Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Community code sync for operand, update CRDs #375

Merged
merged 14 commits into from
Oct 18, 2023
Merged

Community code sync for operand, update CRDs #375

Show file tree
Hide file tree
Changes from 10 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
f9c78a5
update crds, version
bluzarraga Oct 11, 2023
b924692
update crds for uplift
bluzarraga Oct 11, 2023
8978c0a
revert change to controller-runtime
bluzarraga Oct 12, 2023
8a9d715
update tests
bluzarraga Oct 13, 2023
b114018
update controller filtered cache
bluzarraga Oct 13, 2023
a3b30e9
try different version of controller runtime
bluzarraga Oct 13, 2023
cf6b406
Merge branch 'master' into uplift1131
bluzarraga Oct 13, 2023
59c8aa1
rerun go mod tidy
bluzarraga Oct 13, 2023
6f5b946
clean up controller runtime
bluzarraga Oct 13, 2023
d96d658
clean up controller runtime
bluzarraga Oct 13, 2023
d6b96e2
revert label changes
bluzarraga Oct 17, 2023
f55b7f4
run make manifests, make generate, and make bundle
Oct 17, 2023
157236b
fixed formatting for bundle manifests
bitscuit Oct 18, 2023
479b1e9
removed ClusterIssuer from apis package
bitscuit Oct 18, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
94 changes: 73 additions & 21 deletions apis/acme.cert-manager/v1/types_issuer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ package v1
import (
corev1 "k8s.io/api/core/v1"
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
gwapi "sigs.k8s.io/gateway-api/apis/v1beta1"

cmmeta "github.com/ibm/ibm-cert-manager-operator/apis/meta.cert-manager/v1"
)
Expand Down Expand Up @@ -51,14 +52,25 @@ type ACMEIssuer struct {
// chains that has a certificate with this value as its issuer's CN
// +optional
// +kubebuilder:validation:MaxLength=64
PreferredChain string `json:"preferredChain"`

// Enables or disables validation of the ACME server TLS certificate.
// If true, requests to the ACME server will not have their TLS certificate
// validated (i.e. insecure connections will be allowed).
PreferredChain string `json:"preferredChain,omitempty"`

// Base64-encoded bundle of PEM CAs which can be used to validate the certificate
// chain presented by the ACME server.
// Mutually exclusive with SkipTLSVerify; prefer using CABundle to prevent various
// kinds of security vulnerabilities.
// If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
// the container is used to validate the TLS connection.
// +optional
CABundle []byte `json:"caBundle,omitempty"`

// INSECURE: Enables or disables validation of the ACME server TLS certificate.
// If true, requests to the ACME server will not have the TLS certificate chain
// validated.
// Mutually exclusive with CABundle; prefer using CABundle to prevent various
// kinds of security vulnerabilities.
// Only enable this option in development environments.
// The cert-manager system installed roots will be used to verify connections
// to the ACME server if this is false.
// If CABundle and SkipTLSVerify are unset, the system certificate bundle inside
// the container is used to validate the TLS connection.
// Defaults to false.
// +optional
SkipTLSVerify bool `json:"skipTLSVerify,omitempty"`
Expand Down Expand Up @@ -221,17 +233,26 @@ type ACMEChallengeSolverHTTP01Ingress struct {
// +optional
ServiceType corev1.ServiceType `json:"serviceType,omitempty"`

// The ingress class to use when creating Ingress resources to solve ACME
// challenges that use this challenge solver.
// Only one of 'class' or 'name' may be specified.
// This field configures the field `ingressClassName` on the created Ingress
// resources used to solve ACME challenges that use this challenge solver.
// This is the recommended way of configuring the ingress class. Only one of
// `class`, `name` or `ingressClassName` may be specified.
// +optional
IngressClassName *string `json:"ingressClassName,omitempty"`

// This field configures the annotation `kubernetes.io/ingress.class` when
// creating Ingress resources to solve ACME challenges that use this
// challenge solver. Only one of `class`, `name` or `ingressClassName` may
// be specified.
// +optional
Class *string `json:"class,omitempty"`

// The name of the ingress resource that should have ACME challenge solving
// routes inserted into it in order to solve HTTP01 challenges.
// This is typically used in conjunction with ingress controllers like
// ingress-gce, which maintains a 1:1 mapping between external IPs and
// ingress resources.
// ingress resources. Only one of `class`, `name` or `ingressClassName` may
// be specified.
// +optional
Name string `json:"name,omitempty"`

Expand All @@ -253,10 +274,17 @@ type ACMEChallengeSolverHTTP01GatewayHTTPRoute struct {
// are NodePort or ClusterIP. If unset, defaults to NodePort.
// +optional
ServiceType corev1.ServiceType `json:"serviceType,omitempty"`
// The labels that cert-manager will use when creating the temporary
// HTTPRoute needed for solving the HTTP-01 challenge. These labels
// must match the label selector of at least one Gateway.

// Custom labels that will be applied to HTTPRoutes created by cert-manager
// while solving HTTP-01 challenges.
// +optional
Labels map[string]string `json:"labels,omitempty"`

// When solving an HTTP-01 challenge, cert-manager creates an HTTPRoute.
// cert-manager needs to know which parentRefs should be used when creating
// the HTTPRoute. Usually, the parentRef references a Gateway. See:
// https://gateway-api.sigs.k8s.io/api-types/httproute/#attaching-to-gateways
ParentRefs []gwapi.ParentReference `json:"parentRefs,omitempty"`
}

type ACMEChallengeSolverHTTP01IngressPodTemplate struct {
Expand All @@ -268,8 +296,7 @@ type ACMEChallengeSolverHTTP01IngressPodTemplate struct {
ACMEChallengeSolverHTTP01IngressPodObjectMeta `json:"metadata"`

// PodSpec defines overrides for the HTTP01 challenge solver pod.
// Only the 'priorityClassName', 'nodeSelector', 'affinity',
// 'serviceAccountName' and 'tolerations' fields are supported currently.
// Check ACMEChallengeSolverHTTP01IngressPodSpec to find out currently supported fields.
// All other fields will be ignored.
// +optional
Spec ACMEChallengeSolverHTTP01IngressPodSpec `json:"spec"`
Expand Down Expand Up @@ -307,6 +334,10 @@ type ACMEChallengeSolverHTTP01IngressPodSpec struct {
// If specified, the pod's service account
// +optional
ServiceAccountName string `json:"serviceAccountName,omitempty"`

// If specified, the pod's imagePullSecrets
// +optional
ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty" patchStrategy:"merge" patchMergeKey:"name"`
}

type ACMEChallengeSolverHTTP01IngressTemplate struct {
Expand Down Expand Up @@ -447,13 +478,27 @@ type ACMEIssuerDNS01ProviderDigitalOcean struct {
// ACMEIssuerDNS01ProviderRoute53 is a structure containing the Route 53
// configuration for AWS
type ACMEIssuerDNS01ProviderRoute53 struct {
// The AccessKeyID is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// The AccessKeyID is used for authentication.
// Cannot be set when SecretAccessKeyID is set.
// If neither the Access Key nor Key ID are set, we fall-back to using env
// vars, shared credentials file or AWS Instance metadata,
// see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// +optional
AccessKeyID string `json:"accessKeyID,omitempty"`

// The SecretAccessKey is used for authentication. If not set we fall-back to using env vars, shared credentials file or AWS Instance metadata
// https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// The SecretAccessKey is used for authentication. If set, pull the AWS
// access key ID from a key within a Kubernetes Secret.
// Cannot be set when AccessKeyID is set.
// If neither the Access Key nor Key ID are set, we fall-back to using env
// vars, shared credentials file or AWS Instance metadata,
// see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// +optional
SecretAccessKeyID *cmmeta.SecretKeySelector `json:"accessKeyIDSecretRef,omitempty"`

// The SecretAccessKey is used for authentication.
// If neither the Access Key nor Key ID are set, we fall-back to using env
// vars, shared credentials file or AWS Instance metadata,
// see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
// +optional
SecretAccessKey cmmeta.SecretKeySelector `json:"secretAccessKeySecretRef"`

Expand Down Expand Up @@ -508,6 +553,7 @@ type AzureManagedIdentity struct {
// client ID of the managed identity, can not be used at the same time as resourceID
// +optional
ClientID string `json:"clientID,omitempty"`

// resource ID of the managed identity, can not be used at the same time as clientID
// +optional
ResourceID string `json:"resourceID,omitempty"`
Expand Down Expand Up @@ -536,7 +582,7 @@ type ACMEIssuerDNS01ProviderAcmeDNS struct {
type ACMEIssuerDNS01ProviderRFC2136 struct {
// The IP address or hostname of an authoritative DNS server supporting
// RFC2136 in the form host:port. If the host is an IPv6 address it must be
// enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
// enclosed in square brackets (e.g [2001:db8::1]) ; port is optional.
// This field is required.
Nameserver string `json:"nameserver"`

Expand Down Expand Up @@ -595,4 +641,10 @@ type ACMEIssuerStatus struct {
// associated with the Issuer
// +optional
LastRegisteredEmail string `json:"lastRegisteredEmail,omitempty"`
}

// LastPrivateKeyHash is a hash of the private key associated with the latest
// registered ACME account, in order to track changes made to registered account
// associated with the Issuer
// +optional
LastPrivateKeyHash string `json:"lastPrivateKeyHash,omitempty"`
}
Loading