Skip to content

Commit 0341002

Browse files
defdef
authored
Merge pull request #44 from vishnukumarkvs/add-tls-support
Update coroot operator with new TLS Support configs
2 parents 43be4e4 + 7d7589b commit 0341002

9 files changed

Lines changed: 425 additions & 77 deletions

File tree

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ $(LOCALBIN):
7171
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
7272

7373
## Tool Versions
74-
CONTROLLER_TOOLS_VERSION ?= v0.16.1
74+
CONTROLLER_TOOLS_VERSION ?= v0.20.1
7575

7676
.PHONY: controller-gen
7777
controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.

‎api/v1/coroot_types.go‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,13 @@ type AgentsOnlySpec struct {
3636
TLSSkipVerify bool `json:"tlsSkipVerify,omitempty"`
3737
}
3838

39+
type AgentTLSSpec struct {
40+
// Secret containing the CA certificate to verify the Coroot server's certificate.
41+
CASecret *corev1.SecretKeySelector `json:"caSecret,omitempty"`
42+
// Whether to skip verification of the Coroot server's TLS certificate.
43+
TLSSkipVerify bool `json:"tlsSkipVerify,omitempty"`
44+
}
45+
3946
type NodeAgentSpec struct {
4047
// Priority class for the node-agent pods.
4148
PriorityClassName string `json:"priorityClassName,omitempty"`
@@ -50,6 +57,8 @@ type NodeAgentSpec struct {
5057
// Environment variables for the node-agent.
5158
Env []corev1.EnvVar `json:"env,omitempty"`
5259
Image ImageSpec `json:"image,omitempty"`
60+
// TLS settings for connecting to Coroot.
61+
TLS *AgentTLSSpec `json:"tls,omitempty"`
5362

5463
LogCollector LogCollectorSpec `json:"logCollector,omitempty"`
5564
EbpfTracer EbpfTracerSpec `json:"ebpfTracer,omitempty"`
@@ -90,6 +99,8 @@ type ClusterAgentSpec struct {
9099
// Environment variables for the cluster-agent.
91100
Env []corev1.EnvVar `json:"env,omitempty"`
92101
Image ImageSpec `json:"image,omitempty"`
102+
// TLS settings for connecting to Coroot.
103+
TLS *AgentTLSSpec `json:"tls,omitempty"`
93104

94105
KubeStateMetrics KubeStateMetricsSpec `json:"kubeStateMetrics,omitempty"`
95106
}
@@ -254,6 +265,10 @@ type ServiceSpec struct {
254265
GRPCPort int32 `json:"grpcPort,omitempty"`
255266
// gRPC nodePort (if type is NodePort).
256267
GRPCNodePort int32 `json:"grpcNodePort,omitempty"`
268+
// HTTPS port (optional).
269+
HTTPSPort int32 `json:"httpsPort,omitempty"`
270+
// HTTPS nodePort (if type is NodePort).
271+
HTTPSNodePort int32 `json:"httpsNodePort,omitempty"`
257272
// Annotations for the service.
258273
Annotations map[string]string `json:"annotations,omitempty"`
259274
}
@@ -273,6 +288,7 @@ type TLSSpec struct {
273288
}
274289

275290
type CorootSpec struct {
291+
276292
// Specifies the metric resolution interval.
277293
// +kubebuilder:validation:Pattern="^[0-9]+[sm]$"
278294
MetricsRefreshInterval string `json:"metricsRefreshInterval,omitempty"`
@@ -292,6 +308,10 @@ type CorootSpec struct {
292308
AuthAnonymousRole string `json:"authAnonymousRole,omitempty"`
293309
// Initial admin password for bootstrapping.
294310
AuthBootstrapAdminPassword string `json:"authBootstrapAdminPassword,omitempty"`
311+
// Disable plain HTTP.
312+
HTTPDisabled bool `json:"httpDisabled,omitempty"`
313+
// HTTPS listen address (default: :8443).
314+
HTTPSListen string `json:"httpsListen,omitempty"`
295315
// Secret containing the initial admin password.
296316
AuthBootstrapAdminPasswordSecret *corev1.SecretKeySelector `json:"authBootstrapAdminPasswordSecret,omitempty"`
297317
// gRPC settings.

‎api/v1/zz_generated.deepcopy.go‎

Lines changed: 30 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/coroot.com_coroots.yaml‎

Lines changed: 81 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ kind: CustomResourceDefinition
44
metadata:
55
annotations:
66
argocd.argoproj.io/sync-options: Replace=true
7-
controller-gen.kubebuilder.io/version: v0.16.1
7+
controller-gen.kubebuilder.io/version: v0.20.1
88
name: coroots.coroot.com
99
spec:
1010
group: coroot.com
@@ -4674,6 +4674,39 @@ spec:
46744674
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
46754675
type: object
46764676
type: object
4677+
tls:
4678+
description: TLS settings for connecting to Coroot.
4679+
properties:
4680+
caSecret:
4681+
description: Secret containing the CA certificate to verify
4682+
the Coroot server's certificate.
4683+
properties:
4684+
key:
4685+
description: The key of the secret to select from. Must
4686+
be a valid secret key.
4687+
type: string
4688+
name:
4689+
default: ""
4690+
description: |-
4691+
Name of the referent.
4692+
This field is effectively required, but due to backwards compatibility is
4693+
allowed to be empty. Instances of this type with an empty value here are
4694+
almost certainly wrong.
4695+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4696+
type: string
4697+
optional:
4698+
description: Specify whether the Secret or its key must
4699+
be defined
4700+
type: boolean
4701+
required:
4702+
- key
4703+
type: object
4704+
x-kubernetes-map-type: atomic
4705+
tlsSkipVerify:
4706+
description: Whether to skip verification of the Coroot server's
4707+
TLS certificate.
4708+
type: boolean
4709+
type: object
46774710
tolerations:
46784711
items:
46794712
description: |-
@@ -5096,6 +5129,12 @@ spec:
50965129
description: Disables gRPC server.
50975130
type: boolean
50985131
type: object
5132+
httpDisabled:
5133+
description: Disable plain HTTP.
5134+
type: boolean
5135+
httpsListen:
5136+
description: 'HTTPS listen address (default: :8443).'
5137+
type: string
50995138
ingress:
51005139
description: Ingress configuration for Coroot.
51015140
properties:
@@ -6330,6 +6369,39 @@ spec:
63306369
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
63316370
type: object
63326371
type: object
6372+
tls:
6373+
description: TLS settings for connecting to Coroot.
6374+
properties:
6375+
caSecret:
6376+
description: Secret containing the CA certificate to verify
6377+
the Coroot server's certificate.
6378+
properties:
6379+
key:
6380+
description: The key of the secret to select from. Must
6381+
be a valid secret key.
6382+
type: string
6383+
name:
6384+
default: ""
6385+
description: |-
6386+
Name of the referent.
6387+
This field is effectively required, but due to backwards compatibility is
6388+
allowed to be empty. Instances of this type with an empty value here are
6389+
almost certainly wrong.
6390+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
6391+
type: string
6392+
optional:
6393+
description: Specify whether the Secret or its key must
6394+
be defined
6395+
type: boolean
6396+
required:
6397+
- key
6398+
type: object
6399+
x-kubernetes-map-type: atomic
6400+
tlsSkipVerify:
6401+
description: Whether to skip verification of the Coroot server's
6402+
TLS certificate.
6403+
type: boolean
6404+
type: object
63336405
tolerations:
63346406
items:
63356407
description: |-
@@ -8397,6 +8469,14 @@ spec:
83978469
description: gRPC port (default 4317).
83988470
format: int32
83998471
type: integer
8472+
httpsNodePort:
8473+
description: HTTPS nodePort (if type is NodePort).
8474+
format: int32
8475+
type: integer
8476+
httpsPort:
8477+
description: HTTPS port (optional).
8478+
format: int32
8479+
type: integer
84008480
nodePort:
84018481
description: Service nodePort (if type is NodePort).
84028482
format: int32

‎config/crd/coroot.com_coroots_legacy.yaml‎

Lines changed: 73 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ kind: CustomResourceDefinition
33
metadata:
44
annotations:
55
argocd.argoproj.io/sync-options: Replace=true
6-
controller-gen.kubebuilder.io/version: v0.16.1
6+
controller-gen.kubebuilder.io/version: v0.20.1
77
name: coroots.coroot.com
88
spec:
99
group: coroot.com
@@ -4208,6 +4208,34 @@ spec:
42084208
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
42094209
type: object
42104210
type: object
4211+
tls:
4212+
description: TLS settings for connecting to Coroot.
4213+
properties:
4214+
caSecret:
4215+
description: Secret containing the CA certificate to verify the Coroot server's certificate.
4216+
properties:
4217+
key:
4218+
description: The key of the secret to select from. Must be a valid secret key.
4219+
type: string
4220+
name:
4221+
default: ""
4222+
description: |-
4223+
Name of the referent.
4224+
This field is effectively required, but due to backwards compatibility is
4225+
allowed to be empty. Instances of this type with an empty value here are
4226+
almost certainly wrong.
4227+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4228+
type: string
4229+
optional:
4230+
description: Specify whether the Secret or its key must be defined
4231+
type: boolean
4232+
required:
4233+
- key
4234+
type: object
4235+
tlsSkipVerify:
4236+
description: Whether to skip verification of the Coroot server's TLS certificate.
4237+
type: boolean
4238+
type: object
42114239
tolerations:
42124240
items:
42134241
description: |-
@@ -4596,6 +4624,14 @@ spec:
45964624
type: boolean
45974625
type: object
45984626
nullable: true
4627+
httpDisabled:
4628+
description: Disable plain HTTP.
4629+
type: boolean
4630+
nullable: true
4631+
httpsListen:
4632+
description: 'HTTPS listen address (default: :8443).'
4633+
type: string
4634+
nullable: true
45994635
ingress:
46004636
description: Ingress configuration for Coroot.
46014637
properties:
@@ -5707,6 +5743,34 @@ spec:
57075743
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
57085744
type: object
57095745
type: object
5746+
tls:
5747+
description: TLS settings for connecting to Coroot.
5748+
properties:
5749+
caSecret:
5750+
description: Secret containing the CA certificate to verify the Coroot server's certificate.
5751+
properties:
5752+
key:
5753+
description: The key of the secret to select from. Must be a valid secret key.
5754+
type: string
5755+
name:
5756+
default: ""
5757+
description: |-
5758+
Name of the referent.
5759+
This field is effectively required, but due to backwards compatibility is
5760+
allowed to be empty. Instances of this type with an empty value here are
5761+
almost certainly wrong.
5762+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
5763+
type: string
5764+
optional:
5765+
description: Specify whether the Secret or its key must be defined
5766+
type: boolean
5767+
required:
5768+
- key
5769+
type: object
5770+
tlsSkipVerify:
5771+
description: Whether to skip verification of the Coroot server's TLS certificate.
5772+
type: boolean
5773+
type: object
57105774
tolerations:
57115775
items:
57125776
description: |-
@@ -7588,6 +7652,14 @@ spec:
75887652
description: gRPC port (default 4317).
75897653
format: int32
75907654
type: integer
7655+
httpsNodePort:
7656+
description: HTTPS nodePort (if type is NodePort).
7657+
format: int32
7658+
type: integer
7659+
httpsPort:
7660+
description: HTTPS port (optional).
7661+
format: int32
7662+
type: integer
75917663
nodePort:
75927664
description: Service nodePort (if type is NodePort).
75937665
format: int32

‎config/samples/coroot_tls.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: coroot.com/v1
2+
kind: Coroot
3+
metadata:
4+
name: coroot
5+
namespace: coroot
6+
spec:
7+
tls:
8+
certSecret:
9+
name: coroot-server-tls
10+
key: tls.crt
11+
keySecret:
12+
name: coroot-server-tls
13+
key: tls.key
14+
15+
httpDisabled: true
16+
17+
apiKeySecret:
18+
name: coroot-api-key
19+
key: key
20+
21+
projects:
22+
- name: "My Cluster"
23+
apiKeys:
24+
- keySecret:
25+
name: coroot-api-key
26+
key: key
27+
28+
clusterAgent:
29+
tls:
30+
caSecret:
31+
name: coroot-ca-cert
32+
key: ca.crt
33+
tlsSkipVerify: false
34+
35+
nodeAgent:
36+
tls:
37+
caSecret:
38+
name: coroot-ca-cert
39+
key: ca.crt
40+
tlsSkipVerify: false

0 commit comments

Comments
 (0)