Skip to content

Commit 1e6054b

Browse files
embikembik
committed
Address review comments
On-behalf-of: SAP <[email protected]> Signed-off-by: Marvin Beckers <[email protected]>
1 parent 0c25f80 commit 1e6054b

File tree

9 files changed

+31
-94
lines changed

9 files changed

+31
-94
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ kcp-operator will create the necessary resources to start a `Deployment` of a kc
3434

3535
### Certificate Management
3636

37-
Since the operator supports multiple rootshards and frontproxies, its certificate structure differs from the helm chart slightly. The placeholders `$rootshard` and `$frontproxy` in the chart are used to denote the name of the corresponding operator resource.
37+
The placeholders `$rootshard` and `$frontproxy` in the chart are used to denote the name of the corresponding operator resource.
3838

3939
```mermaid
4040
graph TB

‎config/manager/kustomization.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
resources:
2-
- manager.yaml
31
apiVersion: kustomize.config.k8s.io/v1beta1
42
kind: Kustomization
3+
resources:
4+
- manager.yaml
55
images:
66
- name: controller
77
newName: ghcr.io/kcp-dev/kcp-operator

‎internal/controller/frontproxy_controller.go

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"context"
2121
"fmt"
2222

23+
certmanagerv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
2324
k8creconciling "k8c.io/reconciler/pkg/reconciling"
2425

2526
appsv1 "k8s.io/api/apps/v1"
@@ -54,6 +55,8 @@ func (r *FrontProxyReconciler) SetupWithManager(mgr ctrl.Manager) error {
5455
Owns(&appsv1.Deployment{}).
5556
Owns(&corev1.ConfigMap{}).
5657
Owns(&corev1.Secret{}).
58+
Owns(&corev1.Service{}).
59+
Owns(&certmanagerv1.Certificate{}).
5760
Complete(r)
5861
}
5962

@@ -71,7 +74,7 @@ func (r *FrontProxyReconciler) Reconcile(ctx context.Context, req ctrl.Request)
7174
var frontProxy operatorv1alpha1.FrontProxy
7275
if err := r.Client.Get(ctx, req.NamespacedName, &frontProxy); err != nil {
7376
if client.IgnoreNotFound(err) != nil {
74-
return ctrl.Result{}, fmt.Errorf("failed to find %s/%s: %w", req.Namespace, req.Name, err)
77+
return ctrl.Result{}, fmt.Errorf("failed to get FrontProxy object: %w", err)
7578
}
7679

7780
// Object has apparently been deleted already.
@@ -93,18 +96,17 @@ func (r *FrontProxyReconciler) reconcile(ctx context.Context, frontProxy *operat
9396
ownerRefWrapper := k8creconciling.OwnerRefWrapper(*metav1.NewControllerRef(frontProxy, operatorv1alpha1.SchemeGroupVersion.WithKind("FrontProxy")))
9497

9598
ref := frontProxy.Spec.RootShard.Reference
96-
rootShard := &operatorv1alpha1.RootShard{}
97-
switch {
98-
case ref != nil:
99-
if err := r.Client.Get(ctx, types.NamespacedName{Name: ref.Name, Namespace: frontProxy.Namespace}, rootShard); err != nil {
100-
return fmt.Errorf("referenced RootShard '%s' could not be fetched", ref.Name)
101-
}
102-
default:
99+
if ref == nil {
103100
return fmt.Errorf("no valid RootShard in FrontProxy spec defined")
104101
}
105102

103+
rootShard := &operatorv1alpha1.RootShard{}
104+
if err := r.Client.Get(ctx, types.NamespacedName{Name: ref.Name, Namespace: frontProxy.Namespace}, rootShard); err != nil {
105+
return fmt.Errorf("referenced RootShard '%s' could not be fetched", ref.Name)
106+
}
107+
106108
configMapReconcilers := []k8creconciling.NamedConfigMapReconcilerFactory{
107-
frontproxy.ConfigmapReconciler(frontProxy, rootShard),
109+
frontproxy.PathMappingConfigMapReconciler(frontProxy, rootShard),
108110
}
109111

110112
secretReconcilers := []k8creconciling.NamedSecretReconcilerFactory{
@@ -113,9 +115,9 @@ func (r *FrontProxyReconciler) reconcile(ctx context.Context, frontProxy *operat
113115

114116
certReconcilers := []reconciling.NamedCertificateReconcilerFactory{
115117
frontproxy.ServerCertificateReconciler(frontProxy, rootShard),
116-
frontproxy.KubeconfigReconciler(frontProxy, rootShard),
117-
frontproxy.AdminKubeconfigReconciler(frontProxy, rootShard),
118-
frontproxy.RequestHeaderReconciler(frontProxy, rootShard),
118+
frontproxy.KubeconfigCertificateReconciler(frontProxy, rootShard),
119+
frontproxy.AdminKubeconfigCertificateReconciler(frontProxy, rootShard),
120+
frontproxy.RequestHeaderCertificateReconciler(frontProxy, rootShard),
119121
}
120122

121123
deploymentReconcilers := []k8creconciling.NamedDeploymentReconcilerFactory{

‎internal/controller/frontproxy_controller_test.go

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ import (
2323
. "github.com/onsi/ginkgo/v2"
2424
. "github.com/onsi/gomega"
2525

26-
v1 "k8s.io/api/core/v1"
26+
corev1 "k8s.io/api/core/v1"
2727
"k8s.io/apimachinery/pkg/api/errors"
2828
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2929
"k8s.io/apimachinery/pkg/types"
@@ -40,7 +40,7 @@ var _ = Describe("FrontProxy Controller", func() {
4040

4141
typeNamespacedName := types.NamespacedName{
4242
Name: resourceName,
43-
Namespace: "default", // TODO(user):Modify as needed
43+
Namespace: "default",
4444
}
4545
frontproxy := &operatorv1alpha1.FrontProxy{}
4646
rootShard := &operatorv1alpha1.RootShard{}
@@ -55,8 +55,8 @@ var _ = Describe("FrontProxy Controller", func() {
5555
if err != nil && errors.IsNotFound(err) {
5656
rootShard = &operatorv1alpha1.RootShard{
5757
ObjectMeta: metav1.ObjectMeta{
58-
Name: fmt.Sprintf("rootshard-%s", resourceName),
59-
Namespace: "default",
58+
Name: rootShardNamespacedName.Name,
59+
Namespace: rootShardNamespacedName.Namespace,
6060
},
6161
Spec: operatorv1alpha1.RootShardSpec{
6262
External: operatorv1alpha1.ExternalConfig{
@@ -78,12 +78,12 @@ var _ = Describe("FrontProxy Controller", func() {
7878
if err != nil && errors.IsNotFound(err) {
7979
resource := &operatorv1alpha1.FrontProxy{
8080
ObjectMeta: metav1.ObjectMeta{
81-
Name: resourceName,
82-
Namespace: "default",
81+
Name: typeNamespacedName.Name,
82+
Namespace: typeNamespacedName.Namespace,
8383
},
8484
Spec: operatorv1alpha1.FrontProxySpec{
8585
RootShard: operatorv1alpha1.RootShardConfig{
86-
Reference: &v1.LocalObjectReference{
86+
Reference: &corev1.LocalObjectReference{
8787
Name: rootShard.Name,
8888
},
8989
},

‎internal/controller/rootshard_controller.go

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,20 +106,17 @@ func (r *RootShardReconciler) reconcile(ctx context.Context, rootShard *operator
106106
v1alpha1.RequestHeaderClientCA,
107107
v1alpha1.ClientCA,
108108
v1alpha1.ServiceAccountCA,
109+
v1alpha1.FrontProxyClientCA,
109110
}
110111

111112
issuerReconcilers := []reconciling.NamedIssuerReconcilerFactory{
112113
rootshard.RootCAIssuerReconciler(rootShard),
113-
rootshard.ClientCAIssuerReconciler(rootShard),
114-
rootshard.FrontProxyClientCAIssuerReconciler(rootShard),
115114
}
116115

117116
certReconcilers := []reconciling.NamedCertificateReconcilerFactory{
118117
rootshard.ServerCertificateReconciler(rootShard),
119118
rootshard.ServiceAccountCertificateReconciler(rootShard),
120119
rootshard.VirtualWorkspacesCertificateReconciler(rootShard),
121-
rootshard.ClientCACertificateReconciler(rootShard),
122-
rootshard.FrontProxyClientCACertificateReconciler(rootShard),
123120
}
124121

125122
for _, ca := range intermediateCAs {

‎internal/resources/frontproxy/certificates.go

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ func ServerCertificateReconciler(frontproxy *operatorv1alpha1.FrontProxy, rootsh
6767
}
6868
}
6969

70-
func AdminKubeconfigReconciler(frontproxy *operatorv1alpha1.FrontProxy, rootshard *operatorv1alpha1.RootShard) reconciling.NamedCertificateReconcilerFactory {
70+
func AdminKubeconfigCertificateReconciler(frontproxy *operatorv1alpha1.FrontProxy, rootshard *operatorv1alpha1.RootShard) reconciling.NamedCertificateReconcilerFactory {
7171
name := resources.GetFrontProxyCertificateName(rootshard, frontproxy, operatorv1alpha1.AdminKubeconfigClientCertificate)
7272

7373
return func() (string, reconciling.CertificateReconciler) {
@@ -105,7 +105,7 @@ func AdminKubeconfigReconciler(frontproxy *operatorv1alpha1.FrontProxy, rootshar
105105
}
106106
}
107107

108-
func KubeconfigReconciler(frontproxy *operatorv1alpha1.FrontProxy, rootshard *operatorv1alpha1.RootShard) reconciling.NamedCertificateReconcilerFactory {
108+
func KubeconfigCertificateReconciler(frontproxy *operatorv1alpha1.FrontProxy, rootshard *operatorv1alpha1.RootShard) reconciling.NamedCertificateReconcilerFactory {
109109
name := resources.GetFrontProxyCertificateName(rootshard, frontproxy, operatorv1alpha1.KubeconfigCertificate)
110110

111111
return func() (string, reconciling.CertificateReconciler) {
@@ -143,8 +143,8 @@ func KubeconfigReconciler(frontproxy *operatorv1alpha1.FrontProxy, rootshard *op
143143
}
144144
}
145145

146-
func RequestHeaderReconciler(frontproxy *operatorv1alpha1.FrontProxy, rootshard *operatorv1alpha1.RootShard) reconciling.NamedCertificateReconcilerFactory {
147-
name := resources.GetFrontProxyRequestheaderName(rootshard, frontproxy)
146+
func RequestHeaderCertificateReconciler(frontproxy *operatorv1alpha1.FrontProxy, rootshard *operatorv1alpha1.RootShard) reconciling.NamedCertificateReconcilerFactory {
147+
name := resources.GetFrontProxyRequestHeaderName(rootshard, frontproxy)
148148

149149
return func() (string, reconciling.CertificateReconciler) {
150150
return name, func(cert *certmanagerv1.Certificate) (*certmanagerv1.Certificate, error) {

‎internal/resources/frontproxy/configmap.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ import (
2626
operatorv1alpha1 "github.com/kcp-dev/kcp-operator/sdk/apis/operator/v1alpha1"
2727
)
2828

29-
func ConfigmapReconciler(frontproxy *operatorv1alpha1.FrontProxy, rootShard *operatorv1alpha1.RootShard) reconciling.NamedConfigMapReconcilerFactory {
29+
func PathMappingConfigMapReconciler(frontproxy *operatorv1alpha1.FrontProxy, rootShard *operatorv1alpha1.RootShard) reconciling.NamedConfigMapReconcilerFactory {
3030
name := resources.GetFrontProxyConfigName(frontproxy)
3131

3232
return func() (string, reconciling.ConfigMapReconciler) {

‎internal/resources/resources.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ func GetFrontProxyDynamicKubeconfigName(r *operatorv1alpha1.RootShard, f *operat
115115
return fmt.Sprintf("%s-%s-dynamic-kubeconfig", r.Name, f.Name)
116116
}
117117

118-
func GetFrontProxyRequestheaderName(r *operatorv1alpha1.RootShard, f *operatorv1alpha1.FrontProxy) string {
118+
func GetFrontProxyRequestHeaderName(r *operatorv1alpha1.RootShard, f *operatorv1alpha1.FrontProxy) string {
119119
return fmt.Sprintf("%s-%s-requestheader", r.Name, f.Name)
120120
}
121121

‎internal/resources/rootshard/ca_certificates.go

Lines changed: 0 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -94,65 +94,3 @@ func CACertificateReconciler(rootShard *operatorv1alpha1.RootShard, ca operatorv
9494
}
9595
}
9696
}
97-
98-
func ClientCACertificateReconciler(rootshard *operatorv1alpha1.RootShard) reconciling.NamedCertificateReconcilerFactory {
99-
name := resources.GetRootShardCAName(rootshard, operatorv1alpha1.ClientCA)
100-
101-
return func() (string, reconciling.CertificateReconciler) {
102-
return name, func(cert *certmanagerv1.Certificate) (*certmanagerv1.Certificate, error) {
103-
cert.SetLabels(resources.GetRootShardResourceLabels(rootshard))
104-
cert.Spec = certmanagerv1.CertificateSpec{
105-
IsCA: true,
106-
CommonName: name,
107-
SecretName: name,
108-
// Create CA certificate for ten years.
109-
Duration: &operatorv1alpha1.DefaultCADuration,
110-
RenewBefore: &operatorv1alpha1.DefaultCARenewal,
111-
112-
PrivateKey: &certmanagerv1.CertificatePrivateKey{
113-
Algorithm: certmanagerv1.RSAKeyAlgorithm,
114-
Size: 4096,
115-
},
116-
117-
IssuerRef: certmanagermetav1.ObjectReference{
118-
Name: resources.GetRootShardCAName(rootshard, operatorv1alpha1.RootCA),
119-
Kind: "Issuer",
120-
Group: "cert-manager.io",
121-
},
122-
}
123-
124-
return cert, nil
125-
}
126-
}
127-
}
128-
129-
func FrontProxyClientCACertificateReconciler(rootshard *operatorv1alpha1.RootShard) reconciling.NamedCertificateReconcilerFactory {
130-
name := resources.GetRootShardCAName(rootshard, operatorv1alpha1.FrontProxyClientCA)
131-
132-
return func() (string, reconciling.CertificateReconciler) {
133-
return name, func(cert *certmanagerv1.Certificate) (*certmanagerv1.Certificate, error) {
134-
cert.SetLabels(resources.GetRootShardResourceLabels(rootshard))
135-
cert.Spec = certmanagerv1.CertificateSpec{
136-
IsCA: true,
137-
CommonName: name,
138-
SecretName: name,
139-
// Create CA certificate for ten years.
140-
Duration: &operatorv1alpha1.DefaultCADuration,
141-
RenewBefore: &operatorv1alpha1.DefaultCARenewal,
142-
143-
PrivateKey: &certmanagerv1.CertificatePrivateKey{
144-
Algorithm: certmanagerv1.RSAKeyAlgorithm,
145-
Size: 4096,
146-
},
147-
148-
IssuerRef: certmanagermetav1.ObjectReference{
149-
Name: resources.GetRootShardCAName(rootshard, operatorv1alpha1.RootCA),
150-
Kind: "Issuer",
151-
Group: "cert-manager.io",
152-
},
153-
}
154-
155-
return cert, nil
156-
}
157-
}
158-
}

0 commit comments

Comments
 (0)