feat(operator): enable specifying custom acme authority for subdomains (#1634)

* feat: enable specifying custom acme authority for subdomains * test: none authority * chore: use latest ORBOS * chore: use latest ORBOS * test: host tls secret is unmanaged if not provided * chore: use latest ORBOS * chore: use latest ORBOS * fix: default acme authority to "none" * chore: use latest ORBOS * chore: compile with latest ORBOS
2026-10-30 19:12:16 +00:00 · 2021-04-28 11:00:56 +02:00
parent fd3ac0dbd6
commit fe4f6a963e
13 changed files with 95 additions and 127 deletions
@@ -58,6 +58,10 @@ func AdaptFunc(
 		}
 		desired.Parsed = desiredKind

+		if err := desiredKind.Spec.validate(); err != nil {
+			return nil, nil, nil, nil, nil, false, err
+		}
+
 		allSecrets, allExisting := getSecretsMap(desiredKind)

 		if !monitor.IsVerbose() && desiredKind.Spec.Verbose {
@@ -66,11 +66,15 @@ func AdaptFunc(
 			consoleDomain := dns.Subdomains.Console + "." + dns.Domain
 			issuerDomain := dns.Subdomains.Issuer + "." + dns.Domain
 			originCASecretName := dns.TlsSecret
+			authority := dns.ACMEAuthority
+			if authority == "" {
+				authority = "none"
+			}

 			accountsSelector := map[string]string{
 				"hostname": accountsDomain,
 			}
-			queryAccounts, err := host.AdaptFuncToEnsure(namespace, AccountsHostName, labels.MustForNameK8SMap(componentLabels, AccountsHostName), accountsDomain, "none", "", accountsSelector, originCASecretName)
+			queryAccounts, err := host.AdaptFuncToEnsure(namespace, AccountsHostName, labels.MustForNameK8SMap(componentLabels, AccountsHostName), accountsDomain, authority, "", accountsSelector, originCASecretName)
 			if err != nil {
 				return nil, err
 			}
@@ -78,7 +82,7 @@ func AdaptFunc(
 			apiSelector := map[string]string{
 				"hostname": apiDomain,
 			}
-			queryAPI, err := host.AdaptFuncToEnsure(namespace, ApiHostName, labels.MustForNameK8SMap(componentLabels, ApiHostName), apiDomain, "none", "", apiSelector, originCASecretName)
+			queryAPI, err := host.AdaptFuncToEnsure(namespace, ApiHostName, labels.MustForNameK8SMap(componentLabels, ApiHostName), apiDomain, authority, "", apiSelector, originCASecretName)
 			if err != nil {
 				return nil, err
 			}
@@ -86,7 +90,7 @@ func AdaptFunc(
 			consoleSelector := map[string]string{
 				"hostname": consoleDomain,
 			}
-			queryConsole, err := host.AdaptFuncToEnsure(namespace, ConsoleHostName, labels.MustForNameK8SMap(componentLabels, ConsoleHostName), consoleDomain, "none", "", consoleSelector, originCASecretName)
+			queryConsole, err := host.AdaptFuncToEnsure(namespace, ConsoleHostName, labels.MustForNameK8SMap(componentLabels, ConsoleHostName), consoleDomain, authority, "", consoleSelector, originCASecretName)
 			if err != nil {
 				return nil, err
 			}
@@ -94,7 +98,7 @@ func AdaptFunc(
 			issuerSelector := map[string]string{
 				"hostname": issuerDomain,
 			}
-			queryIssuer, err := host.AdaptFuncToEnsure(namespace, IssuerHostName, labels.MustForNameK8SMap(componentLabels, IssuerHostName), issuerDomain, "none", "", issuerSelector, originCASecretName)
+			queryIssuer, err := host.AdaptFuncToEnsure(namespace, IssuerHostName, labels.MustForNameK8SMap(componentLabels, IssuerHostName), issuerDomain, authority, "", issuerSelector, originCASecretName)
 			if err != nil {
 				return nil, err
 			}
@@ -1,10 +1,11 @@
 package hosts

 import (
+	"testing"
+
 	"github.com/caos/orbos/mntr"
 	"github.com/caos/zitadel/operator/zitadel/kinds/iam/zitadel/configuration"
 	"github.com/stretchr/testify/assert"
-	"testing"

 	kubernetesmock "github.com/caos/orbos/pkg/kubernetes/mock"
 	"github.com/caos/orbos/pkg/labels"
@@ -46,6 +47,7 @@ func TestHosts_AdaptFunc(t *testing.T) {
 			Console:  "",
 			Issuer:   "",
 		},
+		ACMEAuthority: "none",
 	}

 	componentLabels := mocklabels.Component
@@ -66,7 +68,7 @@ func TestHosts_AdaptFunc(t *testing.T) {
 			"metadata": map[string]interface{}{
 				"name":      issuerHostName.Name(),
 				"namespace": namespace,
-				"labels":    labels.MustK8sMap(issuerHostName),
+				"labels":    toMapOfInterfaces(labels.MustK8sMap(issuerHostName)),
 				"annotations": map[string]interface{}{
 					"aes_res_changed": "true",
 				},
@@ -76,7 +78,7 @@ func TestHosts_AdaptFunc(t *testing.T) {
 				"acmeProvider": map[string]interface{}{
 					"authority": "none",
 				},
-				"ambassador_id": []string{
+				"ambassador_id": []interface{}{
 					"default",
 				},
 				"selector": map[string]interface{}{
@@ -84,9 +86,6 @@ func TestHosts_AdaptFunc(t *testing.T) {
 						"hostname": ".",
 					},
 				},
-				"tlsSecret": map[string]interface{}{
-					"name": "",
-				},
 			},
 		}}

@@ -101,7 +100,7 @@ func TestHosts_AdaptFunc(t *testing.T) {
 			"metadata": map[string]interface{}{
 				"name":      consoleHostName.Name(),
 				"namespace": namespace,
-				"labels":    labels.MustK8sMap(consoleHostName),
+				"labels":    toMapOfInterfaces(labels.MustK8sMap(consoleHostName)),
 				"annotations": map[string]interface{}{
 					"aes_res_changed": "true",
 				},
@@ -111,7 +110,7 @@ func TestHosts_AdaptFunc(t *testing.T) {
 				"acmeProvider": map[string]interface{}{
 					"authority": "none",
 				},
-				"ambassador_id": []string{
+				"ambassador_id": []interface{}{
 					"default",
 				},
 				"selector": map[string]interface{}{
@@ -119,9 +118,6 @@ func TestHosts_AdaptFunc(t *testing.T) {
 						"hostname": ".",
 					},
 				},
-				"tlsSecret": map[string]interface{}{
-					"name": "",
-				},
 			},
 		}}

@@ -136,7 +132,7 @@ func TestHosts_AdaptFunc(t *testing.T) {
 			"metadata": map[string]interface{}{
 				"name":      apiHostName.Name(),
 				"namespace": namespace,
-				"labels":    labels.MustK8sMap(apiHostName),
+				"labels":    toMapOfInterfaces(labels.MustK8sMap(apiHostName)),
 				"annotations": map[string]interface{}{
 					"aes_res_changed": "true",
 				},
@@ -146,7 +142,7 @@ func TestHosts_AdaptFunc(t *testing.T) {
 				"acmeProvider": map[string]interface{}{
 					"authority": "none",
 				},
-				"ambassador_id": []string{
+				"ambassador_id": []interface{}{
 					"default",
 				},
 				"selector": map[string]interface{}{
@@ -154,9 +150,6 @@ func TestHosts_AdaptFunc(t *testing.T) {
 						"hostname": ".",
 					},
 				},
-				"tlsSecret": map[string]interface{}{
-					"name": "",
-				},
 			},
 		}}

@@ -171,7 +164,7 @@ func TestHosts_AdaptFunc(t *testing.T) {
 			"metadata": map[string]interface{}{
 				"name":      accountsHostName.Name(),
 				"namespace": namespace,
-				"labels":    labels.MustK8sMap(accountsHostName),
+				"labels":    toMapOfInterfaces(labels.MustK8sMap(accountsHostName)),
 				"annotations": map[string]interface{}{
 					"aes_res_changed": "true",
 				},
@@ -181,7 +174,7 @@ func TestHosts_AdaptFunc(t *testing.T) {
 				"acmeProvider": map[string]interface{}{
 					"authority": "none",
 				},
-				"ambassador_id": []string{
+				"ambassador_id": []interface{}{
 					"default",
 				},
 				"selector": map[string]interface{}{
@@ -189,9 +182,6 @@ func TestHosts_AdaptFunc(t *testing.T) {
 						"hostname": ".",
 					},
 				},
-				"tlsSecret": map[string]interface{}{
-					"name": "",
-				},
 			},
 		}}

@@ -218,6 +208,7 @@ func TestHosts_AdaptFunc2(t *testing.T) {
 			Console:  "console",
 			Issuer:   "issuer",
 		},
+		ACMEAuthority: "none",
 	}

 	componentLabels := mocklabels.Component
@@ -238,7 +229,7 @@ func TestHosts_AdaptFunc2(t *testing.T) {
 			"metadata": map[string]interface{}{
 				"name":      issuerHostName.Name(),
 				"namespace": namespace,
-				"labels":    labels.MustK8sMap(issuerHostName),
+				"labels":    toMapOfInterfaces(labels.MustK8sMap(issuerHostName)),
 				"annotations": map[string]interface{}{
 					"aes_res_changed": "true",
 				},
@@ -248,7 +239,7 @@ func TestHosts_AdaptFunc2(t *testing.T) {
 				"acmeProvider": map[string]interface{}{
 					"authority": "none",
 				},
-				"ambassador_id": []string{
+				"ambassador_id": []interface{}{
 					"default",
 				},
 				"selector": map[string]interface{}{
@@ -273,7 +264,7 @@ func TestHosts_AdaptFunc2(t *testing.T) {
 			"metadata": map[string]interface{}{
 				"name":      consoleHostName.Name(),
 				"namespace": namespace,
-				"labels":    labels.MustK8sMap(consoleHostName),
+				"labels":    toMapOfInterfaces(labels.MustK8sMap(consoleHostName)),
 				"annotations": map[string]interface{}{
 					"aes_res_changed": "true",
 				},
@@ -283,7 +274,7 @@ func TestHosts_AdaptFunc2(t *testing.T) {
 				"acmeProvider": map[string]interface{}{
 					"authority": "none",
 				},
-				"ambassador_id": []string{
+				"ambassador_id": []interface{}{
 					"default",
 				},
 				"selector": map[string]interface{}{
@@ -308,7 +299,7 @@ func TestHosts_AdaptFunc2(t *testing.T) {
 			"metadata": map[string]interface{}{
 				"name":      apiHostName.Name(),
 				"namespace": namespace,
-				"labels":    labels.MustK8sMap(apiHostName),
+				"labels":    toMapOfInterfaces(labels.MustK8sMap(apiHostName)),
 				"annotations": map[string]interface{}{
 					"aes_res_changed": "true",
 				},
@@ -318,7 +309,7 @@ func TestHosts_AdaptFunc2(t *testing.T) {
 				"acmeProvider": map[string]interface{}{
 					"authority": "none",
 				},
-				"ambassador_id": []string{
+				"ambassador_id": []interface{}{
 					"default",
 				},
 				"selector": map[string]interface{}{
@@ -343,7 +334,7 @@ func TestHosts_AdaptFunc2(t *testing.T) {
 			"metadata": map[string]interface{}{
 				"name":      accountsHostName.Name(),
 				"namespace": namespace,
-				"labels":    labels.MustK8sMap(accountsHostName),
+				"labels":    toMapOfInterfaces(labels.MustK8sMap(accountsHostName)),
 				"annotations": map[string]interface{}{
 					"aes_res_changed": "true",
 				},
@@ -353,7 +344,7 @@ func TestHosts_AdaptFunc2(t *testing.T) {
 				"acmeProvider": map[string]interface{}{
 					"authority": "none",
 				},
-				"ambassador_id": []string{
+				"ambassador_id": []interface{}{
 					"default",
 				},
 				"selector": map[string]interface{}{
@@ -377,3 +368,11 @@ func TestHosts_AdaptFunc2(t *testing.T) {
 	assert.NoError(t, err)
 	assert.NoError(t, ensure(k8sClient))
 }
+
+func toMapOfInterfaces(m map[string]string) map[string]interface{} {
+	interfaces := make(map[string]interface{})
+	for k, v := range m {
+		interfaces[k] = v
+	}
+	return interfaces
+}
@@ -1,6 +1,11 @@
 package configuration

-import "github.com/caos/orbos/pkg/secret"
+import (
+	"errors"
+	"fmt"
+
+	"github.com/caos/orbos/pkg/secret"
+)

 type Configuration struct {
 	Tracing             *Tracing       `yaml:"tracing,omitempty"`
@@ -15,10 +20,35 @@ type Configuration struct {
 	ClusterDNS          string         `yaml:"clusterdns"`
 }

+func (c *Configuration) Validate() (err error) {
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("validating configuration failed: %w", err)
+		}
+	}()
+
+	return c.DNS.validate()
+}
+
 type DNS struct {
-	Domain     string      `yaml:"domain"`
-	TlsSecret  string      `yaml:"tlsSecret"`
-	Subdomains *Subdomains `yaml:"subdomains"`
+	Domain        string      `yaml:"domain"`
+	TlsSecret     string      `yaml:"tlsSecret"`
+	ACMEAuthority string      `yaml:"acmeAuthority"`
+	Subdomains    *Subdomains `yaml:"subdomains"`
+}
+
+func (d *DNS) validate() (err error) {
+
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("validating dns failed: %w", err)
+		}
+	}()
+
+	if d.TlsSecret != "" && d.ACMEAuthority != "none" && d.ACMEAuthority != "" {
+		return errors.New("if tls secret is provided, acme authority must be 'none'")
+	}
+	return nil
 }

 type Subdomains struct {
@@ -1,6 +1,8 @@
 package zitadel

 import (
+	"fmt"
+
 	"github.com/caos/orbos/pkg/kubernetes/k8s"
 	"github.com/caos/orbos/pkg/tree"
 	"github.com/caos/zitadel/operator/zitadel/kinds/iam/zitadel/configuration"
@@ -24,6 +26,16 @@ type Spec struct {
 	Resources     *k8s.Resources               `yaml:"resources,omitempty"`
 }

+func (s *Spec) validate() (err error) {
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("validating spec failed: %w", err)
+		}
+	}()
+
+	return s.Configuration.Validate()
+}
+
 func parseDesiredV0(desiredTree *tree.Tree) (*DesiredV0, error) {
 	desiredKind := &DesiredV0{
 		Common: desiredTree.Common,