Skip to content

Commit e621593

Browse files
aleoliadamjensenbot
aleoli
authored and
adamjensenbot
committed
feat: certificate renewal
1 parent 9b944ae commit e621593

File tree

18 files changed

+1013
-3
lines changed

18 files changed

+1013
-3
lines changed

‎apis/authentication/v1beta1/renew_types.go

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
// Copyright 2019-2025 The Liqo Authors
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package v1beta1
16+
17+
import (
18+
corev1 "k8s.io/api/core/v1"
19+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
20+
"k8s.io/apimachinery/pkg/runtime/schema"
21+
22+
liqov1beta1 "github.com/liqotech/liqo/apis/core/v1beta1"
23+
)
24+
25+
// RenewResource is the name of the renew resources.
26+
var RenewResource = "renews"
27+
28+
// RenewKind specifies the kind of the renew.
29+
var RenewKind = "Renew"
30+
31+
// RenewGroupResource is group resource used to register these objects.
32+
var RenewGroupResource = schema.GroupResource{Group: GroupVersion.Group, Resource: RenewResource}
33+
34+
// RenewGroupVersionResource is groupResourceVersion used to register these objects.
35+
var RenewGroupVersionResource = GroupVersion.WithResource(RenewResource)
36+
37+
// RenewSpec defines the desired state of Renew.
38+
type RenewSpec struct {
39+
// ConsumerClusterID is the id of the consumer cluster.
40+
ConsumerClusterID liqov1beta1.ClusterID `json:"consumerClusterID,omitempty"`
41+
// PublicKey is the public key of the tenant cluster.
42+
PublicKey []byte `json:"publicKey,omitempty"`
43+
// CSR is the Certificate Signing Request of the tenant cluster.
44+
CSR []byte `json:"csr,omitempty"`
45+
// IdentityType is the type of the identity.
46+
IdentityType IdentityType `json:"identityType,omitempty"`
47+
// ResoruceSliceRef is the reference to the resource slice.
48+
ResourceSliceRef *corev1.LocalObjectReference `json:"resourceSliceRef,omitempty"`
49+
}
50+
51+
// RenewStatus defines the observed state of Renew.
52+
type RenewStatus struct {
53+
// AuthParams contains the authentication parameters for the consumer cluster.
54+
AuthParams *AuthParams `json:"authParams,omitempty"`
55+
}
56+
57+
// +kubebuilder:object:root=true
58+
// +kubebuilder:resource:categories=liqo
59+
// +kubebuilder:subresource:status
60+
// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
61+
62+
// Renew represents a slice of resources given by the provider cluster to the consumer cluster.
63+
type Renew struct {
64+
metav1.TypeMeta `json:",inline"`
65+
metav1.ObjectMeta `json:"metadata,omitempty"`
66+
67+
Spec RenewSpec `json:"spec,omitempty"`
68+
Status RenewStatus `json:"status,omitempty"`
69+
}
70+
71+
// +kubebuilder:object:root=true
72+
73+
// RenewList contains a list of Renews.
74+
type RenewList struct {
75+
metav1.TypeMeta `json:",inline"`
76+
metav1.ListMeta `json:"metadata,omitempty"`
77+
Items []Renew `json:"items"`
78+
}
79+
80+
func init() {
81+
SchemeBuilder.Register(&Renew{}, &RenewList{})
82+
}

‎apis/authentication/v1beta1/resourceslice_types.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ type ResourceSlice struct {
133133

134134
// +kubebuilder:object:root=true
135135

136-
// ResourceSliceList contains a list of Identities.
136+
// ResourceSliceList contains a list of ResourceSlices.
137137
type ResourceSliceList struct {
138138
metav1.TypeMeta `json:",inline"`
139139
metav1.ListMeta `json:"metadata,omitempty"`

‎apis/authentication/v1beta1/zz_generated.deepcopy.go

+109
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/liqo-controller-manager/modules/authentication.go

+22-1
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,11 @@ import (
2727
"github.com/liqotech/liqo/pkg/liqo-controller-manager/authentication"
2828
identitycontroller "github.com/liqotech/liqo/pkg/liqo-controller-manager/authentication/identity-controller"
2929
identitycreatorcontroller "github.com/liqotech/liqo/pkg/liqo-controller-manager/authentication/identitycreator-controller"
30+
localrenwercontroller "github.com/liqotech/liqo/pkg/liqo-controller-manager/authentication/localrenwer-controller"
3031
localresourceslicecontroller "github.com/liqotech/liqo/pkg/liqo-controller-manager/authentication/localresourceslice-controller"
3132
noncecreatorcontroller "github.com/liqotech/liqo/pkg/liqo-controller-manager/authentication/noncecreator-controller"
3233
noncesigner "github.com/liqotech/liqo/pkg/liqo-controller-manager/authentication/noncesigner-controller"
34+
remoterenwercontroller "github.com/liqotech/liqo/pkg/liqo-controller-manager/authentication/remoterenwer-controller"
3335
remoteresourceslicecontroller "github.com/liqotech/liqo/pkg/liqo-controller-manager/authentication/remoteresourceslice-controller"
3436
tenantcontroller "github.com/liqotech/liqo/pkg/liqo-controller-manager/authentication/tenant-controller"
3537
tenantnamespace "github.com/liqotech/liqo/pkg/tenantNamespace"
@@ -115,7 +117,8 @@ func SetupAuthenticationModule(ctx context.Context, mgr manager.Manager, uncache
115117
// Configure controller that fills the remote resource slice status.
116118
remoteResourceSliceReconciler := remoteresourceslicecontroller.NewRemoteResourceSliceReconciler(mgr.GetClient(),
117119
mgr.GetScheme(), mgr.GetConfig(), mgr.GetEventRecorderFor("remoteresourceslice-controller"),
118-
opts.IdentityProvider, opts.APIServerAddressOverride, caOverride, opts.TrustedCA,
120+
opts.IdentityProvider, opts.NamespaceManager,
121+
opts.APIServerAddressOverride, caOverride, opts.TrustedCA,
119122
opts.SliceStatusOptions)
120123
if err := remoteResourceSliceReconciler.SetupWithManager(mgr); err != nil {
121124
klog.Errorf("Unable to setup the remote resource slice reconciler: %v", err)
@@ -131,6 +134,24 @@ func SetupAuthenticationModule(ctx context.Context, mgr manager.Manager, uncache
131134
return err
132135
}
133136

137+
// Configure controllers that handle the certificate rotation.
138+
localRenewerReconciler := localrenwercontroller.NewLocalRenewerReconciler(mgr.GetClient(), mgr.GetScheme(),
139+
opts.LiqoNamespace, opts.LocalClusterID,
140+
mgr.GetEventRecorderFor("local-renewer-controller"))
141+
if err := localRenewerReconciler.SetupWithManager(mgr); err != nil {
142+
klog.Errorf("Unable to setup the local renewer reconciler: %v", err)
143+
return err
144+
}
145+
146+
remoteRenewerReconciler := remoterenwercontroller.NewRemoteRenewerReconciler(mgr.GetClient(), mgr.GetScheme(),
147+
opts.IdentityProvider, opts.NamespaceManager,
148+
opts.APIServerAddressOverride, caOverride, opts.TrustedCA,
149+
mgr.GetEventRecorderFor("remote-renewer-controller"))
150+
if err := remoteRenewerReconciler.SetupWithManager(mgr); err != nil {
151+
klog.Errorf("Unable to setup the remote renewer reconciler: %v", err)
152+
return err
153+
}
154+
134155
return nil
135156
}
136157

‎deployments/liqo/charts/liqo-crds/crds/authentication.liqo.io_renews.yaml

+124
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.16.3
7+
name: renews.authentication.liqo.io
8+
spec:
9+
group: authentication.liqo.io
10+
names:
11+
categories:
12+
- liqo
13+
kind: Renew
14+
listKind: RenewList
15+
plural: renews
16+
singular: renew
17+
scope: Namespaced
18+
versions:
19+
- additionalPrinterColumns:
20+
- jsonPath: .metadata.creationTimestamp
21+
name: Age
22+
type: date
23+
name: v1beta1
24+
schema:
25+
openAPIV3Schema:
26+
description: Renew represents a slice of resources given by the provider cluster
27+
to the consumer cluster.
28+
properties:
29+
apiVersion:
30+
description: |-
31+
APIVersion defines the versioned schema of this representation of an object.
32+
Servers should convert recognized schemas to the latest internal value, and
33+
may reject unrecognized values.
34+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
35+
type: string
36+
kind:
37+
description: |-
38+
Kind is a string value representing the REST resource this object represents.
39+
Servers may infer this from the endpoint the client submits requests to.
40+
Cannot be updated.
41+
In CamelCase.
42+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
43+
type: string
44+
metadata:
45+
type: object
46+
spec:
47+
description: RenewSpec defines the desired state of Renew.
48+
properties:
49+
consumerClusterID:
50+
description: ConsumerClusterID is the id of the consumer cluster.
51+
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
52+
type: string
53+
csr:
54+
description: CSR is the Certificate Signing Request of the tenant
55+
cluster.
56+
format: byte
57+
type: string
58+
identityType:
59+
description: IdentityType is the type of the identity.
60+
type: string
61+
publicKey:
62+
description: PublicKey is the public key of the tenant cluster.
63+
format: byte
64+
type: string
65+
resourceSliceRef:
66+
description: ResoruceSliceRef is the reference to the resource slice.
67+
properties:
68+
name:
69+
default: ""
70+
description: |-
71+
Name of the referent.
72+
This field is effectively required, but due to backwards compatibility is
73+
allowed to be empty. Instances of this type with an empty value here are
74+
almost certainly wrong.
75+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
76+
type: string
77+
type: object
78+
x-kubernetes-map-type: atomic
79+
type: object
80+
status:
81+
description: RenewStatus defines the observed state of Renew.
82+
properties:
83+
authParams:
84+
description: AuthParams contains the authentication parameters for
85+
the consumer cluster.
86+
properties:
87+
apiServer:
88+
type: string
89+
awsConfig:
90+
description: AwsConfig contains the AWS configuration and access
91+
key for the Liqo user and the current EKS cluster.
92+
properties:
93+
awsAccessKeyID:
94+
type: string
95+
awsClusterName:
96+
type: string
97+
awsRegion:
98+
type: string
99+
awsSecretAccessKey:
100+
type: string
101+
awsUserArn:
102+
type: string
103+
required:
104+
- awsAccessKeyID
105+
- awsClusterName
106+
- awsRegion
107+
- awsSecretAccessKey
108+
- awsUserArn
109+
type: object
110+
ca:
111+
format: byte
112+
type: string
113+
proxyURL:
114+
type: string
115+
signedCRT:
116+
format: byte
117+
type: string
118+
type: object
119+
type: object
120+
type: object
121+
served: true
122+
storage: true
123+
subresources:
124+
status: {}

0 commit comments

Comments
 (0)