Feature: ClusterTrustBundle as Target

[SgtCoDFish]

The upstream ClusterTrustBundle resource is reaching beta in k8s 1.33 which gives us a great incentive to adopt the resource. It'll be usable as both a source and a target; this issue focuses on using it as a target.

Key Differences from Existing Targets

1. ClusterTrustBundle only exposes a trustBundle field for PEM-encoded certs; there's no extra space for PKCS#12 or JKS, so CTB won't be able to support it.
2. Because of 1, the current layout of the Bundle CRD risks being confusing; AdditionalFormats looks like it applies to all targets, but ClusterTrustBundle won't be affected. Longer term this could inform how we want to evolve the CRD.
3. ClusterTrustBundle includes a "signer" field, which users may want to be able to configure when creating the bundle. This needs further investigation to determine what the correct approach is.
4. All service accounts can read CTBs by default, but we'll need permission to write
5. CTBs are global-scoped and so don't need to be tracked across namespaces.
6. CTBs are currently v1alpha1 and will migrate to v1beta1 and eventually v1. We'll need to handle that evolution which we didn't need to handle with ConfigMap / Secret.
7. CTB targets may need to be manually enabled in trust-manager for k8s < 1.33
8. CTBs impose requirements on naming based on whether they're signer linked or unlinked. We can't "just" use the trust-manager Bundle resource's name.

Testing ClusterTrustBundle

The following KindConfig will enable the feature flag on k8s 1.28 - 1.32, where the feature is in Alpha:

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
featureGates:
  ClusterTrustBundle: true
  ClusterTrustBundleProjection: true
runtimeConfig:
  "certificates.k8s.io/v1alpha1/clustertrustbundles": "true"

[erikgb]

Thanks for raising this issue! Some comments from me:

• Kubernetes has changed their API graduation policy, so I don't think ClusterTrustBundle will be enabled by default before it is GA. Ref. https://kubernetes.io/docs/reference/using-api/#api-versioning.
• Regarding your comment around additionalFormats, I think we can improve this by changing the API. I have created ClusterBundle target API rework #486, proposing a new API. While still WIP, I think the new API could make the introduction of ClusterTrustBundle as target smoother.

For the latter, a ClusterBundle having ClusterTrustBundle as target could look like this:

target:
  configMap:
    - format: jks
      key: bundle.jks
      password: whatever
  secret:
    # PEM is the default format
    - key: bundle.pem
  clusterTrustBundle: {} # No properties would be allowed here

[arsenalzp]

Hello colleagues,
I can support this feature

[cert-manager-bot]

Issues go stale after 6 months of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues remain open for an additional 3 months of inactivity and then close.
If this issue is safe to close now please do so with /close.
/lifecycle stale

[erikgb]

/remove-lifecycle stale