Skip to content

Commit c247c2b

Browse files
sayan-biswassayan-biswas
committed
Feat: Add corporate certificates to Build APIs
Reference: shipwright-io/community#281 # Changes: - Added APIs to allow user to define custom Root CAs in Build and BuildRun APIs - Add unit tests Signed-off-by: Sayan Biswas <sabiswas@redhat.com>
1 parent 8d4e6e7 commit c247c2b

21 files changed

Lines changed: 1420 additions & 6 deletions

‎deploy/crds/shipwright.io_buildruns.yaml‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7598,6 +7598,59 @@ spec:
75987598
spec:
75997599
description: Spec refers to an embedded build specification
76007600
properties:
7601+
caBundle:
7602+
description: CABundle specifies the Secret or ConfigMap containing
7603+
CA certificates to be loaded in workload containers.
7604+
properties:
7605+
configMap:
7606+
description: configMap is a reference (by name) to a ConfigMap's
7607+
`data` key.
7608+
properties:
7609+
key:
7610+
description: Key of the entry in the object's `data`
7611+
field to be used.
7612+
maxLength: 253
7613+
minLength: 1
7614+
type: string
7615+
name:
7616+
description: Name is the name of the source object
7617+
in the trust namespace.
7618+
maxLength: 253
7619+
minLength: 1
7620+
type: string
7621+
required:
7622+
- key
7623+
- name
7624+
type: object
7625+
x-kubernetes-map-type: atomic
7626+
secret:
7627+
description: secret is a reference (by name) to a Secret's
7628+
`data` key.
7629+
properties:
7630+
key:
7631+
description: Key of the entry in the object's `data`
7632+
field to be used.
7633+
maxLength: 253
7634+
minLength: 1
7635+
type: string
7636+
name:
7637+
description: Name is the name of the source object
7638+
in the trust namespace.
7639+
maxLength: 253
7640+
minLength: 1
7641+
type: string
7642+
required:
7643+
- key
7644+
- name
7645+
type: object
7646+
x-kubernetes-map-type: atomic
7647+
type: object
7648+
x-kubernetes-map-type: atomic
7649+
x-kubernetes-validations:
7650+
- message: exactly one of the fields in [configMap secret]
7651+
must be set
7652+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
7653+
== 1'
76017654
env:
76027655
description: Env contains additional environment variables
76037656
that should be passed to the build container
@@ -10244,6 +10297,59 @@ spec:
1024410297
- strategy
1024510298
type: object
1024610299
type: object
10300+
caBundle:
10301+
description: CABundle specifies the Secret or ConfigMap containing
10302+
CA certificates to be loaded in workload containers.
10303+
properties:
10304+
configMap:
10305+
description: configMap is a reference (by name) to a ConfigMap's
10306+
`data` key.
10307+
properties:
10308+
key:
10309+
description: Key of the entry in the object's `data` field
10310+
to be used.
10311+
maxLength: 253
10312+
minLength: 1
10313+
type: string
10314+
name:
10315+
description: Name is the name of the source object in the
10316+
trust namespace.
10317+
maxLength: 253
10318+
minLength: 1
10319+
type: string
10320+
required:
10321+
- key
10322+
- name
10323+
type: object
10324+
x-kubernetes-map-type: atomic
10325+
secret:
10326+
description: secret is a reference (by name) to a Secret's `data`
10327+
key.
10328+
properties:
10329+
key:
10330+
description: Key of the entry in the object's `data` field
10331+
to be used.
10332+
maxLength: 253
10333+
minLength: 1
10334+
type: string
10335+
name:
10336+
description: Name is the name of the source object in the
10337+
trust namespace.
10338+
maxLength: 253
10339+
minLength: 1
10340+
type: string
10341+
required:
10342+
- key
10343+
- name
10344+
type: object
10345+
x-kubernetes-map-type: atomic
10346+
type: object
10347+
x-kubernetes-map-type: atomic
10348+
x-kubernetes-validations:
10349+
- message: exactly one of the fields in [configMap secret] must be
10350+
set
10351+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
10352+
== 1'
1024710353
env:
1024810354
description: Env contains additional environment variables that should
1024910355
be passed to the build container
@@ -12713,6 +12819,59 @@ spec:
1271312819
buildSpec:
1271412820
description: BuildSpec is the Build Spec of this BuildRun.
1271512821
properties:
12822+
caBundle:
12823+
description: CABundle specifies the Secret or ConfigMap containing
12824+
CA certificates to be loaded in workload containers.
12825+
properties:
12826+
configMap:
12827+
description: configMap is a reference (by name) to a ConfigMap's
12828+
`data` key.
12829+
properties:
12830+
key:
12831+
description: Key of the entry in the object's `data` field
12832+
to be used.
12833+
maxLength: 253
12834+
minLength: 1
12835+
type: string
12836+
name:
12837+
description: Name is the name of the source object in
12838+
the trust namespace.
12839+
maxLength: 253
12840+
minLength: 1
12841+
type: string
12842+
required:
12843+
- key
12844+
- name
12845+
type: object
12846+
x-kubernetes-map-type: atomic
12847+
secret:
12848+
description: secret is a reference (by name) to a Secret's
12849+
`data` key.
12850+
properties:
12851+
key:
12852+
description: Key of the entry in the object's `data` field
12853+
to be used.
12854+
maxLength: 253
12855+
minLength: 1
12856+
type: string
12857+
name:
12858+
description: Name is the name of the source object in
12859+
the trust namespace.
12860+
maxLength: 253
12861+
minLength: 1
12862+
type: string
12863+
required:
12864+
- key
12865+
- name
12866+
type: object
12867+
x-kubernetes-map-type: atomic
12868+
type: object
12869+
x-kubernetes-map-type: atomic
12870+
x-kubernetes-validations:
12871+
- message: exactly one of the fields in [configMap secret] must
12872+
be set
12873+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
12874+
== 1'
1271612875
env:
1271712876
description: Env contains additional environment variables that
1271812877
should be passed to the build container

‎deploy/crds/shipwright.io_builds.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2643,6 +2643,59 @@ spec:
26432643
spec:
26442644
description: BuildSpec defines the desired state of Build
26452645
properties:
2646+
caBundle:
2647+
description: CABundle specifies the Secret or ConfigMap containing
2648+
CA certificates to be loaded in workload containers.
2649+
properties:
2650+
configMap:
2651+
description: configMap is a reference (by name) to a ConfigMap's
2652+
`data` key.
2653+
properties:
2654+
key:
2655+
description: Key of the entry in the object's `data` field
2656+
to be used.
2657+
maxLength: 253
2658+
minLength: 1
2659+
type: string
2660+
name:
2661+
description: Name is the name of the source object in the
2662+
trust namespace.
2663+
maxLength: 253
2664+
minLength: 1
2665+
type: string
2666+
required:
2667+
- key
2668+
- name
2669+
type: object
2670+
x-kubernetes-map-type: atomic
2671+
secret:
2672+
description: secret is a reference (by name) to a Secret's `data`
2673+
key.
2674+
properties:
2675+
key:
2676+
description: Key of the entry in the object's `data` field
2677+
to be used.
2678+
maxLength: 253
2679+
minLength: 1
2680+
type: string
2681+
name:
2682+
description: Name is the name of the source object in the
2683+
trust namespace.
2684+
maxLength: 253
2685+
minLength: 1
2686+
type: string
2687+
required:
2688+
- key
2689+
- name
2690+
type: object
2691+
x-kubernetes-map-type: atomic
2692+
type: object
2693+
x-kubernetes-map-type: atomic
2694+
x-kubernetes-validations:
2695+
- message: exactly one of the fields in [configMap secret] must be
2696+
set
2697+
rule: '[has(self.configMap),has(self.secret)].filter(x,x==true).size()
2698+
== 1'
26462699
env:
26472700
description: Env contains additional environment variables that should
26482701
be passed to the build container

‎docs/build.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ SPDX-License-Identifier: Apache-2.0
2020
- [Defining the vulnerabilityScan](#defining-the-vulnerabilityscan)
2121
- [Defining Retention Parameters](#defining-retention-parameters)
2222
- [Defining Volumes](#defining-volumes)
23+
- [Defining CA Bundle](#defining-ca-bundle)
2324
- [Defining Step Resources](#defining-step-resources)
2425
- [Defining Triggers](#defining-triggers)
2526
- [GitHub](#github)
@@ -45,6 +46,7 @@ A `Build` resource allows the user to define:
4546
- tolerations
4647
- schedulerName
4748
- runtimeClassName
49+
- caBundle
4850

4951
A `Build` is available within a namespace.
5052

@@ -60,6 +62,7 @@ When the controller reconciles it:
6062
- Validates if the specified `paramValues` exist on the referenced strategy parameters. It also validates if the `paramValues` names collide with the Shipwright reserved names.
6163
- Validates if the container `registry` output secret exists.
6264
- Validates if the referenced `spec.source.git.url` endpoint exists.
65+
- Validates the Secret/ConfigMap referenced in the CA Bundle exists or not and also validates if the data in the referenced Secret/ConfigMap is a valid certificate authority.
6366

6467
## Build Validations
6568

@@ -108,6 +111,12 @@ To prevent users from triggering `BuildRun`s (_execution of a Build_) that will
108111
| NodeSelectorPlatformConflict | `spec.output.platforms` is set and `spec.nodeSelector` includes `kubernetes.io/os` or `kubernetes.io/arch`. |
109112
| ExecutorNotPipelineRun | *(BuildRun only)* Multi-arch output requires `PipelineRun` executor mode. |
110113
| NodePlatformNotFound | *(BuildRun only)* No schedulable node matches a requested platform (`kubernetes.io/os` / `kubernetes.io/arch`). |
114+
| NodeSelectorNotValid | The specified nodeSelector is not valid. |
115+
| TolerationNotValid | The specified tolerations are not valid. |
116+
| SchedulerNameNotValid | The specified schedulerName is not valid. |
117+
| RuntimeClassNameNotValid | The specified runtimeClassName is not valid. |
118+
| CABundleNotFound | Referenced ConfigMap/Secret does not exists. |
119+
| CABundleNotValid | The data in the referenced ConfigMap/Secret is not a valid certificate authority. |
111120

112121
## Configuring a Build
113122

@@ -144,6 +153,7 @@ The `Build` definition supports the following fields:
144153
- `spec.schedulerName` - Specifies the scheduler name for the build pod. If schedulerName is specified in both a `Build` and `BuildRun`, `BuildRun` values take precedence.
145154
- `spec.strategy.stepResources` - Allows overriding resource requirements (CPU, memory) for individual steps defined in the `BuildStrategy` or `ClusterBuildStrategy`. Each entry specifies a step name and the resources to use instead of those defined in the strategy. You can overwrite values in the `BuildRun`. See [Defining Step Resources](#defining-step-resources) for more information.
146155
- `spec.runtimeClassName` - Specifies the [RuntimeClass](https://kubernetes.io/docs/concepts/containers/runtime-class/) to be used for the build pod. If runtimeClassName is specified in both a `Build` and `BuildRun`, `BuildRun` values take precedence.
156+
- `spec.caBundle` - Specifies a CA Bundle that is mounted in all the workloads. Either `ConfigMap` or `Secret` can be referenced. The `Key` inside the referenced object also needs to be specified.
147157

148158
### Defining the Source
149159

@@ -788,6 +798,47 @@ spec:
788798

789799
See the related [BuildRun documentation](buildrun.md#defining-step-resources) for how to override step resources at the BuildRun level.
790800

801+
### Defining CA Bundle
802+
803+
Using the CA Bundle API, you can mount your own certificate authority, so that any program running in the build workload can use defined CA to establish mutual trust.
804+
805+
CA Bundle can be referenced from a `ConfigMap` or `Secret` in the build namespace.
806+
The `Key` to be used from referenced `ConfigMap` or `Secret` also needs to be defined.
807+
808+
The CA will be mounted in all the containers at the following locations
809+
- /etc/ssl/certs/ca-certificates.crt
810+
- /etc/pki/tls/certs/ca-bundle.crt
811+
812+
The following environment variables will be added in all the containers, with value `/etc/ssl/certs/ca-certificates.crt`
813+
- SSL_CERT_FILE - OS trust store
814+
- NODE_EXTRA_CA_CERTS - Node.js uses this to append additional certificates
815+
- REQUESTS_CA_BUNDLE - Python requests library
816+
- CURL_CA_BUNDLE - curl CA bundle
817+
818+
**Note**: If an environment is already defined, it will not be overwritten.
819+
820+
```yaml
821+
apiVersion: shipwright.io/v1beta1
822+
kind: Build
823+
metadata:
824+
name: buildah-build-with-ca
825+
spec:
826+
output:
827+
image: registry/namespace/image:latest
828+
source:
829+
contextDir: buildah
830+
git:
831+
url: https://gitea.com/admin/samples.git
832+
type: Git
833+
strategy:
834+
kind: ClusterBuildStrategy
835+
name: buildah
836+
caBundle:
837+
secret:
838+
name: ca-bundle
839+
key: ca.crt
840+
```
841+
791842
### Defining Triggers
792843

793844
Using the triggers, you can submit `BuildRun` instances when certain events happen. The idea is to be able to trigger Shipwright builds in an event driven fashion, for that purpose you can watch certain types of events.

0 commit comments

Comments
 (0)