Skip to content

Commit 7ab6326

Browse files
irbyirby
authored
Merge a1f5029 into 995344a 
2 parents 995344a + a1f5029 commit 7ab6326

15 files changed

Lines changed: 234 additions & 42 deletions

File tree

‎.github/workflows/test.yml‎

Lines changed: 33 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
1-
name: test
2-
on: [workflow_dispatch, push, pull_request]
1+
name: Build Test and Lint
2+
on:
3+
workflow_dispatch:
4+
push:
5+
branches:
6+
- main
7+
- release-*
8+
pull_request:
39
jobs:
410
build:
5-
name: Build and Lint
11+
name: Build and Test
612
runs-on: ubuntu-latest
7-
timeout-minutes: 5
13+
timeout-minutes: 10
814
steps:
915
# Checkout code
1016
# https://github.com/actions/checkout
@@ -25,25 +31,13 @@ jobs:
2531
# Build Go binary
2632
- run: go build -v cmd/main.go
2733

28-
# Run Go linters
29-
# https://github.com/golangci/golangci-lint-action
30-
- name: Run linters
31-
uses: golangci/golangci-lint-action@v7
32-
with:
33-
version: v2.4.0
34+
- run: go test ./...
3435

35-
- name: Regenerate CRDs
36-
run: make generate manifests
37-
- name: Check for CRD drift
38-
run: |
39-
git diff --compact-summary --exit-code || \
40-
(echo; echo "Unexpected difference in directories after code generation. Run 'make generate manifests' and commit."; exit 1)
41-
42-
test:
43-
name: Go Test
36+
lint:
37+
name: Lint
4438
needs: build
4539
runs-on: ubuntu-latest
46-
timeout-minutes: 15
40+
timeout-minutes: 10
4741
steps:
4842
# Checkout code
4943
# https://github.com/actions/checkout
@@ -58,9 +52,25 @@ jobs:
5852
go-version-file: 'go.mod'
5953
cache: true
6054

61-
# Run Go tests
62-
- name: Run go test
63-
run: go test -v ./...
55+
- name: Install Helm
56+
uses: azure/setup-helm@v3.5
57+
58+
# Run Go linters
59+
# https://github.com/golangci/golangci-lint-action
60+
- name: Run linters
61+
uses: golangci/golangci-lint-action@v7
62+
with:
63+
version: v2.4.0
64+
65+
- name: Regenerate CRDs
66+
run: make generate manifests
67+
- name: Check for CRD drift
68+
run: |
69+
git diff --compact-summary --exit-code -- config/crd deploy/charts || \
70+
(echo; echo "Unexpected difference in directories after code generation. Run 'make generate manifests' and commit."; exit 1)
71+
72+
- name: Lint Helm manifests
73+
run: make lint-manifests
6474

6575
## TODO: These integration tests are breaking in GitHub Actions. Need to investigate further as to why.
6676
# integration:

‎.kube-linter.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
checks:
2+
addAllBuiltIn: true
3+
# Add project-specific exclusions below as needed, e.g.:
4+
# exclude:
5+
# - "unset-cpu-requirements"
6+
# - "unset-memory-requirements"

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,9 @@
1+
# v2.2.1
2+
## Fixes
3+
- Update Role and RoleBinding resources to have correct namespace when `secretConfig.useClusterRoleForConfigMapAccess` is set to `false` in Helm chart values.
4+
## Chores:
5+
- Update GitHub Actions workflow to check for policy enforcement on Helm chart rendered manifests in addition to checking for drift in generated CRDs.
6+
17
# v2.2.0
28
## Features:
39
- Add support to specify a ConfigMap for CA trust bundles in Issuer / ClusterIssuer resources via the caBundleConfigMapName specification.

‎CONTRIBUTING.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ For information on how to contribute to EJBCA and related tools, see [EJBCA Cont
77
## Requirements
88
- Go (>= 1.25)
99
- golangci-lint (>= 2.4.0) ([installation notes](https://github.com/golangci/golangci-lint?tab=readme-ov-file#install-golangci-lint))
10+
- helm (>= 3.x) — required to render chart templates for manifest linting ([installation notes](https://helm.sh/docs/intro/install/))
11+
- conftest — policy testing tool powered by Open Policy Agent; installed automatically by `make lint-manifests`
1012

1113
## Installing dependencies
1214
Project dependencies can be installed by running the following:
@@ -35,6 +37,43 @@ The project uses golangci-lint to lint the codebase. The following command can b
3537
golangci-lint run
3638
```
3739

40+
## Updating generated manifests
41+
42+
This command will update the generated custom resource definitions under `config/crd/bases`:
43+
44+
```bash
45+
make generate manifests
46+
```
47+
48+
> [!IMPORTANT]
49+
> There is no automated process to automatically update the CRDs under `deploy/charts/ejbca-cert-manager-issuer`. If any changes are made to the CRDs, the generated CRDs under `config/crd/bases` must be copied to `deploy/charts/ejbca-cert-manager-issuer/crds` to ensure the Helm chart is up to date.
50+
51+
## Linting Helm manifests
52+
53+
The Helm chart under `deploy/charts/ejbca-cert-manager-issuer` is linted with two tools on every PR:
54+
55+
- **conftest** — runs custom Rego policies located in the [`policy/`](policy/) directory against the rendered manifests
56+
57+
To run both checks locally:
58+
59+
```bash
60+
make lint-manifests
61+
```
62+
63+
`conftest` is downloaded automatically into `bin/` on first use; no manual installation is required.
64+
65+
To inspect the rendered templates without linting:
66+
67+
```bash
68+
make helm-template
69+
```
70+
71+
### Adding or modifying policies
72+
73+
Rego policies live in [`policy/`](policy/). Each `.rego` file in that directory is evaluated by conftest against every resource in the rendered chart. Add a new `.rego` file to enforce additional rules. For example, `policy/roles.rego` enforces that all `Role` resources declare an explicit namespace.
74+
75+
kube-linter checks can be tuned in [.kube-linter.yaml](.kube-linter.yaml). To exclude a check, add its name under the `exclude` key.
76+
3877
## Running end-to-end tests
3978
A comprehensive end-to-end test suite is available to verify the issuer code works against cert-manager and an EJBCA instance.
4079

‎Makefile‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,10 @@ endif
2020
# tools. (i.e. podman)
2121
CONTAINER_TOOL ?= docker
2222

23+
# Helm chart and Conftest policy directory for manifest linting
24+
HELM_CHART_DIR ?= deploy/charts/ejbca-cert-manager-issuer
25+
POLICY_DIR ?= policy
26+
2327
# Setting SHELL to bash allows bash commands to be executed by recipes.
2428
# Options are set to exit when a recipe line exits non-zero or a piped command fails.
2529
SHELL = /usr/bin/env bash -o pipefail
@@ -84,6 +88,20 @@ lint: golangci-lint ## Run golangci-lint linter & yamllint
8488
lint-fix: golangci-lint ## Run golangci-lint linter and perform fixes
8589
$(GOLANGCI_LINT) run --fix
8690

91+
.PHONY: helm-template
92+
helm-template: ## Render Helm chart templates to stdout (includes CRDs).
93+
helm template ejbca-cert-manager-issuer $(HELM_CHART_DIR) --include-crds
94+
95+
.PHONY: lint-manifests
96+
lint-manifests: conftest ## Run Conftest policy checks against every CI values file in $(HELM_CHART_DIR)/ci/.
97+
@failed=0; \
98+
for f in $(HELM_CHART_DIR)/ci/*-values.yaml; do \
99+
echo "==> $$(basename $$f)"; \
100+
helm template ejbca-cert-manager-issuer $(HELM_CHART_DIR) --include-crds -f "$$f" \
101+
| $(CONFTEST) test --policy $(POLICY_DIR) - || failed=1; \
102+
done; \
103+
exit $$failed
104+
87105
##@ Build
88106

89107
.PHONY: build
@@ -168,12 +186,16 @@ KUSTOMIZE ?= $(LOCALBIN)/kustomize-$(KUSTOMIZE_VERSION)
168186
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen-$(CONTROLLER_TOOLS_VERSION)
169187
ENVTEST ?= $(LOCALBIN)/setup-envtest-$(ENVTEST_VERSION)
170188
GOLANGCI_LINT = $(LOCALBIN)/golangci-lint-$(GOLANGCI_LINT_VERSION)
189+
KUBE_LINTER = $(LOCALBIN)/kube-linter-$(KUBE_LINTER_VERSION)
190+
CONFTEST = $(LOCALBIN)/conftest-$(CONFTEST_VERSION)
171191

172192
## Tool Versions
173193
KUSTOMIZE_VERSION ?= v5.3.0
174194
CONTROLLER_TOOLS_VERSION ?= v0.17.3
175195
ENVTEST_VERSION ?= latest
176196
GOLANGCI_LINT_VERSION ?= v2.4.0
197+
KUBE_LINTER_VERSION ?= v0.6.8
198+
CONFTEST_VERSION ?= v0.60.0
177199

178200
.PHONY: kustomize
179201
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
@@ -200,6 +222,16 @@ $(GOLANGCI_LINT): $(LOCALBIN)
200222
mv $(LOCALBIN)/golangci-lint $(GOLANGCI_LINT) ;\
201223
}
202224

225+
.PHONY: kube-linter
226+
kube-linter: $(KUBE_LINTER) ## Download kube-linter locally if necessary.
227+
$(KUBE_LINTER): $(LOCALBIN)
228+
$(call go-install-tool,$(KUBE_LINTER),golang.stackrox.io/kube-linter/cmd/kube-linter,$(KUBE_LINTER_VERSION))
229+
230+
.PHONY: conftest
231+
conftest: $(CONFTEST) ## Download conftest locally if necessary.
232+
$(CONFTEST): $(LOCALBIN)
233+
$(call go-install-tool,$(CONFTEST),github.com/open-policy-agent/conftest,$(CONFTEST_VERSION))
234+
203235
# go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
204236
# $1 - target path with name of binary (ideally with version)
205237
# $2 - package url which can be installed

‎deploy/charts/ejbca-cert-manager-issuer/ci/cluster-access-values.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Cluster-wide access configuration — exercises ClusterRole/ClusterRoleBinding
2+
# paths for secret and configmap access, and enables secure metrics.
3+
secretConfig:
4+
useClusterRoleForSecretAccess: true
5+
useClusterRoleForConfigMapAccess: true
6+
metrics:
7+
secure: true

‎deploy/charts/ejbca-cert-manager-issuer/ci/default-values.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Default configuration — all flags at their chart defaults.
2+
# Role/RoleBinding namespace-scoped paths are exercised.
3+
secretConfig:
4+
useClusterRoleForSecretAccess: false
5+
useClusterRoleForConfigMapAccess: false
6+
metrics:
7+
secure: false

‎deploy/charts/ejbca-cert-manager-issuer/templates/clusterrole.yaml‎

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -78,20 +78,4 @@ rules:
7878
- /metrics
7979
verbs:
8080
- get
81-
{{- end }}
82-
---
83-
apiVersion: rbac.authorization.k8s.io/v1
84-
kind: {{ if .Values.secretConfig.useClusterRoleForConfigMapAccess }}ClusterRole{{ else }}Role{{ end }}
85-
metadata:
86-
labels:
87-
{{- include "ejbca-cert-manager-issuer.labels" . | nindent 4 }}
88-
name: {{ include "ejbca-cert-manager-issuer.name" . }}-configmap-reader-role
89-
rules:
90-
- apiGroups:
91-
- ""
92-
resources:
93-
- configmaps
94-
verbs:
95-
- get
96-
- list
97-
- watch
81+
{{- end }}

‎deploy/charts/ejbca-cert-manager-issuer/templates/role.yaml‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,4 +24,23 @@ rules:
2424
- events
2525
verbs:
2626
- create
27-
- patch
27+
- patch
28+
---
29+
apiVersion: rbac.authorization.k8s.io/v1
30+
kind: {{ if .Values.secretConfig.useClusterRoleForConfigMapAccess }}ClusterRole{{ else }}Role{{ end }}
31+
metadata:
32+
labels:
33+
{{- include "ejbca-cert-manager-issuer.labels" . | nindent 4 }}
34+
name: {{ include "ejbca-cert-manager-issuer.name" . }}-configmap-reader-role
35+
{{- if not .Values.secretConfig.useClusterRoleForConfigMapAccess }}
36+
namespace: {{ .Release.Namespace }}
37+
{{- end }}
38+
rules:
39+
- apiGroups:
40+
- ""
41+
resources:
42+
- configmaps
43+
verbs:
44+
- get
45+
- list
46+
- watch

‎deploy/charts/ejbca-cert-manager-issuer/templates/rolebinding.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ metadata:
2020
labels:
2121
{{- include "ejbca-cert-manager-issuer.labels" . | nindent 4 }}
2222
name: {{ include "ejbca-cert-manager-issuer.name" . }}-configmap-reader-rolebinding
23+
{{- if not .Values.secretConfig.useClusterRoleForConfigMapAccess }}
24+
namespace: {{ .Release.Namespace }}
25+
{{- end }}
2326
roleRef:
2427
apiGroup: rbac.authorization.k8s.io
2528
kind: {{ if .Values.secretConfig.useClusterRoleForConfigMapAccess }}ClusterRole{{ else }}Role{{ end }}

0 commit comments

Comments
 (0)