feat: add a new operator for self-hosted certificate management

klt-cert-manager/.dockerignore

@@ -0,0 +1,11 @@
+# Ignore build and test binaries.
+bin/
+.gitignore
+PROJECT
+README.md
+kubebuilder
+Makefile
+.dockerignore
+test/
+config/
+Dockerfile

klt-cert-manager/.gitignore

@@ -0,0 +1,30 @@
+
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+bin
+testbin/*
+
+# Test binary, build with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Reports from suite tests
+report.*
+load-report.*
+# Kubernetes Generated files - skip generated files, except for vendored files
+
+!vendor/**/zz_generated.*
+
+# editor and IDE paraphernalia
+.idea
+*.swp
+*.swo
+*~
+
+.dccache*

klt-cert-manager/Dockerfile

@@ -0,0 +1,60 @@
+# Build the manager binary
+FROM --platform=$BUILDPLATFORM golang:1.19.4-alpine3.16 as builder
+
+ENV CGO_ENABLED=0
+
+WORKDIR /workspace
+
+# Copy the Go Modules manifests
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy the go source
+COPY ./ ./
+
+# renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools
+ARG CONTROLLER_TOOLS_VERSION=v0.9.2
+RUN go install sigs.k8s.io/controller-tools/cmd/controller-gen@$CONTROLLER_TOOLS_VERSION
+
+ARG GIT_HASH
+ARG RELEASE_VERSION
+ARG BUILD_TIME
+ARG TARGETOS
+ARG TARGETARCH
+
+# Build
+RUN controller-gen object:headerFile="hack/boilerplate.go.txt" paths="./..." && \
+  GOOS=$TARGETOS GOARCH=$TARGETARCH \
+  go build -ldflags "\
+    -w \
+    -X main.gitCommit=${GIT_HASH} \
+    -X main.buildTime=${BUILD_TIME} \
+    -X main.buildVersion=${RELEASE_VERSION}" \
+    -a -o manager main.go
+
+FROM gcr.io/distroless/base-debian11:debug-nonroot as debug
+
+LABEL org.opencontainers.image.source="https://github.com/keptn/lifecycle-toolkit" \
+    org.opencontainers.image.url="https://keptn.sh" \
+    org.opencontainers.image.title="Keptn Lifecycle Certificate Manager" \
+    org.opencontainers.image.vendor="Keptn" \
+    org.opencontainers.image.licenses="Apache-2.0"
+
+WORKDIR /
+COPY --from=builder /workspace/manager .
+
+ENTRYPOINT ["/manager"]
+
+FROM gcr.io/distroless/base-debian11:nonroot as production
+
+LABEL org.opencontainers.image.source="https://github.com/keptn/lifecycle-toolkit/klt-cert-manager" \
+    org.opencontainers.image.url="https://keptn.sh" \
+    org.opencontainers.image.title="Keptn Lifecycle Certificate Manager" \
+    org.opencontainers.image.vendor="Keptn" \
+    org.opencontainers.image.licenses="Apache-2.0"
+
+WORKDIR /
+COPY --from=builder /workspace/manager .
+USER 65532:65532
+
+ENTRYPOINT ["/manager"]

klt-cert-manager/Makefile

@@ -0,0 +1,182 @@
+
+# RELEASE_REGISTRY is the container registry to push into.
+RELEASE_REGISTRY?=ghcr.io/keptn
+RELEASE_TIME=$(shell date +%Y%m%d%s)
+BUILD_TIME=$(shell date -u "+%F_%T")
+RELEASE_VERSION?=$(RELEASE_TIME)-v0.24.3#$(shell git describe --tags --match "v*")
+RELEASE_IMAGE:=keptn-cert-operator:$(TAG)
+
+ARCHS = amd64 arm64
+
+# ENVTEST_K8S_VERSION refers to the version of kubebuilder assets to be downloaded by envtest binary.
+ENVTEST_K8S_VERSION = 1.25.0
+
+# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
+ifeq (,$(shell go env GOBIN))
+GOBIN=$(shell go env GOPATH)/bin
+else
+GOBIN=$(shell go env GOBIN)
+endif
+
+# Setting SHELL to bash allows bash commands to be executed by recipes.
+# Options are set to exit when a recipe line exits non-zero or a piped command fails.
+SHELL = /usr/bin/env bash -o pipefail
+.SHELLFLAGS = -ec
+
+.PHONY: all
+all: build
+
+
+#### developer build   ####
+.PHONY: clean
+clean:
+	rm -rf ./bin
+##@ General
+
+# The help target prints out all targets with their descriptions organized
+# beneath their categories. The categories are represented by '##@' and the
+# target descriptions by '##'. The awk commands is responsible for reading the
+# entire set of makefiles included in this invocation, looking for lines of the
+# file as xyz: ## something, and then pretty-format the target and help. Then,
+# if there's a line with ##@ something, that gets pretty-printed as a category.
+# More info on the usage of ANSI control characters for terminal formatting:
+# https://en.wikipedia.org/wiki/ANSI_escape_code#SGR_parameters
+# More info on the awk command:
+# http://linuxcommand.org/lc3_adv_awk.php
+
+.PHONY: help
+help: ## Display this help.
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
+
+##@ Development
+
+.PHONY: manifests
+manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
+	$(CONTROLLER_GEN) rbac:roleName=klc-cert-manager-role crd webhook paths="./..." output:crd:artifacts:config=config/crd/bases
+
+.PHONY: generate
+generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
+	$(CONTROLLER_GEN) object:headerFile="hack/boilerplate.go.txt" paths="./..."
+
+.PHONY: fmt
+fmt: ## Run go fmt against code.
+	go fmt ./...
+
+.PHONY: vet
+vet: ## Run go vet against code.
+	go vet ./...
+
+.PHONY: test
+test: manifests generate fmt vet envtest ## Run tests.
+	KUBEBUILDER_ASSETS="$(shell $(ENVTEST) use $(ENVTEST_K8S_VERSION) --bin-dir $(LOCALBIN) -p path)" go test ./... -coverprofile cover.out
+
+##@ Build
+
+.PHONY: build
+build: generate fmt vet ## Build manager binary.
+	go build -o bin/manager main.go
+
+.PHONY: run
+run: manifests generate fmt vet ## Run a controller from your host.
+	go run ./main.go
+
+##@ Deployment
+
+ifndef ignore-not-found
+  ignore-not-found = false
+endif
+
+.PHONY: deploy
+deploy: kustomize ## Deploy controller to the K8s cluster specified in ~/.kube/config.
+	cd config/manager && $(KUSTOMIZE) edit set image controller=${IMG}
+	$(KUSTOMIZE) build config/default | kubectl apply -f -
+
+.PHONY: undeploy
+undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
+	$(KUSTOMIZE) build config/default | kubectl delete --ignore-not-found=$(ignore-not-found) -f -
+
+##@ Build Dependencies
+
+## Location to install dependencies to
+LOCALBIN ?= $(shell pwd)/bin
+$(LOCALBIN):
+	mkdir -p $(LOCALBIN)
+
+## Tool Binaries
+KUSTOMIZE ?= $(LOCALBIN)/kustomize
+CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
+ENVTEST ?= $(LOCALBIN)/setup-envtest
+
+## Tool Versions
+
+# renovate: datasource=github-tags depName=kubernetes-sigs/kustomize
+KUSTOMIZE_VERSION ?= v3.8.7
+# renovate: datasource=github-releases depName=kubernetes-sigs/controller-tools
+CONTROLLER_TOOLS_VERSION ?= v0.9.2
+
+KUSTOMIZE_INSTALL_SCRIPT ?= "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh"
+.PHONY: kustomize
+kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
+$(KUSTOMIZE): $(LOCALBIN)
+	test -s $(LOCALBIN)/kustomize || { curl -Ss $(KUSTOMIZE_INSTALL_SCRIPT) | bash -s -- $(subst v,,$(KUSTOMIZE_VERSION)) $(LOCALBIN); }
+
+.PHONY: controller-gen
+controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.
+$(CONTROLLER_GEN): $(LOCALBIN)
+	test -s $(LOCALBIN)/controller-gen || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-tools/cmd/controller-gen@$(CONTROLLER_TOOLS_VERSION)
+
+.PHONY: envtest
+envtest: $(ENVTEST) ## Download envtest-setup locally if necessary.
+$(ENVTEST): $(LOCALBIN)
+	test -s $(LOCALBIN)/setup-envtest || GOBIN=$(LOCALBIN) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
+
+.PHONY: release-local
+release-local: release-local.amd64 release-local.arm64
+	for arch in $(ARCHS); do \
+			docker push $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)-$${arch} ;\
+		done
+		DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create $(RELEASE_REGISTRY)/$(RELEASE_IMAGE) $(addprefix --amend $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)-, $(ARCHS))
+		for arch in $(ARCHS); do \
+			DOCKER_CLI_EXPERIMENTAL=enabled docker manifest annotate --arch $${arch} $(RELEASE_REGISTRY)/$(RELEASE_IMAGE) $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)-$${arch} ;\
+		done
+		DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push $(RELEASE_REGISTRY)/$(RELEASE_IMAGE) ;\
+
+.PHONY: release-local.amd64
+release-local.amd64: clean
+	DOCKER_BUILDKIT=1 docker build \
+		--build-arg GIT_HASH="$(HASH)" \
+		--build-arg RELEASE_VERSION="$(TAG)" \
+		--build-arg BUILD_TIME="$(BUILD_TIME)" \
+		--build-arg CONTROLLER_TOOLS_VERSION="$(CONTROLLER_TOOLS_VERSION)" \
+		-t $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)-amd64 \
+		--platform linux/amd64 \
+		--target debug \
+		.
+	docker tag $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)-amd64 $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)
+
+.PHONY: release-local.arm64
+release-local.arm64: clean
+	DOCKER_BUILDKIT=1 docker build \
+		--build-arg GIT_HASH="$(HASH)" \
+		--build-arg RELEASE_VERSION="$(TAG)" \
+		--build-arg BUILD_TIME="$(BUILD_TIME)" \
+		--build-arg CONTROLLER_TOOLS_VERSION="$(CONTROLLER_TOOLS_VERSION)" \
+		-t $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)-arm64 \
+		--platform linux/arm64 \
+		--target debug \
+		.
+	docker tag $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)-arm64 $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)
+
+.PHONY: push-local
+push-local:
+	if [[ "${ARCH}" == "amd64" ]]; then \
+		docker push $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)-amd64 ;\
+	elif [[ "${ARCH}" == "arm64" ]]; then \
+		docker push $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)-arm64 ;\
+	fi
+	docker push $(RELEASE_REGISTRY)/$(RELEASE_IMAGE)
+
+.PHONY: release-manifests
+release-manifests: kustomize
+	cd config/manager && $(KUSTOMIZE) edit set image controller=$(RELEASE_REGISTRY)/$(RELEASE_IMAGE)
+	$(KUSTOMIZE) build config/default > config/rendered/release.yaml

klt-cert-manager/PROJECT

@@ -0,0 +1,12 @@
+domain: keptn.sh
+layout:
+- go.kubebuilder.io/v3
+projectName: klt-cert-manager
+repo: github.com/keptn/lifecycle-toolkit/klt-cert-manager
+resources:
+- controller: true
+  domain: keptn.sh
+  group: klt-cert-manager
+  kind: Deployment
+  version: v1alpha1
+version: "3"

klt-cert-manager/config/default/kustomization.yaml

@@ -0,0 +1,71 @@
+# Adds namespace to all resources.
+namespace: keptn-lifecycle-toolkit-system
+
+# Value of this field is prepended to the
+# names of all resources, e.g. a deployment named
+# "wordpress" becomes "alices-wordpress".
+# Note that it should also match with the prefix (text before '-') of the namespace
+# field above.
+namePrefix: klt-
+
+# Labels to add to all resources and selectors.
+#commonLabels:
+#  someName: someValue
+
+bases:
+- ../rbac
+- ../manager
+# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
+# crd/kustomization.yaml
+#- ../webhook
+# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required.
+#- ../certmanager
+# [PROMETHEUS] To enable prometheus monitor, uncomment all sections with 'PROMETHEUS'.
+#- ../prometheus
+
+patchesStrategicMerge:
+# Protect the /metrics endpoint by putting it behind auth.
+# If you want your cert-manager to expose the /metrics
+# endpoint w/o any authn/z, please comment the following line.
+- manager_auth_proxy_patch.yaml
+
+
+
+# [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in
+# crd/kustomization.yaml
+#- manager_webhook_patch.yaml
+
+# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'.
+# Uncomment 'CERTMANAGER' sections in crd/kustomization.yaml to enable the CA injection in the admission webhooks.
+# 'CERTMANAGER' needs to be enabled to use ca injection
+#- webhookcainjection_patch.yaml
+
+# the following config is for teaching kustomize how to do var substitution
+vars:
+# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
+#- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
+#  objref:
+#    kind: Certificate
+#    group: cert-manager.io
+#    version: v1
+#    name: serving-cert # this name should match the one in certificate.yaml
+#  fieldref:
+#    fieldpath: metadata.namespace
+#- name: CERTIFICATE_NAME
+#  objref:
+#    kind: Certificate
+#    group: cert-manager.io
+#    version: v1
+#    name: serving-cert # this name should match the one in certificate.yaml
+#- name: SERVICE_NAMESPACE # namespace of the service
+#  objref:
+#    kind: Service
+#    version: v1
+#    name: webhook-service
+#  fieldref:
+#    fieldpath: metadata.namespace
+#- name: SERVICE_NAME
+#  objref:
+#    kind: Service
+#    version: v1
+#    name: webhook-service