Skip to content

Commit 57586d0

Browse files
sayan-biswassayan-biswas
committed
Feat: Add corporate certificates to Build APIs
Reference: shipwright-io/community#281 # Changes: - Added APIs to allow user to define custom Root CAs in Build and BuildRun APIs - Add unit tests Signed-off-by: Sayan Biswas <sabiswas@redhat.com>
1 parent 1dd7fd2 commit 57586d0

20 files changed

Lines changed: 1323 additions & 53 deletions

‎deploy/crds/shipwright.io_buildruns.yaml‎

Lines changed: 149 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,11 @@
1+
---
12
apiVersion: apiextensions.k8s.io/v1
23
kind: CustomResourceDefinition
34
metadata:
45
annotations:
5-
controller-gen.kubebuilder.io/version: v0.19.0
6+
controller-gen.kubebuilder.io/version: v0.20.1
67
name: buildruns.shipwright.io
78
spec:
8-
conversion:
9-
strategy: Webhook
10-
webhook:
11-
clientConfig:
12-
service:
13-
name: shp-build-webhook
14-
namespace: shipwright-build
15-
path: /convert
16-
conversionReviewVersions:
17-
- v1
189
group: shipwright.io
1910
names:
2011
kind: BuildRun
@@ -7544,6 +7535,55 @@ spec:
75447535
spec:
75457536
description: Spec refers to an embedded build specification
75467537
properties:
7538+
caBundle:
7539+
description: CABundle specifies the list certificates to be
7540+
loaded in workload containers.
7541+
properties:
7542+
configMap:
7543+
description: |-
7544+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
7545+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
7546+
properties:
7547+
key:
7548+
description: Key of the entry in the object's `data`
7549+
field to be used.
7550+
maxLength: 253
7551+
minLength: 1
7552+
type: string
7553+
name:
7554+
description: Name is the name of the source object
7555+
in the trust namespace.
7556+
maxLength: 253
7557+
minLength: 1
7558+
type: string
7559+
type: object
7560+
x-kubernetes-map-type: atomic
7561+
secret:
7562+
description: |-
7563+
secret is a reference (by name) to a Secret's `data` key(s), or to a
7564+
list of Secret's `data` key(s) using label selector, in the namespace.
7565+
properties:
7566+
key:
7567+
description: Key of the entry in the object's `data`
7568+
field to be used.
7569+
maxLength: 253
7570+
minLength: 1
7571+
type: string
7572+
name:
7573+
description: Name is the name of the source object
7574+
in the trust namespace.
7575+
maxLength: 253
7576+
minLength: 1
7577+
type: string
7578+
type: object
7579+
x-kubernetes-map-type: atomic
7580+
type: object
7581+
x-kubernetes-map-type: atomic
7582+
x-kubernetes-validations:
7583+
- message: exactly one of the fields in [configMap secret]
7584+
must be set
7585+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
7586+
== 1'
75477587
env:
75487588
description: Env contains additional environment variables
75497589
that should be passed to the build container
@@ -10143,6 +10183,55 @@ spec:
1014310183
- strategy
1014410184
type: object
1014510185
type: object
10186+
caBundle:
10187+
description: CABundle specifies the list certificates to be loaded
10188+
in workload containers.
10189+
properties:
10190+
configMap:
10191+
description: |-
10192+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
10193+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
10194+
properties:
10195+
key:
10196+
description: Key of the entry in the object's `data` field
10197+
to be used.
10198+
maxLength: 253
10199+
minLength: 1
10200+
type: string
10201+
name:
10202+
description: Name is the name of the source object in the
10203+
trust namespace.
10204+
maxLength: 253
10205+
minLength: 1
10206+
type: string
10207+
type: object
10208+
x-kubernetes-map-type: atomic
10209+
secret:
10210+
description: |-
10211+
secret is a reference (by name) to a Secret's `data` key(s), or to a
10212+
list of Secret's `data` key(s) using label selector, in the namespace.
10213+
properties:
10214+
key:
10215+
description: Key of the entry in the object's `data` field
10216+
to be used.
10217+
maxLength: 253
10218+
minLength: 1
10219+
type: string
10220+
name:
10221+
description: Name is the name of the source object in the
10222+
trust namespace.
10223+
maxLength: 253
10224+
minLength: 1
10225+
type: string
10226+
type: object
10227+
x-kubernetes-map-type: atomic
10228+
type: object
10229+
x-kubernetes-map-type: atomic
10230+
x-kubernetes-validations:
10231+
- message: exactly one of the fields in [configMap secret] must be
10232+
set
10233+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
10234+
== 1'
1014610235
env:
1014710236
description: Env contains additional environment variables that should
1014810237
be passed to the build container
@@ -12566,6 +12655,55 @@ spec:
1256612655
buildSpec:
1256712656
description: BuildSpec is the Build Spec of this BuildRun.
1256812657
properties:
12658+
caBundle:
12659+
description: CABundle specifies the list certificates to be loaded
12660+
in workload containers.
12661+
properties:
12662+
configMap:
12663+
description: |-
12664+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
12665+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
12666+
properties:
12667+
key:
12668+
description: Key of the entry in the object's `data` field
12669+
to be used.
12670+
maxLength: 253
12671+
minLength: 1
12672+
type: string
12673+
name:
12674+
description: Name is the name of the source object in
12675+
the trust namespace.
12676+
maxLength: 253
12677+
minLength: 1
12678+
type: string
12679+
type: object
12680+
x-kubernetes-map-type: atomic
12681+
secret:
12682+
description: |-
12683+
secret is a reference (by name) to a Secret's `data` key(s), or to a
12684+
list of Secret's `data` key(s) using label selector, in the namespace.
12685+
properties:
12686+
key:
12687+
description: Key of the entry in the object's `data` field
12688+
to be used.
12689+
maxLength: 253
12690+
minLength: 1
12691+
type: string
12692+
name:
12693+
description: Name is the name of the source object in
12694+
the trust namespace.
12695+
maxLength: 253
12696+
minLength: 1
12697+
type: string
12698+
type: object
12699+
x-kubernetes-map-type: atomic
12700+
type: object
12701+
x-kubernetes-map-type: atomic
12702+
x-kubernetes-validations:
12703+
- message: exactly one of the fields in [configMap secret] must
12704+
be set
12705+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
12706+
== 1'
1256912707
env:
1257012708
description: Env contains additional environment variables that
1257112709
should be passed to the build container
@@ -15309,4 +15447,3 @@ spec:
1530915447
storage: true
1531015448
subresources:
1531115449
status: {}
15312-

‎deploy/crds/shipwright.io_builds.yaml‎

Lines changed: 51 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,11 @@
1+
---
12
apiVersion: apiextensions.k8s.io/v1
23
kind: CustomResourceDefinition
34
metadata:
45
annotations:
5-
controller-gen.kubebuilder.io/version: v0.19.0
6+
controller-gen.kubebuilder.io/version: v0.20.1
67
name: builds.shipwright.io
78
spec:
8-
conversion:
9-
strategy: Webhook
10-
webhook:
11-
clientConfig:
12-
service:
13-
name: shp-build-webhook
14-
namespace: shipwright-build
15-
path: /convert
16-
conversionReviewVersions:
17-
- v1
189
group: shipwright.io
1910
names:
2011
kind: Build
@@ -2625,6 +2616,55 @@ spec:
26252616
spec:
26262617
description: BuildSpec defines the desired state of Build
26272618
properties:
2619+
caBundle:
2620+
description: CABundle specifies the list certificates to be loaded
2621+
in workload containers.
2622+
properties:
2623+
configMap:
2624+
description: |-
2625+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
2626+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
2627+
properties:
2628+
key:
2629+
description: Key of the entry in the object's `data` field
2630+
to be used.
2631+
maxLength: 253
2632+
minLength: 1
2633+
type: string
2634+
name:
2635+
description: Name is the name of the source object in the
2636+
trust namespace.
2637+
maxLength: 253
2638+
minLength: 1
2639+
type: string
2640+
type: object
2641+
x-kubernetes-map-type: atomic
2642+
secret:
2643+
description: |-
2644+
secret is a reference (by name) to a Secret's `data` key(s), or to a
2645+
list of Secret's `data` key(s) using label selector, in the namespace.
2646+
properties:
2647+
key:
2648+
description: Key of the entry in the object's `data` field
2649+
to be used.
2650+
maxLength: 253
2651+
minLength: 1
2652+
type: string
2653+
name:
2654+
description: Name is the name of the source object in the
2655+
trust namespace.
2656+
maxLength: 253
2657+
minLength: 1
2658+
type: string
2659+
type: object
2660+
x-kubernetes-map-type: atomic
2661+
type: object
2662+
x-kubernetes-map-type: atomic
2663+
x-kubernetes-validations:
2664+
- message: exactly one of the fields in [configMap secret] must be
2665+
set
2666+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
2667+
== 1'
26282668
env:
26292669
description: Env contains additional environment variables that should
26302670
be passed to the build container
@@ -5226,4 +5266,3 @@ spec:
52265266
storage: true
52275267
subresources:
52285268
status: {}
5229-

‎deploy/crds/shipwright.io_buildstrategies.yaml‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,11 @@
1+
---
12
apiVersion: apiextensions.k8s.io/v1
23
kind: CustomResourceDefinition
34
metadata:
45
annotations:
5-
controller-gen.kubebuilder.io/version: v0.19.0
6+
controller-gen.kubebuilder.io/version: v0.20.1
67
name: buildstrategies.shipwright.io
78
spec:
8-
conversion:
9-
strategy: Webhook
10-
webhook:
11-
clientConfig:
12-
service:
13-
name: shp-build-webhook
14-
namespace: shipwright-build
15-
path: /convert
16-
conversionReviewVersions:
17-
- v1
189
group: shipwright.io
1910
names:
2011
kind: BuildStrategy
@@ -6072,4 +6063,3 @@ spec:
60726063
storage: true
60736064
subresources:
60746065
status: {}
6075-

‎deploy/crds/shipwright.io_clusterbuildstrategies.yaml‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,11 @@
1+
---
12
apiVersion: apiextensions.k8s.io/v1
23
kind: CustomResourceDefinition
34
metadata:
45
annotations:
5-
controller-gen.kubebuilder.io/version: v0.19.0
6+
controller-gen.kubebuilder.io/version: v0.20.1
67
name: clusterbuildstrategies.shipwright.io
78
spec:
8-
conversion:
9-
strategy: Webhook
10-
webhook:
11-
clientConfig:
12-
service:
13-
name: shp-build-webhook
14-
namespace: shipwright-build
15-
path: /convert
16-
conversionReviewVersions:
17-
- v1
189
group: shipwright.io
1910
names:
2011
kind: ClusterBuildStrategy
@@ -6072,4 +6063,3 @@ spec:
60726063
storage: true
60736064
subresources:
60746065
status: {}
6075-

‎pkg/apis/build/v1beta1/build_types.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,10 @@ const (
8989
RuntimeClassNameNotValid BuildReason = "RuntimeClassNameNotValid"
9090
// AllValidationsSucceeded indicates a Build was successfully validated
9191
AllValidationsSucceeded = "all validations succeeded"
92+
// CABundleNotFound indicates the referenced Secret or ConfigMap is missing
93+
CABundleNotFound BuildReason = "CABundleNotFound"
94+
// CABundleNotValid indicates the referenced Secret or ConfigMap is in valid
95+
CABundleNotValid BuildReason = "CABundleNotValid"
9296
)
9397

9498
// IgnoredVulnerabilitySeverity is an enum for the possible values for the ignored severity
@@ -205,6 +209,10 @@ type BuildSpec struct {
205209
// RuntimeClassName specifies the RuntimeClass to be used to run the Pod
206210
// +optional
207211
RuntimeClassName *string `json:"runtimeClassName,omitempty"`
212+
213+
// CABundle specifies the list certificates to be loaded in workload containers.
214+
// +optional
215+
CABundle *CABundle `json:"caBundle,omitempty"`
208216
}
209217

210218
// BuildVolume is a volume that will be mounted in build pod during build step

‎pkg/apis/build/v1beta1/buildrun_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,10 @@ type BuildRunSpec struct {
138138
// RuntimeClassName specifies the RuntimeClass to be used to run the Pod
139139
// +optional
140140
RuntimeClassName *string `json:"runtimeClassName,omitempty"`
141+
142+
// CABundle specifies the list certificates to be loaded in workload containers.
143+
// +optional
144+
CABundle *CABundle `json:"caBundle,omitempty"`
141145
}
142146

143147
// BuildRunRequestedState defines the buildrun state the user can provide to override whatever is the current state.

0 commit comments

Comments
 (0)