Add PrivateConfig field to SecureSourceManagerInstance

apis/refs/v1beta1/privatecaref.go

@@ -0,0 +1,112 @@
+// Copyright 2024 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1beta1
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+type PrivateCACAPoolRef struct {
+	// A reference to an externally managed PrivateCACAPool.
+	// Should be in the format `projects/{project_id}/locations/{region}/caPools/{caPool}`.
+	External string `json:"external,omitempty"`
+
+	// The `name` of a `PrivateCACAPool` resource.
+	Name string `json:"name,omitempty"`
+	// The `namespace` of a `PrivateCACAPool` resource.
+	Namespace string `json:"namespace,omitempty"`
+}
+
+type PrivateCACAPool struct {
+	Ref        *PrivateCACAPoolRef
+	ResourceID string
+}
+
+// ResolvePrivateCACAPoolRef will resolve a PrivateCACAPoolRef to a PrivateCACAPool.
+func ResolvePrivateCACAPoolRef(ctx context.Context, reader client.Reader, src client.Object, ref *PrivateCACAPoolRef) (*PrivateCACAPoolRef, error) {
+	if ref == nil {
+		return nil, nil
+	}
+
+	if ref.Name == "" && ref.External == "" {
+		return nil, fmt.Errorf("must specify either name or external on PrivateCACAPoolRef")
+	}
+	if ref.Name != "" && ref.External != "" {
+		return nil, fmt.Errorf("cannot specify both name and external on PrivateCACAPoolRef")
+	}
+
+	// External should be in the `projects/{project_id}/locations/{region}/caPools/{caPool}` format
+	if ref.External != "" {
+		tokens := strings.Split(ref.External, "/")
+		if len(tokens) == 6 && tokens[0] == "projects" && tokens[2] == "locations" && tokens[4] == "caPools" {
+			ref = &PrivateCACAPoolRef{
+				External: fmt.Sprintf("projects/%s/locations/%s/caPools/%s", tokens[1], tokens[3], tokens[5]),
+			}
+			return ref, nil
+		}
+		return nil, fmt.Errorf("format of PrivateCACAPoolRef external=%q was not known (use projects/{project_id}/locations/{region}/caPools/{caPool})", ref.External)
+	}
+
+	key := types.NamespacedName{
+		Namespace: ref.Namespace,
+		Name:      ref.Name,
+	}
+	if key.Namespace == "" {
+		key.Namespace = src.GetNamespace()
+	}
+
+	// Fetch object from k8s cluster to construct the external form
+	caPool := &unstructured.Unstructured{}
+	caPool.SetGroupVersionKind(schema.GroupVersionKind{
+		Group:   "privateca.cnrm.cloud.google.com",
+		Version: "v1beta1",
+		Kind:    "PrivateCACAPool",
+	})
+	if err := reader.Get(ctx, key, caPool); err != nil {
+		if apierrors.IsNotFound(err) {
+			return nil, fmt.Errorf("referenced PrivateCACAPool %v not found", key)
+		}
+		return nil, fmt.Errorf("error reading referenced PrivateCACAPool %v: %w", key, err)
+	}
+
+	caPoolResourceID, err := GetResourceID(caPool)
+	if err != nil {
+		return nil, err
+	}
+
+	projectID, err := ResolveProjectID(ctx, reader, caPool)
+	if err != nil {
+		return nil, err
+	}
+
+	location, err := GetLocation(caPool)
+	if err != nil {
+		return nil, err
+	}
+
+	ref = &PrivateCACAPoolRef{
+		External: fmt.Sprintf("projects/%s/locations/%s/caPools/%s", projectID, location, caPoolResourceID),
+	}
+
+	return ref, nil
+}

apis/securesourcemanager/v1alpha1/instance_types.go

@@ -44,6 +44,9 @@ type SecureSourceManagerInstanceSpec struct {
 
 	// Optional. Immutable. Customer-managed encryption key name.
 	KmsKeyRef *refs.KMSCryptoKeyRef `json:"kmsKeyRef,omitempty"`
+
+	// Optional. PrivateConfig includes settings for private instance.
+	PrivateConfig *Instance_PrivateConfig `json:"privateConfig,omitempty"`
 }
 
 // SecureSourceManagerInstanceStatus defines the config connector machine state of SecureSourceManagerInstance
@@ -85,6 +88,24 @@ type SecureSourceManagerInstanceObservedState struct {
 	HostConfig *Instance_HostConfig `json:"hostConfig,omitempty"`
 }
 
+// +kcc:proto=google.cloud.securesourcemanager.v1.Instance.PrivateConfig
+type Instance_PrivateConfig struct {
+	// Required. Immutable. Indicate if it's private instance.
+	IsPrivate *bool `json:"isPrivate,omitempty"`
+
+	// Required. Immutable. CA pool resource, resource must in the format of
+	//  `projects/{project}/locations/{location}/caPools/{ca_pool}`.
+	CaPoolRef *refs.PrivateCACAPoolRef `json:"caPoolRef,omitempty"`
+
+	// Output only. Service Attachment for HTTP, resource is in the format of
+	//  `projects/{project}/regions/{region}/serviceAttachments/{service_attachment}`.
+	HTTPServiceAttachment *string `json:"httpServiceAttachment,omitempty"`
+
+	// Output only. Service Attachment for SSH, resource is in the format of
+	//  `projects/{project}/regions/{region}/serviceAttachments/{service_attachment}`.
+	SSHServiceAttachment *string `json:"sshServiceAttachment,omitempty"`
+}
+
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // +kubebuilder:resource:categories=gcp,shortName=gcpsecuresourcemanagerinstance;gcpsecuresourcemanagerinstances

config/crds/resources/apiextensions.k8s.io_v1_customresourcedefinition_securesourcemanagerinstances.securesourcemanager.cnrm.cloud.google.com.yaml

@@ -94,6 +94,51 @@ spec:
               location:
                 description: Immutable. Location of the instance.
                 type: string
+              privateConfig:
+                description: Optional. PrivateConfig includes settings for private
+                  instance.
+                properties:
+                  caPoolRef:
+                    description: Required. Immutable. CA pool resource, resource must
+                      in the format of `projects/{project}/locations/{location}/caPools/{ca_pool}`.
+                    oneOf:
+                    - not:
+                        required:
+                        - external
+                      required:
+                      - name
+                    - not:
+                        anyOf:
+                        - required:
+                          - name
+                        - required:
+                          - namespace
+                      required:
+                      - external
+                    properties:
+                      external:
+                        description: A reference to an externally managed PrivateCACAPool.
+                          Should be in the format `projects/{project_id}/locations/{region}/caPools/{caPool}`.
+                        type: string
+                      name:
+                        description: The `name` of a `PrivateCACAPool` resource.
+                        type: string
+                      namespace:
+                        description: The `namespace` of a `PrivateCACAPool` resource.
+                        type: string
+                    type: object
+                  httpServiceAttachment:
+                    description: Output only. Service Attachment for HTTP, resource
+                      is in the format of `projects/{project}/regions/{region}/serviceAttachments/{service_attachment}`.
+                    type: string
+                  isPrivate:
+                    description: Required. Immutable. Indicate if it's private instance.
+                    type: boolean
+                  sshServiceAttachment:
+                    description: Output only. Service Attachment for SSH, resource
+                      is in the format of `projects/{project}/regions/{region}/serviceAttachments/{service_attachment}`.
+                    type: string
+                type: object
               projectRef:
                 description: Immutable. The Project that this resource belongs to.
                 oneOf:

pkg/controller/direct/securesourcemanager/instance_controller.go

@@ -82,6 +82,14 @@ func (m *secureSourceManagerInstanceModel) AdapterForObject(ctx context.Context,
 		obj.Spec.KmsKeyRef = kmsKeyRef
 	}
 
+	if obj.Spec.PrivateConfig != nil {
+		caPoolRef, err := refs.ResolvePrivateCACAPoolRef(ctx, reader, u, obj.Spec.PrivateConfig.CaPoolRef)
+		if err != nil {
+			return nil, err
+		}
+		obj.Spec.PrivateConfig.CaPoolRef = caPoolRef
+	}
+
 	mapCtx := &direct.MapContext{}
 	desired := SecureSourceManagerInstanceSpec_ToProto(mapCtx, &obj.Spec)
 	if mapCtx.Err() != nil {

pkg/controller/direct/securesourcemanager/mapper.go

@@ -16,6 +16,7 @@ package securesourcemanager
 
 import (
 	pb "cloud.google.com/go/securesourcemanager/apiv1/securesourcemanagerpb"
+	refs "github.com/GoogleCloudPlatform/k8s-config-connector/apis/refs/v1beta1"
 	krm "github.com/GoogleCloudPlatform/k8s-config-connector/apis/securesourcemanager/v1alpha1"
 
 	"github.com/GoogleCloudPlatform/k8s-config-connector/pkg/controller/direct"
@@ -61,7 +62,32 @@ func OperationMetadata_EndTime_ToProto(mapCtx *direct.MapContext, in *string) *t
 	mapCtx.Errorf("OperationMetadata_EndTime_ToProto not implemented")
 	return nil
 }
-
+func Instance_PrivateConfig_FromProto(mapCtx *direct.MapContext, in *pb.Instance_PrivateConfig) *krm.Instance_PrivateConfig {
+	if in == nil {
+		return nil
+	}
+	out := &krm.Instance_PrivateConfig{}
+	out.IsPrivate = direct.LazyPtr(in.GetIsPrivate())
+	if in.GetCaPool() != "" {
+		out.CaPoolRef = &refs.PrivateCACAPoolRef{External: in.GetCaPool()}
+	}
+	out.HTTPServiceAttachment = direct.LazyPtr(in.GetHttpServiceAttachment())
+	out.SSHServiceAttachment = direct.LazyPtr(in.GetSshServiceAttachment())
+	return out
+}
+func Instance_PrivateConfig_ToProto(mapCtx *direct.MapContext, in *krm.Instance_PrivateConfig) *pb.Instance_PrivateConfig {
+	if in == nil {
+		return nil
+	}
+	out := &pb.Instance_PrivateConfig{}
+	out.IsPrivate = direct.ValueOf(in.IsPrivate)
+	if in.CaPoolRef != nil {
+		out.CaPool = in.CaPoolRef.External
+	}
+	out.HttpServiceAttachment = direct.ValueOf(in.HTTPServiceAttachment)
+	out.SshServiceAttachment = direct.ValueOf(in.SSHServiceAttachment)
+	return out
+}
 func SecureSourceManagerRepositoryObservedState_FromProto(mapCtx *direct.MapContext, in *pb.Repository) *krm.SecureSourceManagerRepositoryObservedState {
 	if in == nil {
 		return nil