Add option to switch between using certificates and CRs

README.md

@@ -143,6 +143,14 @@ After modifying the source code, you can execute the tests with:
 go test ./...
 ```
 
+To run the controller locally, export the location of your kubeconfig file:
+
+```sh
+export KUBECONFIG=$HOME/path/to/kubeconfig
+# adjust namespace as necessary
+go run internal/cmd/main.go --namespace cert-manager --enable-leader-election=false
+```
+
 # Why is This a Separate Project?
 
 We do not wish to support non Kubernetes (or kubernetes-sigs) APIs in cert-manager core. This adds

deploy/charts/openshift-routes/README.md

@@ -31,6 +31,16 @@ Override the "cert-manager.fullname" value. This value is used as part of most o
 
 Override the "cert-manager.name" value, which is used to annotate some of the resources that are created by this Chart (using "app.kubernetes.io/name"). NOTE: There are some inconsitencies in the Helm chart when it comes to these annotations (some resources use eg. "cainjector.name" which resolves to the value "cainjector").
 
+#### **issuanceMode** ~ `string`
+> Default value:
+> ```yaml
+> certificate
+> ```
+
+Control how certificates are issued for routes. 'certificate' mode (the default) will create a cert-manager Certificate resource and store the issued certificate in a  
+Kubernetes Secret before adding it to the route.  
+'certificaterequest' mode will directly create a CertificateRequest resource, which makes  
+the cert harder to use outside of Routes but avoids creating a Secret
 #### **image.registry** ~ `string`
 
 Target image registry. This value is prepended to the target image repository, if set.  

deploy/charts/openshift-routes/templates/deployment.yaml

@@ -36,6 +36,7 @@ spec:
           args:
             - "-v={{ .Values.logLevel }}"
             - "--leader-election-namespace={{ .Release.Namespace }}"
+            - "--issuance-mode={{ .Values.issuanceMode }}"
           ports:
           - containerPort: 6060
             name: readiness

deploy/charts/openshift-routes/templates/rbac.yaml

@@ -29,6 +29,7 @@ rules:
   verbs:
   - create
   - update
+{{- if eq (lower .Values.issuanceMode) "certificaterequest" }}
 - apiGroups:
   - cert-manager.io
   resources:
@@ -46,6 +47,34 @@ rules:
     - get
     - list
     - watch
+{{- else }}
+- apiGroups:
+  - cert-manager.io
+  resources:
+  - certificates
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+- apiGroups:
+    - cert-manager.io
+  resources:
+    - certificates/status
+  verbs:
+    - get
+    - list
+    - watch
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+{{- end }}
 - apiGroups:
   - ""
   resources:

deploy/charts/openshift-routes/values.schema.json

@@ -18,6 +18,9 @@
         "imagePullSecrets": {
           "$ref": "#/$defs/helm-values.imagePullSecrets"
         },
+        "issuanceMode": {
+          "$ref": "#/$defs/helm-values.issuanceMode"
+        },
         "logLevel": {
           "$ref": "#/$defs/helm-values.logLevel"
         },
@@ -124,6 +127,11 @@
       "items": {},
       "type": "array"
     },
+    "helm-values.issuanceMode": {
+      "default": "certificate",
+      "description": "Control how certificates are issued for routes. 'certificate' mode (the default) will create a cert-manager Certificate resource and store the issued certificate in a\nKubernetes Secret before adding it to the route.\n'certificaterequest' mode will directly create a CertificateRequest resource, which makes\nthe cert harder to use outside of Routes but avoids creating a Secret",
+      "type": "string"
+    },
     "helm-values.logLevel": {
       "default": 5,
       "type": "number"

deploy/charts/openshift-routes/values.yaml

@@ -21,6 +21,13 @@ namespace: ""
 # +docs:property
 # nameOverride: "my-cert-manager"
 
+# Control how certificates are issued for routes. 'certificate' mode (the default) will
+# create a cert-manager Certificate resource and store the issued certificate in a
+# Kubernetes Secret before adding it to the route.
+# 'certificaterequest' mode will directly create a CertificateRequest resource, which makes
+# the cert harder to use outside of Routes but avoids creating a Secret
+issuanceMode: "certificate"
+
 image:
   # Target image registry. This value is prepended to the target image repository, if set.
   # For example:

internal/cmd/app/app.go

@@ -35,6 +35,7 @@ import (
 
 	"github.com/cert-manager/openshift-routes/internal/cmd/app/options"
 	"github.com/cert-manager/openshift-routes/internal/controller"
+	"github.com/cert-manager/openshift-routes/internal/crcontroller"
 )
 
 func Command() *cobra.Command {
@@ -69,20 +70,33 @@ func Command() *cobra.Command {
 				return fmt.Errorf("connected to the Kubernetes API, but the Openshift Route v1 CRD does not appear to be installed")
 			}
 
-			// Check if v1 cert-manager CertificateRequests exist in the API server
+			// Check if v1 cert-manager Certificates / CertificateRequests exist in the API server
+			apiServerHasCertificates := false
 			apiServerHasCertificateRequests := false
+
 			cmResources, err := cl.Discovery().ServerResourcesForGroupVersion("cert-manager.io/v1")
 			if err != nil {
 				return fmt.Errorf("couldn't check if cert-manager.io/v1 exists in the kubernetes API: %w", err)
 			}
+
 			for _, r := range cmResources.APIResources {
+				if apiServerHasCertificates && apiServerHasCertificateRequests {
+					break
+				}
+
+				if r.Kind == "Certificate" {
+					apiServerHasCertificates = true
+					continue
+				}
+
 				if r.Kind == "CertificateRequest" {
 					apiServerHasCertificateRequests = true
-					break
+					continue
 				}
 			}
-			if !apiServerHasCertificateRequests {
-				return fmt.Errorf("connected to the Kubernetes API, but the cert-manager v1 CRDs do not appear to be installed")
+
+			if !apiServerHasCertificates || !apiServerHasCertificateRequests {
+				return fmt.Errorf("connected to the Kubernetes API, but the cert-manager v1 CRDs do not appear to be installed: has Certificates=%v, has CertificateRequests=%v", apiServerHasCertificates, apiServerHasCertificateRequests)
 			}
 
 			logger := opts.Logr.WithName("controller-manager")
@@ -119,6 +133,7 @@ func Command() *cobra.Command {
 			if err != nil {
 				return fmt.Errorf("could not create controller manager: %w", err)
 			}
+
 			mgr.AddReadyzCheck("informers_synced", func(req *http.Request) error {
 				// haven't got much time to wait in a readiness check
 				ctx, cancel := context.WithTimeout(req.Context(), 2*time.Second)
@@ -128,13 +143,32 @@ func Command() *cobra.Command {
 				}
 				return fmt.Errorf("informers not synced")
 			})
-			if err := controller.AddToManager(mgr, opts); err != nil {
-				return fmt.Errorf("could not add route controller to manager: %w", err)
+
+			switch opts.IssuanceMode {
+			case options.CertificateIssuanceMode:
+				err := controller.AddToManager(mgr, opts)
+				if err != nil {
+					return fmt.Errorf("could not add certificate-based route controller to manager: %w", err)
+				}
+
+				opts.Logr.V(5).Info("starting certificate-based controller")
+
+			case options.CertificateRequestIssuanceMode:
+				err := crcontroller.AddToManager(mgr, opts)
+				if err != nil {
+					return fmt.Errorf("could not add certificate request-based route controller to manager: %w", err)
+				}
+
+				opts.Logr.V(5).Info("starting certificate request-based controller")
+
+			default:
+				return fmt.Errorf("invalid issuance mode %q", opts.IssuanceMode)
 			}
-			opts.Logr.V(5).Info("starting controller")
+
 			return mgr.Start(ctrl.SetupSignalHandler())
 		},
 	}
+
 	opts.Prepare(cmd)
 	return cmd
 }

internal/cmd/app/options/options.go

@@ -19,6 +19,7 @@ package options
 import (
 	"flag"
 	"fmt"
+	"strings"
 
 	"github.com/go-logr/logr"
 	"github.com/spf13/cobra"
@@ -31,6 +32,13 @@ import (
 	"k8s.io/klog/v2/klogr"
 )
 
+const (
+	CertificateIssuanceMode        = "certificate"
+	CertificateRequestIssuanceMode = "certificaterequest"
+
+	defaultIssuanceMode = CertificateIssuanceMode
+)
+
 // Options is the main configuration struct for cert-manager-openshift-routes
 type Options struct {
 	EventRecorder record.EventRecorder
@@ -55,6 +63,10 @@ type Options struct {
 	// RestConfig is the Kubernetes config
 	RestConfig *rest.Config
 
+	// IssuanceMode switches between using Certificates and CertificateRequests
+	// to issue certs for routes
+	IssuanceMode string
+
 	logLevel        string
 	kubeConfigFlags *genericclioptions.ConfigFlags
 }
@@ -82,6 +94,19 @@ func (o *Options) Complete() error {
 		return fmt.Errorf("failed to build kubernetes rest config: %s", err)
 	}
 
+	originalIssuanceMode := o.IssuanceMode
+
+	if o.IssuanceMode == "" {
+		o.IssuanceMode = defaultIssuanceMode
+	}
+
+	o.IssuanceMode = strings.ToLower(o.IssuanceMode)
+	o.IssuanceMode = strings.TrimSuffix(o.IssuanceMode, "s")
+
+	if o.IssuanceMode != CertificateIssuanceMode && o.IssuanceMode != CertificateRequestIssuanceMode {
+		return fmt.Errorf("invalid issuance mode %q; must be either '%s' or '%s'", originalIssuanceMode, CertificateIssuanceMode, CertificateRequestIssuanceMode)
+	}
+
 	return nil
 }
 
@@ -134,4 +159,7 @@ func (o *Options) addAppFlags(fs *pflag.FlagSet) {
 	fs.StringVar(&o.LeaderElectionNamespace,
 		"leader-election-namespace", "cert-manager",
 		"Namespace to create leader election resources in.")
+
+	fs.StringVar(&o.IssuanceMode, "issuance-mode", defaultIssuanceMode,
+		fmt.Sprintf("How certificates should be requested. Either '%s' or '%s'", CertificateIssuanceMode, CertificateRequestIssuanceMode))
 }

internal/controller/controller.go

@@ -26,6 +26,8 @@ import (
 	routev1client "github.com/openshift/client-go/route/clientset/versioned"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/record"
 	"sigs.k8s.io/controller-runtime/pkg/builder"
@@ -35,9 +37,10 @@ import (
 	"github.com/cert-manager/openshift-routes/internal/cmd/app/options"
 )
 
-type Route struct {
+type RouteController struct {
 	routeClient   routev1client.Interface
 	certClient    cmclient.Interface
+	coreClient    corev1client.CoreV1Interface
 	eventRecorder record.EventRecorder
 
 	log logr.Logger
@@ -67,7 +70,7 @@ func shouldSync(log logr.Logger, route *routev1.Route) bool {
 	return false
 }
 
-func (r *Route) Reconcile(ctx context.Context, req reconcile.Request) (reconcile.Result, error) {
+func (r *RouteController) Reconcile(ctx context.Context, req reconcile.Request) (reconcile.Result, error) {
 	log := r.log.WithValues("object", req.NamespacedName)
 	log.V(5).Info("started reconciling")
 	route, err := r.routeClient.RouteV1().Routes(req.Namespace).Get(ctx, req.Name, metav1.GetOptions{})
@@ -86,7 +89,7 @@ func (r *Route) Reconcile(ctx context.Context, req reconcile.Request) (reconcile
 	return r.sync(ctx, req, route.DeepCopy())
 }
 
-func New(base logr.Logger, config *rest.Config, recorder record.EventRecorder) (*Route, error) {
+func New(base logr.Logger, config *rest.Config, recorder record.EventRecorder) (*RouteController, error) {
 	routeClient, err := routev1client.NewForConfig(config)
 	if err != nil {
 		return nil, err
@@ -95,10 +98,15 @@ func New(base logr.Logger, config *rest.Config, recorder record.EventRecorder) (
 	if err != nil {
 		return nil, err
 	}
+	clientset, err := kubernetes.NewForConfig(config)
+	if err != nil {
+		return nil, err
+	}
 
-	return &Route{
+	return &RouteController{
 		routeClient:   routeClient,
 		certClient:    certClient,
+		coreClient:    clientset.CoreV1(),
 		log:           base.WithName("route"),
 		eventRecorder: recorder,
 	}, nil
@@ -109,9 +117,10 @@ func AddToManager(mgr manager.Manager, opts *options.Options) error {
 	if err != nil {
 		return err
 	}
+
 	return builder.
 		ControllerManagedBy(mgr).
 		For(&routev1.Route{}).
-		Owns(&cmapi.CertificateRequest{}).
+		Owns(&cmapi.Certificate{}).
 		Complete(controller)
 }