feat: add KongVault CRD

CHANGELOG.md

@@ -129,6 +129,9 @@ Adding a new version? You'll need three changes:
 - Added functionality to the `KongUpstreamPolicy` controller to properly set and
   enforce `KongUpstreamPolicy` status.
   [#5185](https://github.com/Kong/kubernetes-ingress-controller/pull/5185)
+- Add CRD `KongVault` to reperesent a custom Kong vault for storing senstive
+  data used in plugin configurations.
+  [#5354](https://github.com/Kong/kubernetes-ingress-controller/pull/5354)
 
 ### Fixed
 

config/crd/bases/configuration.konghq.com_kongvaults.yaml

@@ -0,0 +1,174 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    controller-gen.kubebuilder.io/version: v0.13.0
+  name: kongvaults.configuration.konghq.com
+spec:
+  group: configuration.konghq.com
+  names:
+    kind: KongVault
+    listKind: KongVaultList
+    plural: kongvaults
+    singular: kongvault
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - description: Name of the backend of the vault
+      jsonPath: .spec.backend
+      name: Backend-Type
+      type: string
+    - description: Prefix of vault URI to reference the values in the vault
+      jsonPath: .spec.prefix
+      name: Prefix
+      type: string
+    - description: Age
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    - description: Description
+      jsonPath: .spec.description
+      name: Description
+      priority: 1
+      type: string
+    - jsonPath: .status.conditions[?(@.type=="Programmed")].status
+      name: Programmed
+      type: string
+    name: v1alpha1
+    schema:
+      openAPIV3Schema:
+        description: 'KongVault is the schema for kongvaults API which defines a custom
+          Kong vault. A Kong vault is a storage to store sensitive data, where the
+          values can be referenced in configuration of plugins. See: https://docs.konghq.com/gateway/latest/kong-enterprise/secrets-management/'
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: KongVaultSpec defines specification of a custom Kong vault.
+            properties:
+              backend:
+                description: 'Backend is the type of the backend storing the secrets
+                  in the vault. The supported backends of Kong is listed here: https://docs.konghq.com/gateway/latest/kong-enterprise/secrets-management/backends/'
+                minLength: 1
+                type: string
+              config:
+                description: Config is the configuration of the vault. Varies for
+                  different backends.
+                x-kubernetes-preserve-unknown-fields: true
+              description:
+                description: Description is the additional information about the vault.
+                type: string
+              prefix:
+                description: Prefix is the prefix of vault URI for referencing values
+                  in the vault.
+                minLength: 1
+                type: string
+            required:
+            - backend
+            - prefix
+            type: object
+          status:
+            description: KongVaultStatus represents the current status of the KongVault
+              resource.
+            properties:
+              conditions:
+                default:
+                - lastTransitionTime: "1970-01-01T00:00:00Z"
+                  message: Waiting for controller
+                  reason: Pending
+                  status: Unknown
+                  type: Programmed
+                description: "Conditions describe the current conditions of the KongVaultStatus.
+                  \n Known condition types are: \n * \"Programmed\""
+                items:
+                  description: "Condition contains details for one aspect of the current
+                    state of this API Resource. --- This struct is intended for direct
+                    use as an array at the field path .status.conditions.  For example,
+                    \n type FooStatus struct{ // Represents the observations of a
+                    foo's current state. // Known .status.conditions.type are: \"Available\",
+                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
+                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
+                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
+                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
+                  properties:
+                    lastTransitionTime:
+                      description: lastTransitionTime is the last time the condition
+                        transitioned from one status to another. This should be when
+                        the underlying condition changed.  If that is not known, then
+                        using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: message is a human readable message indicating
+                        details about the transition. This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: observedGeneration represents the .metadata.generation
+                        that the condition was set based upon. For instance, if .metadata.generation
+                        is currently 12, but the .status.conditions[x].observedGeneration
+                        is 9, the condition is out of date with respect to the current
+                        state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: reason contains a programmatic identifier indicating
+                        the reason for the condition's last transition. Producers
+                        of specific condition types may define expected values and
+                        meanings for this field, and whether the values are considered
+                        a guaranteed API. The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                        --- Many .condition.type values are consistent across resources
+                        like Available, but because arbitrary conditions can be useful
+                        (see .node.status.conditions), the ability to deconflict is
+                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                maxItems: 8
+                type: array
+                x-kubernetes-list-map-keys:
+                - type
+                x-kubernetes-list-type: map
+            required:
+            - conditions
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}

pkg/apis/configuration/v1alpha1/kong_vault_types.go

@@ -0,0 +1,93 @@
+/*
+Copyright 2023 Kong, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha1
+
+import (
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	KongVaultKind = "KongVault"
+)
+
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +kubebuilder:object:root=true
+// +kubebuilder:storageversion
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:scope=Cluster,shortName=kv,categories=kong-ingress-controller
+// +kubebuilder:resource:path=kongvaults
+// +kubebuilder:printcolumn:name="Backend-Type",type=string,JSONPath=`.spec.backend`,description="Name of the backend of the vault"
+// +kubebuilder:printcolumn:name="Prefix",type=string,JSONPath=`.spec.prefix`,description="Prefix of vault URI to reference the values in the vault"
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`,description="Age"
+// +kubebuilder:printcolumn:name="Description",type=string,JSONPath=`.spec.description`,description="Description",priority=1
+// +kubebuilder:printcolumn:name="Programmed",type=string,JSONPath=`.status.conditions[?(@.type=="Programmed")].status`
+
+// KongVault is the schema for kongvaults API which defines a custom Kong vault.
+// A Kong vault is a storage to store sensitive data, where the values can be referenced in configuration of plugins.
+// See: https://docs.konghq.com/gateway/latest/kong-enterprise/secrets-management/
+type KongVault struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	Spec              KongVaultSpec   `json:"spec"`
+	Status            KongVaultStatus `json:"status,omitempty"`
+}
+
+// KongVaultSpec defines specification of a custom Kong vault.
+type KongVaultSpec struct {
+	// Backend is the type of the backend storing the secrets in the vault.
+	// The supported backends of Kong is listed here:
+	// https://docs.konghq.com/gateway/latest/kong-enterprise/secrets-management/backends/
+	// +kubebuilder:validation:MinLength=1
+	Backend string `json:"backend"`
+	// Prefix is the prefix of vault URI for referencing values in the vault.
+	// +kubebuilder:validation:MinLength=1
+	Prefix string `json:"prefix"`
+	// Description is the additional information about the vault.
+	Description string `json:"description,omitempty"`
+	// Config is the configuration of the vault. Varies for different backends.
+	Config apiextensionsv1.JSON `json:"config,omitempty"`
+}
+
+// KongVaultStatus represents the current status of the KongVault resource.
+type KongVaultStatus struct {
+	// Conditions describe the current conditions of the KongVaultStatus.
+	//
+	// Known condition types are:
+	//
+	// * "Programmed"
+	//
+	// +listType=map
+	// +listMapKey=type
+	// +kubebuilder:validation:MaxItems=8
+	// +kubebuilder:default={{type: "Programmed", status: "Unknown", reason:"Pending", message:"Waiting for controller", lastTransitionTime: "1970-01-01T00:00:00Z"}}
+	Conditions []metav1.Condition `json:"conditions"`
+}
+
+// +kubebuilder:object:root=true
+
+// KongVaultList contains a list of KongVault.
+type KongVaultList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []KongVault `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&KongVault{}, &KongVaultList{})
+}