Skip to content

Commit 712c702

Browse files
jparrilljparrill
authored
CNTRLPLANE-216: Add KubeAPIExteralName api (#5458)
* CNTRLPLANE-216: Add KubeAPIExteralName api This new API changes the value of the KAS Custom URL to points to your desired one Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> * CNTRLPLANE-216: Add autogenerated code and files Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> * CNTRLPLANE-216: Add E2E test for new API KubeAPIDNSName Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> * NO-JIRA: Fix new gosimple minor issues in the code Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> --------- Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com>
1 parent eafea57 commit 712c702

File tree

56 files changed

+1885
-55
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+1885
-55
lines changed

Diff for: ‎Dockerfile.control-plane

+1
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,4 @@ LABEL io.openshift.hypershift.control-plane-operator-applies-management-kas-netw
2626
LABEL io.openshift.hypershift.restricted-psa=true
2727
LABEL io.openshift.hypershift.control-plane-pki-operator-signs-csrs=true
2828
LABEL io.openshift.hypershift.hosted-cluster-config-operator-reports-node-count=true
29+
LABEL io.openshift.hypershift.control-plane-operator-supports-kas-custom-kubeconfig=true

Diff for: ‎Dockerfile.dev

+2-1
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,5 @@ LABEL io.openshift.hypershift.control-plane-operator-creates-aws-sg=true
3636
LABEL io.openshift.hypershift.control-plane-operator-applies-management-kas-network-policy-label=true
3737
LABEL io.openshift.hypershift.restricted-psa=true
3838
LABEL io.openshift.hypershift.control-plane-pki-operator-signs-csrs=true
39-
LABEL io.openshift.hypershift.hosted-cluster-config-operator-reports-node-count=true
39+
LABEL io.openshift.hypershift.hosted-cluster-config-operator-reports-node-count=true
40+
LABEL io.openshift.hypershift.control-plane-operator-supports-kas-custom-kubeconfig=true

Diff for: ‎api/hypershift/v1beta1/hosted_controlplane.go

+23
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,20 @@ type HostedControlPlaneSpec struct {
116116
// +optional
117117
KubeConfig *KubeconfigSecretRef `json:"kubeconfig,omitempty"`
118118

119+
// kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
120+
// When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
121+
// If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
122+
// The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
123+
// This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
124+
// access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
125+
// for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
126+
//
127+
// +kubebuilder:validation:XValidation:rule=`self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')`,message="kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)"
128+
// +kubebuilder:validation:MaxLength=253
129+
// +kubebuilder:example: "api.example.com"
130+
// +optional
131+
KubeAPIServerDNSName string `json:"kubeAPIServerDNSName,omitempty"`
132+
119133
// Services defines metadata about how control plane services are published
120134
// in the management cluster.
121135
// +kubebuilder:validation:MaxItems=6
@@ -314,6 +328,15 @@ type HostedControlPlaneStatus struct {
314328
// for this control plane.
315329
KubeConfig *KubeconfigSecretRef `json:"kubeConfig,omitempty"`
316330

331+
// customKubeconfig references an external custom kubeconfig secret.
332+
// This field is populated in the status when a custom kubeconfig secret has been generated
333+
// for the hosted cluster. It contains the name and key of the secret located in the
334+
// hostedCluster namespace. This field is only populated when kubeApiExternalName is set.
335+
// If this field is removed during a day 2 operation, the referenced secret will be deleted
336+
// and this field will be removed from the hostedCluster status.
337+
// +optional
338+
CustomKubeconfig *KubeconfigSecretRef `json:"customKubeconfig,omitempty"`
339+
317340
// KubeadminPassword is a reference to the secret containing the initial kubeadmin password
318341
// for the guest cluster.
319342
// +optional

Diff for: ‎api/hypershift/v1beta1/hostedcluster_types.go

+19
Original file line numberDiff line numberDiff line change
@@ -472,6 +472,20 @@ type HostedClusterSpec struct {
472472
// +required
473473
Platform PlatformSpec `json:"platform"`
474474

475+
// kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
476+
// When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
477+
// If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
478+
// The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
479+
// This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
480+
// access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
481+
// for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
482+
// This API endpoint only works in OCP version 4.19 or later. Older versions will result in a no-op.
483+
// +kubebuilder:validation:XValidation:rule=`self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')`,message="kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)"
484+
// +kubebuilder:validation:MaxLength=253
485+
// +kubebuilder:example: "api.example.com"
486+
// +optional
487+
KubeAPIServerDNSName string `json:"kubeAPIServerDNSName,omitempty"`
488+
475489
// controllerAvailabilityPolicy specifies the availability policy applied to critical control plane components like the Kube API Server.
476490
// Possible values are HighlyAvailable and SingleReplica. The default value is HighlyAvailable.
477491
// This field is immutable.
@@ -1478,6 +1492,11 @@ type HostedClusterStatus struct {
14781492
// +optional
14791493
KubeConfig *corev1.LocalObjectReference `json:"kubeconfig,omitempty"`
14801494

1495+
// CustomKubeconfig is a local secret reference to the external custom kubeconfig.
1496+
// Once the hypershift operator sets this status field, it will generate a secret with the specified name containing a kubeconfig within the `HostedCluster` namespace.
1497+
// +optional
1498+
CustomKubeconfig *corev1.LocalObjectReference `json:"customKubeconfig,omitempty"`
1499+
14811500
// KubeadminPassword is a reference to the secret that contains the initial
14821501
// kubeadmin user password for the guest cluster.
14831502
// +optional

Diff for: ‎api/hypershift/v1beta1/zz_generated.deepcopy.go

+10
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

Diff for: ‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml

+31
Original file line numberDiff line numberDiff line change
@@ -2393,6 +2393,21 @@ spec:
23932393
rule: self == oldSelf
23942394
- message: issuerURL must be a valid absolute URL
23952395
rule: isURL(self)
2396+
kubeAPIServerDNSName:
2397+
description: |-
2398+
kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
2399+
When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
2400+
If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
2401+
The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
2402+
This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
2403+
access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
2404+
for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
2405+
This API endpoint only works in OCP version 4.19 or later. Older versions will result in a no-op.
2406+
maxLength: 253
2407+
type: string
2408+
x-kubernetes-validations:
2409+
- message: kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)
2410+
rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
23962411
labels:
23972412
additionalProperties:
23982413
type: string
@@ -4827,6 +4842,22 @@ spec:
48274842
- host
48284843
- port
48294844
type: object
4845+
customKubeconfig:
4846+
description: |-
4847+
CustomKubeconfig is a local secret reference to the external custom kubeconfig.
4848+
Once the hypershift operator sets this status field, it will generate a secret with the specified name containing a kubeconfig within the `HostedCluster` namespace.
4849+
properties:
4850+
name:
4851+
default: ""
4852+
description: |-
4853+
Name of the referent.
4854+
This field is effectively required, but due to backwards compatibility is
4855+
allowed to be empty. Instances of this type with an empty value here are
4856+
almost certainly wrong.
4857+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4858+
type: string
4859+
type: object
4860+
x-kubernetes-map-type: atomic
48304861
ignitionEndpoint:
48314862
description: |-
48324863
IgnitionEndpoint is the endpoint injected in the ign config userdata.

Diff for: ‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AutoNodeKarpenter.yaml

+31
Original file line numberDiff line numberDiff line change
@@ -2434,6 +2434,21 @@ spec:
24342434
rule: self == oldSelf
24352435
- message: issuerURL must be a valid absolute URL
24362436
rule: isURL(self)
2437+
kubeAPIServerDNSName:
2438+
description: |-
2439+
kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
2440+
When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
2441+
If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
2442+
The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
2443+
This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
2444+
access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
2445+
for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
2446+
This API endpoint only works in OCP version 4.19 or later. Older versions will result in a no-op.
2447+
maxLength: 253
2448+
type: string
2449+
x-kubernetes-validations:
2450+
- message: kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)
2451+
rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
24372452
labels:
24382453
additionalProperties:
24392454
type: string
@@ -4860,6 +4875,22 @@ spec:
48604875
- host
48614876
- port
48624877
type: object
4878+
customKubeconfig:
4879+
description: |-
4880+
CustomKubeconfig is a local secret reference to the external custom kubeconfig.
4881+
Once the hypershift operator sets this status field, it will generate a secret with the specified name containing a kubeconfig within the `HostedCluster` namespace.
4882+
properties:
4883+
name:
4884+
default: ""
4885+
description: |-
4886+
Name of the referent.
4887+
This field is effectively required, but due to backwards compatibility is
4888+
allowed to be empty. Instances of this type with an empty value here are
4889+
almost certainly wrong.
4890+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4891+
type: string
4892+
type: object
4893+
x-kubernetes-map-type: atomic
48634894
ignitionEndpoint:
48644895
description: |-
48654896
IgnitionEndpoint is the endpoint injected in the ign config userdata.

Diff for: ‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml

+31
Original file line numberDiff line numberDiff line change
@@ -2389,6 +2389,21 @@ spec:
23892389
rule: self == oldSelf
23902390
- message: issuerURL must be a valid absolute URL
23912391
rule: isURL(self)
2392+
kubeAPIServerDNSName:
2393+
description: |-
2394+
kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
2395+
When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
2396+
If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
2397+
The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
2398+
This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
2399+
access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
2400+
for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
2401+
This API endpoint only works in OCP version 4.19 or later. Older versions will result in a no-op.
2402+
maxLength: 253
2403+
type: string
2404+
x-kubernetes-validations:
2405+
- message: kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)
2406+
rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
23922407
labels:
23932408
additionalProperties:
23942409
type: string
@@ -4840,6 +4855,22 @@ spec:
48404855
- host
48414856
- port
48424857
type: object
4858+
customKubeconfig:
4859+
description: |-
4860+
CustomKubeconfig is a local secret reference to the external custom kubeconfig.
4861+
Once the hypershift operator sets this status field, it will generate a secret with the specified name containing a kubeconfig within the `HostedCluster` namespace.
4862+
properties:
4863+
name:
4864+
default: ""
4865+
description: |-
4866+
Name of the referent.
4867+
This field is effectively required, but due to backwards compatibility is
4868+
allowed to be empty. Instances of this type with an empty value here are
4869+
almost certainly wrong.
4870+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4871+
type: string
4872+
type: object
4873+
x-kubernetes-map-type: atomic
48434874
ignitionEndpoint:
48444875
description: |-
48454876
IgnitionEndpoint is the endpoint injected in the ign config userdata.

Diff for: ‎api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/DynamicResourceAllocation.yaml

+31
Original file line numberDiff line numberDiff line change
@@ -2410,6 +2410,21 @@ spec:
24102410
rule: self == oldSelf
24112411
- message: issuerURL must be a valid absolute URL
24122412
rule: isURL(self)
2413+
kubeAPIServerDNSName:
2414+
description: |-
2415+
kubeAPIServerDNSName specifies a desired DNS name to resolve to the KAS.
2416+
When set, the controller will automatically generate a secret with kubeconfig and expose it in the hostedCluster Status.customKubeconfig field.
2417+
If it's set or removed day 2, the kubeconfig generated secret will be created, recreated or deleted.
2418+
The DNS entries should be resolvable from the cluster, so this should be manually configured in the DNS provider.
2419+
This field works in conjunction with configuration.APIServer.ServingCerts.NamedCertificates to enable
2420+
access to the API server via a custom domain name. The NamedCertificates provide the TLS certificates
2421+
for the custom domain, while this field triggers the generation of a kubeconfig that uses those certificates.
2422+
This API endpoint only works in OCP version 4.19 or later. Older versions will result in a no-op.
2423+
maxLength: 253
2424+
type: string
2425+
x-kubernetes-validations:
2426+
- message: kubeAPIServerDNSName must be a valid URL name (e.g., api.example.com)
2427+
rule: self == "" || self.matches('^(?:(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,}|[a-zA-Z0-9-]+)$')
24132428
labels:
24142429
additionalProperties:
24152430
type: string
@@ -4836,6 +4851,22 @@ spec:
48364851
- host
48374852
- port
48384853
type: object
4854+
customKubeconfig:
4855+
description: |-
4856+
CustomKubeconfig is a local secret reference to the external custom kubeconfig.
4857+
Once the hypershift operator sets this status field, it will generate a secret with the specified name containing a kubeconfig within the `HostedCluster` namespace.
4858+
properties:
4859+
name:
4860+
default: ""
4861+
description: |-
4862+
Name of the referent.
4863+
This field is effectively required, but due to backwards compatibility is
4864+
allowed to be empty. Instances of this type with an empty value here are
4865+
almost certainly wrong.
4866+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
4867+
type: string
4868+
type: object
4869+
x-kubernetes-map-type: atomic
48394870
ignitionEndpoint:
48404871
description: |-
48414872
IgnitionEndpoint is the endpoint injected in the ign config userdata.

0 commit comments

Comments
 (0)