feat: add componentRoutes support to ROSAControlPlane

Add support for customizing console and downloads route hostnames
and TLS certificates on ROSA HCP clusters via the ROSAControlPlane CRD.

Signed-off-by: Cortney Reed <creed@redhat.com>

Author: reedcort

config/crd/bases/controlplane.cluster.x-k8s.io_rosacontrolplanes.yaml

@@ -215,6 +215,37 @@ spec:
                         type: array
                     type: object
                 type: object
+              componentRoutes:
+                description: componentRoutes allows customizing the hostname and TLS
+                  certificate for console and downloads routes.
+                items:
+                  description: ComponentRouteSpec defines a custom hostname and TLS
+                    secret for a component route.
+                  properties:
+                    hostname:
+                      description: hostname is the custom domain for the component
+                        route (e.g. console.example.com).
+                      minLength: 1
+                      type: string
+                    name:
+                      description: name is the component route name. Valid values
+                        are "console" and "downloads".
+                      enum:
+                      - console
+                      - downloads
+                      type: string
+                    tlsSecretRef:
+                      description: tlsSecretRef is the name of the TLS secret in the
+                        openshift-config namespace on the hosted cluster.
+                      minLength: 1
+                      type: string
+                  required:
+                  - hostname
+                  - name
+                  - tlsSecretRef
+                  type: object
+                maxItems: 2
+                type: array
               controlPlaneEndpoint:
                 description: ControlPlaneEndpoint represents the endpoint used to
                   communicate with the control plane.

controlplane/rosa/api/v1beta2/rosacontrolplane_types.go

@@ -104,6 +104,17 @@ const (
 	AutoNodeModeDisabled AutoNodeMode = "Disabled"
 )
 
+// ComponentRouteKey specifies the name of a component route.
+type ComponentRouteKey string
+
+const (
+	// ComponentRouteConsole is the console component route.
+	ComponentRouteConsole ComponentRouteKey = "console"
+
+	// ComponentRouteDownloads is the downloads component route.
+	ComponentRouteDownloads ComponentRouteKey = "downloads"
+)
+
 // RosaControlPlaneSpec defines the desired state of ROSAControlPlane.
 type RosaControlPlaneSpec struct { //nolint: maligned
 	// Cluster name must be valid DNS-1035 label, so it must consist of lower case alphanumeric
@@ -354,6 +365,11 @@ type RosaControlPlaneSpec struct { //nolint: maligned
 	// s3LogForwarder set the AWS S3 log forward config for applications and groupVersions.
 	// +optional
 	S3LogForwarder *S3LogForwarderConfig `json:"s3LogForwarder,omitempty"`
+
+	// componentRoutes allows customizing the hostname and TLS certificate for console and downloads routes.
+	// +optional
+	// +kubebuilder:validation:MaxItems=2
+	ComponentRoutes []ComponentRouteSpec `json:"componentRoutes,omitempty"`
 }
 
 // CloudWatchLogForwarderConfig present the cloudWatch log forward config for applications and groupVersions.
@@ -394,6 +410,24 @@ type S3LogForwarderConfig struct {
 	S3ConfigBucketPrefix string `json:"s3ConfigBucketPrefix,omitempty"`
 }
 
+// ComponentRouteSpec defines a custom hostname and TLS secret for a component route.
+type ComponentRouteSpec struct {
+	// name is the component route name. Valid values are "console" and "downloads".
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Enum=console;downloads
+	Name ComponentRouteKey `json:"name"`
+
+	// hostname is the custom domain for the component route (e.g. console.example.com).
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	Hostname string `json:"hostname"`
+
+	// tlsSecretRef is the name of the TLS secret in the openshift-config namespace on the hosted cluster.
+	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:MinLength=1
+	TLSSecretRef string `json:"tlsSecretRef"`
+}
+
 // AutoNode set the AutoNode mode and AutoNode role ARN.
 type AutoNode struct {
 	// mode specifies the mode for the AutoNode. Setting Enable/Disable mode will allows/disallow karpenter AutoNode scaling.

controlplane/rosa/api/v1beta2/zz_generated.deepcopy.go

@@ -333,6 +333,10 @@ func (r *ROSAControlPlaneReconciler) reconcileNormal(ctx context.Context, rosaSc
 				return ctrl.Result{RequeueAfter: time.Second * 60}, fmt.Errorf("failed to reconcile logForwarders: %w", err)
 			}
 
+			if err := r.reconcileComponentRoutes(rosaScope, ocmClient, cluster); err != nil {
+				return ctrl.Result{}, fmt.Errorf("failed to reconcile componentRoutes: %w", err)
+			}
+
 			if err := r.updateOCMCluster(rosaScope, ocmClient, cluster, creator); err != nil {
 				return ctrl.Result{}, fmt.Errorf("failed to update rosa control plane: %w", err)
 			}
@@ -688,6 +692,88 @@ func buildGroups(ids []string) []*cmv1.LogForwarderGroupBuilder {
 	return groups
 }
 
+func (r *ROSAControlPlaneReconciler) reconcileComponentRoutes(rosaScope *scope.ROSAControlPlaneScope, ocmClient rosa.OCMClient, cluster *cmv1.Cluster) error {
+	desiredRoutes := rosaScope.ControlPlane.Spec.ComponentRoutes
+
+	rosaScope.Info("reconcile componentRoutes")
+
+	ingresses, err := ocmClient.GetIngresses(cluster.ID())
+	if err != nil {
+		return fmt.Errorf("failed to get ingresses: %w", err)
+	}
+
+	var defaultIngress *cmv1.Ingress
+	for _, ing := range ingresses {
+		if ing.Default() {
+			defaultIngress = ing
+			break
+		}
+	}
+	if defaultIngress == nil {
+		return fmt.Errorf("default ingress not found for cluster %s", cluster.ID())
+	}
+
+	if componentRoutesEqual(defaultIngress.ComponentRoutes(), desiredRoutes) {
+		return nil
+	}
+
+	componentRoutes := resetComponentRoutes()
+	for _, route := range desiredRoutes {
+		componentRoutes[string(route.Name)] = cmv1.NewComponentRoute().
+			Hostname(route.Hostname).
+			TlsSecretRef(route.TLSSecretRef)
+	}
+
+	updatedIngress, err := cmv1.NewIngress().
+		ID(defaultIngress.ID()).
+		ComponentRoutes(componentRoutes).
+		Build()
+	if err != nil {
+		return fmt.Errorf("failed to build ingress: %w", err)
+	}
+
+	rosaScope.Info(fmt.Sprintf("updating ingress %s componentRoutes on cluster %s",
+		defaultIngress.ID(), cluster.ID()))
+	_, err = ocmClient.UpdateIngress(cluster.ID(), updatedIngress)
+	return err
+}
+
+func resetComponentRoutes() map[string]*cmv1.ComponentRouteBuilder {
+	keys := []rosacontrolplanev1.ComponentRouteKey{rosacontrolplanev1.ComponentRouteConsole, rosacontrolplanev1.ComponentRouteDownloads}
+	routes := make(map[string]*cmv1.ComponentRouteBuilder, len(keys))
+	for _, key := range keys {
+		routes[string(key)] = cmv1.NewComponentRoute().Hostname("").TlsSecretRef("")
+	}
+	return routes
+}
+
+func componentRoutesEqual(current map[string]*cmv1.ComponentRoute, desired []rosacontrolplanev1.ComponentRouteSpec) bool {
+	desiredMap := make(map[string]rosacontrolplanev1.ComponentRouteSpec, len(desired))
+	for _, route := range desired {
+		desiredMap[string(route.Name)] = route
+	}
+
+	keys := []rosacontrolplanev1.ComponentRouteKey{rosacontrolplanev1.ComponentRouteConsole, rosacontrolplanev1.ComponentRouteDownloads}
+	for _, key := range keys {
+		k := string(key)
+		desiredRoute, desiredExists := desiredMap[k]
+		currentRoute, currentExists := current[k]
+
+		if desiredExists {
+			if !currentExists {
+				return false
+			}
+			if currentRoute.Hostname() != desiredRoute.Hostname ||
+				currentRoute.TlsSecretRef() != desiredRoute.TLSSecretRef {
+				return false
+			}
+		} else if currentExists && (currentRoute.Hostname() != "" || currentRoute.TlsSecretRef() != "") {
+			return false
+		}
+	}
+	return true
+}
+
 func (r *ROSAControlPlaneReconciler) reconcileClusterVersion(rosaScope *scope.ROSAControlPlaneScope, ocmClient rosa.OCMClient, cluster *cmv1.Cluster) error {
 	version := rosaScope.ControlPlane.Spec.Version
 	if version == rosa.RawVersionID(cluster.Version()) {