Skip to content

Commit 584410e

Browse files
sayan-biswassayan-biswas
committed
Feat: Add corporate certificates to Build APIs
Reference: shipwright-io/community#281 # Changes: - Added APIs to allow user to define custom Root CAs in Build and BuildRun APIs - Add unit tests Signed-off-by: Sayan Biswas <sabiswas@redhat.com>
1 parent 1dd7fd2 commit 584410e

15 files changed

Lines changed: 862 additions & 5 deletions

File tree

‎deploy/crds/shipwright.io_buildruns.yaml‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7544,6 +7544,55 @@ spec:
75447544
spec:
75457545
description: Spec refers to an embedded build specification
75467546
properties:
7547+
caBundle:
7548+
description: CABundle specifies the list certificates to be
7549+
loaded in workload containers.
7550+
properties:
7551+
configMap:
7552+
description: |-
7553+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
7554+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
7555+
properties:
7556+
key:
7557+
description: Key of the entry in the object's `data`
7558+
field to be used.
7559+
maxLength: 253
7560+
minLength: 1
7561+
type: string
7562+
name:
7563+
description: Name is the name of the source object
7564+
in the trust namespace.
7565+
maxLength: 253
7566+
minLength: 1
7567+
type: string
7568+
type: object
7569+
x-kubernetes-map-type: atomic
7570+
secret:
7571+
description: |-
7572+
secret is a reference (by name) to a Secret's `data` key(s), or to a
7573+
list of Secret's `data` key(s) using label selector, in the namespace.
7574+
properties:
7575+
key:
7576+
description: Key of the entry in the object's `data`
7577+
field to be used.
7578+
maxLength: 253
7579+
minLength: 1
7580+
type: string
7581+
name:
7582+
description: Name is the name of the source object
7583+
in the trust namespace.
7584+
maxLength: 253
7585+
minLength: 1
7586+
type: string
7587+
type: object
7588+
x-kubernetes-map-type: atomic
7589+
type: object
7590+
x-kubernetes-map-type: atomic
7591+
x-kubernetes-validations:
7592+
- message: exactly one of the fields in [configMap secret]
7593+
must be set
7594+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
7595+
== 1'
75477596
env:
75487597
description: Env contains additional environment variables
75497598
that should be passed to the build container
@@ -10143,6 +10192,55 @@ spec:
1014310192
- strategy
1014410193
type: object
1014510194
type: object
10195+
caBundle:
10196+
description: CABundle specifies the list certificates to be loaded
10197+
in workload containers.
10198+
properties:
10199+
configMap:
10200+
description: |-
10201+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
10202+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
10203+
properties:
10204+
key:
10205+
description: Key of the entry in the object's `data` field
10206+
to be used.
10207+
maxLength: 253
10208+
minLength: 1
10209+
type: string
10210+
name:
10211+
description: Name is the name of the source object in the
10212+
trust namespace.
10213+
maxLength: 253
10214+
minLength: 1
10215+
type: string
10216+
type: object
10217+
x-kubernetes-map-type: atomic
10218+
secret:
10219+
description: |-
10220+
secret is a reference (by name) to a Secret's `data` key(s), or to a
10221+
list of Secret's `data` key(s) using label selector, in the namespace.
10222+
properties:
10223+
key:
10224+
description: Key of the entry in the object's `data` field
10225+
to be used.
10226+
maxLength: 253
10227+
minLength: 1
10228+
type: string
10229+
name:
10230+
description: Name is the name of the source object in the
10231+
trust namespace.
10232+
maxLength: 253
10233+
minLength: 1
10234+
type: string
10235+
type: object
10236+
x-kubernetes-map-type: atomic
10237+
type: object
10238+
x-kubernetes-map-type: atomic
10239+
x-kubernetes-validations:
10240+
- message: exactly one of the fields in [configMap secret] must be
10241+
set
10242+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
10243+
== 1'
1014610244
env:
1014710245
description: Env contains additional environment variables that should
1014810246
be passed to the build container
@@ -12566,6 +12664,55 @@ spec:
1256612664
buildSpec:
1256712665
description: BuildSpec is the Build Spec of this BuildRun.
1256812666
properties:
12667+
caBundle:
12668+
description: CABundle specifies the list certificates to be loaded
12669+
in workload containers.
12670+
properties:
12671+
configMap:
12672+
description: |-
12673+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
12674+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
12675+
properties:
12676+
key:
12677+
description: Key of the entry in the object's `data` field
12678+
to be used.
12679+
maxLength: 253
12680+
minLength: 1
12681+
type: string
12682+
name:
12683+
description: Name is the name of the source object in
12684+
the trust namespace.
12685+
maxLength: 253
12686+
minLength: 1
12687+
type: string
12688+
type: object
12689+
x-kubernetes-map-type: atomic
12690+
secret:
12691+
description: |-
12692+
secret is a reference (by name) to a Secret's `data` key(s), or to a
12693+
list of Secret's `data` key(s) using label selector, in the namespace.
12694+
properties:
12695+
key:
12696+
description: Key of the entry in the object's `data` field
12697+
to be used.
12698+
maxLength: 253
12699+
minLength: 1
12700+
type: string
12701+
name:
12702+
description: Name is the name of the source object in
12703+
the trust namespace.
12704+
maxLength: 253
12705+
minLength: 1
12706+
type: string
12707+
type: object
12708+
x-kubernetes-map-type: atomic
12709+
type: object
12710+
x-kubernetes-map-type: atomic
12711+
x-kubernetes-validations:
12712+
- message: exactly one of the fields in [configMap secret] must
12713+
be set
12714+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
12715+
== 1'
1256912716
env:
1257012717
description: Env contains additional environment variables that
1257112718
should be passed to the build container

‎deploy/crds/shipwright.io_builds.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2625,6 +2625,55 @@ spec:
26252625
spec:
26262626
description: BuildSpec defines the desired state of Build
26272627
properties:
2628+
caBundle:
2629+
description: CABundle specifies the list certificates to be loaded
2630+
in workload containers.
2631+
properties:
2632+
configMap:
2633+
description: |-
2634+
configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
2635+
list of ConfigMap's `data` key(s) using label selector, in the namespace.
2636+
properties:
2637+
key:
2638+
description: Key of the entry in the object's `data` field
2639+
to be used.
2640+
maxLength: 253
2641+
minLength: 1
2642+
type: string
2643+
name:
2644+
description: Name is the name of the source object in the
2645+
trust namespace.
2646+
maxLength: 253
2647+
minLength: 1
2648+
type: string
2649+
type: object
2650+
x-kubernetes-map-type: atomic
2651+
secret:
2652+
description: |-
2653+
secret is a reference (by name) to a Secret's `data` key(s), or to a
2654+
list of Secret's `data` key(s) using label selector, in the namespace.
2655+
properties:
2656+
key:
2657+
description: Key of the entry in the object's `data` field
2658+
to be used.
2659+
maxLength: 253
2660+
minLength: 1
2661+
type: string
2662+
name:
2663+
description: Name is the name of the source object in the
2664+
trust namespace.
2665+
maxLength: 253
2666+
minLength: 1
2667+
type: string
2668+
type: object
2669+
x-kubernetes-map-type: atomic
2670+
type: object
2671+
x-kubernetes-map-type: atomic
2672+
x-kubernetes-validations:
2673+
- message: exactly one of the fields in [configMap secret] must be
2674+
set
2675+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
2676+
== 1'
26282677
env:
26292678
description: Env contains additional environment variables that should
26302679
be passed to the build container

‎pkg/apis/build/v1beta1/build_types.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,10 @@ const (
8989
RuntimeClassNameNotValid BuildReason = "RuntimeClassNameNotValid"
9090
// AllValidationsSucceeded indicates a Build was successfully validated
9191
AllValidationsSucceeded = "all validations succeeded"
92+
// CABundleNotFound indicates the referenced Secret or ConfigMap is missing
93+
CABundleNotFound BuildReason = "CABundleNotFound"
94+
// CABundleNotValid indicates the referenced Secret or ConfigMap is in valid
95+
CABundleNotValid BuildReason = "CABundleNotValid"
9296
)
9397

9498
// IgnoredVulnerabilitySeverity is an enum for the possible values for the ignored severity
@@ -205,6 +209,10 @@ type BuildSpec struct {
205209
// RuntimeClassName specifies the RuntimeClass to be used to run the Pod
206210
// +optional
207211
RuntimeClassName *string `json:"runtimeClassName,omitempty"`
212+
213+
// CABundle specifies the list certificates to be loaded in workload containers.
214+
// +optional
215+
CABundle *CABundle `json:"caBundle,omitempty"`
208216
}
209217

210218
// BuildVolume is a volume that will be mounted in build pod during build step

‎pkg/apis/build/v1beta1/buildrun_types.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,10 @@ type BuildRunSpec struct {
138138
// RuntimeClassName specifies the RuntimeClass to be used to run the Pod
139139
// +optional
140140
RuntimeClassName *string `json:"runtimeClassName,omitempty"`
141+
142+
// CABundle specifies the list certificates to be loaded in workload containers.
143+
// +optional
144+
CABundle *CABundle `json:"caBundle,omitempty"`
141145
}
142146

143147
// BuildRunRequestedState defines the buildrun state the user can provide to override whatever is the current state.

‎pkg/apis/build/v1beta1/cabundle.go‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// Copyright The Shipwright Contributors
2+
//
3+
// SPDX-License-Identifier: Apache-2.0
4+
package v1beta1
5+
6+
// CABundle is a set of sources whose data will be added to system trust bundle.
7+
// +structType=atomic
8+
// +kubebuilder:validation:ExactlyOneOf=configMap;secret
9+
type CABundle struct {
10+
// configMap is a reference (by name) to a ConfigMap's `data` key(s), or to a
11+
// list of ConfigMap's `data` key(s) using label selector, in the namespace.
12+
// +optional
13+
ConfigMap *SourceObjectKeySelector `json:"configMap,omitempty"`
14+
15+
// secret is a reference (by name) to a Secret's `data` key(s), or to a
16+
// list of Secret's `data` key(s) using label selector, in the namespace.
17+
// +optional
18+
Secret *SourceObjectKeySelector `json:"secret,omitempty"`
19+
}
20+
21+
// SourceObjectKeySelector is a reference to a source object and its `data` key(s)
22+
// in the trust namespace.
23+
// +structType=atomic
24+
type SourceObjectKeySelector struct {
25+
// Name is the name of the source object in the trust namespace.
26+
// +kubebuilder:validation:MinLength=1
27+
// +kubebuilder:validation:MaxLength=253
28+
Name string `json:"name,omitempty"`
29+
30+
// Key of the entry in the object's `data` field to be used.
31+
// +kubebuilder:validation:MinLength=1
32+
// +kubebuilder:validation:MaxLength=253
33+
Key string `json:"key,omitempty"`
34+
}

0 commit comments

Comments
 (0)