Skip to content

Commit 71c2a12

Browse files
sebrandon1sebrandon1
committed
CM-716: Add HTTP01 Challenge Proxy controller
Adds the HTTP01 Challenge Proxy controller to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. When a user creates an HTTP01Proxy CR with mode DefaultDeployment, the operator validates the platform is BareMetal with distinct API and Ingress VIPs, then deploys a DaemonSet on control plane nodes running a reverse proxy. The proxy uses nftables to redirect HTTP traffic from API_VIP:80 to a local proxy port (default 8888). Only /.well-known/acme-challenge/* requests are forwarded to the Ingress VIP; all other requests are rejected. Feature gate: HTTP01Proxy (Alpha, disabled by default) Enable via: --unsupported-addon-features=HTTP01Proxy=true Jira: https://issues.redhat.com/browse/CM-716 Enhancement: openshift/enhancements#1929
1 parent 4cae755 commit 71c2a12

45 files changed

Lines changed: 2438 additions & 8 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -329,10 +329,12 @@ local-run: build ## Run the operator locally against the cluster configured in ~
329329
RELATED_IMAGE_CERT_MANAGER_ACMESOLVER=quay.io/jetstack/cert-manager-acmesolver:$(CERT_MANAGER_VERSION) \
330330
RELATED_IMAGE_CERT_MANAGER_ISTIOCSR=quay.io/jetstack/cert-manager-istio-csr:$(ISTIO_CSR_VERSION) \
331331
RELATED_IMAGE_CERT_MANAGER_TRUST_MANAGER=quay.io/jetstack/trust-manager:$(TRUST_MANAGER_VERSION) \
332+
RELATED_IMAGE_CERT_MANAGER_HTTP01PROXY=quay.io/bapalm/cert-mgr-http01-proxy:latest \
332333
OPERATOR_NAME=cert-manager-operator \
333334
OPERAND_IMAGE_VERSION=$(BUNDLE_VERSION) \
334335
ISTIOCSR_OPERAND_IMAGE_VERSION=$(ISTIO_CSR_VERSION) \
335336
TRUSTMANAGER_OPERAND_IMAGE_VERSION=$(TRUST_MANAGER_VERSION) \
337+
HTTP01PROXY_OPERAND_IMAGE_VERSION=0.1.0 \
336338
OPERATOR_IMAGE_VERSION=$(BUNDLE_VERSION) \
337339
./cert-manager-operator start \
338340
--config=./hack/local-run-config.yaml \

‎api/operator/v1alpha1/features.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,19 @@ var (
2121
// For more details,
2222
// https://github.com/openshift/enhancements/blob/master/enhancements/cert-manager/trust-manager-controller.md
2323
FeatureTrustManager featuregate.Feature = "TrustManager"
24+
25+
// HTTP01Proxy enables the controller for http01proxies.operator.openshift.io resource,
26+
// which extends cert-manager-operator to deploy and manage the HTTP01 challenge proxy.
27+
// The proxy enables cert-manager to complete HTTP01 ACME challenges for the API endpoint
28+
// on baremetal platforms where the API VIP is not exposed via OpenShift Ingress.
29+
//
30+
// For more details,
31+
// https://github.com/openshift/enhancements/pull/1929
32+
FeatureHTTP01Proxy featuregate.Feature = "HTTP01Proxy"
2433
)
2534

2635
var OperatorFeatureGates = map[featuregate.Feature]featuregate.FeatureSpec{
2736
FeatureIstioCSR: {Default: true, PreRelease: featuregate.GA},
2837
FeatureTrustManager: {Default: false, PreRelease: "TechPreview"},
38+
FeatureHTTP01Proxy: {Default: false, PreRelease: featuregate.Alpha},
2939
}

‎api/operator/v1alpha1/http01proxy_types.go‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
package v1alpha1
2+
3+
import (
4+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
5+
)
6+
7+
func init() {
8+
SchemeBuilder.Register(&HTTP01Proxy{}, &HTTP01ProxyList{})
9+
}
10+
11+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
12+
// +kubebuilder:object:root=true
13+
14+
// HTTP01ProxyList is a list of HTTP01Proxy objects.
15+
type HTTP01ProxyList struct {
16+
metav1.TypeMeta `json:",inline"`
17+
18+
// metadata is the standard list's metadata.
19+
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
20+
metav1.ListMeta `json:"metadata"`
21+
Items []HTTP01Proxy `json:"items"`
22+
}
23+
24+
// +genclient
25+
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
26+
// +kubebuilder:object:root=true
27+
// +kubebuilder:subresource:status
28+
// +kubebuilder:resource:path=http01proxies,scope=Namespaced,categories={cert-manager-operator},shortName=http01proxy
29+
// +kubebuilder:printcolumn:name="Mode",type="string",JSONPath=".spec.mode"
30+
// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].status"
31+
// +kubebuilder:printcolumn:name="Message",type="string",JSONPath=".status.conditions[?(@.type=='Ready')].message"
32+
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
33+
// +kubebuilder:metadata:labels={"app.kubernetes.io/name=http01proxy", "app.kubernetes.io/part-of=cert-manager-operator"}
34+
35+
// HTTP01Proxy describes the configuration for the HTTP01 challenge proxy
36+
// that redirects traffic from the API endpoint on port 80 to ingress routers.
37+
// This enables cert-manager to perform HTTP01 ACME challenges for API endpoint certificates.
38+
// The name must be `default` to make HTTP01Proxy a singleton.
39+
//
40+
// When an HTTP01Proxy is created, the proxy DaemonSet is deployed on control plane nodes.
41+
//
42+
// +kubebuilder:validation:XValidation:rule="self.metadata.name == 'default'",message="http01proxy is a singleton, .metadata.name must be 'default'"
43+
// +operator-sdk:csv:customresourcedefinitions:displayName="HTTP01Proxy"
44+
type HTTP01Proxy struct {
45+
metav1.TypeMeta `json:",inline"`
46+
47+
// metadata is the standard object's metadata.
48+
// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
49+
metav1.ObjectMeta `json:"metadata,omitempty"`
50+
51+
// spec is the specification of the desired behavior of the HTTP01Proxy.
52+
// +kubebuilder:validation:Required
53+
// +required
54+
Spec HTTP01ProxySpec `json:"spec"`
55+
56+
// status is the most recently observed status of the HTTP01Proxy.
57+
// +kubebuilder:validation:Optional
58+
// +optional
59+
Status HTTP01ProxyStatus `json:"status,omitempty"`
60+
}
61+
62+
// HTTP01ProxyMode controls how the HTTP01 challenge proxy is deployed.
63+
// +kubebuilder:validation:Enum=DefaultDeployment;CustomDeployment
64+
type HTTP01ProxyMode string
65+
66+
const (
67+
// HTTP01ProxyModeDefault enables the proxy with default configuration.
68+
HTTP01ProxyModeDefault HTTP01ProxyMode = "DefaultDeployment"
69+
70+
// HTTP01ProxyModeCustom enables the proxy with user-specified configuration.
71+
HTTP01ProxyModeCustom HTTP01ProxyMode = "CustomDeployment"
72+
)
73+
74+
// HTTP01ProxySpec is the specification of the desired behavior of the HTTP01Proxy.
75+
// +kubebuilder:validation:XValidation:rule="self.mode == 'CustomDeployment' ? has(self.customDeployment) : !has(self.customDeployment)",message="customDeployment is required when mode is CustomDeployment and forbidden otherwise"
76+
type HTTP01ProxySpec struct {
77+
// mode controls whether the HTTP01 challenge proxy is active and how it should be deployed.
78+
// DefaultDeployment enables the proxy with default configuration.
79+
// CustomDeployment enables the proxy with user-specified configuration.
80+
// +kubebuilder:validation:Required
81+
// +required
82+
Mode HTTP01ProxyMode `json:"mode"`
83+
84+
// customDeployment contains configuration options when mode is CustomDeployment.
85+
// This field is only valid when mode is CustomDeployment.
86+
// +kubebuilder:validation:Optional
87+
// +optional
88+
CustomDeployment *HTTP01ProxyCustomDeploymentSpec `json:"customDeployment,omitempty"`
89+
}
90+
91+
// HTTP01ProxyCustomDeploymentSpec contains configuration for custom proxy deployment.
92+
type HTTP01ProxyCustomDeploymentSpec struct {
93+
// internalPort specifies the internal port used by the proxy service.
94+
// Valid values are 1024-65535.
95+
// +kubebuilder:validation:Minimum=1024
96+
// +kubebuilder:validation:Maximum=65535
97+
// +kubebuilder:default=8888
98+
// +optional
99+
InternalPort int32 `json:"internalPort,omitempty"`
100+
}
101+
102+
// HTTP01ProxyStatus is the most recently observed status of the HTTP01Proxy.
103+
type HTTP01ProxyStatus struct {
104+
// conditions holds information about the current state of the HTTP01 proxy deployment.
105+
ConditionalStatus `json:",inline,omitempty"`
106+
107+
// proxyImage is the name of the image and the tag used for deploying the proxy.
108+
ProxyImage string `json:"proxyImage,omitempty"`
109+
}

‎api/operator/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 110 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bindata/http01-proxy/cert-manager-http01-proxy-clusterrole.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
name: cert-manager-http01-proxy
5+
labels:
6+
app: cert-manager-http01-proxy
7+
app.kubernetes.io/name: cert-manager-http01-proxy
8+
app.kubernetes.io/part-of: cert-manager-operator
9+
rules:
10+
- apiGroups:
11+
- config.openshift.io
12+
resources:
13+
- clusterversions
14+
- infrastructures
15+
- ingresses
16+
verbs:
17+
- get
18+
- list
19+
- watch

‎bindata/http01-proxy/cert-manager-http01-proxy-clusterrolebinding.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: cert-manager-http01-proxy
5+
labels:
6+
app: cert-manager-http01-proxy
7+
app.kubernetes.io/name: cert-manager-http01-proxy
8+
app.kubernetes.io/part-of: cert-manager-operator
9+
roleRef:
10+
apiGroup: rbac.authorization.k8s.io
11+
kind: ClusterRole
12+
name: cert-manager-http01-proxy
13+
subjects:
14+
- kind: ServiceAccount
15+
name: cert-manager-http01-proxy
16+
namespace: cert-manager-operator

‎bindata/http01-proxy/cert-manager-http01-proxy-daemonset.yaml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
apiVersion: apps/v1
2+
kind: DaemonSet
3+
metadata:
4+
name: cert-manager-http01-proxy
5+
namespace: cert-manager-operator
6+
labels:
7+
app: cert-manager-http01-proxy
8+
app.kubernetes.io/name: cert-manager-http01-proxy
9+
app.kubernetes.io/part-of: cert-manager-operator
10+
spec:
11+
selector:
12+
matchLabels:
13+
app: cert-manager-http01-proxy
14+
updateStrategy:
15+
type: RollingUpdate
16+
template:
17+
metadata:
18+
labels:
19+
app: cert-manager-http01-proxy
20+
app.kubernetes.io/name: cert-manager-http01-proxy
21+
app.kubernetes.io/part-of: cert-manager-operator
22+
spec:
23+
serviceAccountName: cert-manager-http01-proxy
24+
hostNetwork: true
25+
nodeSelector:
26+
node-role.kubernetes.io/master: ""
27+
tolerations:
28+
- key: node-role.kubernetes.io/master
29+
operator: Exists
30+
effect: NoSchedule
31+
- key: node-role.kubernetes.io/control-plane
32+
operator: Exists
33+
effect: NoSchedule
34+
containers:
35+
- name: http01-proxy
36+
image: ${RELATED_IMAGE_CERT_MANAGER_HTTP01PROXY}
37+
ports:
38+
- name: proxy
39+
containerPort: 8888
40+
hostPort: 8888
41+
protocol: TCP
42+
env:
43+
- name: PROXY_PORT
44+
value: "8888"
45+
securityContext:
46+
allowPrivilegeEscalation: false
47+
capabilities:
48+
add:
49+
- NET_ADMIN
50+
drop:
51+
- ALL
52+
runAsNonRoot: false
53+
resources:
54+
requests:
55+
cpu: 10m
56+
memory: 32Mi
57+
limits:
58+
cpu: 100m
59+
memory: 64Mi
60+
priorityClassName: system-cluster-critical

‎bindata/http01-proxy/cert-manager-http01-proxy-scc-rolebinding.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
name: cert-manager-http01-proxy-scc
5+
labels:
6+
app: cert-manager-http01-proxy
7+
app.kubernetes.io/name: cert-manager-http01-proxy
8+
app.kubernetes.io/part-of: cert-manager-operator
9+
roleRef:
10+
apiGroup: rbac.authorization.k8s.io
11+
kind: ClusterRole
12+
name: system:openshift:scc:privileged
13+
subjects:
14+
- kind: ServiceAccount
15+
name: cert-manager-http01-proxy
16+
namespace: cert-manager-operator

‎bindata/http01-proxy/cert-manager-http01-proxy-serviceaccount.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: cert-manager-http01-proxy
5+
namespace: cert-manager-operator
6+
labels:
7+
app: cert-manager-http01-proxy
8+
app.kubernetes.io/name: cert-manager-http01-proxy
9+
app.kubernetes.io/part-of: cert-manager-operator

0 commit comments

Comments
 (0)