Skip to content

Commit 49eff75

Browse files
mjudeikismjudeikis
committed
Add baseURL override
Add Issuer override Add CABundle for Kubeconfig & External kubeconfig Signed-off-by: Mangirdas Judeikis <[email protected]> On-behalf-of: SAP <[email protected]>
1 parent bf12804 commit 49eff75

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+1180
-1031
lines changed

‎config/crd/bases/operator.kcp.io_frontproxies.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,9 @@ spec:
188188
description: |-
189189
Requested DNS subject alternative names. The values given here will be merged into the
190190
DNS names determined automatically by the kcp-operator.
191+
If DNSNames is used together with IssuerRef, DNSNames will be uses as-is and not merged.
192+
If IssuerRef is not set, DNSNames will be merged with the defaults. This is to avoid
193+
trying to guess what DNSNames configued issuer might support.
191194
items:
192195
type: string
193196
type: array
@@ -208,6 +211,22 @@ spec:
208211
items:
209212
type: string
210213
type: array
214+
issuerRef:
215+
description: IssuerRef is a reference to the issuer for
216+
this certificate.
217+
properties:
218+
group:
219+
description: Group of the resource being referred to.
220+
type: string
221+
kind:
222+
description: Kind of the resource being referred to.
223+
type: string
224+
name:
225+
description: Name of the resource being referred to.
226+
type: string
227+
required:
228+
- name
229+
type: object
211230
privateKey:
212231
description: |-
213232
Private key options. These include the key algorithm and size, the used

‎config/crd/bases/operator.kcp.io_kubeconfigs.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,25 @@ spec:
3939
spec:
4040
description: KubeconfigSpec defines the desired state of Kubeconfig.
4141
properties:
42+
caBundleSecretRef:
43+
description: |-
44+
CABundle references a v1.Secret object that contains the CA bundle
45+
that should be used to validate the API server's TLS certificate.
46+
The secret must contain a key named `tls.crt` that holds the PEM encoded CA certificate.
47+
It will be merged into the kubeconfig under the `certificate-authority-data` field.
48+
If not specified, the kubeconfig will use the CA bundle of the root shard or front-proxy referenced in the Target field.
49+
properties:
50+
name:
51+
default: ""
52+
description: |-
53+
Name of the referent.
54+
This field is effectively required, but due to backwards compatibility is
55+
allowed to be empty. Instances of this type with an empty value here are
56+
almost certainly wrong.
57+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
58+
type: string
59+
type: object
60+
x-kubernetes-map-type: atomic
4261
certificateTemplate:
4362
description: |-
4463
CertificateTemplate allows to customize the properties on the generated
@@ -65,6 +84,9 @@ spec:
6584
description: |-
6685
Requested DNS subject alternative names. The values given here will be merged into the
6786
DNS names determined automatically by the kcp-operator.
87+
If DNSNames is used together with IssuerRef, DNSNames will be uses as-is and not merged.
88+
If IssuerRef is not set, DNSNames will be merged with the defaults. This is to avoid
89+
trying to guess what DNSNames configued issuer might support.
6890
items:
6991
type: string
7092
type: array
@@ -85,6 +107,22 @@ spec:
85107
items:
86108
type: string
87109
type: array
110+
issuerRef:
111+
description: IssuerRef is a reference to the issuer for this
112+
certificate.
113+
properties:
114+
group:
115+
description: Group of the resource being referred to.
116+
type: string
117+
kind:
118+
description: Kind of the resource being referred to.
119+
type: string
120+
name:
121+
description: Name of the resource being referred to.
122+
type: string
123+
required:
124+
- name
125+
type: object
88126
privateKey:
89127
description: |-
90128
Private key options. These include the key algorithm and size, the used

‎config/crd/bases/operator.kcp.io_rootshards.yaml‎

Lines changed: 71 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,26 @@ spec:
234234
type: string
235235
type: object
236236
type: object
237+
caBundleSecretRef:
238+
description: |-
239+
CABundle references a v1.Secret object that contains the CA bundle
240+
that should be used to validate the API server's TLS certificate.
241+
The secret must contain a key named `tls.crt` that holds the PEM encoded CA certificate.
242+
It will be merged into the "external-logical-cluster-admin-kubeconfig" kubeconfig under the `certificate-authority-data` field.
243+
If not specified, the kubeconfig will use the CA bundle of the root shard or front-proxy referenced in the Target field.
244+
It will NOT be used to configure the API server's own TLS certificate or any other component.
245+
properties:
246+
name:
247+
default: ""
248+
description: |-
249+
Name of the referent.
250+
This field is effectively required, but due to backwards compatibility is
251+
allowed to be empty. Instances of this type with an empty value here are
252+
almost certainly wrong.
253+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
254+
type: string
255+
type: object
256+
x-kubernetes-map-type: atomic
237257
cache:
238258
description: Cache configures the cache server (with a Kubernetes-like
239259
API) used by a sharded kcp instance.
@@ -274,6 +294,9 @@ spec:
274294
description: |-
275295
Requested DNS subject alternative names. The values given here will be merged into the
276296
DNS names determined automatically by the kcp-operator.
297+
If DNSNames is used together with IssuerRef, DNSNames will be uses as-is and not merged.
298+
If IssuerRef is not set, DNSNames will be merged with the defaults. This is to avoid
299+
trying to guess what DNSNames configued issuer might support.
277300
items:
278301
type: string
279302
type: array
@@ -294,6 +317,22 @@ spec:
294317
items:
295318
type: string
296319
type: array
320+
issuerRef:
321+
description: IssuerRef is a reference to the issuer for
322+
this certificate.
323+
properties:
324+
group:
325+
description: Group of the resource being referred to.
326+
type: string
327+
kind:
328+
description: Kind of the resource being referred to.
329+
type: string
330+
name:
331+
description: Name of the resource being referred to.
332+
type: string
333+
required:
334+
- name
335+
type: object
297336
privateKey:
298337
description: |-
299338
Private key options. These include the key algorithm and size, the used
@@ -472,19 +511,21 @@ spec:
472511
to acquire new certificates. This field is mutually exclusive with caSecretRef.
473512
properties:
474513
group:
475-
description: Group of the object being referred to.
514+
description: Group of the resource being referred to.
476515
type: string
477516
kind:
478-
description: Kind of the object being referred to.
517+
description: Kind of the resource being referred to.
479518
type: string
480519
name:
481-
description: Name of the object being referred to.
520+
description: Name of the resource being referred to.
482521
type: string
483522
required:
484523
- name
485524
type: object
486525
type: object
487526
clusterDomain:
527+
description: ClusterDomain is the DNS domain for services in the cluster.
528+
Defaults to "cluster.local" if not set.
488529
type: string
489530
deploymentTemplate:
490531
description: 'Optional: DeploymentTemplate configures the Kubernetes
@@ -1689,6 +1730,9 @@ spec:
16891730
description: |-
16901731
Requested DNS subject alternative names. The values given here will be merged into the
16911732
DNS names determined automatically by the kcp-operator.
1733+
If DNSNames is used together with IssuerRef, DNSNames will be uses as-is and not merged.
1734+
If IssuerRef is not set, DNSNames will be merged with the defaults. This is to avoid
1735+
trying to guess what DNSNames configued issuer might support.
16921736
items:
16931737
type: string
16941738
type: array
@@ -1709,6 +1753,25 @@ spec:
17091753
items:
17101754
type: string
17111755
type: array
1756+
issuerRef:
1757+
description: IssuerRef is a reference to the issuer
1758+
for this certificate.
1759+
properties:
1760+
group:
1761+
description: Group of the resource being referred
1762+
to.
1763+
type: string
1764+
kind:
1765+
description: Kind of the resource being referred
1766+
to.
1767+
type: string
1768+
name:
1769+
description: Name of the resource being referred
1770+
to.
1771+
type: string
1772+
required:
1773+
- name
1774+
type: object
17121775
privateKey:
17131776
description: |-
17141777
Private key options. These include the key algorithm and size, the used
@@ -3198,6 +3261,11 @@ spec:
31983261
type: string
31993262
type: object
32003263
type: object
3264+
shardBaseURL:
3265+
description: |-
3266+
ShardBaseURL is the base URL under which this shard should be reachable. This is used to configure
3267+
the external URL. If not provided, the operator will use kubernetes service address to generate it.
3268+
type: string
32013269
required:
32023270
- cache
32033271
- certificates

‎config/crd/bases/operator.kcp.io_shards.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,26 @@ spec:
234234
type: string
235235
type: object
236236
type: object
237+
caBundleSecretRef:
238+
description: |-
239+
CABundle references a v1.Secret object that contains the CA bundle
240+
that should be used to validate the API server's TLS certificate.
241+
The secret must contain a key named `tls.crt` that holds the PEM encoded CA certificate.
242+
It will be merged into the "external-logical-cluster-admin-kubeconfig" kubeconfig under the `certificate-authority-data` field.
243+
If not specified, the kubeconfig will use the CA bundle of the root shard or front-proxy referenced in the Target field.
244+
It will NOT be used to configure the API server's own TLS certificate or any other component.
245+
properties:
246+
name:
247+
default: ""
248+
description: |-
249+
Name of the referent.
250+
This field is effectively required, but due to backwards compatibility is
251+
allowed to be empty. Instances of this type with an empty value here are
252+
almost certainly wrong.
253+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
254+
type: string
255+
type: object
256+
x-kubernetes-map-type: atomic
237257
certificateTemplates:
238258
additionalProperties:
239259
properties:
@@ -258,6 +278,9 @@ spec:
258278
description: |-
259279
Requested DNS subject alternative names. The values given here will be merged into the
260280
DNS names determined automatically by the kcp-operator.
281+
If DNSNames is used together with IssuerRef, DNSNames will be uses as-is and not merged.
282+
If IssuerRef is not set, DNSNames will be merged with the defaults. This is to avoid
283+
trying to guess what DNSNames configued issuer might support.
261284
items:
262285
type: string
263286
type: array
@@ -278,6 +301,22 @@ spec:
278301
items:
279302
type: string
280303
type: array
304+
issuerRef:
305+
description: IssuerRef is a reference to the issuer for
306+
this certificate.
307+
properties:
308+
group:
309+
description: Group of the resource being referred to.
310+
type: string
311+
kind:
312+
description: Kind of the resource being referred to.
313+
type: string
314+
name:
315+
description: Name of the resource being referred to.
316+
type: string
317+
required:
318+
- name
319+
type: object
281320
privateKey:
282321
description: |-
283322
Private key options. These include the key algorithm and size, the used
@@ -428,6 +467,8 @@ spec:
428467
certificates for this shard.
429468
type: object
430469
clusterDomain:
470+
description: ClusterDomain is the DNS domain for services in the cluster.
471+
Defaults to "cluster.local" if not set.
431472
type: string
432473
deploymentTemplate:
433474
description: 'Optional: DeploymentTemplate configures the Kubernetes
@@ -1702,6 +1743,11 @@ spec:
17021743
type: string
17031744
type: object
17041745
type: object
1746+
shardBaseURL:
1747+
description: |-
1748+
ShardBaseURL is the base URL under which this shard should be reachable. This is used to configure
1749+
the external URL. If not provided, the operator will use kubernetes service address to generate it.
1750+
type: string
17051751
required:
17061752
- etcd
17071753
- rootShard

0 commit comments

Comments
 (0)