Open
Description
Enable TLS for source artifact download URL
The current implementation of source controller API ImageRepository
and MavenArtifact
expose the resulting source artifact at a HTTP
URL defined in .status.artifact.url
. The source artifact URL is not exposed externally and is only available to in-cluster consumers. This feature request requires TLS for the source artifact download endpoint.
Additional context
An accepted solution for this Proposal must include the requirements listed below.
- Backward compatibility (i.e., deprecate
HTTP
URL and support existing clients during the deprecated period) - Support certificate signed by private CA
- Able to consume certificate updates
- In-cluster clients able to trust the certificate
Proposal
- Add a fixed named secret that contains the TLS key and certificate
- Source Controller manager deployment will use the secret in a mounted volume
- Use
cert-manager
to issue a certificate and rotate expired certificates - Add a new type,
SecureArtifact
that has all the existing fields available in the existingArtifact
type plus a new field calledCABundle
. TheCABundle
is a string field that contains the client certificate key/value pair - The
URL
field forSecureArtifact
will contain theHTTPS
download URL - Source Controller APIs
Status
will includeSecureArtifact
as well as existingArtifact
and maintain backward compatibility
Here is a mock shape of the fixed name secret
apiVersion: v1
data:
ca.crt: …
tls.crt: …
tls.key: …
kind: Secret
metadata:
name: source-server-cert
namespace: source-system
type: kubernetes.io/tls
Here is a mock of the proposed API status
status:
artifact: # existing type `Artifact`
...
url: "http://..."
secureArtifact: # New type `SecureArtifact` = `Artifact` + CABundle
...
url: "https://..."
caBundle: ""
Testing
- Unit test coverage of the
HTTPS
feature - e2e integration test (CI)
- Install with value TLS enabled
- Create
ImageRespository
resource - Validate downloaded artifact from
HTTPS
endpoint - Create
MavenArtifact
resource - Validate downloaded maven artifact from
HTTPS
endpoint