Skip to content

Commit 14ad068

Browse files
committed
feat: Add configurable Ingress hostname template for non-OpenShift clusters
Introduces --ingress-host-template flag (INGRESS_HOST_TEMPLATE env var) to control default Ingress hostnames on non-OpenShift clusters. The default "%[1]s.local" preserves existing behavior. CI is configured with "%[1]s.%[2]s.traefik.me" to produce namespace-unique hostnames, eliminating Ingress hostname collisions between e2e test namespaces that caused Konflux pipeline timeouts. Refs: SECURESIGN-3862 Signed-off-by: Tomas Turek <tturek@redhat.com>
1 parent 958bbab commit 14ad068

7 files changed

Lines changed: 184 additions & 13 deletions

File tree

.github/workflows/main.yml

Lines changed: 22 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ env:
1515
CATALOG_IMG: ghcr.io/securesign/secure-sign-operator-fbc:dev-${{ github.sha }}
1616
NEW_OLM_CHANNEL: rhtas-operator.v1.5.0
1717
OCP_VERSION: ${{ vars.OLM_INDEX_VERSION }}
18+
INGRESS_HOST_TEMPLATE: '%[1]s.%[2]s.traefik.me'
1819

1920
jobs:
2021
build-operator:
@@ -244,9 +245,14 @@ jobs:
244245
run: |
245246
kubectl wait --for=condition=available deployment/rhtas-operator-controller-manager --timeout=120s -n openshift-rhtas-operator
246247
248+
- name: Configure Ingress hostname template
249+
run: |
250+
kubectl set env deployment/rhtas-operator-controller-manager -n openshift-rhtas-operator INGRESS_HOST_TEMPLATE="${INGRESS_HOST_TEMPLATE}"
251+
kubectl rollout status deployment/rhtas-operator-controller-manager -n openshift-rhtas-operator --timeout=120s
252+
247253
- name: Add service hosts to /etc/hosts
248254
run: |
249-
sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local tsa-server.local" | sudo tee -a /etc/hosts
255+
sudo echo "127.0.0.1 keycloak-internal.keycloak-system.svc" | sudo tee -a /etc/hosts
250256
- name: Install cosign
251257
run: go install github.com/sigstore/cosign/v3/cmd/cosign@v3.0.5
252258

@@ -327,7 +333,7 @@ jobs:
327333
328334
- name: Add service hosts to /etc/hosts
329335
run: |
330-
sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local tsa-server.local" | sudo tee -a /etc/hosts
336+
sudo echo "127.0.0.1 keycloak-internal.keycloak-system.svc" | sudo tee -a /etc/hosts
331337
- name: Install cosign
332338
#keep upgrade scenario on cosign v2 (latest released version does not support cosign v3)
333339
run: go install github.com/sigstore/cosign/v2/cmd/cosign@v2.4.0
@@ -409,9 +415,14 @@ jobs:
409415
run: |
410416
kubectl wait --for=condition=available deployment/rhtas-operator-controller-manager --timeout=120s -n openshift-rhtas-operator
411417
418+
- name: Configure Ingress hostname template
419+
run: |
420+
kubectl set env deployment/rhtas-operator-controller-manager -n openshift-rhtas-operator INGRESS_HOST_TEMPLATE="${INGRESS_HOST_TEMPLATE}"
421+
kubectl rollout status deployment/rhtas-operator-controller-manager -n openshift-rhtas-operator --timeout=120s
422+
412423
- name: Add service hosts to /etc/hosts
413424
run: |
414-
sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local tsa-server.local" | sudo tee -a /etc/hosts
425+
sudo echo "127.0.0.1 keycloak-internal.keycloak-system.svc" | sudo tee -a /etc/hosts
415426
416427
- name: Install cosign
417428
run: go install github.com/sigstore/cosign/v3/cmd/cosign@v3.0.5
@@ -489,7 +500,7 @@ jobs:
489500
490501
- name: Add service hosts to /etc/hosts
491502
run: |
492-
sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local rekor-search-ui.local cli-server.local" | sudo tee -a /etc/hosts
503+
echo "# service hosts added here if needed"
493504
494505
- name: Replace images
495506
run: make dev-images generate && cat config/default/images.env
@@ -573,7 +584,7 @@ jobs:
573584
574585
- name: Add service hosts to /etc/hosts
575586
run: |
576-
sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local rekor-search-ui.local tsa-server.local cli-server.local ${{ steps.kind.outputs.oidc_host }}" | sudo tee -a /etc/hosts
587+
sudo echo "127.0.0.1 ${{ steps.kind.outputs.oidc_host }}" | sudo tee -a /etc/hosts
577588
578589
- name: Replace images
579590
run: make dev-images generate && cat config/default/images.env
@@ -585,6 +596,11 @@ jobs:
585596
run: |
586597
kubectl wait --for=condition=available deployment/rhtas-operator-controller-manager --timeout=120s -n openshift-rhtas-operator
587598
599+
- name: Configure Ingress hostname template
600+
run: |
601+
kubectl set env deployment/rhtas-operator-controller-manager -n openshift-rhtas-operator INGRESS_HOST_TEMPLATE="${INGRESS_HOST_TEMPLATE}"
602+
kubectl rollout status deployment/rhtas-operator-controller-manager -n openshift-rhtas-operator --timeout=120s
603+
588604
- name: Install securesign
589605
run: |
590606
sed -i 's#https://your-oidc-issuer-url#http://${{ steps.kind.outputs.oidc_host }}/realms/trusted-artifact-signer#' config/samples/rhtas_v1alpha1_securesign.yaml
@@ -602,7 +618,7 @@ jobs:
602618
export FULCIO_URL=$(kubectl get fulcio -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }})
603619
604620
export CLI_STRATEGY=cli_server
605-
export CLI_SERVER_URL="http://cli-server.local"
621+
export CLI_SERVER_URL="http://cli-server.openshift-rhtas-operator.traefik.me"
606622
607623
cd e2e
608624
source ./tas-env-variables.sh

cmd/main.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,9 @@ func main() {
102102
flag.Int64Var(&appconfig.CreateTreeDeadline, "create-tree-deadline", appconfig.CreateTreeDeadline, "The time allowance (in seconds) for the create tree job to run before failing.")
103103
utils.BoolFlagOrEnv(&appconfig.Openshift, "openshift", "OPENSHIFT", false, "Enable to ensures the operator applies OpenShift specific configurations.")
104104
utils.StringFlagOrEnv(&appconfig.OpenshiftAPIServerName, "openshift-apiserver-name", "OPENSHIFT_APISERVER_NAME", "openshift-apiserver", "The OpenShift API Server name.")
105+
utils.StringFlagOrEnv(&appconfig.IngressHostTemplate, "ingress-host-template", "INGRESS_HOST_TEMPLATE", appconfig.IngressHostTemplate,
106+
"Default hostname template for non-OpenShift Ingress resources when ExternalAccess.Host is not set. "+
107+
"Uses Go fmt.Sprintf with %[1]s=service name, %[2]s=namespace. Ignored on OpenShift.")
105108
utils.RelatedImageFlag("trillian-log-signer-image", images.TrillianLogSigner, "The image used for trillian log signer.")
106109
utils.RelatedImageFlag("trillian-log-server-image", images.TrillianServer, "The image used for trillian log server.")
107110
utils.RelatedImageFlag("trillian-db-image", images.TrillianDb, "The image used for trillian's database.")

internal/config/config.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,5 @@ var (
44
CreateTreeDeadline int64 = 1200
55
Openshift bool
66
OpenshiftAPIServerName string
7+
IngressHostTemplate = "%[1]s.local"
78
)

internal/utils/kubernetes/common.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ func CalculateHostname(ctx context.Context, client client.Client, svcName, ns st
8686
}
8787
return fmt.Sprintf("%s-%s.%s", svcName, ns, ingress.Spec.Domain), nil
8888
}
89-
return svcName + ".local", nil
89+
return fmt.Sprintf(config.IngressHostTemplate, svcName, ns), nil
9090
}
9191

9292
func FindByLabelSelector(ctx context.Context, c client.Client, list client.ObjectList, namespace, labelSelector string) error {
Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
package kubernetes
2+
3+
import (
4+
"context"
5+
"testing"
6+
7+
configv1 "github.com/openshift/api/config/v1"
8+
"github.com/securesign/operator/internal/config"
9+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
10+
"k8s.io/apimachinery/pkg/runtime"
11+
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
12+
"sigs.k8s.io/controller-runtime/pkg/client/fake"
13+
)
14+
15+
func TestCalculateHostname(t *testing.T) {
16+
tests := []struct {
17+
name string
18+
template string
19+
svcName string
20+
ns string
21+
expected string
22+
}{
23+
{
24+
name: "default template produces static .local hostname",
25+
template: "%[1]s.local",
26+
svcName: "rekor-server",
27+
ns: "test-ns",
28+
expected: "rekor-server.local",
29+
},
30+
{
31+
name: "namespace-scoped template includes namespace",
32+
template: "%[1]s.%[2]s.traefik.me",
33+
svcName: "rekor-server",
34+
ns: "test-ns",
35+
expected: "rekor-server.test-ns.traefik.me",
36+
},
37+
{
38+
name: "custom template with different format",
39+
template: "%[1]s-%[2]s.example.com",
40+
svcName: "fulcio-server",
41+
ns: "my-namespace",
42+
expected: "fulcio-server-my-namespace.example.com",
43+
},
44+
}
45+
46+
for _, tt := range tests {
47+
t.Run(tt.name, func(t *testing.T) {
48+
original := config.IngressHostTemplate
49+
origOpenshift := config.Openshift
50+
t.Cleanup(func() {
51+
config.IngressHostTemplate = original
52+
config.Openshift = origOpenshift
53+
})
54+
55+
config.IngressHostTemplate = tt.template
56+
config.Openshift = false
57+
58+
result, err := CalculateHostname(context.Background(), nil, tt.svcName, tt.ns)
59+
if err != nil {
60+
t.Fatalf("unexpected error: %v", err)
61+
}
62+
if result != tt.expected {
63+
t.Errorf("got %q, want %q", result, tt.expected)
64+
}
65+
})
66+
}
67+
}
68+
69+
func TestCalculateHostname_OpenShift(t *testing.T) {
70+
scheme := runtime.NewScheme()
71+
utilruntime.Must(configv1.AddToScheme(scheme))
72+
73+
tests := []struct {
74+
name string
75+
domain string
76+
svcName string
77+
ns string
78+
expected string
79+
}{
80+
{
81+
name: "OpenShift hostname includes namespace and cluster domain",
82+
domain: "apps.cluster.example.com",
83+
svcName: "rekor-server",
84+
ns: "test-ns",
85+
expected: "rekor-server-test-ns.apps.cluster.example.com",
86+
},
87+
{
88+
name: "OpenShift hostname with different service and namespace",
89+
domain: "apps.ocp.internal",
90+
svcName: "fulcio-server",
91+
ns: "secure-sign",
92+
expected: "fulcio-server-secure-sign.apps.ocp.internal",
93+
},
94+
}
95+
96+
for _, tt := range tests {
97+
t.Run(tt.name, func(t *testing.T) {
98+
origOpenshift := config.Openshift
99+
t.Cleanup(func() { config.Openshift = origOpenshift })
100+
config.Openshift = true
101+
102+
cli := fake.NewClientBuilder().
103+
WithScheme(scheme).
104+
WithObjects(&configv1.Ingress{
105+
ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
106+
Spec: configv1.IngressSpec{Domain: tt.domain},
107+
}).
108+
Build()
109+
110+
result, err := CalculateHostname(context.Background(), cli, tt.svcName, tt.ns)
111+
if err != nil {
112+
t.Fatalf("unexpected error: %v", err)
113+
}
114+
if result != tt.expected {
115+
t.Errorf("got %q, want %q", result, tt.expected)
116+
}
117+
})
118+
}
119+
}
120+
121+
func TestCalculateHostname_OpenShift_MissingIngress(t *testing.T) {
122+
scheme := runtime.NewScheme()
123+
utilruntime.Must(configv1.AddToScheme(scheme))
124+
125+
origOpenshift := config.Openshift
126+
t.Cleanup(func() { config.Openshift = origOpenshift })
127+
config.Openshift = true
128+
129+
cli := fake.NewClientBuilder().WithScheme(scheme).Build()
130+
131+
_, err := CalculateHostname(context.Background(), cli, "rekor-server", "test-ns")
132+
if err == nil {
133+
t.Fatal("expected error when cluster Ingress is missing, got nil")
134+
}
135+
}

test/e2e/custom_install/suite_test.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,10 @@ func managerPod(ns string, opts ...optManagerPod) *v1.Pod {
9999
Name: "OPENSHIFT",
100100
Value: support.EnvOrDefault("OPENSHIFT", "false"),
101101
},
102+
{
103+
Name: "INGRESS_HOST_TEMPLATE",
104+
Value: support.EnvOrDefault("INGRESS_HOST_TEMPLATE", "%[1]s.local"),
105+
},
102106
},
103107
LivenessProbe: &v1.Probe{
104108
ProbeHandler: v1.ProbeHandler{

test/e2e/support/kubernetes/olm/olm.go

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package olm
33
import (
44
"context"
55
"fmt"
6+
"os"
67
"strconv"
78
"strings"
89

@@ -113,12 +114,7 @@ func OlmInstaller(ctx context.Context, cli client.Client, catalogImage, ns, pack
113114
Package: packageName,
114115
Channel: channel,
115116
Config: &v1alpha1.SubscriptionConfig{
116-
Env: []coreV1.EnvVar{
117-
{
118-
Name: "OPENSHIFT",
119-
Value: strconv.FormatBool(ocp),
120-
},
121-
},
117+
Env: subscriptionEnv(ocp),
122118
},
123119
},
124120
},
@@ -132,3 +128,19 @@ func OlmInstaller(ctx context.Context, cli client.Client, catalogImage, ns, pack
132128

133129
return subscription, catalog, nil
134130
}
131+
132+
func subscriptionEnv(ocp bool) []coreV1.EnvVar {
133+
env := []coreV1.EnvVar{
134+
{
135+
Name: "OPENSHIFT",
136+
Value: strconv.FormatBool(ocp),
137+
},
138+
}
139+
if v, ok := os.LookupEnv("INGRESS_HOST_TEMPLATE"); ok {
140+
env = append(env, coreV1.EnvVar{
141+
Name: "INGRESS_HOST_TEMPLATE",
142+
Value: v,
143+
})
144+
}
145+
return env
146+
}

0 commit comments

Comments
 (0)