Wildcard tls secret

api/core/v1alpha1/common.go

@@ -9,11 +9,13 @@ const (
 )
 
 const (
-	LabelManagedBy    = "app.kubernetes.io/managed-by"
-	LabelStackName    = "core.stackdome.io/stack-name"
-	LabelStackID      = "core.stackdome.io/stack-id"
-	LabelResourceName = "core.stackdome.io/resource-name"
-	LabelResourceID   = "core.stackdome.io/resource-id"
+	LabelManagedBy                 = "app.kubernetes.io/managed-by"
+	LabelStackName                 = "core.stackdome.io/stack-name"
+	LabelStackID                   = "core.stackdome.io/stack-id"
+	LabelResourceName              = "core.stackdome.io/resource-name"
+	LabelResourceID                = "core.stackdome.io/resource-id"
+	LabelUsesPlatformWildcardTLS   = "core.stackdome.io/uses-platform-wildcard-tls"
+	LabelPlatformWildcardTLSSecret = "core.stackdome.io/platform-wildcard-tls"
 
 	ManagedByStackdome = "stackdome"
 

api/core/v1alpha1/stack_resource_types.go

@@ -195,6 +195,14 @@ type Port struct {
 	FQDN string `json:"fqdn,omitempty"`
 	// +optional
 	TLS bool `json:"tls,omitempty"`
+	// TLSSecretRef names a pre-provisioned TLS Secret in the configured platform
+	// TLS namespace. Its certificate must cover FQDN. When set, the ingress uses
+	// a copy of this Secret instead of asking cert-manager for a certificate.
+	// +optional
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=253
+	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
+	TLSSecretRef string `json:"tlsSecretRef,omitempty"`
 }
 
 // +kubebuilder:validation:XValidation:rule="has(self.value) != has(self.valueFrom)",message="exactly one of value or valueFrom must be set"
@@ -447,6 +455,26 @@ type BuildStatus struct {
 	Phase          string `json:"phase,omitempty"`
 }
 
+// CertManagerTLSStatus records when this resource started waiting for its
+// cert-manager Certificate. The time remains set after the grace period
+// expires so another reconcile does not restart the clock.
+type CertManagerTLSStatus struct {
+	// +optional
+	WaitingSince *metav1.Time `json:"waitingSince,omitempty"`
+}
+
+// ReferencedTLSSecretStatus records controller state for a TLS Secret copied
+// from the platform TLS namespace. It is not a user-facing condition: it scopes the
+// temporary HTTPS grace period to the configured Secret reference.
+type ReferencedTLSSecretStatus struct {
+	// Reference is the configured TLS Secret name.
+	Reference string `json:"reference"`
+	// WaitingSince is set while the source Secret or its workload replica is
+	// unavailable, and is cleared once the replica is ready.
+	// +optional
+	WaitingSince *metav1.Time `json:"waitingSince,omitempty"`
+}
+
 // StackResourceStatus defines the observed state of StackResource
 type StackResourceStatus struct {
 	// The most recent generation observed by the controller.
@@ -478,6 +506,16 @@ type StackResourceStatus struct {
 	// memory) also keeps the grace window intact across operator restarts.
 	// +optional
 	PortCheck *PortCheckStatus `json:"portCheck,omitempty"`
+	// ReferencedTLSSecret tracks the copied Secret and the start of its
+	// temporary unavailable period. It is absent when no referenced TLS Secret
+	// is configured.
+	// +optional
+	ReferencedTLSSecret *ReferencedTLSSecretStatus `json:"referencedTLSSecret,omitempty"`
+	// CertManagerTLS tracks the certificate grace period independently from a
+	// referenced TLS Secret. It is absent when no certificate is needed or the
+	// certificate is ready.
+	// +optional
+	CertManagerTLS *CertManagerTLSStatus `json:"certManagerTLS,omitempty"`
 	// Summary is the agent's rolled-up verdict, written every pass.
 	// +optional
 	Summary *StackResourceStatusSummary `json:"summary,omitempty"`
@@ -582,6 +620,15 @@ type StackResource struct {
 	Status StackResourceStatus `json:"status,omitempty"`
 }
 
+func (w *StackResource) GetPort(port int32) *Port {
+	for _, p := range w.Spec.Ports {
+		if p.Number == port {
+			return &p
+		}
+	}
+	return nil
+}
+
 func (w *StackResource) NeedsPullSecret() bool {
 	if w.Spec.ImageSpec != nil && w.Spec.ImageSpec.PullAuth != nil {
 		return true

charts/stackdome-agent-standalone/crds/core.stackdome.io_stackresources.yaml

@@ -676,6 +676,15 @@ spec:
                       type: string
                     tls:
                       type: boolean
+                    tlsSecretRef:
+                      description: |-
+                        TLSSecretRef names a pre-provisioned TLS Secret in the configured platform
+                        TLS namespace. Its certificate must cover FQDN. When set, the ingress uses
+                        a copy of this Secret instead of asking cert-manager for a certificate.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
                   required:
                   - name
                   - number
@@ -814,6 +823,16 @@ spec:
               availableReplicas:
                 format: int32
                 type: integer
+              certManagerTLS:
+                description: |-
+                  CertManagerTLS tracks the certificate grace period independently from a
+                  referenced TLS Secret. It is absent when no certificate is needed or the
+                  certificate is ready.
+                properties:
+                  waitingSince:
+                    format: date-time
+                    type: string
+                type: object
               conditions:
                 description: Conditions is a list of status conditions ths object
                   is in.
@@ -1007,6 +1026,24 @@ spec:
                 - revision
                 - status
                 type: object
+              referencedTLSSecret:
+                description: |-
+                  ReferencedTLSSecret tracks the copied Secret and the start of its
+                  temporary unavailable period. It is absent when no referenced TLS Secret
+                  is configured.
+                properties:
+                  reference:
+                    description: Reference is the configured TLS Secret name.
+                    type: string
+                  waitingSince:
+                    description: |-
+                      WaitingSince is set while the source Secret or its workload replica is
+                      unavailable, and is cleared once the replica is ready.
+                    format: date-time
+                    type: string
+                required:
+                - reference
+                type: object
               replicas:
                 format: int32
                 type: integer

charts/stackdome-agent-standalone/templates/clusterrole.yaml

@@ -119,6 +119,7 @@ rules:
     - list
     - patch
     - create
+    - delete
 - apiGroups:
     - traefik.io
   resources:

charts/stackdome-agent-standalone/templates/deployment.yaml

@@ -27,6 +27,7 @@ spec:
         image: {{ include "stackdome-agent-standalone.image" . }}
         imagePullPolicy: {{ .Values.image.pullPolicy }}
         args:
+        - --platform-tls-namespace={{ .Values.platformTLSNamespace }}
         {{- if .Values.leaderElect }}
         - --leader-elect
         {{- end }}

charts/stackdome-agent-standalone/values.yaml

@@ -9,6 +9,7 @@ imagePullSecrets: []
 
 replicaCount: 1
 leaderElect: true
+platformTLSNamespace: stackdome-control-plane
 
 resources:
   limits:

charts/stackdome-agent/values.yaml

@@ -6,6 +6,7 @@ stackdome-agent-standalone:
     tag: ""
   replicaCount: 1
   leaderElect: true
+  platformTLSNamespace: stackdome-control-plane
   resources:
     limits:
       cpu: 500m

cmd/cluster-agent/cluster-agent-manager.go

@@ -81,6 +81,7 @@ func main() {
 	var secureMetrics bool
 	var enableHTTP2 bool
 	var imageBuildHistoryLimit int
+	var platformTLSNamespace string
 	var portCheckGrace time.Duration
 	var errorPagesAddr string
 	flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
@@ -96,6 +97,8 @@ func main() {
 		"If set, HTTP/2 will be enabled for the metrics and webhook servers")
 	flag.IntVar(&imageBuildHistoryLimit, "image-build-history-limit", 5,
 		"Number of completed/cancelled ImageBuilds to retain per StackResource.")
+	flag.StringVar(&platformTLSNamespace, "platform-tls-namespace", stackresource.DefaultPlatformTLSNamespace,
+		"Namespace containing the platform wildcard TLS Secret.")
 	flag.DurationVar(&portCheckGrace, "port-check-grace", workload.DefaultPortCheckGrace,
 		"How long a closed-port verdict on a StackResource is re-verified before it is believed and the resource is reported failed.")
 	opts := zap.Options{
@@ -200,6 +203,7 @@ func main() {
 		mgr.GetClient(), mgr.GetScheme(), uncachedClient,
 		stackresource.StackResourceReconcilerOpts{
 			ImageBuildHistoryLimit: imageBuildHistoryLimit,
+			PlatformTLSNamespace:   platformTLSNamespace,
 			PortVerifier:           portVerifier,
 			PortCheckGrace:         portCheckGrace,
 		})

config/deploy/01-rbac.yaml

@@ -165,6 +165,7 @@ rules:
   - list
   - patch
   - create
+  - delete
 - apiGroups:
   - traefik.io
   resources:

config/deploy/crds/core.stackdome.io_stackresources.yaml

@@ -676,6 +676,15 @@ spec:
                       type: string
                     tls:
                       type: boolean
+                    tlsSecretRef:
+                      description: |-
+                        TLSSecretRef names a pre-provisioned TLS Secret in the configured platform
+                        TLS namespace. Its certificate must cover FQDN. When set, the ingress uses
+                        a copy of this Secret instead of asking cert-manager for a certificate.
+                      maxLength: 253
+                      minLength: 1
+                      pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
                   required:
                   - name
                   - number
@@ -814,6 +823,16 @@ spec:
               availableReplicas:
                 format: int32
                 type: integer
+              certManagerTLS:
+                description: |-
+                  CertManagerTLS tracks the certificate grace period independently from a
+                  referenced TLS Secret. It is absent when no certificate is needed or the
+                  certificate is ready.
+                properties:
+                  waitingSince:
+                    format: date-time
+                    type: string
+                type: object
               conditions:
                 description: Conditions is a list of status conditions ths object
                   is in.
@@ -1007,6 +1026,24 @@ spec:
                 - revision
                 - status
                 type: object
+              referencedTLSSecret:
+                description: |-
+                  ReferencedTLSSecret tracks the copied Secret and the start of its
+                  temporary unavailable period. It is absent when no referenced TLS Secret
+                  is configured.
+                properties:
+                  reference:
+                    description: Reference is the configured TLS Secret name.
+                    type: string
+                  waitingSince:
+                    description: |-
+                      WaitingSince is set while the source Secret or its workload replica is
+                      unavailable, and is cleared once the replica is ready.
+                    format: date-time
+                    type: string
+                required:
+                - reference
+                type: object
               replicas:
                 format: int32
                 type: integer