Skip to content

Commit 7092e63

Browse files
fghanmifghanmi
committed
Add TLS to Rekor and Trillian services
1 parent e138a4e commit 7092e63

23 files changed

+1190
-5
lines changed

‎api/v1alpha1/common.go

+14
Original file line numberDiff line numberDiff line change
@@ -90,3 +90,17 @@ type Pvc struct {
9090
//+optional
9191
StorageClass string `json:"storageClass,omitempty"`
9292
}
93+
94+
// TLSCert defines fields for TLS certificate
95+
// +kubebuilder:validation:XValidation:rule=(!has(self.certRef) || has(self.privateKeyRef)),message=privateKeyRef cannot be empty
96+
type TLSCert struct {
97+
// Reference to the private key
98+
//+optional
99+
PrivateKeyRef *SecretKeySelector `json:"privateKeyRef,omitempty"`
100+
// Reference to service certificate
101+
//+optional
102+
CertRef *SecretKeySelector `json:"certRef,omitempty"`
103+
// Reference to CA certificate
104+
//+optional
105+
CACertRef *LocalObjectReference `json:"CACertRef,omitempty"`
106+
}

‎api/v1alpha1/ctlog_types.go

+5
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ type CTlogSpec struct {
3838

3939
//Enable Service monitors for ctlog
4040
Monitoring MonitoringConfig `json:"monitoring,omitempty"`
41+
42+
// Reference to TLS server certificate, private key and CA certificate
43+
//+optional
44+
TLSCertificate TLSCert `json:"tls"`
4145
}
4246

4347
// CTlogStatus defines the observed state of CTlog component
@@ -47,6 +51,7 @@ type CTlogStatus struct {
4751
PrivateKeyPasswordRef *SecretKeySelector `json:"privateKeyPasswordRef,omitempty"`
4852
PublicKeyRef *SecretKeySelector `json:"publicKeyRef,omitempty"`
4953
RootCertificates []SecretKeySelector `json:"rootCertificates,omitempty"`
54+
TLSCertificate *TLSCert `json:"tls,omitempty"`
5055
// The ID of a Trillian tree that stores the log data.
5156
TreeID *int64 `json:"treeID,omitempty"`
5257
// +listType=map

‎api/v1alpha1/ctlog_types_test.go

+10
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,16 @@ var _ = Describe("CTlog", func() {
130130
},
131131
},
132132
},
133+
TLSCertificate: TLSCert{
134+
CertRef: &SecretKeySelector{
135+
Key: "cert",
136+
LocalObjectReference: LocalObjectReference{Name: "secret"},
137+
},
138+
PrivateKeyRef: &SecretKeySelector{
139+
Key: "key",
140+
LocalObjectReference: LocalObjectReference{Name: "secret"},
141+
},
142+
},
133143
},
134144
}
135145

‎api/v1alpha1/fulcio_types.go

+4
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ type FulcioSpec struct {
2626
// ConfigMap with additional bundle of trusted CA
2727
//+optional
2828
TrustedCA *LocalObjectReference `json:"trustedCA,omitempty"`
29+
// Reference to TLS server certificate, private key and CA certificate
30+
//+optional
31+
TLSCertificate TLSCert `json:"tls"`
2932
}
3033

3134
// FulcioCert defines fields for system-generated certificate
@@ -101,6 +104,7 @@ type OIDCIssuer struct {
101104
type FulcioStatus struct {
102105
ServerConfigRef *LocalObjectReference `json:"serverConfigRef,omitempty"`
103106
Certificate *FulcioCert `json:"certificate,omitempty"`
107+
TLSCertificate *TLSCert `json:"tls,omitempty"`
104108
Url string `json:"url,omitempty"`
105109
// +listType=map
106110
// +listMapKey=type

‎api/v1alpha1/fulcio_types_test.go

+17
Original file line numberDiff line numberDiff line change
@@ -209,10 +209,16 @@ var _ = Describe("Fulcio", func() {
209209
PrivateKeyRef: &SecretKeySelector{Key: "key", LocalObjectReference: LocalObjectReference{Name: "name"}},
210210
PrivateKeyPasswordRef: &SecretKeySelector{Key: "key", LocalObjectReference: LocalObjectReference{Name: "name"}},
211211
},
212+
212213
Ctlog: CtlogService{
213214
Address: "ctlog.default.svc",
214215
Port: &port,
215216
},
217+
TLSCertificate: TLSCert{
218+
CertRef: &SecretKeySelector{Key: "key", LocalObjectReference: LocalObjectReference{Name: "name"}},
219+
PrivateKeyRef: &SecretKeySelector{Key: "key", LocalObjectReference: LocalObjectReference{Name: "name"}},
220+
CACertRef: &LocalObjectReference{Name: "ca-configmap"},
221+
},
216222
},
217223
}
218224

@@ -260,6 +266,17 @@ func generateFulcioObject(name string) *Fulcio {
260266
CommonName: "hostname",
261267
OrganizationName: "organization",
262268
},
269+
TLSCertificate: TLSCert{
270+
CertRef: &SecretKeySelector{
271+
Key: "cert",
272+
LocalObjectReference: LocalObjectReference{Name: "secret"},
273+
},
274+
PrivateKeyRef: &SecretKeySelector{
275+
Key: "key",
276+
LocalObjectReference: LocalObjectReference{Name: "secret"},
277+
},
278+
CACertRef: &LocalObjectReference{Name: "ca-configmap"},
279+
},
263280
},
264281
}
265282
}

‎api/v1alpha1/zz_generated.deepcopy.go

+42
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/manifests/rhtas-operator.clusterserviceversion.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -192,7 +192,7 @@ metadata:
192192
]
193193
capabilities: Seamless Upgrades
194194
containerImage: registry.redhat.io/rhtas/rhtas-rhel9-operator@sha256:a21f7128694a64989bf0d84a7a7da4c1ffc89edf62d594dc8bea7bcfe9ac08d3
195-
createdAt: "2024-07-03T12:24:03Z"
195+
createdAt: "2024-07-04T14:29:12Z"
196196
features.operators.openshift.io/cnf: "false"
197197
features.operators.openshift.io/cni: "false"
198198
features.operators.openshift.io/csi: "false"

‎bundle/manifests/rhtas.redhat.com_ctlogs.yaml

+111
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,62 @@ spec:
137137
type: object
138138
x-kubernetes-map-type: atomic
139139
type: array
140+
tls:
141+
description: Reference to TLS server certificate, private key and
142+
CA certificate
143+
properties:
144+
CACertRef:
145+
description: Reference to CA certificate
146+
properties:
147+
name:
148+
description: |-
149+
Name of the referent.
150+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
151+
type: string
152+
required:
153+
- name
154+
type: object
155+
x-kubernetes-map-type: atomic
156+
certRef:
157+
description: Reference to service certificate
158+
properties:
159+
key:
160+
description: The key of the secret to select from. Must be
161+
a valid secret key.
162+
pattern: ^[-._a-zA-Z0-9]+$
163+
type: string
164+
name:
165+
description: |-
166+
Name of the referent.
167+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
168+
type: string
169+
required:
170+
- key
171+
- name
172+
type: object
173+
x-kubernetes-map-type: atomic
174+
privateKeyRef:
175+
description: Reference to the private key
176+
properties:
177+
key:
178+
description: The key of the secret to select from. Must be
179+
a valid secret key.
180+
pattern: ^[-._a-zA-Z0-9]+$
181+
type: string
182+
name:
183+
description: |-
184+
Name of the referent.
185+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
186+
type: string
187+
required:
188+
- key
189+
- name
190+
type: object
191+
x-kubernetes-map-type: atomic
192+
type: object
193+
x-kubernetes-validations:
194+
- message: privateKeyRef cannot be empty
195+
rule: (!has(self.certRef) || has(self.privateKeyRef))
140196
treeID:
141197
description: |-
142198
The ID of a Trillian tree that stores the log data.
@@ -312,6 +368,61 @@ spec:
312368
- name
313369
type: object
314370
x-kubernetes-map-type: atomic
371+
tls:
372+
description: TLSCert defines fields for TLS certificate
373+
properties:
374+
CACertRef:
375+
description: Reference to CA certificate
376+
properties:
377+
name:
378+
description: |-
379+
Name of the referent.
380+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
381+
type: string
382+
required:
383+
- name
384+
type: object
385+
x-kubernetes-map-type: atomic
386+
certRef:
387+
description: Reference to service certificate
388+
properties:
389+
key:
390+
description: The key of the secret to select from. Must be
391+
a valid secret key.
392+
pattern: ^[-._a-zA-Z0-9]+$
393+
type: string
394+
name:
395+
description: |-
396+
Name of the referent.
397+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
398+
type: string
399+
required:
400+
- key
401+
- name
402+
type: object
403+
x-kubernetes-map-type: atomic
404+
privateKeyRef:
405+
description: Reference to the private key
406+
properties:
407+
key:
408+
description: The key of the secret to select from. Must be
409+
a valid secret key.
410+
pattern: ^[-._a-zA-Z0-9]+$
411+
type: string
412+
name:
413+
description: |-
414+
Name of the referent.
415+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
416+
type: string
417+
required:
418+
- key
419+
- name
420+
type: object
421+
x-kubernetes-map-type: atomic
422+
type: object
423+
x-kubernetes-validations:
424+
- message: privateKeyRef cannot be empty
425+
rule: (!has(self.certRef) || has(self.privateKeyRef))
315426
treeID:
316427
description: The ID of a Trillian tree that stores the log data.
317428
format: int64

0 commit comments

Comments
 (0)