CM-716: Add HTTP01 Challenge Proxy controller

Adds the HTTP01 Challenge Proxy controller to cert-manager-operator,
enabling cert-manager to complete HTTP01 ACME challenges for the API
endpoint on baremetal platforms where the API VIP is not exposed via
OpenShift Ingress.

When a user creates an HTTP01Proxy CR with mode DefaultDeployment,
the operator validates the platform is BareMetal with distinct API
and Ingress VIPs, then deploys a DaemonSet on control plane nodes
running a reverse proxy. The proxy uses nftables to redirect HTTP
traffic from API_VIP:80 to a local proxy port (default 8888). Only
/.well-known/acme-challenge/* requests are forwarded to the Ingress
VIP; all other requests are rejected.

Feature gate: HTTP01Proxy (Alpha, disabled by default)
Enable via: --unsupported-addon-features=HTTP01Proxy=true

Jira: https://issues.redhat.com/browse/CM-716
Enhancement: openshift/enhancements#1929

Author: sebrandon1

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: builder
   namespace: ocp
-  tag: rhel-9-golang-1.25-openshift-4.21
+  tag: rhel-9-golang-1.26-openshift-4.23

.golangci.yaml

@@ -130,11 +130,11 @@ linters:
         linters:
           - godot
       # Exclude false positive hardcoded credential warnings (these are paths, not credentials)
-      - path: pkg/controller/deployment/credentials_request.go
+      - path: pkg/controller/certmanager/credentials_request.go
         text: "gcpCredentialsDir|cloudCredentialsVolumeName"
         linters:
           - gosec
-      - path: pkg/controller/deployment/deployment_overrides.go
+      - path: pkg/controller/certmanager/deployment_overrides.go
         text: "boundSATokenDir"
         linters:
           - gosec
@@ -150,7 +150,7 @@ linters:
       # Exclude unparam for functions that may be part of interfaces
       - linters:
           - unparam
-        path: pkg/controller/deployment/
+        path: pkg/controller/certmanager/
   settings:
     wrapcheck:
       # Ignore errors returned from these packages - they are either internal or

Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/golang:1.25 AS builder
+FROM docker.io/golang:1.26 AS builder
 WORKDIR /go/src/github.com/openshift/cert-manager-operator
 COPY . .
 RUN make build --warn-undefined-variables

Makefile

@@ -19,7 +19,7 @@ export XDG_CONFIG_HOME ?= $(PROJECT_ROOT)/_output/.config
 # ============================================================================
 
 # DEFAULT_VERSION is the default version to use for image tags when not set.
-DEFAULT_VERSION := 1.19.0
+DEFAULT_VERSION := 1.20.0
 
 # Helper function to validate semver (Major.Minor.Patch format)
 # Returns 'valid' if the version matches semver (X.Y.Z) or 'latest', empty string otherwise
@@ -57,12 +57,17 @@ endif
 # --- Operand Versions ---
 
 # Versions of the cert-manager components managed by this operator
-CERT_MANAGER_VERSION ?= v1.19.4
+CERT_MANAGER_VERSION ?= v1.20.2
 ISTIO_CSR_VERSION ?= v0.16.0
 TRUST_MANAGER_VERSION ?= v0.20.3
 
 # --- Test Versions ---
 
+# OpenShift Service Mesh versions for IstioCSR ServiceMesh e2e tests.
+# Keep servicemesh_helpers_test.go ossmDefault* constants in sync when bumping.
+E2E_OSM_ISTIO_VERSION ?= v1.24.3
+E2E_OSM_OPERATOR_VERSION ?= 3.2.5
+
 # ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
 ENVTEST_K8S_VERSION ?= 1.32.0
 
@@ -132,7 +137,7 @@ USE_IMAGE_DIGESTS ?= false
 
 # CHANNELS define the bundle channels used in the bundle.
 # To override: make bundle CHANNELS=candidate,fast,stable or export CHANNELS="candidate,fast,stable"
-CHANNELS ?= stable-v1,stable-v1.19
+CHANNELS ?= stable-v1,stable-v1.20
 ifneq ($(origin CHANNELS), undefined)
 BUNDLE_CHANNELS := --channels=$(CHANNELS)
 endif
@@ -164,7 +169,7 @@ TLS_VERIFY ?= true
 CONTAINER_PUSH_ARGS ?= $(if $(filter $(CONTAINER_ENGINE),docker),,--tls-verify=$(TLS_VERIFY))
 
 # Container image used for running make targets in a container
-CONTAINER_IMAGE_NAME ?= registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.25-openshift-4.21
+CONTAINER_IMAGE_NAME ?= registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.26-openshift-4.23
 
 # ============================================================================
 # Build Configuration
@@ -188,7 +193,7 @@ E2E_TIMEOUT ?= 2h
 # E2E_GINKGO_LABEL_FILTER is ginkgo label query for selecting tests.
 # See https://onsi.github.io/ginkgo/#spec-labels
 # The default is to run tests on the AWS platform.
-E2E_GINKGO_LABEL_FILTER ?= Platform: isSubsetOf {AWS,Generic} && CredentialsMode: isSubsetOf {Mint}
+E2E_GINKGO_LABEL_FILTER ?= Platform: isSubsetOf {AWS,Generic} && CredentialsMode: isSubsetOf {Mint} && !Feature:ServiceMesh
 
 # ============================================================================
 # Default Target
@@ -279,6 +284,8 @@ test-apis: $(SETUP_ENVTEST) $(GINKGO)
 TEST ?=
 .PHONY: test-e2e
 test-e2e: test-e2e-wait-for-stable-state ## Run end-to-end tests.
+	E2E_OSM_ISTIO_VERSION=$(E2E_OSM_ISTIO_VERSION) \
+	E2E_OSM_OPERATOR_VERSION=$(E2E_OSM_OPERATOR_VERSION) \
 	go test -C $(PROJECT_ROOT)/test/e2e \
 		-timeout $(E2E_TIMEOUT) \
 		-count 1 -v -p 1 \
@@ -322,10 +329,12 @@ local-run: build ## Run the operator locally against the cluster configured in ~
 	RELATED_IMAGE_CERT_MANAGER_ACMESOLVER=quay.io/jetstack/cert-manager-acmesolver:$(CERT_MANAGER_VERSION) \
 	RELATED_IMAGE_CERT_MANAGER_ISTIOCSR=quay.io/jetstack/cert-manager-istio-csr:$(ISTIO_CSR_VERSION) \
 	RELATED_IMAGE_CERT_MANAGER_TRUST_MANAGER=quay.io/jetstack/trust-manager:$(TRUST_MANAGER_VERSION) \
+	RELATED_IMAGE_CERT_MANAGER_HTTP01PROXY=quay.io/bapalm/cert-mgr-http01-proxy:latest \
 	OPERATOR_NAME=cert-manager-operator \
 	OPERAND_IMAGE_VERSION=$(BUNDLE_VERSION) \
 	ISTIOCSR_OPERAND_IMAGE_VERSION=$(ISTIO_CSR_VERSION) \
 	TRUSTMANAGER_OPERAND_IMAGE_VERSION=$(TRUST_MANAGER_VERSION) \
+	HTTP01PROXY_OPERAND_IMAGE_VERSION=0.1.0 \
 	OPERATOR_IMAGE_VERSION=$(BUNDLE_VERSION) \
 	./cert-manager-operator start \
 		--config=./hack/local-run-config.yaml \
@@ -436,6 +445,37 @@ verify-with-container: ## Run verification in a container.
 govulncheck: $(GOVULNCHECK) $(OUTPUT_DIR) ## Run govulncheck vulnerability scan.
 	@./hack/govulncheck.sh $(GOVULNCHECK) $(OUTPUT_DIR)
 
+# ============================================================================
+# E2E Coverage
+# ============================================================================
+
+##@ E2E Coverage
+##
+## Targets for building a coverage-instrumented operator image, collecting
+## coverage data written during E2E tests, and uploading the report to Codecov.
+##
+## Typical flow (local):
+##   make image-build-coverage image-push-coverage         # build & push coverage image
+##   COVERAGE_IMAGE=<pullspec> hack/e2e-coverage.sh setup  # patch CSV
+##   make test-e2e                                         # run E2E suite
+##   make e2e-coverage-collect                              # collect + upload
+##
+## In CI, hack/e2e-coverage.sh handles setup and collection automatically.
+
+COVERAGE_IMG ?= $(IMG)-e2e-coverage
+
+.PHONY: image-build-coverage
+image-build-coverage: ## Build coverage-instrumented container image.
+	$(CONTAINER_ENGINE) build -f images/ci/Dockerfile.coverage -t $(COVERAGE_IMG) .
+
+.PHONY: image-push-coverage
+image-push-coverage: ## Push coverage-instrumented container image.
+	$(CONTAINER_ENGINE) push $(COVERAGE_IMG) $(CONTAINER_PUSH_ARGS)
+
+.PHONY: e2e-coverage-collect
+e2e-coverage-collect: ## Collect e2e coverage data and optionally upload to Codecov.
+	ARTIFACT_DIR=$${ARTIFACT_DIR:-.} hack/e2e-coverage.sh collect
+
 # ============================================================================
 # Maintenance
 # ============================================================================
@@ -559,4 +599,4 @@ $(OPERATOR_SDK): ## Download operator-sdk locally if necessary.
 	hack/download-tools.sh operator-sdk $(OPERATOR_SDK)
 
 $(OPM): ## Download opm locally if necessary.
-	hack/download-tools.sh opm $(OPM)
+	hack/download-tools.sh opm $(OPM)

README.md

@@ -5,9 +5,9 @@ This repository contains Cert Manager Operator designed for OpenShift. The opera
 ## The operator architecture and design assumptions
 
 The Operator uses the [upstream deployment manifests](https://github.com/cert-manager/cert-manager/releases). It divides them into separate files and deploys using 3 controllers:
-- [cert_manager_cainjector_deployment.go](pkg/controller/deployment/cert_manager_cainjector_deployment.go)
-- [cert_manager_controller_deployment.go](pkg/controller/deployment/cert_manager_controller_deployment.go)
-- [cert_manager_webhook_deployment.go](pkg/controller/deployment/cert_manager_webhook_deployment.go)
+- [cert_manager_cainjector_deployment.go](pkg/controller/certmanager/cert_manager_cainjector_deployment.go)
+- [cert_manager_controller_deployment.go](pkg/controller/certmanager/cert_manager_controller_deployment.go)
+- [cert_manager_webhook_deployment.go](pkg/controller/certmanager/cert_manager_webhook_deployment.go)
 
 The Operator automatically deploys a cluster-scoped `CertManager` object named `cluster` if it's missing (with default values).
 

api/operator/v1alpha1/features.go

@@ -21,9 +21,19 @@ var (
 	// For more details,
 	// https://github.com/openshift/enhancements/blob/master/enhancements/cert-manager/trust-manager-controller.md
 	FeatureTrustManager featuregate.Feature = "TrustManager"
+
+	// HTTP01Proxy enables the controller for http01proxies.operator.openshift.io resource,
+	// which extends cert-manager-operator to deploy and manage the HTTP01 challenge proxy.
+	// The proxy enables cert-manager to complete HTTP01 ACME challenges for the API endpoint
+	// on baremetal platforms where the API VIP is not exposed via OpenShift Ingress.
+	//
+	// For more details,
+	// https://github.com/openshift/enhancements/pull/1929
+	FeatureHTTP01Proxy featuregate.Feature = "HTTP01Proxy"
 )
 
 var OperatorFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
 	FeatureIstioCSR:     {Default: true, PreRelease: featuregate.GA},
 	FeatureTrustManager: {Default: false, PreRelease: "TechPreview"},
+	FeatureHTTP01Proxy:  {Default: false, PreRelease: featuregate.Alpha},
 }

api/operator/v1alpha1/http01proxy_types.go

@@ -0,0 +1,109 @@
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func init() {
+	SchemeBuilder.Register(&HTTP01Proxy{}, &HTTP01ProxyList{})
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:object:root=true
+
+// HTTP01ProxyList is a list of HTTP01Proxy objects.
+type HTTP01ProxyList struct {
+	metav1.TypeMeta `json:",inline"`
+
+	// metadata is the standard list's metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	metav1.ListMeta `json:"metadata"`
+	Items           []HTTP01Proxy `json:"items"`
+}
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:path=http01proxies,scope=Namespaced,categories={cert-manager-operator},shortName=http01proxy
+// +kubebuilder:printcolumn:name="Mode",type="string",JSONPath=".spec.mode"
+// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
+// +kubebuilder:printcolumn:name="Message",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].message"
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
+// +kubebuilder:metadata:labels={"app.kubernetes.io/name=http01proxy", "app.kubernetes.io/part-of=cert-manager-operator"}
+
+// HTTP01Proxy describes the configuration for the HTTP01 challenge proxy
+// that redirects traffic from the API endpoint on port 80 to ingress routers.
+// This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
+// The name must be `default` to make HTTP01Proxy a singleton.
+//
+// When an HTTP01Proxy is created, the proxy DaemonSet is deployed on control plane nodes.
+//
+// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'default'",message="http01proxy is a singleton, .metadata.name must be 'default'"
+// +operator-sdk:csv:customresourcedefinitions:displayName="HTTP01Proxy"
+type HTTP01Proxy struct {
+	metav1.TypeMeta `json:",inline"`
+
+	// metadata is the standard object's metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// spec is the specification of the desired behavior of the HTTP01Proxy.
+	// +kubebuilder:validation:Required
+	// +required
+	Spec HTTP01ProxySpec `json:"spec"`
+
+	// status is the most recently observed status of the HTTP01Proxy.
+	// +kubebuilder:validation:Optional
+	// +optional
+	Status HTTP01ProxyStatus `json:"status,omitempty"`
+}
+
+// HTTP01ProxyMode controls how the HTTP01 challenge proxy is deployed.
+// +kubebuilder:validation:Enum=DefaultDeployment;CustomDeployment
+type HTTP01ProxyMode string
+
+const (
+	// HTTP01ProxyModeDefault enables the proxy with default configuration.
+	HTTP01ProxyModeDefault HTTP01ProxyMode = "DefaultDeployment"
+
+	// HTTP01ProxyModeCustom enables the proxy with user-specified configuration.
+	HTTP01ProxyModeCustom HTTP01ProxyMode = "CustomDeployment"
+)
+
+// HTTP01ProxySpec is the specification of the desired behavior of the HTTP01Proxy.
+// +kubebuilder:validation:XValidation:rule="self.mode == 'CustomDeployment' ? has(self.customDeployment) : !has(self.customDeployment)",message="customDeployment is required when mode is CustomDeployment and forbidden otherwise"
+type HTTP01ProxySpec struct {
+	// mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
+	// DefaultDeployment enables the proxy with default configuration.
+	// CustomDeployment enables the proxy with user-specified configuration.
+	// +kubebuilder:validation:Required
+	// +required
+	Mode HTTP01ProxyMode `json:"mode"`
+
+	// customDeployment contains configuration options when mode is CustomDeployment.
+	// This field is only valid when mode is CustomDeployment.
+	// +kubebuilder:validation:Optional
+	// +optional
+	CustomDeployment *HTTP01ProxyCustomDeploymentSpec `json:"customDeployment,omitempty"`
+}
+
+// HTTP01ProxyCustomDeploymentSpec contains configuration for custom proxy deployment.
+type HTTP01ProxyCustomDeploymentSpec struct {
+	// internalPort specifies the internal port used by the proxy service.
+	// Valid values are 1024-65535.
+	// +kubebuilder:validation:Minimum=1024
+	// +kubebuilder:validation:Maximum=65535
+	// +kubebuilder:default=8888
+	// +optional
+	InternalPort int32 `json:"internalPort,omitempty"`
+}
+
+// HTTP01ProxyStatus is the most recently observed status of the HTTP01Proxy.
+type HTTP01ProxyStatus struct {
+	// conditions holds information about the current state of the HTTP01 proxy deployment.
+	ConditionalStatus `json:",inline,omitempty"`
+
+	// proxyImage is the name of the image and the tag used for deploying the proxy.
+	ProxyImage string `json:"proxyImage,omitempty"`
+}