User-facing migration to ClusterBundle

Signed-off-by: Erik Godding Boye <egboye@gmail.com>

Author: erikgb

cmd/trust-manager/app/app.go

@@ -33,6 +33,7 @@ import (
 
 	"github.com/cert-manager/trust-manager/cmd/trust-manager/app/options"
 	trustapi "github.com/cert-manager/trust-manager/pkg/apis/trust/v1alpha1"
+	trustmanagerapi "github.com/cert-manager/trust-manager/pkg/apis/trustmanager/v1alpha2"
 	"github.com/cert-manager/trust-manager/pkg/bundle"
 	"github.com/cert-manager/trust-manager/pkg/webhook"
 )
@@ -70,6 +71,7 @@ func NewCommand() *cobra.Command {
 			scheme := runtime.NewScheme()
 			utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 			utilruntime.Must(trustapi.AddToScheme(scheme))
+			utilruntime.Must(trustmanagerapi.AddToScheme(scheme))
 
 			mgr, err := ctrl.NewManager(opts.RestConfig, ctrl.Options{
 				Scheme:                        scheme,
@@ -113,7 +115,10 @@ func NewCommand() *cobra.Command {
 			// Register webhook handlers with manager.
 			log.Info("registering webhook endpoints")
 			if err := webhook.SetupWebhookWithManager(mgr); err != nil {
-				return fmt.Errorf("failed to register webhook: %w", err)
+				return fmt.Errorf("failed to register Bundle webhook: %w", err)
+			}
+			if err := (&webhook.ClusterBundle{}).SetupWebhookWithManager(mgr); err != nil {
+				return fmt.Errorf("failed to register ClusterBundle webhook: %w", err)
 			}
 
 			// Start all runnables and controller

deploy/charts/trust-manager/templates/clusterrole.yaml

@@ -36,6 +36,27 @@ rules:
   - "namespaces"
   verbs: ["get", "list", "watch"]
 
+- apiGroups:
+  - "trust-manager.io"
+  resources:
+  - "clusterbundles"
+  # The create and patch verbs are required as long as the migration controller is operating.
+  verbs: ["get", "list", "watch", "create", "patch"]
+
+# Permissions to update finalizers are required for trust-manager to work correctly
+# on OpenShift, even though we don't directly use finalizers at the time of writing
+- apiGroups:
+  - "trust-manager.io"
+  resources:
+  - "clusterbundles/finalizers"
+  verbs: ["update"]
+
+- apiGroups:
+  - "trust-manager.io"
+  resources:
+  - "clusterbundles/status"
+  verbs: ["patch"]
+
 {{- if not .Values.app.targetNamespaces }}
 {{ include "trust-manager.rbac.namespacedResourcesRules" . }}
 {{- end -}}

deploy/charts/trust-manager/templates/crd-trust-manager.io_clusterbundles.yaml

@@ -39,9 +39,12 @@ spec:
           jsonPath: .metadata.creationTimestamp
           name: Age
           type: date
+      deprecated: true
+      deprecationWarning: trust.cert-manager.io/v1alpha1 Bundle is deprecated, please migrate to trust-manager.io/v1alpha2 ClusterBundle
       name: v1alpha1
       schema:
         openAPIV3Schema:
+          description: 'Deprecated: v1alpha1.Bundle will be removed in a future release. Migrate to v1alpha2.ClusterBundle instead.'
           properties:
             apiVersion:
               description: |-

deploy/charts/trust-manager/templates/crd-trust.cert-manager.io_bundles.yaml

@@ -124,3 +124,26 @@ webhooks:
         name: {{ include "trust-manager.name" . }}
         namespace: {{ include "trust-manager.namespace" . }}
         path: /validate-trust-cert-manager-io-v1alpha1-bundle
+  - name: vclusterbundle-v1alpha2.trust-manager.io
+    rules:
+      - apiGroups:
+          - "trust-manager.io"
+        apiVersions:
+          - v1alpha2
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - clusterbundles
+    admissionReviewVersions: ["v1"]
+    timeoutSeconds: {{ .Values.app.webhook.timeoutSeconds }}
+    failurePolicy: Fail
+    sideEffects: None
+    clientConfig:
+{{ if .Values.app.webhook.tls.helmCert.enabled }}
+      caBundle: "{{ $ca.Cert | b64enc }}"
+{{ end }}
+      service:
+        name: {{ include "trust-manager.name" . }}
+        namespace: {{ include "trust-manager.namespace" . }}
+        path: /validate-trust-manager-io-v1alpha2-clusterbundle

deploy/charts/trust-manager/templates/webhook.yaml

@@ -35,9 +35,14 @@ spec:
       jsonPath: .metadata.creationTimestamp
       name: Age
       type: date
+    deprecated: true
+    deprecationWarning: trust.cert-manager.io/v1alpha1 Bundle is deprecated, please
+      migrate to trust-manager.io/v1alpha2 ClusterBundle
     name: v1alpha1
     schema:
       openAPIV3Schema:
+        description: 'Deprecated: v1alpha1.Bundle will be removed in a future release.
+          Migrate to v1alpha2.ClusterBundle instead.'
         properties:
           apiVersion:
             description: |-

deploy/crds/trust.cert-manager.io_bundles.yaml

@@ -58,8 +58,6 @@ oci_package_debian_bookworm_additional_layers += $(debian_bookworm_package_layer
 deploy_name := trust-manager
 deploy_namespace := cert-manager
 
-# Exclude new ClusterBundle API from Helm chart for now.
-crds_template_exclude_pattern := trust-manager.io_clusterbundles.yaml
 helm_chart_source_dir := deploy/charts/trust-manager
 helm_chart_image_name := quay.io/jetstack/charts/trust-manager
 helm_chart_version := $(VERSION)

make/00_mod.mk

@@ -26,6 +26,7 @@ var BundleLabelKey = "trust.cert-manager.io/bundle"
 var BundleHashAnnotationKey = "trust.cert-manager.io/hash"
 
 // +kubebuilder:object:root=true
+// +kubebuilder:deprecatedversion:warning="trust.cert-manager.io/v1alpha1 Bundle is deprecated, please migrate to trust-manager.io/v1alpha2 ClusterBundle"
 // +kubebuilder:printcolumn:name="ConfigMap Target",type="string",JSONPath=".spec.target.configMap.key",description="Bundle ConfigMap Target Key"
 // +kubebuilder:printcolumn:name="Secret Target",type="string",JSONPath=".spec.target.secret.key",description="Bundle Secret Target Key"
 // +kubebuilder:printcolumn:name="Synced",type="string",JSONPath=`.status.conditions[?(@.type == "Synced")].status`,description="Bundle has been synced"
@@ -36,6 +37,7 @@ var BundleHashAnnotationKey = "trust.cert-manager.io/hash"
 // +genclient
 // +genclient:nonNamespaced
 
+// Deprecated: v1alpha1.Bundle will be removed in a future release. Migrate to v1alpha2.ClusterBundle instead.
 type Bundle struct {
 	metav1.TypeMeta `json:",inline"`
 
@@ -54,6 +56,8 @@ type Bundle struct {
 }
 
 // +kubebuilder:object:root=true
+
+// Deprecated: v1alpha1.BundleList will be removed in one of the next releases. Migrate to v1alpha2.ClusterBundleList instead.
 type BundleList struct {
 	metav1.TypeMeta `json:",inline"`
 	metav1.ListMeta `json:"metadata"`

pkg/apis/trust/v1alpha1/types_bundle.go

@@ -36,6 +36,7 @@ import (
 	logf "sigs.k8s.io/controller-runtime/pkg/log"
 
 	trustapi "github.com/cert-manager/trust-manager/pkg/apis/trust/v1alpha1"
+	trustmanagerapi "github.com/cert-manager/trust-manager/pkg/apis/trustmanager/v1alpha2"
 	"github.com/cert-manager/trust-manager/pkg/bundle/controller"
 	"github.com/cert-manager/trust-manager/pkg/bundle/internal/source"
 	"github.com/cert-manager/trust-manager/pkg/bundle/internal/ssa_client"
@@ -83,12 +84,12 @@ func (b *bundle) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result,
 	return ctrl.Result{}, resultErr
 }
 
-func (b *bundle) reconcileBundle(ctx context.Context, req ctrl.Request) (statusPatch *trustapi.BundleStatus, returnedErr error) {
+func (b *bundle) reconcileBundle(ctx context.Context, req ctrl.Request) (statusPatch *trustmanagerapi.BundleStatus, returnedErr error) {
 	log := logf.FromContext(ctx).WithValues("bundle", req.NamespacedName.Name)
 	ctx = logf.IntoContext(ctx, log)
 	log.V(2).Info("syncing bundle")
 
-	var bundle trustapi.Bundle
+	var bundle trustmanagerapi.ClusterBundle
 	err := b.client.Get(ctx, req.NamespacedName, &bundle)
 	if apierrors.IsNotFound(err) {
 		log.V(2).Info("bundle no longer exists, ignoring")
@@ -102,10 +103,10 @@ func (b *bundle) reconcileBundle(ctx context.Context, req ctrl.Request) (statusP
 
 	// Initialize patch with current status field values, except conditions.
 	// This is done to ensure information is not lost in patch if exiting early.
-	statusPatch = &trustapi.BundleStatus{
+	statusPatch = &trustmanagerapi.BundleStatus{
 		DefaultCAPackageVersion: bundle.Status.DefaultCAPackageVersion,
 	}
-	resolvedBundle, err := b.bundleBuilder.BuildBundle(ctx, bundle.Spec.Sources)
+	resolvedBundle, err := b.bundleBuilder.BuildBundle(ctx, bundle.Spec)
 
 	if err != nil {
 		var reason, message string
@@ -222,7 +223,7 @@ func (b *bundle) reconcileBundle(ctx context.Context, req ctrl.Request) (statusP
 		}
 		err := b.targetReconciler.Cache.List(ctx, targetList, &client.ListOptions{
 			LabelSelector: labels.SelectorFromSet(map[string]string{
-				trustapi.BundleLabelKey: bundle.Name,
+				trustmanagerapi.BundleLabelKey: bundle.Name,
 			}),
 		})
 		if err != nil {
@@ -338,7 +339,7 @@ func (b *bundle) reconcileBundle(ctx context.Context, req ctrl.Request) (statusP
 	return statusPatch, nil
 }
 
-func (b *bundle) bundleTargetNamespaceSelector(bundleTarget trustapi.BundleTarget) (labels.Selector, error) {
+func (b *bundle) bundleTargetNamespaceSelector(bundleTarget trustmanagerapi.BundleTarget) (labels.Selector, error) {
 	nsSelector := bundleTarget.NamespaceSelector
 
 	// LabelSelectorAsSelector returns a Selector selecting nothing if LabelSelector is nil,