Partial implementation of certmanager for integration sink #8481

matzew · 2025-02-19T08:51:51Z

Proposed Changes

adding cert manager dependency and generating code
disabled it for now - but sharing for other parts to be able to use it

Next steps (or PRs)

isolate the "certmanager" library in a common place (so that event transformer can also "easily" use it
bump cert manager version and use their client set (like serving does)
Enable cert manager for integration sink and have dynamic knob for feature toggle (e.g. on/off)

Basics for Cert-manager Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

…f TLS Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

… env vars Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

knative-prow · 2025-02-19T08:51:59Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: matzew

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [matzew]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

codecov · 2025-02-19T09:18:32Z

Codecov Report

Attention: Patch coverage is 42.94872% with 89 lines in your changes missing coverage. Please review.

Project coverage is 62.64%. Comparing base (9a7c6d5) to head (5a0c1de).
Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...conciler/integration/sink/resources/certificate.go	0.00%	44 Missing ⚠️
pkg/reconciler/integration/sink/integrationsink.go	31.42%	24 Missing ⚠️
...iler/integration/sink/resources/container_image.go	87.09%	7 Missing and 1 partial ⚠️
pkg/reconciler/integration/sink/controller.go	0.00%	6 Missing ⚠️
cmd/controller/main.go	0.00%	5 Missing ⚠️
pkg/reconciler/integration/sink/resources/names.go	50.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8481      +/-   ##
==========================================
- Coverage   62.77%   62.64%   -0.14%     
==========================================
  Files         395      397       +2     
  Lines       24108    24241     +133     
==========================================
+ Hits        15135    15185      +50     
- Misses       8166     8247      +81     
- Partials      807      809       +2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

matzew · 2025-02-19T09:33:41Z

/test unit-tests

matzew · 2025-02-19T09:56:58Z

/test unit-tests

matzew · 2025-02-19T10:12:51Z

/retest

matzew · 2025-02-19T10:15:46Z

/test unit-tests

matzew · 2025-02-19T10:49:36Z

/test unit-tests

matzew · 2025-02-19T11:37:13Z

/test unit-tests

pierDipi · 2025-02-19T11:41:37Z

cmd/controller/main.go

+	for _, inf := range []injection.InformerInjector{challenge.WithInformer, v1certificate.WithInformer, certificaterequest.WithInformer, clusterissuer.WithInformer, issuer.WithInformer} {
+		injection.Default.RegisterInformer(inf)
+	}


If cert-manager is not installed, I think this logs errors and gets the controller stack on starting? Did you try that?

Also I don't think we need the clusterissuer, issuer, challenge, or certificaterequest

yeah - forgot to comment that out

config/core/roles/controller-clusterroles.yaml

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

pierDipi · 2025-02-19T13:20:39Z

/lgtm

matzew · 2025-02-19T13:45:25Z

/test unit-tests

matzew · 2025-02-19T14:03:09Z

/test unit-tests

) * Adding cert-mananger bits Basics for Cert-manager Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Adding create cert manifest function Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Use the make cert Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Reconcile Certificate manifest and add RBAC Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Add secret filter to controller Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Look up secrets/certs for sink Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Remove old/wrong Certificate manifest and reference Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Fix controller compile Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Formatting Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * change the reconcile of cert manifest, and run it only w/ some form of TLS Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * using filtered informer Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Adding Rekt test for IntegrationSink TLS support Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * adding a bit of https port for deployment/service of the IntegrationSink Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Mounting secrets and setting quarkus env vars for TLS support Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Adding flags for different TLS levels resulting in diffeerent quarkus env vars Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Remove bad comment Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Adding label Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Update codegen Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Disable tmp. the cert manager feature Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Fixing header/year Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * More test tweaking Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Remove unused and comment out the hooks for now Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> --------- Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

* Partial implementation of certmanager for integration sink (knative#8481) * Adding cert-mananger bits Basics for Cert-manager Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Adding create cert manifest function Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Use the make cert Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Reconcile Certificate manifest and add RBAC Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Add secret filter to controller Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Look up secrets/certs for sink Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Remove old/wrong Certificate manifest and reference Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Fix controller compile Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Formatting Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * change the reconcile of cert manifest, and run it only w/ some form of TLS Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * using filtered informer Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Adding Rekt test for IntegrationSink TLS support Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * adding a bit of https port for deployment/service of the IntegrationSink Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Mounting secrets and setting quarkus env vars for TLS support Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Adding flags for different TLS levels resulting in diffeerent quarkus env vars Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Remove bad comment Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Adding label Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Update codegen Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Disable tmp. the cert manager feature Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Fixing header/year Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * More test tweaking Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Remove unused and comment out the hooks for now Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> --------- Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Run make generate-release Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Remove unused code (knative#8485) Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * IntegrationSink prefactors (knative#8486) Little refactors on IntegrationSink Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Add initial iteration of eventing-integration resources (knative#8493) * Generic code for Certificates (knative#8489) Make Certifacte factory more generic Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Jsonata Event transform e2e tests (knative#8499) * E2E tests Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * EventTransform Jsonata e2e tests Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Use eventing-integrations images and fix tests Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Verify response status code received by source Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Update JSONata transformations Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> --------- Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Inject integration images from ConfigMap (knative#8500) Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Run make generate-release Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Update to the correct file (knative#8507) Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * EventTransform: Inject tracing configurations (knative#8479) Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * EventTransform: add reconciler unit tests (knative#8513) * EventTransform: add reconciler unit tests Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Update pkg/reconciler/testing/v1alpha1/eventtransform.go Co-authored-by: Marek Schmidt <maschmid@redhat.com> --------- Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> Co-authored-by: Marek Schmidt <maschmid@redhat.com> * Enable Cert Manager (knative#8509) * Re-enable Cert Mgr Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Manual informer Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Update main Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * update controller Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Adding label on cert Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * add enqueue Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Create Cert Informer, on demand, and cancle when flag is disabled Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Update unit tests that broke during rrefactors Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> --------- Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Event Transform JSONata TLS (knative#8515) * Event Transform JSONata TLS Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * HA and security context Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Reconcile Certificate Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Additional unit tests cases Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Fix tests Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * EventTransform trust bundle propagation and tests Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Fix tests and address comments Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> --------- Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Run make generate-release Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Add dynamic cert-manager certificates informer (knative#8517) * Add dynamic informer, part I Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Add Dynamic certificates informer for EventTransform Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Add Dynamic certificates Informer to IntegrationSink Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Fix error message Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> --------- Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> Co-authored-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Improve CM Cert reconcile and deletion if feature is turned off (knative#8519) refactor CM Cert reconciler and take care of delete if feature is disabled Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Remove transformations and integrations ConfigMaps (#1201) We don't use the ConfigMaps to inject the values, the operator will replace the value to the images directly. Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> Co-authored-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Run make generate-release Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Add configmaps/finalizers permissions Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Add update finalizers permissions for EventTransform reconciled resources Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> * Volume mounts use direct Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> * Fix EventTransform with TLS Sink test Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> --------- Signed-off-by: Matthias Wessendorf <mwessend@redhat.com> Signed-off-by: Pierangelo Di Pilato <pierdipi@redhat.com> Co-authored-by: David Simansky <dsimansk@redhat.com> Co-authored-by: Pierangelo Di Pilato <pierdipi@redhat.com> Co-authored-by: Marek Schmidt <maschmid@redhat.com>

matzew added 19 commits February 18, 2025 17:40

Adding cert-mananger bits

ffc8377

Basics for Cert-manager Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Adding create cert manifest function

ba26ba5

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Use the make cert

3c6a30a

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Reconcile Certificate manifest and add RBAC

2df990c

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Add secret filter to controller

f6fa1df

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Look up secrets/certs for sink

cf0574d

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Remove old/wrong Certificate manifest and reference

0d49024

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Fix controller compile

c12dea3

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Formatting

6af8b8a

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

change the reconcile of cert manifest, and run it only w/ some form o…

31bf340

…f TLS Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

using filtered informer

3b6e31d

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Adding Rekt test for IntegrationSink TLS support

5643b5e

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

adding a bit of https port for deployment/service of the IntegrationSink

b166f10

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Mounting secrets and setting quarkus env vars for TLS support

d9b646e

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Adding flags for different TLS levels resulting in diffeerent quarkus…

a2909da

… env vars Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Remove bad comment

5203878

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Adding label

5a235c1

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Update codegen

34b8cd2

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

Disable tmp. the cert manager feature

7400edd

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

knative-prow bot added the area/test-and-release Test infrastructure, tests or release label Feb 19, 2025

knative-prow bot requested review from mgencur and pierDipi February 19, 2025 08:51

knative-prow bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Feb 19, 2025

matzew added 2 commits February 19, 2025 09:58

Fixing header/year

3059b60

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

More test tweaking

05de212

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

pierDipi reviewed Feb 19, 2025

View reviewed changes

config/core/roles/controller-clusterroles.yaml Outdated Show resolved Hide resolved

Remove unused and comment out the hooks for now

5a0c1de

Signed-off-by: Matthias Wessendorf <mwessend@redhat.com>

knative-prow bot assigned pierDipi Feb 19, 2025

knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label Feb 19, 2025

knative-prow bot merged commit 732ec62 into knative:main Feb 19, 2025
30 of 36 checks passed

pierDipi mentioned this pull request Feb 26, 2025

Enable Cert Manager #8509

Merged

5 tasks

Partial implementation of certmanager for integration sink #8481

Partial implementation of certmanager for integration sink #8481

Uh oh!

Conversation

matzew commented Feb 19, 2025

Proposed Changes

Next steps (or PRs)

Uh oh!

knative-prow bot commented Feb 19, 2025

Uh oh!

codecov bot commented Feb 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

matzew commented Feb 19, 2025

Uh oh!

matzew commented Feb 19, 2025

Uh oh!

matzew commented Feb 19, 2025

Uh oh!

matzew commented Feb 19, 2025

Uh oh!

matzew commented Feb 19, 2025

Uh oh!

matzew commented Feb 19, 2025

Uh oh!

pierDipi Feb 19, 2025

Choose a reason for hiding this comment

Uh oh!

matzew Feb 19, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pierDipi commented Feb 19, 2025

Uh oh!

matzew commented Feb 19, 2025

Uh oh!

matzew commented Feb 19, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Feb 19, 2025 •

edited

Loading