Skip to content

Commit ed61b07

Browse files
Gazza7205Gazza7205
committed
updated otk dual modesupport
1 parent 0f54d5b commit ed61b07

19 files changed

Lines changed: 1600 additions & 622 deletions

File tree

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ run: manifests generate fmt vet ## Run a controller from your host.
222222

223223
.PHONY: docker-build
224224
docker-build: dockerfile #test ## Build docker image with the manager.
225-
$(CONTAINER_TOOL) build -f operator.Dockerfile -t ${IMG} .
225+
$(CONTAINER_TOOL) build -t ${IMG} -f operator.Dockerfile --build-arg COPYRIGHT="${COPYRIGHT}" --build-arg AUTHOR="layer7" --build-arg TITLE="layer7-operator" --build-arg VERSION="${IMAGE_TAG}" --build-arg CREATED="${CREATED}" .
226226

227227
.PHONY: docker-push
228228
docker-push: ## Push docker image with the manager.

‎api/v1/gateway_types.go‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,8 @@ type GatewayStatus struct {
117117
LastAppliedExternalSecrets map[string][]string `json:"lastAppliedExternalSecrets,omitempty"`
118118
// LastAppliedExternalCerts
119119
LastAppliedExternalCerts map[string][]string `json:"lastAppliedExternalCerts,omitempty"`
120+
// LastAppliedOtkFipsCerts tracks which OTK FIPS user certificates have been applied
121+
LastAppliedOtkFipsCerts map[string][]string `json:"lastAppliedOtkFipsCerts,omitempty"`
120122
}
121123

122124
// GatewayState tracks the status of Gateway Resources
@@ -367,6 +369,19 @@ type Otk struct {
367369
InternalOTKGateway GatewayReference `json:"internalGateway,omitempty"`
368370
//DmzOTKGateway reference if type is internal
369371
DmzOTKGateway GatewayReference `json:"dmzGateway,omitempty"`
372+
// FipsCertificates is a list of certificate references for FIPS user management
373+
// on Internal gateways. Each entry references a Secret or ConfigMap containing
374+
// leaf certificates for DMZ gateway mTLS client authentication.
375+
FipsCertificates []OtkFipsCertificate `json:"fipsCertificates,omitempty"`
376+
}
377+
378+
type OtkFipsCertificate struct {
379+
// Enabled or disabled
380+
Enabled bool `json:"enabled,omitempty"`
381+
// Name of the Secret or ConfigMap
382+
Name string `json:"name,omitempty"`
383+
// Type of the referenced resource: "secret" or "configmap"
384+
Type string `json:"type,omitempty"`
370385
}
371386

372387
// OtkMaintenanceTasks are included in the install bundle as disabled scheduled tasks
@@ -384,7 +399,7 @@ type GatewayReference struct {
384399
Namespace string `json:"namespace,omitempty"`
385400
// Url of the target gateway
386401
// used for post-installation gateway policy configuration
387-
Url string `json:"Url,omitempty"`
402+
Url string `json:"url,omitempty"`
388403
// Port of the target gateway
389404
Port int `json:"port,omitempty"`
390405
}

‎api/v1/zz_generated.deepcopy.go‎

Lines changed: 36 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/security.brcmlabs.com_gateways.yaml‎

Lines changed: 35 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4006,11 +4006,6 @@ spec:
40064006
dmzGateway:
40074007
description: DmzOTKGateway reference if type is internal
40084008
properties:
4009-
Url:
4010-
description: |-
4011-
Url of the target gateway
4012-
used for post-installation gateway policy...
4013-
type: string
40144009
name:
40154010
description: |-
40164011
Name of the gateway
@@ -4023,10 +4018,32 @@ spec:
40234018
port:
40244019
description: Port of the target gateway
40254020
type: integer
4021+
url:
4022+
description: |-
4023+
Url of the target gateway
4024+
used for post-installation gateway policy...
4025+
type: string
40264026
type: object
40274027
enabled:
40284028
description: Enable or disable the OTK initContainer
40294029
type: boolean
4030+
fipsCertificates:
4031+
description: FipsCertificates is a list of certificate references
4032+
for FIPS user...
4033+
items:
4034+
properties:
4035+
enabled:
4036+
description: Enabled or disabled
4037+
type: boolean
4038+
name:
4039+
description: Name of the Secret or ConfigMap
4040+
type: string
4041+
type:
4042+
description: 'Type of the referenced resource: "secret"
4043+
or "configmap"'
4044+
type: string
4045+
type: object
4046+
type: array
40304047
initContainerImage:
40314048
description: InitContainerImage for the initContainer
40324049
type: string
@@ -4163,11 +4180,6 @@ spec:
41634180
internalGateway:
41644181
description: InternalOTKGateway reference if type is dmz
41654182
properties:
4166-
Url:
4167-
description: |-
4168-
Url of the target gateway
4169-
used for post-installation gateway policy...
4170-
type: string
41714183
name:
41724184
description: |-
41734185
Name of the gateway
@@ -4180,6 +4192,11 @@ spec:
41804192
port:
41814193
description: Port of the target gateway
41824194
type: integer
4195+
url:
4196+
description: |-
4197+
Url of the target gateway
4198+
used for post-installation gateway policy...
4199+
type: string
41834200
type: object
41844201
maintenanceTasks:
41854202
description: MaintenanceTasks for the OTK database are disabled
@@ -6510,6 +6527,14 @@ spec:
65106527
items:
65116528
type: string
65126529
type: array
6530+
lastAppliedOtkFipsCerts:
6531+
additionalProperties:
6532+
items:
6533+
type: string
6534+
type: array
6535+
description: LastAppliedOtkFipsCerts tracks which OTK FIPS user certificates
6536+
have been...
6537+
type: object
65136538
managementPod:
65146539
description: Management Pod is a Gateway with a special annotation
65156540
is used as a...

‎deploy/bundle.yaml‎

Lines changed: 71 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -4002,12 +4002,47 @@ spec:
40024002
description: Type of OTK Database
40034003
type: string
40044004
type: object
4005-
dmzGatewayReference:
4006-
description: OTKPort is used in Single mode - sets the otk.
4007-
type: string
4005+
dmzGateway:
4006+
description: DmzOTKGateway reference if type is internal
4007+
properties:
4008+
name:
4009+
description: |-
4010+
Name of the gateway
4011+
if managing otk gateways across namespaces this must...
4012+
type: string
4013+
namespace:
4014+
description: Namespace of the referenced gateway if managing
4015+
gateways cross namespace...
4016+
type: string
4017+
port:
4018+
description: Port of the target gateway
4019+
type: integer
4020+
url:
4021+
description: |-
4022+
Url of the target gateway
4023+
used for post-installation gateway policy...
4024+
type: string
4025+
type: object
40084026
enabled:
40094027
description: Enable or disable the OTK initContainer
40104028
type: boolean
4029+
fipsCertificates:
4030+
description: FipsCertificates is a list of certificate references
4031+
for FIPS user...
4032+
items:
4033+
properties:
4034+
enabled:
4035+
description: Enabled or disabled
4036+
type: boolean
4037+
name:
4038+
description: Name of the Secret or ConfigMap
4039+
type: string
4040+
type:
4041+
description: 'Type of the referenced resource: "secret"
4042+
or "configmap"'
4043+
type: string
4044+
type: object
4045+
type: array
40114046
initContainerImage:
40124047
description: InitContainerImage for the initContainer
40134048
type: string
@@ -4141,14 +4176,27 @@ spec:
41414176
type: string
41424177
type: object
41434178
type: object
4144-
internalGatewayPort:
4145-
description: InternalGatewayPort defaults to 9443 or graphmanDynamicSync
4146-
port
4147-
type: integer
4148-
internalGatewayReference:
4149-
description: InternalOtkGatewayReference to an Operator managed
4150-
Gateway deployment that...
4151-
type: string
4179+
internalGateway:
4180+
description: InternalOTKGateway reference if type is dmz
4181+
properties:
4182+
name:
4183+
description: |-
4184+
Name of the gateway
4185+
if managing otk gateways across namespaces this must...
4186+
type: string
4187+
namespace:
4188+
description: Namespace of the referenced gateway if managing
4189+
gateways cross namespace...
4190+
type: string
4191+
port:
4192+
description: Port of the target gateway
4193+
type: integer
4194+
url:
4195+
description: |-
4196+
Url of the target gateway
4197+
used for post-installation gateway policy...
4198+
type: string
4199+
type: object
41524200
maintenanceTasks:
41534201
description: MaintenanceTasks for the OTK database are disabled
41544202
by default
@@ -4157,6 +4205,10 @@ spec:
41574205
description: Enable or disable database maintenance tasks
41584206
type: boolean
41594207
type: object
4208+
manageCrossNamespace:
4209+
description: ManageCrossNamespace allows a cluster-wide layer7
4210+
operator to manage...
4211+
type: boolean
41604212
overrides:
41614213
description: Overrides default OTK install functionality
41624214
properties:
@@ -4191,10 +4243,6 @@ spec:
41914243
port:
41924244
description: OTKPort defaults to 8443
41934245
type: integer
4194-
runtimeSyncIntervalSeconds:
4195-
description: RuntimeSyncIntervalSeconds how often OTK Gateways
4196-
should be updated in...
4197-
type: integer
41984246
subSolutionKitNames:
41994247
description: A list of subSolutionKitNames - all,internal
42004248
or dmz cover the primary use...
@@ -6478,6 +6526,14 @@ spec:
64786526
items:
64796527
type: string
64806528
type: array
6529+
lastAppliedOtkFipsCerts:
6530+
additionalProperties:
6531+
items:
6532+
type: string
6533+
type: array
6534+
description: LastAppliedOtkFipsCerts tracks which OTK FIPS user certificates
6535+
have been...
6536+
type: object
64816537
managementPod:
64826538
description: Management Pod is a Gateway with a special annotation
64836539
is used as a...

0 commit comments

Comments
 (0)