Skip to content

Commit

Permalink
WIP: switching between cert / cr
Browse files Browse the repository at this point in the history
Signed-off-by: Ashley Davis <[email protected]>
  • Loading branch information
SgtCoDFish committed Sep 30, 2024
1 parent c0b0dd6 commit 7b03fa6
Show file tree
Hide file tree
Showing 12 changed files with 2,625 additions and 8 deletions.
10 changes: 10 additions & 0 deletions deploy/charts/openshift-routes/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,16 @@ Override the "cert-manager.fullname" value. This value is used as part of most o
Override the "cert-manager.name" value, which is used to annotate some of the resources that are created by this Chart (using "app.kubernetes.io/name"). NOTE: There are some inconsitencies in the Helm chart when it comes to these annotations (some resources use eg. "cainjector.name" which resolves to the value "cainjector").
#### **issuanceMode** ~ `string`
> Default value:
> ```yaml
> certificate
> ```
Control how certificates are issued for routes. 'certificate' mode (the default) will create a cert-manager Certificate resource and store the issued certificate in a
Kubernetes Secret before adding it to the route.
'certificaterequest' mode will directly create a CertificateRequest resource, which makes
the cert harder to use outside of Routes but avoids creating a Secret
#### **image.registry** ~ `string`
Target image registry. This value is prepended to the target image repository, if set.
Expand Down
1 change: 1 addition & 0 deletions deploy/charts/openshift-routes/templates/deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ spec:
args:
- "-v={{ .Values.logLevel }}"
- "--leader-election-namespace={{ .Release.Namespace }}"
- "--issuance-mode={{ .Values.issuanceMode }}"
ports:
- containerPort: 6060
name: readiness
Expand Down
20 changes: 20 additions & 0 deletions deploy/charts/openshift-routes/templates/rbac.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,25 @@ rules:
verbs:
- create
- update
{{- if eq (lower .Values.issuanceMode) "certificaterequest" }}
- apiGroups:
- cert-manager.io
resources:
- certificaterequests
verbs:
- create
- get
- list
- watch
- apiGroups:
- cert-manager.io
resources:
- certificaterequests/status
verbs:
- get
- list
- watch
{{- else }}
- apiGroups:
- cert-manager.io
resources:
Expand All @@ -55,6 +74,7 @@ rules:
- get
- list
- watch
{{- end }}
- apiGroups:
- ""
resources:
Expand Down
8 changes: 8 additions & 0 deletions deploy/charts/openshift-routes/values.schema.json
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@
"imagePullSecrets": {
"$ref": "#/$defs/helm-values.imagePullSecrets"
},
"issuanceMode": {
"$ref": "#/$defs/helm-values.issuanceMode"
},
"logLevel": {
"$ref": "#/$defs/helm-values.logLevel"
},
Expand Down Expand Up @@ -124,6 +127,11 @@
"items": {},
"type": "array"
},
"helm-values.issuanceMode": {
"default": "certificate",
"description": "Control how certificates are issued for routes. 'certificate' mode (the default) will create a cert-manager Certificate resource and store the issued certificate in a\nKubernetes Secret before adding it to the route.\n'certificaterequest' mode will directly create a CertificateRequest resource, which makes\nthe cert harder to use outside of Routes but avoids creating a Secret",
"type": "string"
},
"helm-values.logLevel": {
"default": 5,
"type": "number"
Expand Down
7 changes: 7 additions & 0 deletions deploy/charts/openshift-routes/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,13 @@ namespace: ""
# +docs:property
# nameOverride: "my-cert-manager"

# Control how certificates are issued for routes. 'certificate' mode (the default) will
# create a cert-manager Certificate resource and store the issued certificate in a
# Kubernetes Secret before adding it to the route.
# 'certificaterequest' mode will directly create a CertificateRequest resource, which makes
# the cert harder to use outside of Routes but avoids creating a Secret
issuanceMode: "certificate"

image:
# Target image registry. This value is prepended to the target image repository, if set.
# For example:
Expand Down
46 changes: 39 additions & 7 deletions internal/cmd/app/app.go
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ import (

"github.com/cert-manager/openshift-routes/internal/cmd/app/options"
"github.com/cert-manager/openshift-routes/internal/controller"
"github.com/cert-manager/openshift-routes/internal/crcontroller"
)

func Command() *cobra.Command {
Expand Down Expand Up @@ -69,22 +70,33 @@ func Command() *cobra.Command {
return fmt.Errorf("connected to the Kubernetes API, but the Openshift Route v1 CRD does not appear to be installed")
}

// Check if v1 cert-manager Certificates exist in the API server
// Check if v1 cert-manager Certificates / CertificateRequests exist in the API server
apiServerHasCertificates := false
apiServerHasCertificateRequests := false

cmResources, err := cl.Discovery().ServerResourcesForGroupVersion("cert-manager.io/v1")
if err != nil {
return fmt.Errorf("couldn't check if cert-manager.io/v1 exists in the kubernetes API: %w", err)
}

for _, r := range cmResources.APIResources {
if apiServerHasCertificates && apiServerHasCertificateRequests {
break
}

if r.Kind == "Certificate" {
apiServerHasCertificates = true
break
continue
}

if r.Kind == "CertificateRequest" {
apiServerHasCertificateRequests = true
continue
}
}

if !apiServerHasCertificates {
return fmt.Errorf("connected to the Kubernetes API, but the cert-manager v1 CRDs do not appear to be installed")
if !apiServerHasCertificates || !apiServerHasCertificateRequests {
return fmt.Errorf("connected to the Kubernetes API, but the cert-manager v1 CRDs do not appear to be installed: has Certificates=%v, has CertificateRequests=%v", apiServerHasCertificates, apiServerHasCertificateRequests)
}

logger := opts.Logr.WithName("controller-manager")
Expand Down Expand Up @@ -121,6 +133,7 @@ func Command() *cobra.Command {
if err != nil {
return fmt.Errorf("could not create controller manager: %w", err)
}

mgr.AddReadyzCheck("informers_synced", func(req *http.Request) error {
// haven't got much time to wait in a readiness check
ctx, cancel := context.WithTimeout(req.Context(), 2*time.Second)
Expand All @@ -130,13 +143,32 @@ func Command() *cobra.Command {
}
return fmt.Errorf("informers not synced")
})
if err := controller.AddToManager(mgr, opts); err != nil {
return fmt.Errorf("could not add route controller to manager: %w", err)

switch opts.IssuanceMode {
case options.CertificateIssuanceMode:
err := controller.AddToManager(mgr, opts)
if err != nil {
return fmt.Errorf("could not add certificate-based route controller to manager: %w", err)
}

opts.Logr.V(5).Info("starting certificate-based controller")

case options.CertificateRequestIssuanceMode:
err := crcontroller.AddToManager(mgr, opts)
if err != nil {
return fmt.Errorf("could not add certificate request-based route controller to manager: %w", err)
}

opts.Logr.V(5).Info("starting certificate request-based controller")

default:
return fmt.Errorf("invalid issuance mode %q", opts.IssuanceMode)
}
opts.Logr.V(5).Info("starting controller")

return mgr.Start(ctrl.SetupSignalHandler())
},
}

opts.Prepare(cmd)
return cmd
}
28 changes: 28 additions & 0 deletions internal/cmd/app/options/options.go
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ package options
import (
"flag"
"fmt"
"strings"

"github.com/go-logr/logr"
"github.com/spf13/cobra"
Expand All @@ -31,6 +32,13 @@ import (
"k8s.io/klog/v2/klogr"
)

const (
CertificateIssuanceMode = "certificate"
CertificateRequestIssuanceMode = "certificaterequest"

defaultIssuanceMode = CertificateIssuanceMode
)

// Options is the main configuration struct for cert-manager-openshift-routes
type Options struct {
EventRecorder record.EventRecorder
Expand All @@ -55,6 +63,10 @@ type Options struct {
// RestConfig is the Kubernetes config
RestConfig *rest.Config

// IssuanceMode switches between using Certificates and CertificateRequests
// to issue certs for routes
IssuanceMode string

logLevel string
kubeConfigFlags *genericclioptions.ConfigFlags
}
Expand Down Expand Up @@ -82,6 +94,19 @@ func (o *Options) Complete() error {
return fmt.Errorf("failed to build kubernetes rest config: %s", err)
}

originalIssuanceMode := o.IssuanceMode

if o.IssuanceMode == "" {
o.IssuanceMode = defaultIssuanceMode
}

o.IssuanceMode = strings.ToLower(o.IssuanceMode)
o.IssuanceMode = strings.TrimSuffix(o.IssuanceMode, "s")

if o.IssuanceMode != CertificateIssuanceMode && o.IssuanceMode != CertificateRequestIssuanceMode {
return fmt.Errorf("invalid issuance mode %q; must be either '%s' or '%s'", originalIssuanceMode, CertificateIssuanceMode, CertificateRequestIssuanceMode)
}

return nil
}

Expand Down Expand Up @@ -134,4 +159,7 @@ func (o *Options) addAppFlags(fs *pflag.FlagSet) {
fs.StringVar(&o.LeaderElectionNamespace,
"leader-election-namespace", "cert-manager",
"Namespace to create leader election resources in.")

fs.StringVar(&o.IssuanceMode, "issuance-mode", defaultIssuanceMode,
fmt.Sprintf("How certificates should be requested. Either '%s' or '%s'", CertificateIssuanceMode, CertificateRequestIssuanceMode))
}
117 changes: 117 additions & 0 deletions internal/crcontroller/controller.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,117 @@
/*
Copyright 2022 The cert-manager Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package crcontroller

import (
"context"

cmapi "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
cmclient "github.com/cert-manager/cert-manager/pkg/client/clientset/versioned"
"github.com/go-logr/logr"
routev1 "github.com/openshift/api/route/v1"
routev1client "github.com/openshift/client-go/route/clientset/versioned"
"k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/client-go/rest"
"k8s.io/client-go/tools/record"
"sigs.k8s.io/controller-runtime/pkg/builder"
"sigs.k8s.io/controller-runtime/pkg/manager"
"sigs.k8s.io/controller-runtime/pkg/reconcile"

"github.com/cert-manager/openshift-routes/internal/cmd/app/options"
)

type Route struct {
routeClient routev1client.Interface
certClient cmclient.Interface
eventRecorder record.EventRecorder

log logr.Logger
}

func shouldSync(log logr.Logger, route *routev1.Route) bool {
if len(route.ObjectMeta.OwnerReferences) > 0 {
for _, o := range route.ObjectMeta.OwnerReferences {
if o.Kind == "Ingress" {
log.V(5).Info("Route is owned by an Ingress")
return false
}
}
}

if metav1.HasAnnotation(route.ObjectMeta, cmapi.IssuerNameAnnotationKey) {
log.V(5).Info("Route has the annotation", "annotation-key", cmapi.IssuerNameAnnotationKey, "annotation-value", route.Annotations[cmapi.IssuerNameAnnotationKey])
return true
}

if metav1.HasAnnotation(route.ObjectMeta, cmapi.IngressIssuerNameAnnotationKey) {
log.V(5).Info("Route has the annotation", "annotation-key", cmapi.IngressIssuerNameAnnotationKey, "annotation-value", route.Annotations[cmapi.IngressIssuerNameAnnotationKey])
return true
}

log.V(5).Info("Route does not have the cert-manager issuer annotation")
return false
}

func (r *Route) Reconcile(ctx context.Context, req reconcile.Request) (reconcile.Result, error) {
log := r.log.WithValues("object", req.NamespacedName)
log.V(5).Info("started reconciling")
route, err := r.routeClient.RouteV1().Routes(req.Namespace).Get(ctx, req.Name, metav1.GetOptions{})
if errors.IsNotFound(err) {
return reconcile.Result{}, nil
}
if err != nil {
return reconcile.Result{}, err
}
log.V(5).Info("retrieved route")

if !shouldSync(log, route) {
return reconcile.Result{}, nil
}

return r.sync(ctx, req, route.DeepCopy())
}

func New(base logr.Logger, config *rest.Config, recorder record.EventRecorder) (*Route, error) {
routeClient, err := routev1client.NewForConfig(config)
if err != nil {
return nil, err
}
certClient, err := cmclient.NewForConfig(config)
if err != nil {
return nil, err
}

return &Route{
routeClient: routeClient,
certClient: certClient,
log: base.WithName("route"),
eventRecorder: recorder,
}, nil
}

func AddToManager(mgr manager.Manager, opts *options.Options) error {
controller, err := New(opts.Logr, opts.RestConfig, opts.EventRecorder)
if err != nil {
return err
}
return builder.
ControllerManagedBy(mgr).
For(&routev1.Route{}).
Owns(&cmapi.CertificateRequest{}).
Complete(controller)
}
Loading

0 comments on commit 7b03fa6

Please sign in to comment.