Merge pull request crossplane#7001 from ezgidemirel/remove-ess-helm-value

chore: Remove ESS leftovers

Author: phisco

cluster/charts/crossplane/templates/_helpers.tpl

@@ -30,14 +30,3 @@ app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{ toYaml .Values.customLabels }}
 {{- end }}
 {{- end }}
-
-{{/*
-Define ExternalSecretStoreEnabled Feature Flag
-*/}}
-{{- define "crossplane.externalSecretStoresEnabled" -}}
-{{- if has "--enable-external-secret-stores" .Values.args -}}
-true
-{{- else -}}
-false
-{{- end -}}
-{{- end -}}

cluster/charts/crossplane/templates/deployment.yaml

@@ -1,4 +1,3 @@
-{{- $externalSecretStoresEnabled := include "crossplane.externalSecretStoresEnabled" . | eq "true" -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -123,10 +122,6 @@ spec:
           - name: "ENABLE_WEBHOOKS"
             value: "false"
           {{- end }}
-          {{- if $externalSecretStoresEnabled }}
-          - name: "ESS_TLS_SERVER_SECRET_NAME"
-            value: ess-server-certs
-          {{- end }}
           - name: "TLS_CA_SECRET_NAME"
             value: crossplane-root-ca
           - name: "TLS_SERVER_SECRET_NAME"

cluster/charts/crossplane/templates/secret.yaml

@@ -1,19 +1,3 @@
-{{- $externalSecretStoresEnabled := include "crossplane.externalSecretStoresEnabled" . | eq "true" -}}
-{{- if $externalSecretStoresEnabled }}
----
-# The reason this is created empty and filled by the init container is we want
-# to manage the lifecycle of the secret via Helm. This way whenever Crossplane
-# is deleted, the secret is deleted as well.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: ess-server-certs
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.secrets.customAnnotations }}
-  annotations: {{ toYaml . | nindent 4 }}
-  {{- end }}
-type: Opaque
-{{- end }}
 ---
 # The reason this is created empty and filled by the init container is we want
 # to manage the lifecycle of the secret via Helm. This way whenever Crossplane

cmd/crossplane/core/init.go

@@ -47,13 +47,12 @@ type initCommand struct {
 
 	EnableWebhooks bool `aliases:"webhook-enabled" default:"true" env:"ENABLE_WEBHOOKS,WEBHOOK_ENABLED" help:"Enable webhook configuration."`
 
-	WebhookServiceName      string `env:"WEBHOOK_SERVICE_NAME"       help:"The name of the Service object that the webhook service will be run."`
-	WebhookServiceNamespace string `env:"WEBHOOK_SERVICE_NAMESPACE"  help:"The namespace of the Service object that the webhook service will be run."`
-	WebhookServicePort      int32  `env:"WEBHOOK_SERVICE_PORT"       help:"The port of the Service that the webhook service will be run."`
-	ESSTLSServerSecretName  string `env:"ESS_TLS_SERVER_SECRET_NAME" help:"The name of the Secret that the initializer will fill with ESS TLS server certificate."`
-	TLSCASecretName         string `env:"TLS_CA_SECRET_NAME"         help:"The name of the Secret that the initializer will fill with TLS CA certificate."`
-	TLSServerSecretName     string `env:"TLS_SERVER_SECRET_NAME"     help:"The name of the Secret that the initializer will fill with TLS server certificates."`
-	TLSClientSecretName     string `env:"TLS_CLIENT_SECRET_NAME"     help:"The name of the Secret that the initializer will fill with TLS client certificates."`
+	WebhookServiceName      string `env:"WEBHOOK_SERVICE_NAME"      help:"The name of the Service object that the webhook service will be run."`
+	WebhookServiceNamespace string `env:"WEBHOOK_SERVICE_NAMESPACE" help:"The namespace of the Service object that the webhook service will be run."`
+	WebhookServicePort      int32  `env:"WEBHOOK_SERVICE_PORT"      help:"The port of the Service that the webhook service will be run."`
+	TLSCASecretName         string `env:"TLS_CA_SECRET_NAME"        help:"The name of the Secret that the initializer will fill with TLS CA certificate."`
+	TLSServerSecretName     string `env:"TLS_SERVER_SECRET_NAME"    help:"The name of the Secret that the initializer will fill with TLS server certificates."`
+	TLSClientSecretName     string `env:"TLS_CLIENT_SECRET_NAME"    help:"The name of the Secret that the initializer will fill with TLS client certificates."`
 }
 
 // Run starts the initialization process.
@@ -117,16 +116,7 @@ func (c *initCommand) Run(s *runtime.Scheme, log logging.Logger) error {
 		initializer.NewCoreCRDsMigrator("usages.apiextensions.crossplane.io", "v1beta1"),
 		initializer.NewCoreCRDsMigrator("functions.pkg.crossplane.io", "v1beta1"),
 		initializer.NewCoreCRDsMigrator("functionrevisions.pkg.crossplane.io", "v1beta1"),
-	)
-
-	if c.ESSTLSServerSecretName != "" {
-		steps = append(steps, initializer.NewTLSCertificateGenerator(c.Namespace, c.TLSCASecretName,
-			initializer.TLSCertificateGeneratorWithServerSecretName(c.ESSTLSServerSecretName, []string{fmt.Sprintf("*.%s", c.Namespace)}),
-			initializer.TLSCertificateGeneratorWithLogger(log.WithValues("Step", "ESSCertificateGenerator")),
-		))
-	}
-
-	steps = append(steps, initializer.NewLockObject(),
+		initializer.NewLockObject(),
 		initializer.NewPackageInstaller(c.Providers, c.Configurations, c.Functions),
 		initializer.StepFunc(initializer.DefaultDeploymentRuntimeConfig),
 		initializer.DefaultManagedResourceActivationPolicy(c.Activations...),

contributing/guide-adding-external-secret-stores.md

@@ -55,9 +55,6 @@ const (
 	// ServiceEndpointFmt is the format string for service endpoints.
 	ServiceEndpointFmt = "dns:///%s.%s:%d"
 
-	// ESSTLSCertDirEnvVar is the environment variable for ESS TLS certificate directory.
-	ESSTLSCertDirEnvVar = "ESS_TLS_CERTS_DIR"
-
 	// TLSServerCertDirEnvVar is the environment variable for TLS server certificate directory.
 	TLSServerCertDirEnvVar = "TLS_SERVER_CERTS_DIR"
 	// TLSServerCertsVolumeName is the name of the TLS server certificates volume.

internal/controller/pkg/runtime/runtime.go

@@ -235,18 +235,6 @@ func providerDeploymentOverrides(pr v1.PackageRevisionWithRuntime, image string)
 
 	do = append(do, DeploymentRuntimeWithOptionalImage(image))
 
-	if pr.GetObservedTLSClientSecretName() != nil {
-		do = append(do, DeploymentRuntimeWithAdditionalEnvironments([]corev1.EnvVar{
-			// for backward compatibility with existing providers, we set the
-			// environment variable ESS_TLS_CERTS_DIR to the same value as
-			// TLS_CLIENT_CERTS_DIR to ease the transition to the new certificates.
-			{
-				Name:  ESSTLSCertDirEnvVar,
-				Value: fmt.Sprintf("$(%s)", TLSClientCertDirEnvVar),
-			},
-		}))
-	}
-
 	if pr.GetObservedTLSServerSecretName() != nil {
 		do = append(do, DeploymentRuntimeWithAdditionalPorts([]corev1.ContainerPort{
 			{

internal/controller/pkg/runtime/runtime_provider.go

@@ -530,10 +530,6 @@ func deploymentProvider(provider string, rev string, image string, overrides ...
 									Name:  "REVISION_UID",
 									Value: providerRevisionUID,
 								},
-								{
-									Name:  "ESS_TLS_CERTS_DIR",
-									Value: "$(TLS_CLIENT_CERTS_DIR)",
-								},
 								{
 									Name:  "WEBHOOK_TLS_CERT_DIR",
 									Value: "$(TLS_SERVER_CERTS_DIR)",

internal/controller/pkg/runtime/runtime_test.go

@@ -47,4 +47,3 @@ func NewFunctionValidator() Validator {
 		parser.ObjectLinterFns(IsFunction, PackageValidSemver),
 		parser.ObjectLinterFns())
 }
-