2 * ============LICENSE_START=======================================================
3 * oom-certservice-k8s-external-provider
4 * ================================================================================
5 * Copyright 2019 The cert-manager authors.
6 * Modifications copyright (C) 2020 Nokia. All rights reserved.
7 * ================================================================================
8 * This source code was copied from the following git repository:
9 * https://github.com/smallstep/step-issuer
10 * The source code was modified for usage in the ONAP project.
11 * ================================================================================
12 * Licensed under the Apache License, Version 2.0 (the "License");
13 * you may not use this file except in compliance with the License.
14 * You may obtain a copy of the License at
16 * http://www.apache.org/licenses/LICENSE-2.0
18 * Unless required by applicable law or agreed to in writing, software
19 * distributed under the License is distributed on an "AS IS" BASIS,
20 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
21 * See the License for the specific language governing permissions and
22 * limitations under the License.
23 * ============LICENSE_END=========================================================
26 package cmpv2controller
32 "github.com/go-logr/logr"
33 apiutil "github.com/jetstack/cert-manager/pkg/api/util"
34 cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
35 cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
36 core "k8s.io/api/core/v1"
37 apierrors "k8s.io/apimachinery/pkg/api/errors"
38 "k8s.io/apimachinery/pkg/types"
39 "k8s.io/client-go/tools/record"
40 ctrl "sigs.k8s.io/controller-runtime"
41 "sigs.k8s.io/controller-runtime/pkg/client"
43 "onap.org/oom-certservice/k8s-external-provider/src/cmpv2api"
44 "onap.org/oom-certservice/k8s-external-provider/src/cmpv2controller/logger"
45 provisioners "onap.org/oom-certservice/k8s-external-provider/src/cmpv2provisioner"
49 privateKeySecretNameAnnotation = "cert-manager.io/private-key-secret-name"
50 privateKeySecretKey = "tls.key"
53 // CertificateRequestController reconciles a CMPv2Issuer object.
54 type CertificateRequestController struct {
57 Recorder record.EventRecorder
60 // Reconcile will read and validate a CMPv2Issuer resource associated to the
61 // CertificateRequest resource, and it will sign the CertificateRequest with the
62 // provisioner in the CMPv2Issuer.
63 func (controller *CertificateRequestController) Reconcile(k8sRequest ctrl.Request) (ctrl.Result, error) {
64 ctx := context.Background()
65 log := controller.Log.WithValues("certificate-request-controller", k8sRequest.NamespacedName)
67 // 1. Fetch the CertificateRequest resource being reconciled.
68 certificateRequest := new(cmapi.CertificateRequest)
69 if err := controller.Client.Get(ctx, k8sRequest.NamespacedName, certificateRequest); err != nil {
70 err = handleErrorResourceNotFound(log, err)
71 return ctrl.Result{}, err
74 // 2. Check if CertificateRequest is meant for CMPv2Issuer (if not ignore)
75 if !isCMPv2CertificateRequest(certificateRequest) {
76 log.V(4).Info("Certificate request is not meant for CMPv2Issuer (ignoring)",
77 "group", certificateRequest.Spec.IssuerRef.Group,
78 "kind", certificateRequest.Spec.IssuerRef.Kind)
79 return ctrl.Result{}, nil
82 // 3. If the certificate data is already set then we skip this request as it
83 // has already been completed in the past.
84 if len(certificateRequest.Status.Certificate) > 0 {
85 log.V(4).Info("Existing certificate data found in status, skipping already completed CertificateRequest")
86 return ctrl.Result{}, nil
89 // 4. Fetch the CMPv2Issuer resource
90 issuer := cmpv2api.CMPv2Issuer{}
91 issuerNamespaceName := types.NamespacedName{
92 Namespace: k8sRequest.Namespace,
93 Name: certificateRequest.Spec.IssuerRef.Name,
95 if err := controller.Client.Get(ctx, issuerNamespaceName, &issuer); err != nil {
96 controller.handleErrorGettingCMPv2Issuer(ctx, log, err, certificateRequest, issuerNamespaceName, k8sRequest)
97 return ctrl.Result{}, err
100 // 5. Check if CMPv2Issuer is ready to sing certificates
101 if !isCMPv2IssuerReady(issuer) {
102 err := controller.handleErrorCMPv2IssuerIsNotReady(ctx, log, issuerNamespaceName, certificateRequest, k8sRequest)
103 return ctrl.Result{}, err
106 // 6. Load the provisioner that will sign the CertificateRequest
107 provisioner, ok := provisioners.Load(issuerNamespaceName)
109 err := controller.handleErrorCouldNotLoadCMPv2Provisioner(ctx, log, issuerNamespaceName, certificateRequest)
110 return ctrl.Result{}, err
113 // 7. Get private key matching CertificateRequest
114 privateKeySecretName := certificateRequest.ObjectMeta.Annotations[privateKeySecretNameAnnotation]
115 privateKeySecretNamespaceName := types.NamespacedName{
116 Namespace: k8sRequest.Namespace,
117 Name: privateKeySecretName,
119 var privateKeySecret core.Secret
120 if err := controller.Client.Get(ctx, privateKeySecretNamespaceName, &privateKeySecret); err != nil {
121 controller.handleErrorGettingPrivateKey(ctx, log, err, certificateRequest, privateKeySecretNamespaceName)
122 return ctrl.Result{}, err
124 privateKeyBytes := privateKeySecret.Data[privateKeySecretKey]
126 // 8. Log Certificate Request properties not supported or overridden by CertService API
127 logger.LogCertRequestProperties(ctrl.Log.WithName("CSR details"), certificateRequest)
129 // 9. Sign CertificateRequest
130 signedPEM, trustedCAs, err := provisioner.Sign(ctx, certificateRequest, privateKeyBytes)
132 controller.handleErrorFailedToSignCertificate(ctx, log, err, certificateRequest)
133 return ctrl.Result{}, err
136 // 10. Store signed certificates in CertificateRequest
137 certificateRequest.Status.Certificate = signedPEM
138 certificateRequest.Status.CA = trustedCAs
139 if err := controller.updateCertificateRequestWithSignedCerficates(ctx, certificateRequest); err != nil {
140 return ctrl.Result{}, err
143 return ctrl.Result{}, nil
146 func (controller *CertificateRequestController) updateCertificateRequestWithSignedCerficates(ctx context.Context, certificateRequest *cmapi.CertificateRequest) error {
147 return controller.setStatus(ctx, certificateRequest, cmmeta.ConditionTrue, cmapi.CertificateRequestReasonIssued, "Certificate issued")
150 func (controller *CertificateRequestController) SetupWithManager(manager ctrl.Manager) error {
151 return ctrl.NewControllerManagedBy(manager).
152 For(&cmapi.CertificateRequest{}).
156 func (controller *CertificateRequestController) setStatus(ctx context.Context, certificateRequest *cmapi.CertificateRequest, status cmmeta.ConditionStatus, reason, message string, args ...interface{}) error {
157 completeMessage := fmt.Sprintf(message, args...)
158 apiutil.SetCertificateRequestCondition(certificateRequest, cmapi.CertificateRequestConditionReady, status, reason, completeMessage)
160 // Fire an Event to additionally inform users of the change
161 eventType := core.EventTypeNormal
162 if status == cmmeta.ConditionFalse {
163 eventType = core.EventTypeWarning
165 controller.Recorder.Event(certificateRequest, eventType, reason, completeMessage)
167 return controller.Client.Status().Update(ctx, certificateRequest)
170 func isCMPv2IssuerReady(issuer cmpv2api.CMPv2Issuer) bool {
171 condition := cmpv2api.CMPv2IssuerCondition{Type: cmpv2api.ConditionReady, Status: cmpv2api.ConditionTrue}
172 return hasCondition(issuer, condition)
175 func hasCondition(issuer cmpv2api.CMPv2Issuer, condition cmpv2api.CMPv2IssuerCondition) bool {
176 existingConditions := issuer.Status.Conditions
177 for _, cond := range existingConditions {
178 if condition.Type == cond.Type && condition.Status == cond.Status {
185 func isCMPv2CertificateRequest(certificateRequest *cmapi.CertificateRequest) bool {
186 return certificateRequest.Spec.IssuerRef.Group != "" &&
187 certificateRequest.Spec.IssuerRef.Group == cmpv2api.GroupVersion.Group &&
188 certificateRequest.Spec.IssuerRef.Kind == cmpv2api.CMPv2IssuerKind
194 func (controller *CertificateRequestController) handleErrorCouldNotLoadCMPv2Provisioner(ctx context.Context, log logr.Logger, issuerNamespaceName types.NamespacedName, certificateRequest *cmapi.CertificateRequest) error {
195 err := fmt.Errorf("provisioner %s not found", issuerNamespaceName)
196 log.Error(err, "Failed to load CMPv2 Provisioner resource")
197 _ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonPending, "Failed to load provisioner for CMPv2Issuer resource %s", issuerNamespaceName)
201 func (controller *CertificateRequestController) handleErrorCMPv2IssuerIsNotReady(ctx context.Context, log logr.Logger, issuerNamespaceName types.NamespacedName, certificateRequest *cmapi.CertificateRequest, req ctrl.Request) error {
202 err := fmt.Errorf("resource %s is not ready", issuerNamespaceName)
203 log.Error(err, "CMPv2Issuer not ready", "namespace", req.Namespace, "name", certificateRequest.Spec.IssuerRef.Name)
204 _ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonPending, "CMPv2Issuer resource %s is not Ready", issuerNamespaceName)
208 func (controller *CertificateRequestController) handleErrorGettingCMPv2Issuer(ctx context.Context, log logr.Logger, err error, certificateRequest *cmapi.CertificateRequest, issuerNamespaceName types.NamespacedName, req ctrl.Request) {
209 log.Error(err, "Failed to retrieve CMPv2Issuer resource", "namespace", req.Namespace, "name", certificateRequest.Spec.IssuerRef.Name)
210 _ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonPending, "Failed to retrieve CMPv2Issuer resource %s: %v", issuerNamespaceName, err)
213 func (controller *CertificateRequestController) handleErrorGettingPrivateKey(ctx context.Context, log logr.Logger, err error, certificateRequest *cmapi.CertificateRequest, pkSecretNamespacedName types.NamespacedName) {
214 log.Error(err, "Failed to retrieve private key secret for certificate request", "namespace", pkSecretNamespacedName.Namespace, "name", pkSecretNamespacedName.Name)
215 _ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonPending, "Failed to retrieve private key secret: %v", err)
218 func (controller *CertificateRequestController) handleErrorFailedToSignCertificate(ctx context.Context, log logr.Logger, err error, certificateRequest *cmapi.CertificateRequest) {
219 log.Error(err, "Failed to sign certificate request")
220 _ = controller.setStatus(ctx, certificateRequest, cmmeta.ConditionFalse, cmapi.CertificateRequestReasonFailed, "Failed to sign certificate request: %v", err)
223 func handleErrorResourceNotFound(log logr.Logger, err error) error {
224 if apierrors.IsNotFound(err) {
225 log.Error(err, "CertificateRequest resource not found")
227 log.Error(err, "Failed to retrieve CertificateRequest resource")