-
Notifications
You must be signed in to change notification settings - Fork 6
Open
Labels
enhancementNew feature or requestNew feature or request
Description
Enable TLS for source artifact download URL
The current implementation of source controller API ImageRepository and MavenArtifact expose the resulting source artifact at a HTTP URL defined in .status.artifact.url. The source artifact URL is not exposed externally and is only available to in-cluster consumers. This feature request requires TLS for the source artifact download endpoint.
Additional context
An accepted solution for this Proposal must include the requirements listed below.
- Backward compatibility (i.e., deprecate
HTTPURL and support existing clients during the deprecated period) - Support certificate signed by private CA
- Able to consume certificate updates
- In-cluster clients able to trust the certificate
Proposal
- Add a fixed named secret that contains the TLS key and certificate
- Source Controller manager deployment will use the secret in a mounted volume
- Use
cert-managerto issue a certificate and rotate expired certificates - Add a new type,
SecureArtifactthat has all the existing fields available in the existingArtifacttype plus a new field calledCABundle. TheCABundleis a string field that contains the client certificate key/value pair - The
URLfield forSecureArtifactwill contain theHTTPSdownload URL - Source Controller APIs
Statuswill includeSecureArtifactas well as existingArtifactand maintain backward compatibility
Here is a mock shape of the fixed name secret
apiVersion: v1
data:
ca.crt: …
tls.crt: …
tls.key: …
kind: Secret
metadata:
name: source-server-cert
namespace: source-system
type: kubernetes.io/tlsHere is a mock of the proposed API status
status:
artifact: # existing type `Artifact`
...
url: "http://..."
secureArtifact: # New type `SecureArtifact` = `Artifact` + CABundle
...
url: "https://..."
caBundle: ""Testing
- Unit test coverage of the
HTTPSfeature - e2e integration test (CI)
- Install with value TLS enabled
- Create
ImageRespositoryresource - Validate downloaded artifact from
HTTPSendpoint - Create
MavenArtifactresource - Validate downloaded maven artifact from
HTTPSendpoint
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or request