refactor: establish target.Reconciler

Signed-off-by: Erik Godding Boye <[email protected]>

docs/api/api.md

@@ -58,10 +58,19 @@ import "github.com/cert-manager/trust-manager/pkg/apis/trust/v1alpha1"
 
 ## Constants
 
-<a name="BundleConditionSynced"></a>
+<a name="DefaultJKSPassword"></a>
 
 ```go
 const (
+ // DefaultJKSPassword is the default password that Java uses; it's a Java convention to use this exact password.
+ // Since we're not storing anything secret in the JKS files we generate, this password is not a meaningful security measure
+ // but seems often to be expected by applications consuming JKS files
+ DefaultJKSPassword = "changeit"
+ // DefaultPKCS12Password is the empty string, that will create a password-less PKCS12 truststore.
+ // Password-less PKCS is the new default Java truststore from Java 18.
+ // By password-less, it means the certificates are not encrypted, and it contains no MacData for integrity check.
+ DefaultPKCS12Password = ""
+
  // BundleConditionSynced indicates that the Bundle has successfully synced
  // all source bundle data to the Bundle target in all Namespaces.
  BundleConditionSynced string = "Synced"

pkg/apis/trust/v1alpha1/types_bundle.go

@@ -239,6 +239,15 @@ type BundleCondition struct {
 }
 
 const (
+ // DefaultJKSPassword is the default password that Java uses; it's a Java convention to use this exact password.
+ // Since we're not storing anything secret in the JKS files we generate, this password is not a meaningful security measure
+ // but seems often to be expected by applications consuming JKS files
+ DefaultJKSPassword = "changeit"
+ // DefaultPKCS12Password is the empty string, that will create a password-less PKCS12 truststore.
+ // Password-less PKCS is the new default Java truststore from Java 18.
+ // By password-less, it means the certificates are not encrypted, and it contains no MacData for integrity check.
+ DefaultPKCS12Password = ""
+
  // BundleConditionSynced indicates that the Bundle has successfully synced
  // all source bundle data to the Bundle target in all Namespaces.
  BundleConditionSynced string = "Synced"

pkg/bundle/bundle.go

@@ -33,12 +33,12 @@ import (
  "k8s.io/client-go/tools/record"
  "k8s.io/client-go/util/csaupgrade"
  "k8s.io/utils/clock"
- "k8s.io/utils/ptr"
  ctrl "sigs.k8s.io/controller-runtime"
  "sigs.k8s.io/controller-runtime/pkg/client"
 
  trustapi "github.com/cert-manager/trust-manager/pkg/apis/trust/v1alpha1"
  "github.com/cert-manager/trust-manager/pkg/bundle/internal/ssa_client"
+ "github.com/cert-manager/trust-manager/pkg/bundle/internal/target"
  "github.com/cert-manager/trust-manager/pkg/fspkg"
 )
 
@@ -69,10 +69,6 @@ type bundle struct {
  // a cache-backed Kubernetes client
  client client.Client
 
- // targetCache is a cache.Cache that holds cached ConfigMap and Secret
- // resources that are used as targets for Bundles.
- targetCache client.Reader
-
  // defaultPackage holds the loaded 'default' certificate package, if one was specified
  // at startup.
  defaultPackage *fspkg.Package
@@ -86,9 +82,7 @@ type bundle struct {
  // Options holds options for the Bundle controller.
  Options
 
- // patchResourceOverwrite allows use to override the patchResource function
- // it is used for testing purposes
- patchResourceOverwrite func(ctx context.Context, obj interface{}) error
+ targetReconciler *target.Reconciler
 }
 
 // Reconcile is the top level function for reconciling over synced Bundles.
@@ -103,12 +97,7 @@ func (b *bundle) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result,
  return ctrl.Result{}, utilerrors.NewAggregate([]error{resultErr, err})
  }
 
- if err := b.client.Status().Patch(ctx, con, patch, &client.SubResourcePatchOptions{
- PatchOptions: client.PatchOptions{
- FieldManager: fieldManager,
- Force: ptr.To(true),
- },
- }); err != nil {
+ if err := b.client.Status().Patch(ctx, con, patch, ssa_client.FieldManager, client.ForceOwnership); err != nil {
  err = fmt.Errorf("failed to apply bundle status patch: %w", err)
  return ctrl.Result{}, utilerrors.NewAggregate([]error{resultErr, err})
  }
@@ -260,7 +249,7 @@ func (b *bundle) reconcileBundle(ctx context.Context, req ctrl.Request) (result
  Kind: string(kind),
  },
  }
- err := b.targetCache.List(ctx, targetList, &client.ListOptions{
+ err := b.targetReconciler.Cache.List(ctx, targetList, &client.ListOptions{
  LabelSelector: labels.SelectorFromSet(map[string]string{
  trustapi.BundleLabelKey: bundle.Name,
  }),
@@ -310,12 +299,12 @@ func (b *bundle) reconcileBundle(ctx context.Context, req ctrl.Request) (result
 
  if target.Kind == configMapTarget {
  syncFunc = func(targetLog logr.Logger, target targetResource, shouldExist bool) (bool, error) {
- return b.syncConfigMapTarget(ctx, targetLog, &bundle, target.Name, target.Namespace, resolvedBundle, shouldExist)
+ return b.targetReconciler.SyncConfigMap(ctx, targetLog, &bundle, target.NamespacedName, resolvedBundle.Data, shouldExist)
  }
  }
  if target.Kind == secretTarget {
  syncFunc = func(targetLog logr.Logger, target targetResource, shouldExist bool) (bool, error) {
- return b.syncSecretTarget(ctx, targetLog, &bundle, target.Name, target.Namespace, resolvedBundle, shouldExist)
+ return b.targetReconciler.SyncSecret(ctx, targetLog, &bundle, target.NamespacedName, resolvedBundle.Data, shouldExist)
  }
  }
 
@@ -394,7 +383,8 @@ func (b *bundle) bundleTargetNamespaceSelector(bundleObj *trustapi.Bundle) (labe
 // to ensure that the apply operations will also remove fields that were
 // created by the Update operation.
 func (b *bundle) migrateBundleStatusToApply(ctx context.Context, obj client.Object) (bool, error) {
- patch, err := csaupgrade.UpgradeManagedFieldsPatch(obj, sets.New(fieldManager, crRegressionFieldManager), fieldManager, csaupgrade.Subresource("status"))
+ fieldManager := string(ssa_client.FieldManager)
+ patch, err := csaupgrade.UpgradeManagedFieldsPatch(obj, sets.New(fieldManager, ssa_client.CRRegressionFieldManager), fieldManager, csaupgrade.Subresource("status"))
  if err != nil {
  return false, err
  }

pkg/bundle/bundle_test.go

@@ -40,6 +40,8 @@ import (
  fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
 
  trustapi "github.com/cert-manager/trust-manager/pkg/apis/trust/v1alpha1"
+ "github.com/cert-manager/trust-manager/pkg/bundle/internal/ssa_client"
+ "github.com/cert-manager/trust-manager/pkg/bundle/internal/target"
  "github.com/cert-manager/trust-manager/pkg/fspkg"
  "github.com/cert-manager/trust-manager/test/dummy"
  "github.com/cert-manager/trust-manager/test/gen"
@@ -48,7 +50,7 @@ import (
 func testEncodeJKS(t *testing.T, data string) []byte {
  t.Helper()
 
- encoded, err := jksEncoder{password: DefaultJKSPassword}.encode(data)
+ encoded, err := target.JKSEncoder{Password: trustapi.DefaultJKSPassword}.Encode(data)
  if err != nil {
  t.Error(err)
  }
@@ -210,7 +212,7 @@ func Test_Reconcile(t *testing.T) {
  Labels: baseBundleLabels,
  Annotations: annotations,
  OwnerReferences: baseBundleOwnerRef,
- ManagedFields: managedFieldEntries(dataEntries, binDataEntries),
+ ManagedFields: ssa_client.ManagedFieldEntries(dataEntries, binDataEntries),
  },
  Data: data,
  BinaryData: binData,
@@ -247,7 +249,7 @@ func Test_Reconcile(t *testing.T) {
  Labels: baseBundleLabels,
  Annotations: annotations,
  OwnerReferences: baseBundleOwnerRef,
- ManagedFields: managedFieldEntries(dataEntries, nil),
+ ManagedFields: ssa_client.ManagedFieldEntries(dataEntries, nil),
  },
  Data: binaryData,
  }
@@ -493,7 +495,7 @@ func Test_Reconcile(t *testing.T) {
  KeySelector: trustapi.KeySelector{
  Key: "target.jks",
  },
- Password: ptr.To(DefaultJKSPassword),
+ Password: ptr.To(trustapi.DefaultJKSPassword),
  },
  }),
  )},
@@ -566,7 +568,7 @@ func Test_Reconcile(t *testing.T) {
  KeySelector: trustapi.KeySelector{
  Key: "target.jks",
  },
- Password: ptr.To(DefaultJKSPassword),
+ Password: ptr.To(trustapi.DefaultJKSPassword),
  },
  }),
  ),
@@ -1304,22 +1306,25 @@ func Test_Reconcile(t *testing.T) {
 
  log, ctx := ktesting.NewTestContext(t)
  b := &bundle{
- client: fakeclient,
- targetCache: fakeclient,
- recorder: fakerecorder,
- clock: fixedclock,
+ client: fakeclient,
+ recorder: fakerecorder,
+ clock: fixedclock,
  Options: Options{
  Log: log,
  Namespace: trustNamespace,
  SecretTargetsEnabled: !test.disableSecretTargets,
  FilterExpiredCerts: true,
  },
- patchResourceOverwrite: func(ctx context.Context, obj interface{}) error {
- logMutex.Lock()
- defer logMutex.Unlock()
+ targetReconciler: &target.Reconciler{
+ Client: fakeclient,
+ Cache: fakeclient,
+ PatchResourceOverwrite: func(ctx context.Context, obj interface{}) error {
+ logMutex.Lock()
+ defer logMutex.Unlock()
 
- resourcePatches = append(resourcePatches, obj)
- return nil
+ resourcePatches = append(resourcePatches, obj)
+ return nil
+ },
  },
  }
 

pkg/bundle/controller.go

@@ -37,6 +37,7 @@ import (
  "sigs.k8s.io/controller-runtime/pkg/source"
 
  trustapi "github.com/cert-manager/trust-manager/pkg/apis/trust/v1alpha1"
+ "github.com/cert-manager/trust-manager/pkg/bundle/internal/target"
  "github.com/cert-manager/trust-manager/pkg/fspkg"
 )
 
@@ -52,11 +53,14 @@ func AddBundleController(
  targetCache cache.Cache,
 ) error {
  b := &bundle{
- client: mgr.GetClient(),
- targetCache: targetCache,
- recorder: mgr.GetEventRecorderFor("bundles"),
- clock: clock.RealClock{},
- Options: opts,
+ client: mgr.GetClient(),
+ recorder: mgr.GetEventRecorderFor("bundles"),
+ clock: clock.RealClock{},
+ Options: opts,
+ targetReconciler: &target.Reconciler{
+ Client: mgr.GetClient(),
+ Cache: targetCache,
+ },
  }
 
  if b.Options.DefaultPackageLocation != "" {

pkg/bundle/internal/ssa_client/patch.go

@@ -17,8 +17,19 @@ limitations under the License.
 package ssa_client
 
 import (
+ "k8s.io/apimachinery/pkg/apis/meta/v1"
  "k8s.io/apimachinery/pkg/types"
  "sigs.k8s.io/controller-runtime/pkg/client"
+ "sigs.k8s.io/structured-merge-diff/fieldpath"
+)
+
+const (
+ FieldManager = client.FieldOwner("trust-manager")
+ // CRRegressionFieldManager is the field manager that was introduced by a regression in controller-runtime
+ // version 0.15.0; fixed in 15.1 and 0.16.0: https://github.com/kubernetes-sigs/controller-runtime/pull/2435
+ // trust-manager 0.6.0 was released with this regression in controller-runtime, which means that we have to
+ // take extra care when migrating from CSA to SSA.
+ CRRegressionFieldManager = "Go-http-client"
 )
 
 type applyPatch struct {
@@ -34,3 +45,32 @@ func (p applyPatch) Data(_ client.Object) ([]byte, error) {
 func (p applyPatch) Type() types.PatchType {
  return types.ApplyPatchType
 }
+
+func ManagedFieldEntries(fields []string, dataFields []string) []v1.ManagedFieldsEntry {
+ fieldset := fieldpath.NewSet()
+ for _, property := range fields {
+ fieldset.Insert(
+ fieldpath.MakePathOrDie("data", property),
+ )
+ }
+ for _, property := range dataFields {
+ fieldset.Insert(
+ fieldpath.MakePathOrDie("binaryData", property),
+ )
+ }
+
+ jsonFieldSet, err := fieldset.ToJSON()
+ if err != nil {
+ panic(err)
+ }
+
+ return []v1.ManagedFieldsEntry{
+ {
+ Manager: "trust-manager",
+ Operation: v1.ManagedFieldsOperationApply,
+ FieldsV1: &v1.FieldsV1{
+ Raw: jsonFieldSet,
+ },
+ },
+ }
+}