Skip to content

Commit 7bead72

Browse files
JasonPowrJasonPowr
committed
improve testing, apply requested changes
1 parent 14f95cb commit 7bead72

31 files changed

+1891
-272
lines changed

‎.github/workflows/main.yml

+5-3
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,7 @@ jobs:
292292

293293
- name: Add service hosts to /etc/hosts
294294
run: |
295-
sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local" | sudo tee -a /etc/hosts
295+
sudo echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local tsa-server.local" | sudo tee -a /etc/hosts
296296
- name: Install cosign
297297
run: go install github.com/sigstore/cosign/v2/cmd/cosign@v2.2.4
298298

@@ -371,7 +371,7 @@ jobs:
371371
kubectl create ns ${{ env.TEST_NAMESPACE }}
372372
kubectl create secret generic redhat-registry -n ${{ env.TEST_NAMESPACE }} --from-file=.dockerconfigjson=/tmp/config.json --type=kubernetes.io/dockerconfigjson
373373
kubectl patch serviceaccount default --type=merge -p '{"imagePullSecrets": [{"name":"redhat-registry"}]}' -n ${{ env.TEST_NAMESPACE }}
374-
for NAME in "fulcio" "ctlog" "trillian" "rekor" "tuf"
374+
for NAME in "fulcio" "ctlog" "trillian" "rekor" "tuf" "tsa"
375375
do
376376
echo """
377377
apiVersion: v1
@@ -400,7 +400,7 @@ jobs:
400400
401401
- name: Until shell script to wait for deployment to be created
402402
run: |
403-
for i in trillian fulcio rekor tuf ctlog; do
403+
for i in trillian fulcio rekor tuf ctlog timestampAuthority; do
404404
until [ ! -z "$(kubectl get $i -n ${{ env.TEST_NAMESPACE }} 2>/dev/null)" ]
405405
do
406406
echo "Waiting for $i to be created."
@@ -416,6 +416,7 @@ jobs:
416416
kubectl wait --for=condition=ready rekor/securesign-sample -n ${{ env.TEST_NAMESPACE }} --timeout=5m
417417
kubectl wait --for=condition=ready ctlog/securesign-sample -n ${{ env.TEST_NAMESPACE }} --timeout=5m
418418
kubectl wait --for=condition=ready tuf/securesign-sample -n ${{ env.TEST_NAMESPACE }} --timeout=5m
419+
kubectl wait --for=condition=ready timestampAuthority/securesign-sample -n ${{ env.TEST_NAMESPACE }} --timeout=5m
419420
420421
- name: Test deployments are ready
421422
run: |
@@ -428,6 +429,7 @@ jobs:
428429
kubectl wait --for=condition=available deployment/rekor-search-ui -n ${{ env.TEST_NAMESPACE }}
429430
kubectl wait --for=condition=available deployment/tuf -n ${{ env.TEST_NAMESPACE }}
430431
kubectl wait --for=condition=available deployment/ctlog -n ${{ env.TEST_NAMESPACE }}
432+
kubectl wait --for=condition=available deployment/tsa-server -n ${{ env.TEST_NAMESPACE }}
431433
432434
- name: Archive test artifacts
433435
uses: actions/upload-artifact@v4

‎api/v1alpha1/timestampauthority_types.go

+4-2
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ type KMS struct {
111111
//KMS key for signing timestamp responses. Valid options include: [gcpkms://resource, azurekms://resource, hashivault://resource, awskms://resource]
112112
//+required
113113
KeyResource string `json:"keyResource,omitempty"`
114-
//Configuration for authentication for key managment services
114+
//Configuration for authentication for key management services
115115
//+optional
116116
Auth *Auth `json:"auth,omitempty"`
117117
}
@@ -124,7 +124,7 @@ type Tink struct {
124124
//+required
125125
//Path to KMS-encrypted keyset for Tink, decrypted by TinkKeyResource
126126
KeysetRef *SecretKeySelector `json:"keysetRef,omitempty"`
127-
// Configuration for authentication for key managment services
127+
// Configuration for authentication for key management services
128128
//+optional
129129
Auth *Auth `json:"auth,omitempty"`
130130
}
@@ -182,6 +182,8 @@ type TimestampAuthorityStatus struct {
182182

183183
//+kubebuilder:object:root=true
184184
//+kubebuilder:subresource:status
185+
//+kubebuilder:printcolumn:name="Status",type=string,JSONPath=`.status.conditions[?(@.type=="Ready")].reason`,description="The component status"
186+
//+kubebuilder:printcolumn:name="URL",type=string,JSONPath=`.status.url`,description="The component url"
185187

186188
// TimestampAuthority is the Schema for the timestampauthorities API
187189
type TimestampAuthority struct {

‎bundle/manifests/rhtas.redhat.com_securesigns.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1098,7 +1098,7 @@ spec:
10981098
properties:
10991099
auth:
11001100
description: Configuration for authentication for key
1101-
managment services
1101+
management services
11021102
properties:
11031103
env:
11041104
description: Environmental variables used to define
@@ -1254,7 +1254,7 @@ spec:
12541254
properties:
12551255
auth:
12561256
description: Configuration for authentication for key
1257-
managment services
1257+
management services
12581258
properties:
12591259
env:
12601260
description: Environmental variables used to define

‎bundle/manifests/rhtas.redhat.com_timestampauthorities.yaml

+14-5
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,16 @@ spec:
1414
singular: timestampauthority
1515
scope: Namespaced
1616
versions:
17-
- name: v1alpha1
17+
- additionalPrinterColumns:
18+
- description: The component status
19+
jsonPath: .status.conditions[?(@.type=="Ready")].reason
20+
name: Status
21+
type: string
22+
- description: The component url
23+
jsonPath: .status.url
24+
name: URL
25+
type: string
26+
name: v1alpha1
1827
schema:
1928
openAPIV3Schema:
2029
description: TimestampAuthority is the Schema for the timestampauthorities
@@ -378,7 +387,7 @@ spec:
378387
description: Configuration for KMS based signer
379388
properties:
380389
auth:
381-
description: Configuration for authentication for key managment
390+
description: Configuration for authentication for key management
382391
services
383392
properties:
384393
env:
@@ -530,7 +539,7 @@ spec:
530539
description: Configuration for Tink based signer
531540
properties:
532541
auth:
533-
description: Configuration for authentication for key managment
542+
description: Configuration for authentication for key management
534543
services
535544
properties:
536545
env:
@@ -1106,7 +1115,7 @@ spec:
11061115
description: Configuration for KMS based signer
11071116
properties:
11081117
auth:
1109-
description: Configuration for authentication for key managment
1118+
description: Configuration for authentication for key management
11101119
services
11111120
properties:
11121121
env:
@@ -1258,7 +1267,7 @@ spec:
12581267
description: Configuration for Tink based signer
12591268
properties:
12601269
auth:
1261-
description: Configuration for authentication for key managment
1270+
description: Configuration for authentication for key management
12621271
services
12631272
properties:
12641273
env:

‎cmd/main.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -241,8 +241,9 @@ func main() {
241241
os.Exit(1)
242242
}
243243
if err = (&tsa.TimestampAuthorityReconciler{
244-
Client: mgr.GetClient(),
245-
Scheme: mgr.GetScheme(),
244+
Client: mgr.GetClient(),
245+
Scheme: mgr.GetScheme(),
246+
Recorder: mgr.GetEventRecorderFor("tsa-controller"),
246247
}).SetupWithManager(mgr); err != nil {
247248
setupLog.Error(err, "unable to create controller", "controller", "TimestampAuthority")
248249
os.Exit(1)

‎config/crd/bases/rhtas.redhat.com_securesigns.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1098,7 +1098,7 @@ spec:
10981098
properties:
10991099
auth:
11001100
description: Configuration for authentication for key
1101-
managment services
1101+
management services
11021102
properties:
11031103
env:
11041104
description: Environmental variables used to define
@@ -1254,7 +1254,7 @@ spec:
12541254
properties:
12551255
auth:
12561256
description: Configuration for authentication for key
1257-
managment services
1257+
management services
12581258
properties:
12591259
env:
12601260
description: Environmental variables used to define

‎config/crd/bases/rhtas.redhat.com_timestampauthorities.yaml

+14-5
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,16 @@ spec:
1414
singular: timestampauthority
1515
scope: Namespaced
1616
versions:
17-
- name: v1alpha1
17+
- additionalPrinterColumns:
18+
- description: The component status
19+
jsonPath: .status.conditions[?(@.type=="Ready")].reason
20+
name: Status
21+
type: string
22+
- description: The component url
23+
jsonPath: .status.url
24+
name: URL
25+
type: string
26+
name: v1alpha1
1827
schema:
1928
openAPIV3Schema:
2029
description: TimestampAuthority is the Schema for the timestampauthorities
@@ -378,7 +387,7 @@ spec:
378387
description: Configuration for KMS based signer
379388
properties:
380389
auth:
381-
description: Configuration for authentication for key managment
390+
description: Configuration for authentication for key management
382391
services
383392
properties:
384393
env:
@@ -530,7 +539,7 @@ spec:
530539
description: Configuration for Tink based signer
531540
properties:
532541
auth:
533-
description: Configuration for authentication for key managment
542+
description: Configuration for authentication for key management
534543
services
535544
properties:
536545
env:
@@ -1106,7 +1115,7 @@ spec:
11061115
description: Configuration for KMS based signer
11071116
properties:
11081117
auth:
1109-
description: Configuration for authentication for key managment
1118+
description: Configuration for authentication for key management
11101119
services
11111120
properties:
11121121
env:
@@ -1258,7 +1267,7 @@ spec:
12581267
description: Configuration for Tink based signer
12591268
properties:
12601269
auth:
1261-
description: Configuration for authentication for key managment
1270+
description: Configuration for authentication for key management
12621271
services
12631272
properties:
12641273
env:

‎go.mod

+2
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,8 @@ require (
7878
github.com/spf13/pflag v1.0.5 // indirect
7979
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
8080
github.com/transparency-dev/merkle v0.0.2 // indirect
81+
go.uber.org/multierr v1.11.0 // indirect
82+
go.uber.org/zap v1.27.0 // indirect
8183
golang.org/x/crypto v0.23.0 // indirect
8284
golang.org/x/exp v0.0.0-20240213143201-ec583247a57a // indirect
8385
golang.org/x/mod v0.15.0 // indirect

‎go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -157,8 +157,8 @@ go.opentelemetry.io/otel v1.23.0 h1:Df0pqjqExIywbMCMTxkAwzjLZtRf+bBKLbUcpxO2C9E=
157157
go.opentelemetry.io/otel v1.23.0/go.mod h1:YCycw9ZeKhcJFrb34iVSkyT0iczq/zYDtZYFufObyB0=
158158
go.opentelemetry.io/otel/trace v1.23.0 h1:37Ik5Ib7xfYVb4V1UtnT97T1jI+AoIYkJyPkuL4iJgI=
159159
go.opentelemetry.io/otel/trace v1.23.0/go.mod h1:GSGTbIClEsuZrGIzoEHqsVfxgn5UkggkflQwDScNUsk=
160-
go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
161-
go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
160+
go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
161+
go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
162162
go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
163163
go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
164164
go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=

‎internal/controller/common/utils/kubernetes/config_map.go

-11
Original file line numberDiff line numberDiff line change
@@ -35,17 +35,6 @@ func CreateImmutableConfigmap(namePrefix string, namespace string, labels map[st
3535
}
3636
}
3737

38-
func CreateConfigMap(namePrefix string, namespace string, labels map[string]string, data map[string]string) *corev1.ConfigMap {
39-
return &corev1.ConfigMap{
40-
ObjectMeta: metav1.ObjectMeta{
41-
GenerateName: namePrefix,
42-
Namespace: namespace,
43-
Labels: labels,
44-
},
45-
Data: data,
46-
}
47-
}
48-
4938
func GetConfigMap(ctx context.Context, client client.Client, namespace, secretName string) (*corev1.ConfigMap, error) {
5039
var cm corev1.ConfigMap
5140

‎internal/controller/constants/images.go

+6-4
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,10 @@ var (
1919

2020
CTLogImage = "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:a0c7d71fc8f4cb7530169a6b54dc3a67215c4058a45f84b87bb04fc62e6e8141"
2121

22-
ClientServerImage = "registry.access.redhat.com/ubi9/httpd-24@sha256:7874b82335a80269dcf99e5983c2330876f5fe8bdc33dc6aa4374958a2ffaaee"
23-
ClientServerImage_cg = "registry.redhat.io/rhtas/client-server-cg-rhel9@sha256:987c630213065a6339b2b2582138f7b921473b86dfe82e91a002f08386a899ed"
24-
ClientServerImage_re = "registry.redhat.io/rhtas/client-server-re-rhel9@sha256:dc4667af49ce6cc70d70bf83cab9d7a14b424d8ae1aae7e4863ff5c4ac769a96"
25-
SegmentBackupImage = "registry.redhat.io/rhtas/segment-reporting-rhel9@sha256:3fcf8f14a0cfdd36f9ec263f83ba1597f892e6fa923d3d61bacbc467af643c9d"
22+
ClientServerImage = "registry.access.redhat.com/ubi9/httpd-24@sha256:7874b82335a80269dcf99e5983c2330876f5fe8bdc33dc6aa4374958a2ffaaee"
23+
ClientServerImage_cg = "registry.redhat.io/rhtas/client-server-cg-rhel9@sha256:987c630213065a6339b2b2582138f7b921473b86dfe82e91a002f08386a899ed"
24+
ClientServerImage_re = "registry.redhat.io/rhtas/client-server-re-rhel9@sha256:dc4667af49ce6cc70d70bf83cab9d7a14b424d8ae1aae7e4863ff5c4ac769a96"
25+
ClientServerImage_f = "registry.redhat.io/rhtas/client-server-f-rhel9@sha256:65fb59c8f631215d9752fc4f41571eb2750ecaaa8555083f58baa6982e97d192"
26+
SegmentBackupImage = "registry.redhat.io/rhtas/segment-reporting-rhel9@sha256:3fcf8f14a0cfdd36f9ec263f83ba1597f892e6fa923d3d61bacbc467af643c9d"
27+
TimestampAuthorityImage = "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:3fba2f8cd09548d2bd2dfff938529952999cb28ff5b7ea42c1c5e722b8eb827f"
2628
)

‎internal/controller/constants/labels.go

+36
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,17 @@
11
package constants
22

3+
import (
4+
"context"
5+
"encoding/json"
6+
"fmt"
7+
"strings"
8+
9+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
10+
"k8s.io/apimachinery/pkg/runtime/schema"
11+
"k8s.io/apimachinery/pkg/types"
12+
"sigs.k8s.io/controller-runtime/pkg/client"
13+
)
14+
315
const (
416
LabelNamespace = "rhtas.redhat.com"
517
)
@@ -26,3 +38,27 @@ func LabelsRHTAS() map[string]string {
2638
"app.kubernetes.io/managed-by": "controller-manager",
2739
}
2840
}
41+
42+
func RemoveLabel(ctx context.Context, object *metav1.PartialObjectMetadata, c client.Client, label string) error {
43+
object.SetGroupVersionKind(schema.GroupVersionKind{
44+
Group: "",
45+
Version: "v1",
46+
Kind: "Secret",
47+
})
48+
patch, err := json.Marshal([]map[string]string{
49+
{
50+
"op": "remove",
51+
"path": fmt.Sprintf("/metadata/labels/%s", strings.ReplaceAll(label, "/", "~1")),
52+
},
53+
})
54+
if err != nil {
55+
return fmt.Errorf("failed to marshal patch: %v", err)
56+
}
57+
58+
err = c.Patch(ctx, object, client.RawPatch(types.JSONPatchType, patch))
59+
if err != nil {
60+
return fmt.Errorf("unable to remove '%s' label from secret: %w", label, err)
61+
}
62+
63+
return nil
64+
}

‎internal/controller/rekor/actions/server/resolve_pub_key.go

+1-29
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,10 @@ package server
33
import (
44
"bytes"
55
"context"
6-
"encoding/json"
76
"fmt"
87
"io"
98
"net/http"
109
"strconv"
11-
"strings"
1210

1311
"k8s.io/utils/ptr"
1412

@@ -22,8 +20,6 @@ import (
2220
"k8s.io/apimachinery/pkg/api/meta"
2321
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2422
"k8s.io/apimachinery/pkg/runtime/schema"
25-
"k8s.io/apimachinery/pkg/types"
26-
"sigs.k8s.io/controller-runtime/pkg/client"
2723
)
2824

2925
const (
@@ -98,7 +94,7 @@ func (i resolvePubKeyAction) Handle(ctx context.Context, instance *rhtasv1alpha1
9894
}
9995

10096
// Remove label from secret
101-
if err = i.removeLabel(ctx, &secret); err != nil {
97+
if err = constants.RemoveLabel(ctx, &secret, i.Client, RekorPubLabel); err != nil {
10298
return i.Failed(fmt.Errorf("ResolvePubKey: %w", err))
10399
}
104100

@@ -177,27 +173,3 @@ func (i resolvePubKeyAction) requestPublicKey(basePath string) ([]byte, error) {
177173
}
178174
return nil, fmt.Errorf("unexpected http response %s", response.Status)
179175
}
180-
181-
func (i resolvePubKeyAction) removeLabel(ctx context.Context, object *metav1.PartialObjectMetadata) error {
182-
object.SetGroupVersionKind(schema.GroupVersionKind{
183-
Group: "",
184-
Version: "v1",
185-
Kind: "Secret",
186-
})
187-
patch, err := json.Marshal([]map[string]string{
188-
{
189-
"op": "remove",
190-
"path": fmt.Sprintf("/metadata/labels/%s", strings.ReplaceAll(RekorPubLabel, "/", "~1")),
191-
},
192-
})
193-
if err != nil {
194-
return fmt.Errorf("failed to marshal patch: %v", err)
195-
}
196-
197-
err = i.Client.Patch(ctx, object, client.RawPatch(types.JSONPatchType, patch))
198-
if err != nil {
199-
return fmt.Errorf("unable to remove '%s' label from secret: %w", RekorPubLabel, err)
200-
}
201-
202-
return nil
203-
}

0 commit comments

Comments
 (0)