Skip to content

Commit c3a6322

Browse files
TechassiTechassi
committed
refactor: Separate CRDs, add SecretClass change
Co-authored-by: Sebastian Bernauer <sebastian.bernauer@stackable.tech
1 parent c84e382 commit c3a6322

File tree

14 files changed

+924
-707
lines changed

14 files changed

+924
-707
lines changed

‎rust/operator-binary/src/backend/cert_manager.rs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ use super::{
2020
scope::SecretScope,
2121
};
2222
use crate::{
23-
crd::{self, CertificateKeyGeneration},
23+
crd::v1alpha2,
2424
external_crd::{self, cert_manager::CertificatePrivateKey},
2525
format::SecretData,
2626
utils::Unloggable,
@@ -99,7 +99,7 @@ impl SecretBackendError for Error {
9999
pub struct CertManager {
100100
// Not secret per se, but Client isn't Debug: https://github.com/stackabletech/secret-operator/issues/411
101101
pub client: Unloggable<stackable_operator::client::Client>,
102-
pub config: crd::CertManagerBackend,
102+
pub config: v1alpha2::CertManagerBackend,
103103
}
104104

105105
#[async_trait]
@@ -160,7 +160,7 @@ impl SecretBackend for CertManager {
160160
kind: Some(self.config.issuer.kind.to_string()),
161161
},
162162
private_key: match self.config.key_generation {
163-
CertificateKeyGeneration::Rsa { length } => CertificatePrivateKey {
163+
v1alpha2::CertificateKeyGeneration::Rsa { length } => CertificatePrivateKey {
164164
algorithm: "RSA".to_string(),
165165
size: length,
166166
},

‎rust/operator-binary/src/backend/dynamic.rs‎

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,7 @@ use super::{
1515
pod_info::{PodInfo, SchedulingPodInfo},
1616
tls,
1717
};
18-
use crate::{
19-
crd::{self, SecretClass},
20-
utils::Unloggable,
21-
};
18+
use crate::{crd::v1alpha2, utils::Unloggable};
2219

2320
pub struct DynError(Box<dyn SecretBackendError>);
2421

@@ -129,18 +126,18 @@ impl SecretBackendError for FromClassError {
129126

130127
pub async fn from_class(
131128
client: &stackable_operator::client::Client,
132-
class: SecretClass,
129+
class: v1alpha2::SecretClass,
133130
) -> Result<Box<Dynamic>, FromClassError> {
134131
Ok(match class.spec.backend {
135-
crd::SecretClassBackend::K8sSearch(crd::K8sSearchBackend {
132+
v1alpha2::SecretClassBackend::K8sSearch(v1alpha2::K8sSearchBackend {
136133
search_namespace,
137134
trust_store_config_map_name,
138135
}) => from(super::K8sSearch {
139136
client: Unloggable(client.clone()),
140137
search_namespace,
141138
trust_store_config_map_name,
142139
}),
143-
crd::SecretClassBackend::AutoTls(crd::AutoTlsBackend {
140+
v1alpha2::SecretClassBackend::AutoTls(v1alpha2::AutoTlsBackend {
144141
ca,
145142
additional_trust_roots,
146143
max_certificate_lifetime,
@@ -153,11 +150,11 @@ pub async fn from_class(
153150
)
154151
.await?,
155152
),
156-
crd::SecretClassBackend::CertManager(config) => from(super::CertManager {
153+
v1alpha2::SecretClassBackend::CertManager(config) => from(super::CertManager {
157154
client: Unloggable(client.clone()),
158155
config,
159156
}),
160-
crd::SecretClassBackend::KerberosKeytab(crd::KerberosKeytabBackend {
157+
v1alpha2::SecretClassBackend::KerberosKeytab(v1alpha2::KerberosKeytabBackend {
161158
realm_name,
162159
kdc,
163160
admin,
@@ -185,14 +182,14 @@ pub enum FromSelectorError {
185182
#[snafu(display("failed to get {class}"))]
186183
GetSecretClass {
187184
source: stackable_operator::client::Error,
188-
class: ObjectRef<SecretClass>,
185+
class: ObjectRef<v1alpha2::SecretClass>,
189186
},
190187

191188
#[snafu(display("failed to initialize backend for {class}"))]
192189
FromClass {
193190
#[snafu(source(from(FromClassError, Box::new)))]
194191
source: Box<FromClassError>,
195-
class: ObjectRef<SecretClass>,
192+
class: ObjectRef<v1alpha2::SecretClass>,
196193
},
197194
}
198195

@@ -220,7 +217,7 @@ pub async fn from_selector(
220217
) -> Result<Box<Dynamic>, FromSelectorError> {
221218
let class_ref = || ObjectRef::new(&selector.class);
222219
let class = client
223-
.get::<SecretClass>(&selector.class, &())
220+
.get::<v1alpha2::SecretClass>(&selector.class, &())
224221
.await
225222
.with_context(|_| from_selector_error::GetSecretClassSnafu { class: class_ref() })?;
226223
from_class(client, class)

‎rust/operator-binary/src/backend/k8s_search.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ use super::{
2020
pod_info::{PodInfo, SchedulingPodInfo},
2121
scope::SecretScope,
2222
};
23-
use crate::{crd::SearchNamespace, format::SecretData, utils::Unloggable};
23+
use crate::{crd::v1alpha2, format::SecretData, utils::Unloggable};
2424

2525
const LABEL_CLASS: &str = "secrets.stackable.tech/class";
2626
pub(super) const LABEL_SCOPE_NODE: &str = "secrets.stackable.tech/node";
@@ -89,7 +89,7 @@ impl SecretBackendError for Error {
8989
pub struct K8sSearch {
9090
// Not secret per se, but isn't Debug: https://github.com/stackabletech/secret-operator/issues/411
9191
pub client: Unloggable<stackable_operator::client::Client>,
92-
pub search_namespace: SearchNamespace,
92+
pub search_namespace: v1alpha2::SearchNamespace,
9393
pub trust_store_config_map_name: Option<String>,
9494
}
9595

‎rust/operator-binary/src/backend/kerberos_keytab.rs‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,7 @@ use super::{
2222
scope::SecretScope,
2323
};
2424
use crate::{
25-
crd::{
26-
ActiveDirectorySamAccountNameRules, InvalidKerberosPrincipal, KerberosKeytabBackendAdmin,
27-
KerberosPrincipal,
28-
},
25+
crd::{self, KerberosPrincipal, v1alpha2},
2926
format::{SecretData, WellKnownSecretData, well_known},
3027
utils::Unloggable,
3128
};
@@ -62,7 +59,9 @@ pub enum Error {
6259
},
6360

6461
#[snafu(display("generated invalid Kerberos principal for pod"))]
65-
PodPrincipal { source: InvalidKerberosPrincipal },
62+
PodPrincipal {
63+
source: crd::InvalidKerberosPrincipal,
64+
},
6665

6766
#[snafu(display("failed to read the provisioned keytab"))]
6867
ReadProvisionedKeytab { source: std::io::Error },
@@ -106,7 +105,7 @@ impl SecretBackendError for Error {
106105
pub struct KerberosProfile {
107106
pub realm_name: KerberosRealmName,
108107
pub kdc: HostName,
109-
pub admin: KerberosKeytabBackendAdmin,
108+
pub admin: v1alpha2::KerberosKeytabBackendAdmin,
110109
}
111110

112111
#[derive(Debug)]
@@ -169,10 +168,12 @@ impl SecretBackend for KerberosKeytab {
169168
} = self;
170169

171170
let admin_server_clause = match admin {
172-
KerberosKeytabBackendAdmin::Mit { kadmin_server } => {
171+
v1alpha2::KerberosKeytabBackendAdmin::Mit(v1alpha2::KerberosKeytabBackendMit {
172+
kadmin_server,
173+
}) => {
173174
format!(" admin_server = {kadmin_server}")
174175
}
175-
KerberosKeytabBackendAdmin::ActiveDirectory { .. } => String::new(),
176+
v1alpha2::KerberosKeytabBackendAdmin::ActiveDirectory { .. } => String::new(),
176177
};
177178

178179
let tmp = tempdir().context(TempSetupSnafu)?;
@@ -254,24 +255,26 @@ cluster.local = {realm_name}
254255
})
255256
.collect(),
256257
admin_backend: match admin {
257-
KerberosKeytabBackendAdmin::Mit { .. } => {
258+
v1alpha2::KerberosKeytabBackendAdmin::Mit { .. } => {
258259
stackable_krb5_provision_keytab::AdminBackend::Mit
259260
}
260-
KerberosKeytabBackendAdmin::ActiveDirectory {
261-
ldap_server,
262-
ldap_tls_ca_secret,
263-
password_cache_secret,
264-
user_distinguished_name,
265-
schema_distinguished_name,
266-
generate_sam_account_name,
267-
} => stackable_krb5_provision_keytab::AdminBackend::ActiveDirectory {
261+
v1alpha2::KerberosKeytabBackendAdmin::ActiveDirectory(
262+
v1alpha2::KerberosKeytabBackendActiveDirectory {
263+
ldap_server,
264+
ldap_tls_ca_secret,
265+
password_cache_secret,
266+
user_distinguished_name,
267+
schema_distinguished_name,
268+
generate_sam_account_name,
269+
},
270+
) => stackable_krb5_provision_keytab::AdminBackend::ActiveDirectory {
268271
ldap_server: ldap_server.to_string(),
269272
ldap_tls_ca_secret: ldap_tls_ca_secret.clone(),
270273
password_cache_secret: password_cache_secret.clone(),
271274
user_distinguished_name: user_distinguished_name.clone(),
272275
schema_distinguished_name: schema_distinguished_name.clone(),
273276
generate_sam_account_name: generate_sam_account_name.clone().map(
274-
|ActiveDirectorySamAccountNameRules {
277+
|v1alpha2::ActiveDirectorySamAccountNameRules {
275278
prefix,
276279
total_length,
277280
}| {

‎rust/operator-binary/src/backend/tls/ca.rs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ use tracing::{info, info_span, warn};
3838

3939
use crate::{
4040
backend::SecretBackendError,
41-
crd::{AdditionalTrustRoot, CertificateKeyGeneration},
41+
crd::v1alpha2,
4242
utils::{Asn1TimeParseError, Unloggable, asn1time_to_offsetdatetime},
4343
};
4444

@@ -202,7 +202,7 @@ pub struct Config {
202202
pub rotate_if_ca_expires_before: Option<Duration>,
203203

204204
/// Configuration how TLS private keys should be created.
205-
pub key_generation: CertificateKeyGeneration,
205+
pub key_generation: v1alpha2::CertificateKeyGeneration,
206206
}
207207

208208
/// A single certificate authority certificate.
@@ -241,7 +241,7 @@ impl CertificateAuthority {
241241
Conf::new(ConfMethod::default()).expect("failed to initialize OpenSSL configuration");
242242

243243
let private_key_length = match config.key_generation {
244-
CertificateKeyGeneration::Rsa { length } => length,
244+
v1alpha2::CertificateKeyGeneration::Rsa { length } => length,
245245
};
246246

247247
let private_key = Rsa::generate(private_key_length)
@@ -348,7 +348,7 @@ impl Manager {
348348
pub async fn load_or_create(
349349
client: &stackable_operator::client::Client,
350350
secret_ref: &SecretReference,
351-
additional_trust_roots: &[AdditionalTrustRoot],
351+
additional_trust_roots: &[v1alpha2::AdditionalTrustRoot],
352352
config: &Config,
353353
) -> Result<Self> {
354354
// Use entry API rather than apply so that we crash and retry on conflicts (to avoid creating spurious certs that we throw away immediately)
@@ -496,10 +496,10 @@ impl Manager {
496496
let mut additional_trusted_certificates = vec![];
497497
for entry in additional_trust_roots {
498498
let certs = match entry {
499-
AdditionalTrustRoot::ConfigMap(config_map) => {
499+
v1alpha2::AdditionalTrustRoot::ConfigMap(config_map) => {
500500
Self::read_extra_trust_roots_from_config_map(client, config_map).await?
501501
}
502-
AdditionalTrustRoot::Secret(secret) => {
502+
v1alpha2::AdditionalTrustRoot::Secret(secret) => {
503503
Self::read_extra_trust_roots_from_secret(client, secret).await?
504504
}
505505
};

‎rust/operator-binary/src/backend/tls/mod.rs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ use super::{
3333
scope::SecretScope,
3434
};
3535
use crate::{
36-
crd::{self, AdditionalTrustRoot, CertificateKeyGeneration},
36+
crd::v1alpha2,
3737
format::{SecretData, WellKnownSecretData, well_known},
3838
utils::iterator_try_concat_bytes,
3939
};
@@ -150,7 +150,7 @@ impl SecretBackendError for Error {
150150
pub struct TlsGenerate {
151151
ca_manager: ca::Manager,
152152
max_cert_lifetime: Duration,
153-
key_generation: CertificateKeyGeneration,
153+
key_generation: v1alpha2::CertificateKeyGeneration,
154154
}
155155

156156
impl TlsGenerate {
@@ -162,13 +162,13 @@ impl TlsGenerate {
162162
/// an independent self-signed CA.
163163
pub async fn get_or_create_k8s_certificate(
164164
client: &stackable_operator::client::Client,
165-
crd::AutoTlsCa {
165+
v1alpha2::AutoTlsCa {
166166
secret: ca_secret,
167167
auto_generate: auto_generate_ca,
168168
ca_certificate_lifetime,
169169
key_generation,
170-
}: &crd::AutoTlsCa,
171-
additional_trust_roots: &[AdditionalTrustRoot],
170+
}: &v1alpha2::AutoTlsCa,
171+
additional_trust_roots: &[v1alpha2::AdditionalTrustRoot],
172172
max_cert_lifetime: Duration,
173173
) -> Result<Self> {
174174
Ok(Self {
@@ -260,7 +260,7 @@ impl SecretBackend for TlsGenerate {
260260
Conf::new(ConfMethod::default()).expect("failed to initialize OpenSSL configuration");
261261

262262
let pod_key_length = match self.key_generation {
263-
CertificateKeyGeneration::Rsa { length } => length,
263+
v1alpha2::CertificateKeyGeneration::Rsa { length } => length,
264264
};
265265

266266
let pod_key = Rsa::generate(pod_key_length)

0 commit comments

Comments
 (0)