- Adds enableMeshRootCertificate to featureFlag values

- Allows manager to set issuer ID
- Removes unnecessary newline

Signed-off-by: jaellio <[email protected]>

Author: jaellio

charts/osm/README.md

@@ -93,12 +93,11 @@ The following table lists the configurable parameters of the osm chart and their
 | osm.enableReconciler | bool | `false` | Enable reconciler for OSM's CRDs and mutating webhook |
 | osm.enforceSingleMesh | bool | `true` | Enforce only deploying one mesh in the cluster |
 | osm.envoyLogLevel | string | `"error"` | Log level for the Envoy proxy sidecar. Non developers should generally never set this value. In production environments the LogLevel should be set to `error` |
-| osm.experimental | object | `{"enableMeshRootCertificate":false}` | Experimental values. Behavior is not supported. |
-| osm.experimental.enableMeshRootCertificate | bool | `false` | Enable the MeshRootCertificate to configure the OSM certificate provider. |
 | osm.featureFlags.enableAsyncProxyServiceMapping | bool | `false` | Enable async proxy-service mapping |
 | osm.featureFlags.enableEgressPolicy | bool | `true` | Enable OSM's Egress policy API. When enabled, fine grained control over Egress (external) traffic is enforced |
 | osm.featureFlags.enableEnvoyActiveHealthChecks | bool | `false` | Enable Envoy active health checks |
 | osm.featureFlags.enableIngressBackendPolicy | bool | `true` | Enables OSM's IngressBackend policy API. When enabled, OSM will use the IngressBackend API allow ingress traffic to mesh backends |
+| osm.featureFlags.enableMeshRootCertificate | bool | `false` | Enable the MeshRootCertificate to configure the OSM certificate provider |
 | osm.featureFlags.enableRetryPolicy | bool | `false` | Enable Retry Policy for automatic request retries |
 | osm.featureFlags.enableSnapshotCacheMode | bool | `false` | Enables SnapshotCache feature for Envoy xDS server. |
 | osm.featureFlags.enableWASMStats | bool | `true` | Enable extra Envoy statistics generated by a custom WASM extension |

charts/osm/templates/osm-bootstrap-deployment.yaml

@@ -61,7 +61,7 @@ spec:
             "--osm-version", "{{ .Chart.AppVersion }}",
             "--ca-bundle-secret-name", "{{.Values.osm.caBundleSecretName}}",
             "--certificate-manager", "{{.Values.osm.certificateProvider.kind}}",
-            "--enable-mesh-root-certificate={{.Values.osm.experimental.enableMeshRootCertificate}}",
+            "--enable-mesh-root-certificate={{.Values.osm.featureFlags.enableMeshRootCertificate}}",
             {{ if eq .Values.osm.certificateProvider.kind "vault" }}
             "--vault-host", "{{.Values.osm.vault.host}}",
             "--vault-port", "{{.Values.osm.vault.port}}",

charts/osm/templates/osm-deployment.yaml

@@ -61,7 +61,7 @@ spec:
             "--validator-webhook-config", "{{ include "osm.validatorWebhookConfigName" . }}",
             "--ca-bundle-secret-name", "{{.Values.osm.caBundleSecretName}}",
             "--certificate-manager", "{{.Values.osm.certificateProvider.kind}}",
-            "--enable-mesh-root-certificate={{.Values.osm.experimental.enableMeshRootCertificate}}",
+            "--enable-mesh-root-certificate={{.Values.osm.featureFlags.enableMeshRootCertificate}}",
             {{ if eq .Values.osm.certificateProvider.kind "vault" }}
             "--vault-host", "{{ required "osm.vault.host is required when osm.certificateProvider.kind==vault" .Values.osm.vault.host }}",
             "--vault-port", "{{.Values.osm.vault.port}}",

charts/osm/templates/osm-injector-deployment.yaml

@@ -58,7 +58,7 @@ spec:
             "--webhook-timeout", "{{.Values.osm.injector.webhookTimeoutSeconds}}",
             "--ca-bundle-secret-name", "{{.Values.osm.caBundleSecretName}}",
             "--certificate-manager", "{{.Values.osm.certificateProvider.kind}}",
-            "--enable-mesh-root-certificate={{.Values.osm.experimental.enableMeshRootCertificate}}",
+            "--enable-mesh-root-certificate={{.Values.osm.featureFlags.enableMeshRootCertificate}}",
             {{ if eq .Values.osm.certificateProvider.kind "vault" }}
             "--vault-host", "{{.Values.osm.vault.host}}",
             "--vault-port", "{{.Values.osm.vault.port}}",

charts/osm/templates/preset-mesh-root-certificate.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.osm.experimental.enableMeshRootCertificate }}
+{{- if .Values.osm.featureFlags.enableMeshRootCertificate }}
 apiVersion: v1
 kind: ConfigMap
 metadata:

charts/osm/values.schema.json

@@ -438,24 +438,6 @@
                         "envoyproxy/envoy-windows:v1.22.1@sha256:92733f8e5beae5c45df204a0e13edbd29e99adf962d1b1c7869b197d85c64bd0"
                     ]
                 },
-                "experimental": {
-                    "$id": "#/properties/osm/properties/experimental",
-                    "type": "object",
-                    "title": "The experimental schema",
-                    "description": "Parameters that are unsupported by OSM",
-                    "additionalProperties": false,
-                    "properties": {
-                        "enableMeshRootCertificate": {
-                            "$id": "#/properties/osm/properties/experimental/properties/enableMeshRootCertificate",
-                            "type": "boolean",
-                            "title": "Enable the MeshRootCertificate",
-                            "description": "Using the MeshRootCertificate to configure the OSM certificate provider is not supported",
-                            "examples": [
-                                false
-                            ]
-                        }
-                    }
-                },
                 "trustDomain": {
                     "$id": "#/properties/osm/properties/trustDomain",
                     "type": "string",
@@ -1001,7 +983,8 @@
                         "enableIngressBackendPolicy",
                         "enableEnvoyActiveHealthChecks",
                         "enableSnapshotCacheMode",
-                        "enableRetryPolicy"
+                        "enableRetryPolicy",
+                        "enableMeshRootCertificate"
                     ],
                     "properties": {
                         "enableWASMStats": {
@@ -1066,6 +1049,15 @@
                             "examples": [
                                 true
                             ]
+                        },
+                        "enableMeshRootCertificate": {
+                            "$id": "#/properties/osm/properties/featureFlags/properties/enableMeshRootCertificate",
+                            "type": "boolean",
+                            "title": "Enable the MeshRootCertificate",
+                            "description": "Enable the MeshRootCertificate to configure the OSM certificate provider.",
+                            "examples": [
+                                false
+                            ]
                         }
                     },
                     "additionalProperties": false

charts/osm/values.yaml

@@ -167,11 +167,6 @@ osm:
     # The specified tolerations allow pods to schedule onto nodes with matching taints.
     tolerations: []
 
-  # -- Experimental values. Behavior is not supported.
-  experimental:
-    # -- Enable the MeshRootCertificate to configure the OSM certificate provider.
-    enableMeshRootCertificate: false
-
   # -- The trust domain to use as part of the common name when requesting new certificates.
   trustDomain: cluster.local
 
@@ -203,7 +198,6 @@ osm:
       # -- The Kubernetes secret key with the value bring the Vault token
       key: ""
 
-
   #
   # -- cert-manager.io configuration
   certmanager:
@@ -488,6 +482,8 @@ osm:
     enableSnapshotCacheMode: false
     # -- Enable Retry Policy for automatic request retries
     enableRetryPolicy: false
+    # -- Enable the MeshRootCertificate to configure the OSM certificate provider
+    enableMeshRootCertificate: false
 
   # -- Node tolerations applied to control plane pods.
   # The specified tolerations allow pods to schedule onto nodes with matching taints.

pkg/certificate/fake_manager.go

@@ -20,8 +20,8 @@ var (
 
 type fakeMRCClient struct{}
 
-func (c *fakeMRCClient) GetCertIssuerForMRC(mrc *v1alpha2.MeshRootCertificate) (Issuer, pem.RootCertificate, string, error) {
-	return &fakeIssuer{}, pem.RootCertificate("rootCA"), "fake-issuer-1", nil
+func (c *fakeMRCClient) GetCertIssuerForMRC(mrc *v1alpha2.MeshRootCertificate) (Issuer, pem.RootCertificate, error) {
+	return &fakeIssuer{}, pem.RootCertificate("rootCA"), nil
 }
 
 // List returns the single, pre-generated MRC. It is intended to implement the certificate.MRCClient interface.

pkg/certificate/manager.go

@@ -121,12 +121,12 @@ func (m *Manager) handleMRCEvent(mrcClient MRCClient, event MRCEvent) error {
 			return nil
 		}
 
-		client, ca, clientID, err := mrcClient.GetCertIssuerForMRC(mrc)
+		client, ca, err := mrcClient.GetCertIssuerForMRC(mrc)
 		if err != nil {
 			return err
 		}
 
-		c := &issuer{Issuer: client, ID: clientID, CertificateAuthority: ca}
+		c := &issuer{Issuer: client, ID: mrc.Name, CertificateAuthority: ca}
 		switch {
 		case mrc.Status.State == constants.MRCStateActive:
 			m.mu.Lock()

pkg/certificate/providers/config.go

@@ -103,36 +103,35 @@ func NewCertificateManagerFromMRC(ctx context.Context, kubeClient kubernetes.Int
 }
 
 // GetCertIssuerForMRC returns a certificate.Issuer generated from the provided MRC.
-func (c *MRCProviderGenerator) GetCertIssuerForMRC(mrc *v1alpha2.MeshRootCertificate) (certificate.Issuer, pem.RootCertificate, string, error) {
+func (c *MRCProviderGenerator) GetCertIssuerForMRC(mrc *v1alpha2.MeshRootCertificate) (certificate.Issuer, pem.RootCertificate, error) {
 	p := mrc.Spec.Provider
 	var issuer certificate.Issuer
-	var id string
 	var err error
 	switch {
 	case p.Tresor != nil:
-		issuer, id, err = c.getTresorOSMCertificateManager(mrc)
+		issuer, err = c.getTresorOSMCertificateManager(mrc)
 	case p.Vault != nil:
-		issuer, id, err = c.getHashiVaultOSMCertificateManager(mrc)
+		issuer, err = c.getHashiVaultOSMCertificateManager(mrc)
 	case p.CertManager != nil:
-		issuer, id, err = c.getCertManagerOSMCertificateManager(mrc)
+		issuer, err = c.getCertManagerOSMCertificateManager(mrc)
 	default:
-		return nil, nil, "", fmt.Errorf("Unknown certificate provider: %+v", p)
+		return nil, nil, fmt.Errorf("Unknown certificate provider: %+v", p)
 	}
 
 	if err != nil {
-		return nil, nil, "", err
+		return nil, nil, err
 	}
 
 	ca, err := c.caExtractorFunc(issuer)
 	if err != nil {
-		return nil, nil, "", fmt.Errorf("error generating init cert: %w", err)
+		return nil, nil, fmt.Errorf("error generating init cert: %w", err)
 	}
 
-	return issuer, ca, id, nil
+	return issuer, ca, nil
 }
 
 // getTresorOSMCertificateManager returns a certificate manager instance with Tresor as the certificate provider
-func (c *MRCProviderGenerator) getTresorOSMCertificateManager(mrc *v1alpha2.MeshRootCertificate) (certificate.Issuer, string, error) {
+func (c *MRCProviderGenerator) getTresorOSMCertificateManager(mrc *v1alpha2.MeshRootCertificate) (certificate.Issuer, error) {
 	var err error
 	var rootCert *certificate.Certificate
 
@@ -142,20 +141,20 @@ func (c *MRCProviderGenerator) getTresorOSMCertificateManager(mrc *v1alpha2.Mesh
 	// Regardless of success or failure, all instances can proceed to load the same CA.
 	rootCert, err = tresor.NewCA(constants.CertificationAuthorityCommonName, constants.CertificationAuthorityRootValidityPeriod, rootCertCountry, rootCertLocality, rootCertOrganization)
 	if err != nil {
-		return nil, "", errors.New("Failed to create new Certificate Authority with cert issuer tresor")
+		return nil, errors.New("Failed to create new Certificate Authority with cert issuer tresor")
 	}
 
 	if rootCert.GetPrivateKey() == nil {
-		return nil, "", errors.New("Root cert does not have a private key")
+		return nil, errors.New("Root cert does not have a private key")
 	}
 
 	rootCert, err = k8s.GetCertificateFromSecret(mrc.Namespace, mrc.Spec.Provider.Tresor.CA.SecretRef.Name, rootCert, c.kubeClient)
 	if err != nil {
-		return nil, "", fmt.Errorf("Failed to synchronize certificate on Secrets API : %w", err)
+		return nil, fmt.Errorf("Failed to synchronize certificate on Secrets API : %w", err)
 	}
 
 	if rootCert.GetPrivateKey() == nil {
-		return nil, "", fmt.Errorf("Root cert does not have a private key: %w", certificate.ErrInvalidCertSecret)
+		return nil, fmt.Errorf("Root cert does not have a private key: %w", certificate.ErrInvalidCertSecret)
 	}
 
 	tresorClient, err := tresor.New(
@@ -164,14 +163,14 @@ func (c *MRCProviderGenerator) getTresorOSMCertificateManager(mrc *v1alpha2.Mesh
 		c.KeyBitSize,
 	)
 	if err != nil {
-		return nil, "", fmt.Errorf("failed to instantiate Tresor as a Certificate Manager: %w", err)
+		return nil, fmt.Errorf("failed to instantiate Tresor as a Certificate Manager: %w", err)
 	}
 
-	return tresorClient, mrc.Name, nil
+	return tresorClient, nil
 }
 
 // getHashiVaultOSMCertificateManager returns a certificate manager instance with Hashi Vault as the certificate provider
-func (c *MRCProviderGenerator) getHashiVaultOSMCertificateManager(mrc *v1alpha2.MeshRootCertificate) (certificate.Issuer, string, error) {
+func (c *MRCProviderGenerator) getHashiVaultOSMCertificateManager(mrc *v1alpha2.MeshRootCertificate) (certificate.Issuer, error) {
 	provider := mrc.Spec.Provider.Vault
 
 	// A Vault address would have the following shape: "http://vault.default.svc.cluster.local:8200"
@@ -184,7 +183,7 @@ func (c *MRCProviderGenerator) getHashiVaultOSMCertificateManager(mrc *v1alpha2.
 		log.Debug().Msgf("Attempting to get Vault token from secret %s", provider.Token.SecretKeyRef.Name)
 		vaultToken, err = getHashiVaultOSMToken(&provider.Token.SecretKeyRef, c.kubeClient)
 		if err != nil {
-			return nil, "", err
+			return nil, err
 		}
 	}
 
@@ -194,10 +193,10 @@ func (c *MRCProviderGenerator) getHashiVaultOSMCertificateManager(mrc *v1alpha2.
 		provider.Role,
 	)
 	if err != nil {
-		return nil, "", fmt.Errorf("error instantiating Hashicorp Vault as a Certificate Manager: %w", err)
+		return nil, fmt.Errorf("error instantiating Hashicorp Vault as a Certificate Manager: %w", err)
 	}
 
-	return vaultClient, mrc.Name, nil
+	return vaultClient, nil
 }
 
 // getHashiVaultOSMToken returns the Hashi Vault token from the secret specified in the provided secret key reference
@@ -216,11 +215,11 @@ func getHashiVaultOSMToken(secretKeyRef *v1alpha2.SecretKeyReferenceSpec, kubeCl
 }
 
 // getCertManagerOSMCertificateManager returns a certificate manager instance with cert-manager as the certificate provider
-func (c *MRCProviderGenerator) getCertManagerOSMCertificateManager(mrc *v1alpha2.MeshRootCertificate) (certificate.Issuer, string, error) {
+func (c *MRCProviderGenerator) getCertManagerOSMCertificateManager(mrc *v1alpha2.MeshRootCertificate) (certificate.Issuer, error) {
 	provider := mrc.Spec.Provider.CertManager
 	client, err := cmversionedclient.NewForConfig(c.kubeConfig)
 	if err != nil {
-		return nil, "", fmt.Errorf("Failed to build cert-manager client set: %s", err)
+		return nil, fmt.Errorf("Failed to build cert-manager client set: %s", err)
 	}
 
 	cmClient, err := certmanager.New(
@@ -234,8 +233,8 @@ func (c *MRCProviderGenerator) getCertManagerOSMCertificateManager(mrc *v1alpha2
 		c.KeyBitSize,
 	)
 	if err != nil {
-		return nil, "", fmt.Errorf("error instantiating Jetstack cert-manager client: %w", err)
+		return nil, fmt.Errorf("error instantiating Jetstack cert-manager client: %w", err)
 	}
 
-	return cmClient, mrc.Name, nil
+	return cmClient, nil
 }

pkg/certificate/providers/tresor/fake/fake.go

@@ -22,15 +22,15 @@ const (
 
 type fakeMRCClient struct{}
 
-func (c *fakeMRCClient) GetCertIssuerForMRC(mrc *v1alpha2.MeshRootCertificate) (certificate.Issuer, pem.RootCertificate, string, error) {
+func (c *fakeMRCClient) GetCertIssuerForMRC(mrc *v1alpha2.MeshRootCertificate) (certificate.Issuer, pem.RootCertificate, error) {
 	rootCertCountry := "US"
 	rootCertLocality := "CA"
 	ca, err := tresor.NewCA("Fake Tresor CN", 1*time.Hour, rootCertCountry, rootCertLocality, rootCertOrganization)
 	if err != nil {
-		return nil, nil, "", err
+		return nil, nil, err
 	}
 	issuer, err := tresor.New(ca, rootCertOrganization, 2048)
-	return issuer, pem.RootCertificate("rootCA"), "issuer-1", err
+	return issuer, pem.RootCertificate("rootCA"), err
 }
 
 // List returns the single, pre-generated MRC. It is intended to implement the certificate.MRCClient interface.

pkg/certificate/types.go

@@ -123,7 +123,7 @@ type MRCClient interface {
 	MRCEventBroker
 
 	// GetCertIssuerForMRC returns an Issuer based on the provided MRC.
-	GetCertIssuerForMRC(mrc *v1alpha2.MeshRootCertificate) (Issuer, pem.RootCertificate, string, error)
+	GetCertIssuerForMRC(mrc *v1alpha2.MeshRootCertificate) (Issuer, pem.RootCertificate, error)
 }
 
 // MRCEventType is a type alias for a string describing the type of MRC event