244+ // +kubebuilder:validation:Optional
245+ // +operator-sdk:csv:customresourcedefinitions:type=spec
246+ // Ca - defines details for CA cert config
247+ Ca CertConfig `json:"ca,omitempty"`
248+ }
249+
250+ // CertConfig defines details for cert configs
251+ type CertConfig struct {
252+ // The requested 'duration' (i.e. lifetime) of the Certificate.
253+ // The Certificate will be renewed either 2/3 through its duration or
254+ // `renewBefore` period before its expiry, whichever is later. Minimum
255+ // accepted duration is 1 hour. Value must be in units accepted by Go
256+ // time.ParseDuration https://golang.org/pkg/time/#ParseDuration
257+ // +optional
258+ Duration * metav1.Duration `json:"duration,omitempty"`
259+
260+ // How long before the currently issued certificate's expiry
261+ // cert-manager should renew the certificate. The default is 2/3 of the
262+ // issued certificate's duration. Minimum accepted value is 5 minutes.
263+ // Value must be in units accepted by Go time.ParseDuration
264+ // https://golang.org/pkg/time/#ParseDuration
265+ // +optional
266+ RenewBefore * metav1.Duration `json:"renewBefore,omitempty"`
209267}
210268
211269// DNSMasqSection defines the desired state of DNSMasq service
@@ -768,8 +826,12 @@ func SetupDefaults() {
768826// Enabled - returns status of tls configuration for the passed in endpoint type
769827func (t * TLSSection ) Enabled (endpt service.Endpoint ) bool {
770828 if t != nil {
771- if cfg , ok := t .Endpoint [endpt ]; ok && cfg .Enabled {
772- return true
829+ switch endpt {
830+ case service .EndpointPublic :
831+ return t .Ingress .Enabled
832+
833+ case service .EndpointInternal :
834+ return t .PodLevel .Enabled
773835 }
774836 }
775837 return false
![openshift-merge-bot[bot]](https://avatars.githubusercontent.com/in/412865?v=4&size=40){kind=avatar}
0 commit comments