Skip to content

Commit 171b90d

Browse files
JasonPowrJasonPowr
committed
add file signer type
1 parent 6379dea commit 171b90d

16 files changed

+1713
-20
lines changed

‎api/v1alpha1/timestampauthority_types.go

+51-1
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,61 @@ import (
2424
type TimestampAuthoritySpec struct {
2525
// Define whether you want to export service or not
2626
ExternalAccess ExternalAccess `json:"externalAccess,omitempty"`
27+
// Signer configuration
28+
Signer TimestampAuthoritySigner `json:"signer,omitempty"`
29+
}
30+
31+
type TimestampAuthoritySigner struct {
32+
// Timestamping authority signer. Valid options include: [kms, tink, file].
33+
Type string `json:"type,omitempty"`
34+
// Configuration for the Certificate Chain
35+
CertificateChain CertificateChain `json:"certificateChain,omitempty"`
36+
// Configuration for file-based signer
37+
//+optional
38+
FileSigner FileSigner `json:"fileSigner,omitempty"`
39+
}
40+
41+
type CertificateChain struct {
42+
// CommonName specifies the common name for the TimeStampAuthorities cert chain.
43+
// If not provided, the common name will default to the host name.
44+
//+optional
45+
CommonName string `json:"commonName,omitempty"`
46+
//+optional
47+
//OrganizationName specifies the Organization Name for the TimeStampAuthorities cert chain.
48+
OrganizationName string `json:"organizationName,omitempty"`
49+
//+optional
50+
//Organization Email specifies the Organization Email for the TimeStampAuthorities cert chain.
51+
OrganizationEmail string `json:"organizationEmail,omitempty"`
52+
//Reference to the certificate chain
53+
//+optional
54+
CertificateChainRef *SecretKeySelector `json:"certificateChainRef,omitempty"`
55+
// Password to decrypt the signer's root private key
56+
//+optional
57+
RootPasswordRef *SecretKeySelector `json:"rootPasswordRef,omitempty"`
58+
// Reference to the signer's root private key
59+
//+optional
60+
RootPrivateKeyRef *SecretKeySelector `json:"rootPrivateKeyRef,omitempty"`
61+
// Password to decrypt the signer's Intermediate private key
62+
//+optional
63+
InterPasswordRef *SecretKeySelector `json:"interPasswordRef,omitempty"`
64+
// Reference to the signer's Intermediate private key
65+
//+optional
66+
InterPrivateKeyRef *SecretKeySelector `json:"interPrivateKeyRef,omitempty"`
67+
}
68+
69+
type FileSigner struct {
70+
// Password to decrypt the signer's root private key
71+
//+optional
72+
PasswordRef *SecretKeySelector `json:"passwordRef,omitempty"`
73+
// Reference to the signer's root private key
74+
//+optional
75+
PrivateKeyRef *SecretKeySelector `json:"privateKeyRef,omitempty"`
2776
}
2877

2978
// TimestampAuthorityStatus defines the observed state of TimestampAuthority
3079
type TimestampAuthorityStatus struct {
31-
Url string `json:"url,omitempty"`
80+
Signer *TimestampAuthoritySigner `json:"signer,omitempty"`
81+
Url string `json:"url,omitempty"`
3282
// +listType=map
3383
// +listMapKey=type
3484
// +patchStrategy=merge

‎api/v1alpha1/zz_generated.deepcopy.go

+90-2
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎bundle/manifests/rhtas-operator.clusterserviceversion.yaml

+9-1
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,14 @@ metadata:
121121
"tsa": {
122122
"externalAccess": {
123123
"enabled": true
124+
},
125+
"signer": {
126+
"certificateChain": {
127+
"commonName": "tsa.hostname",
128+
"organizationEmail": "jdoe@redhat.com",
129+
"organizationName": "Red Hat"
130+
},
131+
"type": "file"
124132
}
125133
},
126134
"tuf": {
@@ -216,7 +224,7 @@ metadata:
216224
]
217225
capabilities: Seamless Upgrades
218226
containerImage: registry.redhat.io/rhtas/rhtas-rhel9-operator@sha256:a21f7128694a64989bf0d84a7a7da4c1ffc89edf62d594dc8bea7bcfe9ac08d3
219-
createdAt: "2024-06-24T12:36:11Z"
227+
createdAt: "2024-07-02T11:25:13Z"
220228
features.operators.openshift.io/cnf: "false"
221229
features.operators.openshift.io/cni: "false"
222230
features.operators.openshift.io/csi: "false"

‎bundle/manifests/rhtas.redhat.com_securesigns.yaml

+159
Original file line numberDiff line numberDiff line change
@@ -684,6 +684,165 @@ spec:
684684
required:
685685
- enabled
686686
type: object
687+
signer:
688+
description: Signer configuration
689+
properties:
690+
certificateChain:
691+
description: Configuration for the Certificate Chain
692+
properties:
693+
certificateChainRef:
694+
description: Reference to the certificate chain
695+
properties:
696+
key:
697+
description: The key of the secret to select from.
698+
Must be a valid secret key.
699+
pattern: ^[-._a-zA-Z0-9]+$
700+
type: string
701+
name:
702+
description: |-
703+
Name of the referent.
704+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
705+
type: string
706+
required:
707+
- key
708+
- name
709+
type: object
710+
x-kubernetes-map-type: atomic
711+
commonName:
712+
description: |-
713+
CommonName specifies the common name for the TimeStampAuthorities cert chain.
714+
If not provided, the common name will default to the host name.
715+
type: string
716+
interPasswordRef:
717+
description: Password to decrypt the signer's Intermediate
718+
private key
719+
properties:
720+
key:
721+
description: The key of the secret to select from.
722+
Must be a valid secret key.
723+
pattern: ^[-._a-zA-Z0-9]+$
724+
type: string
725+
name:
726+
description: |-
727+
Name of the referent.
728+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
729+
type: string
730+
required:
731+
- key
732+
- name
733+
type: object
734+
x-kubernetes-map-type: atomic
735+
interPrivateKeyRef:
736+
description: Reference to the signer's Intermediate private
737+
key
738+
properties:
739+
key:
740+
description: The key of the secret to select from.
741+
Must be a valid secret key.
742+
pattern: ^[-._a-zA-Z0-9]+$
743+
type: string
744+
name:
745+
description: |-
746+
Name of the referent.
747+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
748+
type: string
749+
required:
750+
- key
751+
- name
752+
type: object
753+
x-kubernetes-map-type: atomic
754+
organizationEmail:
755+
description: Organization Email specifies the Organization
756+
Email for the TimeStampAuthorities cert chain.
757+
type: string
758+
organizationName:
759+
description: OrganizationName specifies the Organization
760+
Name for the TimeStampAuthorities cert chain.
761+
type: string
762+
rootPasswordRef:
763+
description: Password to decrypt the signer's root private
764+
key
765+
properties:
766+
key:
767+
description: The key of the secret to select from.
768+
Must be a valid secret key.
769+
pattern: ^[-._a-zA-Z0-9]+$
770+
type: string
771+
name:
772+
description: |-
773+
Name of the referent.
774+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
775+
type: string
776+
required:
777+
- key
778+
- name
779+
type: object
780+
x-kubernetes-map-type: atomic
781+
rootPrivateKeyRef:
782+
description: Reference to the signer's root private key
783+
properties:
784+
key:
785+
description: The key of the secret to select from.
786+
Must be a valid secret key.
787+
pattern: ^[-._a-zA-Z0-9]+$
788+
type: string
789+
name:
790+
description: |-
791+
Name of the referent.
792+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
793+
type: string
794+
required:
795+
- key
796+
- name
797+
type: object
798+
x-kubernetes-map-type: atomic
799+
type: object
800+
fileSigner:
801+
description: Configuration for file-based signer
802+
properties:
803+
passwordRef:
804+
description: Password to decrypt the signer's root private
805+
key
806+
properties:
807+
key:
808+
description: The key of the secret to select from.
809+
Must be a valid secret key.
810+
pattern: ^[-._a-zA-Z0-9]+$
811+
type: string
812+
name:
813+
description: |-
814+
Name of the referent.
815+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
816+
type: string
817+
required:
818+
- key
819+
- name
820+
type: object
821+
x-kubernetes-map-type: atomic
822+
privateKeyRef:
823+
description: Reference to the signer's root private key
824+
properties:
825+
key:
826+
description: The key of the secret to select from.
827+
Must be a valid secret key.
828+
pattern: ^[-._a-zA-Z0-9]+$
829+
type: string
830+
name:
831+
description: |-
832+
Name of the referent.
833+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
834+
type: string
835+
required:
836+
- key
837+
- name
838+
type: object
839+
x-kubernetes-map-type: atomic
840+
type: object
841+
type:
842+
description: 'Timestamping authority signer. Valid options
843+
include: [kms, tink, file].'
844+
type: string
845+
type: object
687846
type: object
688847
tuf:
689848
default:

0 commit comments

Comments
 (0)