|
| 1 | +/* |
| 2 | +Copyright 2021. |
| 3 | +
|
| 4 | +Licensed under the Apache License, Version 2.0 (the "License"); |
| 5 | +you may not use this file except in compliance with the License. |
| 6 | +You may obtain a copy of the License at |
| 7 | +
|
| 8 | + http://www.apache.org/licenses/LICENSE-2.0 |
| 9 | +
|
| 10 | +Unless required by applicable law or agreed to in writing, software |
| 11 | +distributed under the License is distributed on an "AS IS" BASIS, |
| 12 | +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 13 | +See the License for the specific language governing permissions and |
| 14 | +limitations under the License. |
| 15 | +*/ |
| 16 | + |
| 17 | +package v1alpha1 |
| 18 | + |
| 19 | +import ( |
| 20 | + "context" |
| 21 | + "reflect" |
| 22 | + |
| 23 | + "github.com/redhat-cop/vault-config-operator/api/v1alpha1/utils" |
| 24 | + vaultutils "github.com/redhat-cop/vault-config-operator/api/v1alpha1/utils" |
| 25 | + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
| 26 | + "sigs.k8s.io/controller-runtime/pkg/client" |
| 27 | +) |
| 28 | + |
| 29 | +// CertAuthEngineConfigSpec defines the desired state of CertAuthEngineConfig |
| 30 | +type CertAuthEngineConfigSpec struct { |
| 31 | + // Connection represents the information needed to connect to Vault. This operator uses the standard Vault environment variables to connect to Vault. If you need to override those settings and for example connect to a different Vault instance, you can do with this section of the CR. |
| 32 | + // +kubebuilder:validation:Optional |
| 33 | + Connection *vaultutils.VaultConnection `json:"connection,omitempty"` |
| 34 | + |
| 35 | + // Authentication is the kube auth configuration to be used to execute this request |
| 36 | + // +kubebuilder:validation:Required |
| 37 | + Authentication vaultutils.KubeAuthConfiguration `json:"authentication,omitempty"` |
| 38 | + |
| 39 | + // Path at which to make the configuration. |
| 40 | + // The final path in Vault will be {[spec.authentication.namespace]}/auth/{spec.path}/{metadata.name}/config. |
| 41 | + // The authentication role must have the following capabilities = [ "create", "read", "update", "delete"] on that path. |
| 42 | + // +kubebuilder:validation:Required |
| 43 | + Path vaultutils.Path `json:"path,omitempty"` |
| 44 | + |
| 45 | + // The name of the object created in Vault. If this is specified it takes precedence over {metatada.name} |
| 46 | + // +kubebuilder:validation:Optional |
| 47 | + // +kubebuilder:validation:Pattern:=`[a-z0-9]([-a-z0-9]*[a-z0-9])?` |
| 48 | + Name string `json:"name,omitempty"` |
| 49 | + |
| 50 | + // +kubebuilder:validation:Required |
| 51 | + CertAuthEngineConfigInternal `json:",inline"` |
| 52 | +} |
| 53 | + |
| 54 | +// CertAuthEngineConfigStatus defines the observed state of CertAuthEngineConfig |
| 55 | +type CertAuthEngineConfigStatus struct { |
| 56 | + // +patchMergeKey=type |
| 57 | + // +patchStrategy=merge |
| 58 | + // +listType=map |
| 59 | + // +listMapKey=type |
| 60 | + Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"` |
| 61 | +} |
| 62 | + |
| 63 | +//+kubebuilder:object:root=true |
| 64 | +//+kubebuilder:subresource:status |
| 65 | + |
| 66 | +// CertAuthEngineConfig is the Schema for the certauthengineconfigs API |
| 67 | +type CertAuthEngineConfig struct { |
| 68 | + metav1.TypeMeta `json:",inline"` |
| 69 | + metav1.ObjectMeta `json:"metadata,omitempty"` |
| 70 | + |
| 71 | + Spec CertAuthEngineConfigSpec `json:"spec,omitempty"` |
| 72 | + Status CertAuthEngineConfigStatus `json:"status,omitempty"` |
| 73 | +} |
| 74 | + |
| 75 | +//+kubebuilder:object:root=true |
| 76 | + |
| 77 | +// CertAuthEngineConfigList contains a list of CertAuthEngineConfig |
| 78 | +type CertAuthEngineConfigList struct { |
| 79 | + metav1.TypeMeta `json:",inline"` |
| 80 | + metav1.ListMeta `json:"metadata,omitempty"` |
| 81 | + Items []CertAuthEngineConfig `json:"items"` |
| 82 | +} |
| 83 | + |
| 84 | +type CertAuthEngineConfigInternal struct { |
| 85 | + // If set, during renewal, skips the matching of presented client identity with the client identity used during login. |
| 86 | + // +kubebuilder:validation:Optional |
| 87 | + // +kubebuilder:default:=false |
| 88 | + DisableBinding bool `json:"disableBinding,omitempty"` |
| 89 | + |
| 90 | + // If set, metadata of the certificate including the metadata corresponding to allowedMetadataExtensions will be stored in the alias. |
| 91 | + // +kubebuilder:validation:Optional |
| 92 | + // +kubebuilder:default:=false |
| 93 | + EnableIdentityAliasMetadata bool `json:"enableIdentityAliasMetadata,omitempty"` |
| 94 | + |
| 95 | + // The size of the OCSP response LRU cache. Note that this cache is used for all configured certificates. |
| 96 | + // +kubebuilder:validation:Optional |
| 97 | + // +kubebuilder:default:=100 |
| 98 | + OCSPCacheSize int `json:"ocspCacheSize,omitempty"` |
| 99 | + |
| 100 | + // The size of the role cache. Use -1 to disable role caching. |
| 101 | + // +kubebuilder:validation:Optional |
| 102 | + // +kubebuilder:default:=200 |
| 103 | + RoleCacheSize int `json:"roleCacheSize,omitempty"` |
| 104 | +} |
| 105 | + |
| 106 | +func (c *CertAuthEngineConfigInternal) toMap() map[string]any { |
| 107 | + payload := make(map[string]any) |
| 108 | + payload["disable_binding"] = c.DisableBinding |
| 109 | + payload["enable_identity_alias_metadata"] = c.EnableIdentityAliasMetadata |
| 110 | + payload["ocsp_cache_size"] = c.OCSPCacheSize |
| 111 | + payload["role_cache_size"] = c.RoleCacheSize |
| 112 | + |
| 113 | + return payload |
| 114 | +} |
| 115 | + |
| 116 | +var _ vaultutils.VaultObject = &CertAuthEngineConfig{} |
| 117 | +var _ vaultutils.ConditionsAware = &CertAuthEngineConfig{} |
| 118 | + |
| 119 | +func (r *CertAuthEngineConfig) GetPath() string { |
| 120 | + if r.Spec.Name != "" { |
| 121 | + return vaultutils.CleansePath("auth/" + string(r.Spec.Path) + "/" + r.Spec.Name + "/config") |
| 122 | + } |
| 123 | + |
| 124 | + return vaultutils.CleansePath("auth/" + string(r.Spec.Path) + "/" + r.Name + "/config") |
| 125 | +} |
| 126 | + |
| 127 | +func (r *CertAuthEngineConfig) GetPayload() map[string]interface{} { |
| 128 | + return r.Spec.CertAuthEngineConfigInternal.toMap() |
| 129 | +} |
| 130 | + |
| 131 | +// IsEquivalentToDesiredState returns wether the passed payload is equivalent to the payload that the current object would generate. When this is a engine object the tune payload will be compared |
| 132 | +func (r *CertAuthEngineConfig) IsEquivalentToDesiredState(payload map[string]interface{}) bool { |
| 133 | + desiredState := r.Spec.CertAuthEngineConfigInternal.toMap() |
| 134 | + |
| 135 | + return reflect.DeepEqual(desiredState, payload) |
| 136 | +} |
| 137 | + |
| 138 | +func (r *CertAuthEngineConfig) IsInitialized() bool { |
| 139 | + return true |
| 140 | +} |
| 141 | + |
| 142 | +func (r *CertAuthEngineConfig) IsValid() (bool, error) { |
| 143 | + return true, nil |
| 144 | +} |
| 145 | + |
| 146 | +func (r *CertAuthEngineConfig) IsDeletable() bool { |
| 147 | + return true |
| 148 | +} |
| 149 | + |
| 150 | +func (r *CertAuthEngineConfig) PrepareInternalValues(context context.Context, object client.Object) error { |
| 151 | + return nil |
| 152 | +} |
| 153 | + |
| 154 | +func (r *CertAuthEngineConfig) PrepareTLSConfig(context context.Context, object client.Object) error { |
| 155 | + return nil |
| 156 | +} |
| 157 | + |
| 158 | +func (r *CertAuthEngineConfig) GetKubeAuthConfiguration() *utils.KubeAuthConfiguration { |
| 159 | + return &r.Spec.Authentication |
| 160 | +} |
| 161 | + |
| 162 | +func (r *CertAuthEngineConfig) GetVaultConnection() *utils.VaultConnection { |
| 163 | + return r.Spec.Connection |
| 164 | +} |
| 165 | + |
| 166 | +func (r *CertAuthEngineConfig) GetConditions() []metav1.Condition { |
| 167 | + return r.Status.Conditions |
| 168 | +} |
| 169 | + |
| 170 | +func (r *CertAuthEngineConfig) SetConditions(conditions []metav1.Condition) { |
| 171 | + r.Status.Conditions = conditions |
| 172 | +} |
| 173 | + |
| 174 | +func init() { |
| 175 | + SchemeBuilder.Register(&CertAuthEngineConfig{}, &CertAuthEngineConfigList{}) |
| 176 | +} |
0 commit comments