Skip to content

Commit 35d1481

Browse files
irbyirby
committed
feat(issuer): add caConfigMap and caBundleKey to deployment chart
Signed-off-by: Matthew H. Irby <matt.irby@keyfactor.com>
1 parent d9e2ff3 commit 35d1481

File tree

13 files changed

+354
-19
lines changed

13 files changed

+354
-19
lines changed

‎api/v1alpha1/issuer_types.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,12 @@ type IssuerSpec struct {
113113
// +optional
114114
CaBundleConfigMapName string `json:"caBundleConfigMapName,omitempty"`
115115

116+
// The key in the Secret or ConfigMap containing the CA certificate bundle.
117+
// Applies to both caSecretName and caBundleConfigMapName.
118+
// If unspecifed, the last key alphabetically in the Secret or ConfigMap data will be used.
119+
// +optional
120+
CaBundleKey string `json:"caBundleKey,omitempty"`
121+
116122
// A list of comma separated scopes used when requesting a Bearer token from an ambient token provider implied
117123
// by the environment, rather than by commandSecretName. For example, could be set to
118124
// api://{tenant ID}/.default when requesting an access token for Entra ID (DefaultAzureCredential). Has no

‎cmd/main.go‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ func main() {
6969
var clusterResourceNamespace string
7070
var disableApprovedCheck bool
7171
var secretAccessGrantedAtClusterLevel bool
72+
var configMapAccessGrantedAtClusterLevel bool
7273

7374
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
7475
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the probe endpoint binds to.")
@@ -84,6 +85,8 @@ func main() {
8485
"Disables waiting for CertificateRequests to have an approved condition before signing.")
8586
flag.BoolVar(&secretAccessGrantedAtClusterLevel, "secret-access-granted-at-cluster-level", false,
8687
"Set this flag to true if the secret access is granted at cluster level. This will allow the controller to access secrets in any namespace. ")
88+
flag.BoolVar(&configMapAccessGrantedAtClusterLevel, "configmap-access-granted-at-cluster-level", false,
89+
"Set this flag to true if the config map access is granted at cluster level. This will allow the controller to access config maps in any namespace. ")
8790
opts := zap.Options{
8891
Development: true,
8992
}
@@ -126,16 +129,31 @@ func main() {
126129
}
127130

128131
var cacheOpts cache.Options
129-
if secretAccessGrantedAtClusterLevel {
130-
setupLog.Info("expecting SA to have Get+List+Watch permissions for corev1 Secret resources at cluster level")
131-
} else {
132-
setupLog.Info(fmt.Sprintf("expecting SA to have Get+List+Watch permissions for corev1 Secret resources in the %q namespace", clusterResourceNamespace))
132+
133+
// Build the ByObject map if either resource is namespace-scoped
134+
if !secretAccessGrantedAtClusterLevel || !configMapAccessGrantedAtClusterLevel {
135+
byObject := make(map[client.Object]cache.ByObject)
136+
137+
if !secretAccessGrantedAtClusterLevel {
138+
setupLog.Info(fmt.Sprintf("expecting SA to have Get+List+Watch permissions for corev1 Secret resources in the %q namespace", clusterResourceNamespace))
139+
byObject[&corev1.Secret{}] = cache.ByObject{
140+
Namespaces: map[string]cache.Config{clusterResourceNamespace: {}},
141+
}
142+
} else {
143+
setupLog.Info("expecting SA to have Get+List+Watch permissions for corev1 Secret resources at cluster level")
144+
}
145+
146+
if !configMapAccessGrantedAtClusterLevel {
147+
setupLog.Info(fmt.Sprintf("expecting SA to have Get+List+Watch permissions for corev1 ConfigMap resources in the %q namespace", clusterResourceNamespace))
148+
byObject[&corev1.ConfigMap{}] = cache.ByObject{
149+
Namespaces: map[string]cache.Config{clusterResourceNamespace: {}},
150+
}
151+
} else {
152+
setupLog.Info("expecting SA to have Get+List+Watch permissions for corev1 ConfigMap resources at cluster level")
153+
}
154+
133155
cacheOpts = cache.Options{
134-
ByObject: map[client.Object]cache.ByObject{
135-
&corev1.Secret{}: {
136-
Namespaces: map[string]cache.Config{clusterResourceNamespace: cache.Config{}},
137-
},
138-
},
156+
ByObject: byObject,
139157
}
140158
}
141159

‎config/crd/bases/command-issuer.keyfactor.com_clusterissuers.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,12 @@ spec:
5959
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
6060
are specified, caBundleConfigMapName will take precedence.
6161
type: string
62+
caBundleKey:
63+
description: |-
64+
The key in the Secret or ConfigMap containing the CA certificate bundle.
65+
Applies to both caSecretName and caBundleConfigMapName.
66+
If unspecifed, the last key alphabetically in the Secret or ConfigMap data will be used.
67+
type: string
6268
caSecretName:
6369
description: |-
6470
The name of the secret containing the CA bundle to use when verifying

‎config/crd/bases/command-issuer.keyfactor.com_issuers.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,12 @@ spec:
5959
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
6060
are specified, caBundleConfigMapName will take precedence.
6161
type: string
62+
caBundleKey:
63+
description: |-
64+
The key in the Secret or ConfigMap containing the CA certificate bundle.
65+
Applies to both caSecretName and caBundleConfigMapName.
66+
If unspecifed, the last key alphabetically in the Secret or ConfigMap data will be used.
67+
type: string
6268
caSecretName:
6369
description: |-
6470
The name of the secret containing the CA bundle to use when verifying

‎deploy/charts/command-cert-manager-issuer/templates/crds/clusterissuers.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,25 @@ spec:
4646
description: APIPath is the base path of the Command API. KeyfactorAPI
4747
by default
4848
type: string
49+
caBundleConfigMapName:
50+
description: |-
51+
The name of the ConfigMap containing the CA bundle to use when verifying
52+
Command's server certificate. If specified, the CA bundle will be added to
53+
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
54+
are specified, caBundleConfigMapName will take precedence.
55+
type: string
56+
caBundleKey:
57+
description: |-
58+
The key in the Secret or ConfigMap containing the CA certificate bundle.
59+
Applies to both caSecretName and caBundleConfigMapName.
60+
If unspecifed, the last key alphabetically in the Secret or ConfigMap data will be used.
61+
type: string
4962
caSecretName:
5063
description: |-
5164
The name of the secret containing the CA bundle to use when verifying
5265
Command's server certificate. If specified, the CA bundle will be added to
53-
the client trust roots for the Command issuer.
66+
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
67+
are specified, caBundleConfigMapName will take precedence.
5468
type: string
5569
certificateAuthorityHostname:
5670
description: |-

‎deploy/charts/command-cert-manager-issuer/templates/crds/issuers.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,25 @@ spec:
4646
description: APIPath is the base path of the Command API. KeyfactorAPI
4747
by default
4848
type: string
49+
caBundleConfigMapName:
50+
description: |-
51+
The name of the ConfigMap containing the CA bundle to use when verifying
52+
Command's server certificate. If specified, the CA bundle will be added to
53+
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
54+
are specified, caBundleConfigMapName will take precedence.
55+
type: string
56+
caBundleKey:
57+
description: |-
58+
The key in the Secret or ConfigMap containing the CA certificate bundle.
59+
Applies to both caSecretName and caBundleConfigMapName.
60+
If unspecifed, the last key alphabetically in the Secret or ConfigMap data will be used.
61+
type: string
4962
caSecretName:
5063
description: |-
5164
The name of the secret containing the CA bundle to use when verifying
5265
Command's server certificate. If specified, the CA bundle will be added to
53-
the client trust roots for the Command issuer.
66+
the client trust roots for the Command issuer. If both caSecretName and caBundleConfigMapName
67+
are specified, caBundleConfigMapName will take precedence.
5468
type: string
5569
certificateAuthorityHostname:
5670
description: |-

‎deploy/charts/command-cert-manager-issuer/templates/deployment.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ spec:
3636
{{- if .Values.secretConfig.useClusterRoleForSecretAccess}}
3737
- --secret-access-granted-at-cluster-level
3838
{{- end}}
39+
{{- if .Values.secretConfig.useClusterRoleForConfigMapAccess}}
40+
- --configmap-access-granted-at-cluster-level
41+
{{- end}}
3942
command:
4043
- /manager
4144
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.Version }}"

‎deploy/charts/command-cert-manager-issuer/templates/role.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,19 @@ rules:
4040
- get
4141
- list
4242
- watch
43+
---
44+
apiVersion: rbac.authorization.k8s.io/v1
45+
kind: {{ if .Values.secretConfig.useClusterRoleForConfigMapAccess }}ClusterRole{{ else }}Role{{ end }}
46+
metadata:
47+
labels:
48+
{{- include "command-cert-manager-issuer.labels" . | nindent 4 }}
49+
name: {{ include "command-cert-manager-issuer.name" . }}-configmap-reader-role
50+
rules:
51+
- apiGroups:
52+
- ""
53+
resources:
54+
- configmaps
55+
verbs:
56+
- get
57+
- list
58+
- watch

‎deploy/charts/command-cert-manager-issuer/templates/rolebinding.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,18 @@ subjects:
2727
- kind: ServiceAccount
2828
name: {{ include "command-cert-manager-issuer.serviceAccountName" . }}
2929
namespace: {{ .Release.Namespace }}
30+
---
31+
apiVersion: rbac.authorization.k8s.io/v1
32+
kind: {{ if .Values.secretConfig.useClusterRoleForConfigMapAccess }}ClusterRoleBinding{{ else }}RoleBinding{{ end }}
33+
metadata:
34+
labels:
35+
{{- include "command-cert-manager-issuer.labels" . | nindent 4 }}
36+
name: {{ include "command-cert-manager-issuer.name" . }}-configmap-reader-rolebinding
37+
roleRef:
38+
apiGroup: rbac.authorization.k8s.io
39+
kind: {{ if .Values.secretConfig.useClusterRoleForConfigMapAccess }}ClusterRole{{ else }}Role{{ end }}
40+
name: {{ include "command-cert-manager-issuer.name" . }}-configmap-reader-role
41+
subjects:
42+
- kind: ServiceAccount
43+
name: {{ include "command-cert-manager-issuer.serviceAccountName" . }}
44+
namespace: {{ .Release.Namespace }}

‎deploy/charts/command-cert-manager-issuer/values.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,15 @@ secretConfig:
2323
# namespace the chart is deployed in.
2424
useClusterRoleForSecretAccess: false
2525

26+
# If true, when using Issuer resources, the configmap resource must be created in the same namespace as the
27+
# Issuer resource. This access is facilitated by granting the ServiceAccount [get, list, watch] for the config map
28+
# API at the cluster level.
29+
#
30+
# If false, both Issuer and ClusterIssuer must reference a config map in the same namespace as the chart/reconciler.
31+
# This access is facilitated by granting the ServiceAccount [get, list, watch] for the config map API only for the
32+
# namespace the chart is deployed in.
33+
useClusterRoleForConfigMapAccess: false
34+
2635
crd:
2736
# Specifies whether CRDs will be created
2837
create: true

0 commit comments

Comments
 (0)