Skip to content

Commit b4af1ae

Browse files
sayan-biswassayan-biswas
committed
Feat: Add corporate certificates to Build APIs
# Changes: - Added APIs to allow user to define custom Root CAs in Build and BuildRun APIs Signed-off-by: Sayan Biswas <sayan-biswas@live.com>
1 parent e0c4b9d commit b4af1ae

File tree

16 files changed

+842
-5
lines changed

16 files changed

+842
-5
lines changed

‎deploy/crds/shipwright.io_buildruns.yaml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7129,6 +7129,50 @@ spec:
71297129
spec:
71307130
description: Spec refers to an embedded build specification
71317131
properties:
7132+
caBundle:
7133+
description: CABundle specifies the list certificates to be
7134+
loaded in workload containers.
7135+
properties:
7136+
configMap:
7137+
description: |-
7138+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
7139+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
7140+
properties:
7141+
key:
7142+
description: Key of the entry in the object's `data`
7143+
field to be used.
7144+
maxLength: 253
7145+
minLength: 1
7146+
type: string
7147+
name:
7148+
description: Name is the name of the source object
7149+
in the trust namespace.
7150+
maxLength: 253
7151+
minLength: 1
7152+
type: string
7153+
type: object
7154+
x-kubernetes-map-type: atomic
7155+
secret:
7156+
description: |-
7157+
secret is a reference (by name) to a Secret's `data` key(s), or to a
7158+
list of Secret's `data` key(s) using label selector, in the namespace.
7159+
properties:
7160+
key:
7161+
description: Key of the entry in the object's `data`
7162+
field to be used.
7163+
maxLength: 253
7164+
minLength: 1
7165+
type: string
7166+
name:
7167+
description: Name is the name of the source object
7168+
in the trust namespace.
7169+
maxLength: 253
7170+
minLength: 1
7171+
type: string
7172+
type: object
7173+
x-kubernetes-map-type: atomic
7174+
type: object
7175+
x-kubernetes-map-type: atomic
71327176
env:
71337177
description: Env contains additional environment variables
71347178
that should be passed to the build container
@@ -9508,6 +9552,50 @@ spec:
95089552
- strategy
95099553
type: object
95109554
type: object
9555+
caBundle:
9556+
description: CABundle specifies the list certificates to be loaded
9557+
in workload containers.
9558+
properties:
9559+
configMap:
9560+
description: |-
9561+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
9562+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
9563+
properties:
9564+
key:
9565+
description: Key of the entry in the object's `data` field
9566+
to be used.
9567+
maxLength: 253
9568+
minLength: 1
9569+
type: string
9570+
name:
9571+
description: Name is the name of the source object in the
9572+
trust namespace.
9573+
maxLength: 253
9574+
minLength: 1
9575+
type: string
9576+
type: object
9577+
x-kubernetes-map-type: atomic
9578+
secret:
9579+
description: |-
9580+
secret is a reference (by name) to a Secret's `data` key(s), or to a
9581+
list of Secret's `data` key(s) using label selector, in the namespace.
9582+
properties:
9583+
key:
9584+
description: Key of the entry in the object's `data` field
9585+
to be used.
9586+
maxLength: 253
9587+
minLength: 1
9588+
type: string
9589+
name:
9590+
description: Name is the name of the source object in the
9591+
trust namespace.
9592+
maxLength: 253
9593+
minLength: 1
9594+
type: string
9595+
type: object
9596+
x-kubernetes-map-type: atomic
9597+
type: object
9598+
x-kubernetes-map-type: atomic
95119599
env:
95129600
description: Env contains additional environment variables that should
95139601
be passed to the build container
@@ -11710,6 +11798,50 @@ spec:
1171011798
buildSpec:
1171111799
description: BuildSpec is the Build Spec of this BuildRun.
1171211800
properties:
11801+
caBundle:
11802+
description: CABundle specifies the list certificates to be loaded
11803+
in workload containers.
11804+
properties:
11805+
configMap:
11806+
description: |-
11807+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
11808+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
11809+
properties:
11810+
key:
11811+
description: Key of the entry in the object's `data` field
11812+
to be used.
11813+
maxLength: 253
11814+
minLength: 1
11815+
type: string
11816+
name:
11817+
description: Name is the name of the source object in
11818+
the trust namespace.
11819+
maxLength: 253
11820+
minLength: 1
11821+
type: string
11822+
type: object
11823+
x-kubernetes-map-type: atomic
11824+
secret:
11825+
description: |-
11826+
secret is a reference (by name) to a Secret's `data` key(s), or to a
11827+
list of Secret's `data` key(s) using label selector, in the namespace.
11828+
properties:
11829+
key:
11830+
description: Key of the entry in the object's `data` field
11831+
to be used.
11832+
maxLength: 253
11833+
minLength: 1
11834+
type: string
11835+
name:
11836+
description: Name is the name of the source object in
11837+
the trust namespace.
11838+
maxLength: 253
11839+
minLength: 1
11840+
type: string
11841+
type: object
11842+
x-kubernetes-map-type: atomic
11843+
type: object
11844+
x-kubernetes-map-type: atomic
1171311845
env:
1171411846
description: Env contains additional environment variables that
1171511847
should be passed to the build container

‎deploy/crds/shipwright.io_builds.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2486,6 +2486,50 @@ spec:
24862486
spec:
24872487
description: BuildSpec defines the desired state of Build
24882488
properties:
2489+
caBundle:
2490+
description: CABundle specifies the list certificates to be loaded
2491+
in workload containers.
2492+
properties:
2493+
configMap:
2494+
description: |-
2495+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
2496+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
2497+
properties:
2498+
key:
2499+
description: Key of the entry in the object's `data` field
2500+
to be used.
2501+
maxLength: 253
2502+
minLength: 1
2503+
type: string
2504+
name:
2505+
description: Name is the name of the source object in the
2506+
trust namespace.
2507+
maxLength: 253
2508+
minLength: 1
2509+
type: string
2510+
type: object
2511+
x-kubernetes-map-type: atomic
2512+
secret:
2513+
description: |-
2514+
secret is a reference (by name) to a Secret's `data` key(s), or to a
2515+
list of Secret's `data` key(s) using label selector, in the namespace.
2516+
properties:
2517+
key:
2518+
description: Key of the entry in the object's `data` field
2519+
to be used.
2520+
maxLength: 253
2521+
minLength: 1
2522+
type: string
2523+
name:
2524+
description: Name is the name of the source object in the
2525+
trust namespace.
2526+
maxLength: 253
2527+
minLength: 1
2528+
type: string
2529+
type: object
2530+
x-kubernetes-map-type: atomic
2531+
type: object
2532+
x-kubernetes-map-type: atomic
24892533
env:
24902534
description: Env contains additional environment variables that should
24912535
be passed to the build container

‎pkg/apis/build/v1beta1/build_types.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,8 @@ const (
8686
RuntimeClassNameNotValid BuildReason = "RuntimeClassNameNotValid"
8787
// AllValidationsSucceeded indicates a Build was successfully validated
8888
AllValidationsSucceeded = "all validations succeeded"
89+
// CABundleReferenceNotFound indicates the referenced Secret or ConfigMap is missing
90+
CABundleReferenceNotFound BuildReason = "CABundleReferenceNotFound"
8991
)
9092

9193
// IgnoredVulnerabilitySeverity is an enum for the possible values for the ignored severity
@@ -202,6 +204,10 @@ type BuildSpec struct {
202204
// RuntimeClassName specifies the RuntimeClass to be used to run the Pod
203205
// +optional
204206
RuntimeClassName *string `json:"runtimeClassName,omitempty"`
207+
208+
// CABundle specifies the list certificates to be loaded in workload containers.
209+
// +optional
210+
CABundle *CABundle `json:"caBundle,omitempty"`
205211
}
206212

207213
// BuildVolume is a volume that will be mounted in build pod during build step

‎pkg/apis/build/v1beta1/buildrun_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,10 @@ type BuildRunSpec struct {
130130
// RuntimeClassName specifies the RuntimeClass to be used to run the Pod
131131
// +optional
132132
RuntimeClassName *string `json:"runtimeClassName,omitempty"`
133+
134+
// CABundle specifies the list certificates to be loaded in workload containers.
135+
// +optional
136+
CABundle *CABundle `json:"caBundle,omitempty"`
133137
}
134138

135139
// BuildRunRequestedState defines the buildrun state the user can provide to override whatever is the current state.

‎pkg/apis/build/v1beta1/cabundle.go‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// Copyright The Shipwright Contributors
2+
//
3+
// SPDX-License-Identifier: Apache-2.0
4+
package v1beta1
5+
6+
// CABundle is a set of sources whose data will be added to system trust bundle.
7+
// +structType=atomic
8+
// +kubebuilder:validation:ExactlyOneOf=configMap;secret
9+
type CABundle struct {
10+
// configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
11+
// list of ConfigMap's `data` key(s) using label selector, in the namespace.
12+
// +optional
13+
ConfigMap *SourceObjectKeySelector `json:"configMap,omitempty"`
14+
15+
// secret is a reference (by name) to a Secret's `data` key(s), or to a
16+
// list of Secret's `data` key(s) using label selector, in the namespace.
17+
// +optional
18+
Secret *SourceObjectKeySelector `json:"secret,omitempty"`
19+
}
20+
21+
// SourceObjectKeySelector is a reference to a source object and its `data` key(s)
22+
// in the trust namespace.
23+
// +structType=atomic
24+
type SourceObjectKeySelector struct {
25+
// Name is the name of the source object in the trust namespace.
26+
// +kubebuilder:validation:MinLength=1
27+
// +kubebuilder:validation:MaxLength=253
28+
Name string `json:"name,omitempty"`
29+
30+
// Key of the entry in the object's `data` field to be used.
31+
// +kubebuilder:validation:MinLength=1
32+
// +kubebuilder:validation:MaxLength=253
33+
Key string `json:"key,omitempty"`
34+
}

0 commit comments

Comments
 (0)