-
Notifications
You must be signed in to change notification settings - Fork 6
Open
Labels
enhancementNew feature or requestNew feature or request
Description
Enable TLS for source artifact download URL
The current implementation of source controller API ImageRepository
and MavenArtifact
expose the resulting source artifact at a HTTP
URL defined in .status.artifact.url
. The source artifact URL is not exposed externally and is only available to in-cluster consumers. This feature request requires TLS for the source artifact download endpoint.
Additional context
An accepted solution for this Proposal must include the requirements listed below.
- Backward compatibility (i.e., deprecate
HTTP
URL and support existing clients during the deprecated period) - Support certificate signed by private CA
- Able to consume certificate updates
- In-cluster clients able to trust the certificate
Proposal
- Add a fixed named secret that contains the TLS key and certificate
- Source Controller manager deployment will use the secret in a mounted volume
- Use
cert-manager
to issue a certificate and rotate expired certificates - Add a new type,
SecureArtifact
that has all the existing fields available in the existingArtifact
type plus a new field calledCABundle
. TheCABundle
is a string field that contains the client certificate key/value pair - The
URL
field forSecureArtifact
will contain theHTTPS
download URL - Source Controller APIs
Status
will includeSecureArtifact
as well as existingArtifact
and maintain backward compatibility
Here is a mock shape of the fixed name secret
apiVersion: v1
data:
ca.crt: …
tls.crt: …
tls.key: …
kind: Secret
metadata:
name: source-server-cert
namespace: source-system
type: kubernetes.io/tls
Here is a mock of the proposed API status
status:
artifact: # existing type `Artifact`
...
url: "http://..."
secureArtifact: # New type `SecureArtifact` = `Artifact` + CABundle
...
url: "https://..."
caBundle: ""
Testing
- Unit test coverage of the
HTTPS
feature - e2e integration test (CI)
- Install with value TLS enabled
- Create
ImageRespository
resource - Validate downloaded artifact from
HTTPS
endpoint - Create
MavenArtifact
resource - Validate downloaded maven artifact from
HTTPS
endpoint
Metadata
Metadata
Assignees
Labels
enhancementNew feature or requestNew feature or request