feat: add pre-generated certificates support - #1252
Conversation
✅ Deploy Preview for kamaji-documentation ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
05c8186 to
dd19c91
Compare
prometherion
left a comment
prometherion
left a comment
There was a problem hiding this comment.
Besides the comment on the implementation allowing to retrieve Secret objects from a different Namespace, may I ask you a documentation page explaining the feature, and providing an example with cert-manager resources? Since I guess this is the most concrete example of using already existing certs and keys.
|
Hi @prometherion - I've pushed the documentation for pre-generated certificates to the docs repository. The documentation page is available at: https://github.com/clastix/kamaji-documentation/blob/main/docs/content/guides/pre-generated-certificates.md It includes:
Would you like me to expand on any particular section or add more cert-manager examples? |
Add PreGeneratedCertificatesSpec to allow users to provide their own certificates instead of auto-generating them. Key features: - CertificateReference and KeyReference types for referencing secrets - PreGeneratedCertificatesSpec with CA, APIServer, KubeletClient, FrontProxyCA, FrontProxyClient, and ServiceAccount fields - Webhook validation for certificate/key references - Unit and e2e tests for the feature Signed-off-by: Ross Golder <ross@golder.org>
The webhook validates that pre-generated certificates exist in secrets, but the certificate generation code wasn't reading from them. This adds the usePreGeneratedCACertificate method to actually use the user-provided certificates instead of generating new ones.
…ources - ca_certificate.go: usePreGeneratedCACertificate - api_server_certificate.go: usePreGeneratedAPIServerCertificate - api_server_kubelet_client_certificate.go: usePreGeneratedKubeletClientCertificate - front_proxy_ca_certificate.go: usePreGeneratedFrontProxyCACertificate - front-proxy-client-certificate.go: usePreGeneratedFrontProxyClientCertificate - sa_certificate.go: usePreGeneratedSACertificate
The pre-generated certificates validation webhook was not being invoked because the handler was not registered in the webhook chain.
…rtificates The SecretNamespace field has been removed from CertificateReference and KeyReference types since cross-namespace secret references require complex RBAC setup that violates the principle of least privilege. Secrets referenced in pre-generated certificates must now be in the same namespace as the TenantControlPlane. Updated: - api/v1alpha1/tenantcontrolplane_types.go (removed SecretNamespace fields) - internal/resources/*.go (removed secretNamespace handling) - internal/webhook/handlers/tcp_pregenerated_certs.go (removed validation) - internal/webhook/handlers/tcp_pregenerated_certs_test.go (updated test)
5c347d3 to
b085991
Compare
|
@prometherion rebased onto current On your documentation request: I wrote the guide but pushed it to the On CI: e2e fails 1/32 on |
2 participants
Summary
Adds support for pre-generated certificates, letting a TenantControlPlane consume existing CA and leaf certificates from Secrets instead of having Kamaji generate them. The main use case is certificates issued by an external PKI or by
cert-manager.Changes
PreGeneratedCertificatesSpecadded to the TenantControlPlane API, with generated CRDs and deepcopy.ca_certificate.go,api_server_certificate.go,api_server_kubelet_client_certificate.go,front_proxy_ca_certificate.go,front-proxy-client-certificate.go,sa_certificate.go.internal/webhook/handlers/tcp_pregenerated_certs.go, registered incmd/manager/cmd.go.e2e/tcp_pregenerated_certs_test.go.Review feedback addressed
Cross-namespace Secret references have been removed. Per your comment that namespace-scoped objects should only reference local objects, the
secretNamespacefield is gone from the API, the implementation and the generated CRDs; all Secret lookups are now namespace-local. Done in 81cd21e / 628d0c1 / 764e910.Documentation. You asked for a guide page with a
cert-managerexample. I wrote one but pushed it to theclastix/kamaji-documentationrepository, which I now think was the wrong call — the Netlify preview on this PR builds from this repo'sdocs/, and comparable guides live indocs/content/guides/. Unless you prefer it in the separate repo, I will add it here asdocs/content/guides/pre-generated-certificates.md, covering the overview, a cert-manager issuance example, and a step-by-step walkthrough. Say the word and I will push it to this branch.Currently this PR only adds the generated
docs/content/reference/api.md.CI status
Kubernetes(e2e) is failing: 1 of 32 specs,e2e/tcp_migration_test.go:106— "migrating a Tenant Control Plane to another datastore (postgresql)". Lint, integration and diff all pass.This failure is not caused by the changes in this PR. It is the flaky migration webhook-wait: the manager can stall for over two minutes under CPU starvation on the 2-vCPU runner while the spec only waits one minute. The fix — widening that
Eventuallyto 5 minutes — is now split out as #1260.An earlier version of this description named #1258 as the prerequisite. That is now merged and was not the cause; please disregard it. Merging #1260 is what turns this PR's e2e green.
Testing