Skip to content

add generateCABundleContainer api field #315

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nikitka merged 7 commits into from
Mar 13, 2026
Merged

add generateCABundleContainer api field #315

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
ef02799
add generateCaStore api field
nikitka Mar 5, 2026
3734433
add generateCABundleContainer api field
nikitka Mar 10, 2026
7c93d1a
lint fixes
nikitka Mar 10, 2026
79a51a7
fixes
nikitka Mar 10, 2026
3eaa17f
import order fixes
nikitka Mar 10, 2026
a77b501
add default
nikitka Mar 10, 2026
8b0e5e6
improve docs
nikitka Mar 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changes/unreleased/Added-20260305-173124.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
kind: Added
body: add generateCABundleContainer api field with enabled/resources options to control the CA store init container
time: 2026-03-05T17:31:24.421992+01:00
17 changes: 17 additions & 0 deletions api/v1alpha1/common_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,23 @@ type RemoteSpec struct {
Cluster string `json:"cluster"`
}

// GenerateCABundleContainer configures the init container that builds
// the built-in CA store with the user-provided CA bundle or CA from TLS-enabled services.
// If enabled is false, the operator does not add this init container, but when certificates or
// TLS-enabled services are configured it still mounts /etc/ssl/certs so users can provide their
// own init container to populate the trust store.
type GenerateCABundleContainer struct {
// (Optional) Enables the init container that builds the built-in CA store.
// If not specified, the init container is enabled.
// +kubebuilder:default:=true
// +optional
Enabled *bool `json:"enabled,omitempty"`

// (Optional) Container resource limits for the CA bundle init container.
// +optional
Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
}
Comment on lines +54 to +64

Copilot AI Mar 10, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Enabled is documented as defaulting to true, but there is no kubebuilder/CRD default specified for this field. If you want clients (kubectl explain/OpenAPI) to reflect the default, consider adding a +kubebuilder:default:=true marker for Enabled (keeping the existing nil-as-true behavior in code for backwards compatibility).

Copilot uses AI. Check for mistakes.

type RemoteResource struct {
Group string `json:"group"`
Version string `json:"version"`
Expand Down
8 changes: 8 additions & 0 deletions api/v1alpha1/database_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,14 @@ type DatabaseClusterSpec struct {
// +optional
InitContainers []corev1.Container `json:"initContainers,omitempty"`

// (Optional) Configure the init container that builds the built-in CA store.
// When any certificates or TLS-enabled services are configured, the shared cert volumes are added.
// If `enabled=false`, the operator does not add this init container, but /etc/ssl/certs is still
// mounted so you can provide your own init container to populate the trust store.
// If `enabled` is not specified, the init container is enabled.
// +optional
GenerateCABundleContainer *GenerateCABundleContainer `json:"generateCABundleContainer,omitempty"`
Comment thread
nikitka marked this conversation as resolved.

// YDB configuration in YAML format. Will be applied on top of generated one in internal/configuration
// +optional
Configuration string `json:"configuration"`
Expand Down
8 changes: 8 additions & 0 deletions api/v1alpha1/storage_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,14 @@ type StorageClusterSpec struct {
// +optional
InitContainers []corev1.Container `json:"initContainers,omitempty"`

// (Optional) Configure the init container that builds the built-in CA store.
// When any certificates or TLS-enabled services are configured, the shared cert volumes are added.
// If `enabled=false`, the operator does not add this init container, but /etc/ssl/certs is still
// mounted so you can provide your own init container to populate the trust store.
// If `enabled` is not specified, the init container is enabled.
// +optional
GenerateCABundleContainer *GenerateCABundleContainer `json:"generateCABundleContainer,omitempty"`
Comment thread
nikitka marked this conversation as resolved.

// YDB configuration in YAML format. Will be applied on top of generated one in internal/configuration
// +optional
Configuration string `json:"configuration"`
Expand Down
35 changes: 35 additions & 0 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

75 changes: 75 additions & 0 deletions deploy/ydb-operator/crds/database.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1036,6 +1036,81 @@ spec:
required:
- enabled
type: object
generateCABundleContainer:
description: |-
(Optional) Configure the init container that builds the built-in CA store.
When any certificates or TLS-enabled services are configured, the shared cert volumes are added.
If `enabled=false`, the operator does not add this init container, but /etc/ssl/certs is still
mounted so you can provide your own init container to populate the trust store.
If `enabled` is not specified, the init container is enabled.
properties:
enabled:
default: true
description: |-
(Optional) Enables the init container that builds the built-in CA store.
If not specified, the init container is enabled.
type: boolean
resources:
description: (Optional) Container resource limits for the CA bundle
init container.
properties:
claims:
description: |-
Claims lists the names of resources, defined in spec.resourceClaims,
that are used by this container.

This field depends on the
DynamicResourceAllocation feature gate.

This field is immutable. It can only be set for containers.
items:
description: ResourceClaim references one entry in PodSpec.ResourceClaims.
properties:
name:
description: |-
Name must match the name of one entry in pod.spec.resourceClaims of
the Pod where this field is used. It makes that resource available
inside a container.
type: string
request:
description: |-
Request is the name chosen for a request in the referenced claim.
If empty, everything from the claim is made available, otherwise
only the result of this request.
type: string
required:
- name
type: object
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
limits:
additionalProperties:
anyOf:
- type: integer
- type: string
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
x-kubernetes-int-or-string: true
description: |-
Limits describes the maximum amount of compute resources allowed.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
requests:
additionalProperties:
anyOf:
- type: integer
- type: string
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
x-kubernetes-int-or-string: true
description: |-
Requests describes the minimum amount of compute resources required.
If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
otherwise to an implementation-defined value. Requests cannot exceed Limits.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
type: object
type: object
image:
description: (Optional) YDB Image
properties:
Expand Down
75 changes: 75 additions & 0 deletions deploy/ydb-operator/crds/databasenodeset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1051,6 +1051,81 @@ spec:
required:
- enabled
type: object
generateCABundleContainer:
description: |-
(Optional) Configure the init container that builds the built-in CA store.
When any certificates or TLS-enabled services are configured, the shared cert volumes are added.
If `enabled=false`, the operator does not add this init container, but /etc/ssl/certs is still
mounted so you can provide your own init container to populate the trust store.
If `enabled` is not specified, the init container is enabled.
properties:
enabled:
default: true
description: |-
(Optional) Enables the init container that builds the built-in CA store.
If not specified, the init container is enabled.
type: boolean
resources:
description: (Optional) Container resource limits for the CA bundle
init container.
properties:
claims:
description: |-
Claims lists the names of resources, defined in spec.resourceClaims,
that are used by this container.

This field depends on the
DynamicResourceAllocation feature gate.

This field is immutable. It can only be set for containers.
items:
description: ResourceClaim references one entry in PodSpec.ResourceClaims.
properties:
name:
description: |-
Name must match the name of one entry in pod.spec.resourceClaims of
the Pod where this field is used. It makes that resource available
inside a container.
type: string
request:
description: |-
Request is the name chosen for a request in the referenced claim.
If empty, everything from the claim is made available, otherwise
only the result of this request.
type: string
required:
- name
type: object
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
limits:
additionalProperties:
anyOf:
- type: integer
- type: string
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
x-kubernetes-int-or-string: true
description: |-
Limits describes the maximum amount of compute resources allowed.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
requests:
additionalProperties:
anyOf:
- type: integer
- type: string
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
x-kubernetes-int-or-string: true
description: |-
Requests describes the minimum amount of compute resources required.
If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
otherwise to an implementation-defined value. Requests cannot exceed Limits.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
type: object
type: object
image:
description: (Optional) YDB Image
properties:
Expand Down
75 changes: 75 additions & 0 deletions deploy/ydb-operator/crds/remotedatabasenodeset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1052,6 +1052,81 @@ spec:
required:
- enabled
type: object
generateCABundleContainer:
description: |-
(Optional) Configure the init container that builds the built-in CA store.
When any certificates or TLS-enabled services are configured, the shared cert volumes are added.
If `enabled=false`, the operator does not add this init container, but /etc/ssl/certs is still
mounted so you can provide your own init container to populate the trust store.
If `enabled` is not specified, the init container is enabled.
properties:
enabled:
default: true
description: |-
(Optional) Enables the init container that builds the built-in CA store.
If not specified, the init container is enabled.
type: boolean
resources:
description: (Optional) Container resource limits for the CA bundle
init container.
properties:
claims:
description: |-
Claims lists the names of resources, defined in spec.resourceClaims,
that are used by this container.

This field depends on the
DynamicResourceAllocation feature gate.

This field is immutable. It can only be set for containers.
items:
description: ResourceClaim references one entry in PodSpec.ResourceClaims.
properties:
name:
description: |-
Name must match the name of one entry in pod.spec.resourceClaims of
the Pod where this field is used. It makes that resource available
inside a container.
type: string
request:
description: |-
Request is the name chosen for a request in the referenced claim.
If empty, everything from the claim is made available, otherwise
only the result of this request.
type: string
required:
- name
type: object
type: array
x-kubernetes-list-map-keys:
- name
x-kubernetes-list-type: map
limits:
additionalProperties:
anyOf:
- type: integer
- type: string
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
x-kubernetes-int-or-string: true
description: |-
Limits describes the maximum amount of compute resources allowed.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
requests:
additionalProperties:
anyOf:
- type: integer
- type: string
pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
x-kubernetes-int-or-string: true
description: |-
Requests describes the minimum amount of compute resources required.
If Requests is omitted for a container, it defaults to Limits if that is explicitly specified,
otherwise to an implementation-defined value. Requests cannot exceed Limits.
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
type: object
type: object
image:
description: (Optional) YDB Image
properties:
Expand Down
Loading