This PR looks to fix the long standing issue with CA Certs not auto-renewing and becoming expired thus no longer being able to convert CRD's until a new CA cert is re-created. It expands the capabilities to allow for more flexibility in allowing the CA Cert and CRD Patching to be externally managed by third parties such as CertManager. Also, leverages leader-election to ensure predictability when managed CA Cert and CRD Patching.
APIExt design
The new design is built on top of the controller-runtime using the familiar Runnable and Controller patterns. The following are the key abstractions created.
Entity
Description
Required
Leader Election
CertificateAuthority
Internal CA Cert cache that generates Server Certificates
Yes
No
caCertController
Controller watching CA Cert Secret and providing CertificateAuthority the CACert
Yes
No
crdPatchController
Controller patching getambassador.io CRDs to ensure CABundle matches CACert
No
Yes
CACertManager
Runnable watching CA Cert Secret and ensuring it is always valid and non-expired
No
Yes
Note: crdPatchController and CACertManager can be disabled but the capabilities they provide are required so if disabled then it is up to the user to provide an alternative such as CertManager.
Now that we support LeaderElection the RBAC has been expanded to include the new permissions needed.
One other thing to mention, is that this PR laid the ground work for publishing the apiext as a stand alone container by decoupling its binary from busy ambassador. However, for now the standalone container is only used to simplify the e2e testing (mainly due to keeping scope down, in an already large PR). The standalone binary is still copied into the core container and the deployment in the charts/manifest are still the same.
Related Issues
CA Cert Renewal and support for externally managing CA Cert and CRD Patching.
Testing
New unit tests for rewrite and added automated e2e tests to CI. Pulled into Edge Stack and verified no issues there as well.
Checklist
[ ] Does my change need to be backported to a previous release?
[ ] I made sure to update CHANGELOG.md.
[x] This is unlikely to impact how Ambassador performs at scale.
[x] My change is adequately tested.
[ ] I updated DEVELOPING.md with any any special dev tricks I had to use to work on this code efficiently.
[x] The changes in this PR have been reviewed for security concerns and adherence to security best practices.
Description
This PR looks to fix the long standing issue with CA Certs not auto-renewing and becoming expired thus no longer being able to convert CRD's until a new CA cert is re-created. It expands the capabilities to allow for more flexibility in allowing the CA Cert and CRD Patching to be externally managed by third parties such as CertManager. Also, leverages leader-election to ensure predictability when managed CA Cert and CRD Patching.
APIExt design
The new design is built on top of the controller-runtime using the familiar Runnable and Controller patterns. The following are the key abstractions created.
Now that we support LeaderElection the RBAC has been expanded to include the new permissions needed.
One other thing to mention, is that this PR laid the ground work for publishing the apiext as a stand alone container by decoupling its binary from busy ambassador. However, for now the standalone container is only used to simplify the e2e testing (mainly due to keeping scope down, in an already large PR). The standalone binary is still copied into the core container and the deployment in the charts/manifest are still the same.
Related Issues
CA Cert Renewal and support for externally managing CA Cert and CRD Patching.
Testing
New unit tests for rewrite and added automated e2e tests to CI. Pulled into Edge Stack and verified no issues there as well.
Checklist
CHANGELOG.md
.DEVELOPING.md
with any any special dev tricks I had to use to work on this code efficiently.