Skip to content

Commit aa47789

Browse files
robertgraeffrobertgraeff
committed
feat: extend config and create pull secrets
1 parent 11f157b commit aa47789

File tree

8 files changed

+114
-15
lines changed

8 files changed

+114
-15
lines changed

‎api/crds/manifests/gateway.openmcp.cloud_gatewayserviceconfigs.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,21 @@ spec:
9393
chart:
9494
description: Chart configuration for Envoy Gateway.
9595
properties:
96+
secretRef:
97+
description: |-
98+
SecretRef specifies the Secret containing authentication credentials
99+
for the OCIRepository.
100+
For HTTP/S basic auth the secret must contain 'username' and 'password'
101+
fields.
102+
Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'
103+
keys is deprecated. Please use `.spec.certSecretRef` instead.
104+
properties:
105+
name:
106+
description: Name of the referent.
107+
type: string
108+
required:
109+
- name
110+
type: object
96111
tag:
97112
description: 'Tag of the chart. Example: 1.5.4'
98113
minLength: 1
@@ -112,6 +127,21 @@ spec:
112127
gateway:
113128
description: 'EnvoyGateway image. Example: docker.io/envoyproxy/gateway:v1.5.1'
114129
type: string
130+
imagePullSecrets:
131+
description: |-
132+
ImagePullSecrets specifies the Secrets containing authentication credentials
133+
for the Envoy Gateway deployment.
134+
items:
135+
description: LocalObjectReference contains enough information
136+
to locate the referenced Kubernetes resource object.
137+
properties:
138+
name:
139+
description: Name of the referent.
140+
type: string
141+
required:
142+
- name
143+
type: object
144+
type: array
115145
proxy:
116146
description: 'EnvoyProxy image. Example: docker.io/envoyproxy/envoy:distroless-v1.35.3'
117147
type: string

‎api/gateway/v1alpha1/config_types.go‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package v1alpha1
22

33
import (
4+
"github.com/fluxcd/pkg/apis/meta"
45
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
56
)
67

@@ -60,6 +61,15 @@ type EnvoyGatewayChart struct {
6061
// +kubebuilder:validation:Required
6162
// +kubebuilder:validation:MinLength=1
6263
Tag string `json:"tag"`
64+
65+
// SecretRef specifies the Secret containing authentication credentials
66+
// for the OCIRepository.
67+
// For HTTP/S basic auth the secret must contain 'username' and 'password'
68+
// fields.
69+
// Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile'
70+
// keys is deprecated. Please use `.spec.certSecretRef` instead.
71+
// +optional
72+
SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`
6373
}
6474

6575
type ImagesConfig struct {
@@ -71,6 +81,11 @@ type ImagesConfig struct {
7181

7282
// Ratelimit image. Example: docker.io/envoyproxy/ratelimit:e74a664a
7383
Ratelimit string `json:"rateLimit"`
84+
85+
// ImagePullSecrets specifies the Secrets containing authentication credentials
86+
// for the Envoy Gateway deployment.
87+
// +optional
88+
ImagePullSecrets []meta.LocalObjectReference `json:"imagePullSecrets,omitempty"`
7489
}
7590

7691
type DNSConfig struct {

‎api/gateway/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 13 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ module github.com/openmcp-project/platform-service-gateway/api
33
go 1.25.3
44

55
require (
6+
github.com/fluxcd/pkg/apis/meta v1.22.0
67
github.com/openmcp-project/controller-utils v0.23.3
78
github.com/openmcp-project/openmcp-operator/api v0.16.0
89
k8s.io/apiextensions-apiserver v0.34.1

‎api/go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ github.com/evanphx/json-patch v4.12.0+incompatible h1:4onqiflcdA9EOZ4RxV643DvftH
1414
github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
1515
github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
1616
github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
17+
github.com/fluxcd/pkg/apis/meta v1.22.0 h1:EHWQH5ZWml7i8eZ/AMjm1jxid3j/PQ31p+hIwCt6crM=
18+
github.com/fluxcd/pkg/apis/meta v1.22.0/go.mod h1:Kc1+bWe5p0doROzuV9XiTfV/oL3ddsemYXt8ZYWdVVg=
1719
github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
1820
github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
1921
github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=

‎internal/controllers/cluster/controller.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -231,7 +231,6 @@ func (r *ClusterReconciler) buildGatewayManager(ctx context.Context, req reconci
231231
DNSConfig: r.Config.Spec.DNS,
232232
PlatformClient: r.PlatformCluster.Client(),
233233
ClusterClient: access.Client(),
234-
PullSecrets: []corev1.LocalObjectReference{}, // TODO
235234
FluxKubeconfig: &fluxmeta.KubeConfigReference{
236235
SecretRef: &fluxmeta.SecretKeyReference{
237236
Name: ar.Status.SecretRef.Name,

‎pkg/envoy/config.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66
"fmt"
77
"time"
88

9-
"github.com/openmcp-project/platform-service-gateway/pkg/utils"
109
corev1 "k8s.io/api/core/v1"
1110
apierrors "k8s.io/apimachinery/pkg/api/errors"
1211
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -16,6 +15,8 @@ import (
1615
"sigs.k8s.io/controller-runtime/pkg/client"
1716
"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
1817
gatewayv1 "sigs.k8s.io/gateway-api/apis/v1"
18+
19+
"github.com/openmcp-project/platform-service-gateway/pkg/utils"
1920
)
2021

2122
var (
@@ -163,7 +164,7 @@ func (g *Gateway) reconcileEnvoyProxyFunc(obj *unstructured.Unstructured) func()
163164
"envoyDeployment": map[string]any{
164165
"container": container,
165166
"pod": map[string]any{
166-
"imagePullSecrets": g.PullSecrets,
167+
"imagePullSecrets": g.EnvoyConfig.Images.ImagePullSecrets,
167168
},
168169
},
169170
},

‎pkg/envoy/deployment.go‎

Lines changed: 50 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -33,25 +33,29 @@ type Gateway struct {
3333
DNSConfig v1alpha1.DNSConfig
3434
PlatformClient client.Client
3535
ClusterClient client.Client
36-
PullSecrets []corev1.LocalObjectReference
3736
FluxKubeconfig *fluxmeta.KubeConfigReference
3837
}
3938

4039
func (g *Gateway) InstallOrUpdate(ctx context.Context) error {
4140
repo := g.getRepo()
4241
helmRelease := g.getHelmRelease()
4342

43+
imagePullSecretOps := g.ensureSecrets(ctx, deploymentNamespace)
44+
4445
ops := []applyOperation{
4546
ensureNamespace(deploymentNamespace, g.ClusterClient),
46-
{
47+
}
48+
ops = append(ops, imagePullSecretOps...)
49+
ops = append(ops,
50+
applyOperation{
4751
obj: repo,
4852
f: g.reconcileOCIRepositoryFunc(repo),
4953
},
50-
{
54+
applyOperation{
5155
obj: helmRelease,
5256
f: g.reconcileHelmReleaseFunc(repo.Name, helmRelease),
5357
},
54-
}
58+
)
5559

5660
return createOrUpdate(ctx, g.PlatformClient, ops...)
5761
}
@@ -93,11 +97,7 @@ func (g *Gateway) reconcileOCIRepositoryFunc(obj *sourcev1.OCIRepository) func()
9397
Tag: g.EnvoyConfig.Chart.Tag,
9498
}
9599

96-
if len(g.PullSecrets) > 0 {
97-
obj.Spec.SecretRef = &fluxmeta.LocalObjectReference{
98-
Name: g.PullSecrets[0].Name,
99-
}
100-
}
100+
obj.Spec.SecretRef = g.EnvoyConfig.Chart.SecretRef
101101

102102
return nil
103103
}
@@ -136,6 +136,46 @@ func (g *Gateway) reconcileHelmReleaseFunc(repoName string, obj *helmv2.HelmRele
136136
}
137137
}
138138

139+
func (g *Gateway) reconcileSecretFunc(ctx context.Context, obj *corev1.Secret) func() error {
140+
return func() error {
141+
sourceSecret := &corev1.Secret{}
142+
sourceKey := client.ObjectKey{
143+
Namespace: g.Cluster.Namespace,
144+
Name: obj.Name,
145+
}
146+
if err := g.PlatformClient.Get(ctx, sourceKey, sourceSecret); err != nil {
147+
return fmt.Errorf("failed to get secret %s: %w", sourceKey, err)
148+
}
149+
150+
obj.Data = sourceSecret.Data
151+
obj.Type = sourceSecret.Type
152+
return nil
153+
}
154+
}
155+
156+
func (g *Gateway) ensureSecrets(ctx context.Context, targetNamespace string) []applyOperation {
157+
if g.EnvoyConfig.Images == nil || len(g.EnvoyConfig.Images.ImagePullSecrets) == 0 {
158+
return nil
159+
}
160+
161+
ops := make([]applyOperation, len(g.EnvoyConfig.Images.ImagePullSecrets))
162+
for i, imagePullSecret := range g.EnvoyConfig.Images.ImagePullSecrets {
163+
obj := &corev1.Secret{
164+
ObjectMeta: metav1.ObjectMeta{
165+
Name: imagePullSecret.Name,
166+
Namespace: targetNamespace,
167+
},
168+
}
169+
ops[i] = applyOperation{
170+
obj: obj,
171+
f: g.reconcileSecretFunc(ctx, obj),
172+
c: g.ClusterClient,
173+
}
174+
}
175+
176+
return ops
177+
}
178+
139179
func (g *Gateway) generateHelmValuesJSON() (*apiextensionsv1.JSON, error) {
140180
values := g.generateHelmValues()
141181
raw, err := json.Marshal(values)
@@ -160,7 +200,7 @@ func (g *Gateway) generateHelmValues() map[string]any {
160200
return map[string]any{
161201
"global": map[string]any{
162202
"images": images,
163-
"imagePullSecrets": g.PullSecrets,
203+
"imagePullSecrets": g.EnvoyConfig.Images.ImagePullSecrets,
164204
},
165205
}
166206
}

0 commit comments

Comments
 (0)