cert-manager: add jmp admin legacy client support, oidc missing yet

Author: mangelajo

e2e/tests.bats

@@ -179,6 +179,34 @@ EOF
   jmp shell --selector example.com/board=oidc j power on
 }
 
+@test "legacy client config contains CA certificate and works with secure TLS" {
+  # This test only works with operator-based deployment, which creates the CA ConfigMap
+  if [ "${METHOD:-}" != "operator" ]; then
+    skip "CA certificate injection only available with operator deployment (METHOD=$METHOD)"
+  fi
+
+  wait_for_exporter
+
+  # Get the config file path from jmp (clients are saved to ~/.config/jumpstarter/clients/)
+  local config_file="${HOME}/.config/jumpstarter/clients/test-client-legacy.yaml"
+  run test -f "$config_file"
+  assert_success
+
+  # Check that tls.ca field exists and is not empty
+  run go run github.com/mikefarah/yq/v4@latest '.tls.ca' "$config_file"
+  assert_success
+  # The CA should be a non-empty base64-encoded string
+  refute_output ""
+  refute_output "null"
+
+  # Test that the client works WITHOUT JUMPSTARTER_GRPC_INSECURE set
+  # This proves the CA certificate is being used for TLS verification
+  run env -u JUMPSTARTER_GRPC_INSECURE jmp get exporters --client test-client-legacy
+  assert_success
+  # Should see the legacy exporter in the output
+  assert_output --partial "test-exporter-legacy"
+}
+
 @test "can operate on leases" {
   wait_for_exporter
 

python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/clients.py

@@ -12,6 +12,7 @@
 from .util import AbstractAsyncCustomObjectApi
 from jumpstarter.config.client import ClientConfigV1Alpha1, ClientConfigV1Alpha1Drivers
 from jumpstarter.config.common import ObjectMeta
+from jumpstarter.config.tls import TLSConfigV1Alpha1
 
 logger = logging.getLogger(__name__)
 
@@ -147,6 +148,8 @@ async def get_client_config(self, name: str, allow: list[str], unsafe=False) ->
         secret = await self.core_api.read_namespaced_secret(client.status.credential.name, self.namespace)
         endpoint = client.status.endpoint
         token = base64.b64decode(secret.data["token"]).decode("utf8")
+        # Get CA bundle from ConfigMap (base64-encoded)
+        ca_bundle = await self.get_ca_bundle()
         return ClientConfigV1Alpha1(
             alias=name,
             metadata=ObjectMeta(
@@ -156,6 +159,7 @@ async def get_client_config(self, name: str, allow: list[str], unsafe=False) ->
             endpoint=endpoint,
             token=token,
             drivers=ClientConfigV1Alpha1Drivers(allow=allow, unsafe=unsafe),
+            tls=TLSConfigV1Alpha1(ca=ca_bundle),
         )
 
     async def delete_client(self, name: str):

python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/clients_test.py

@@ -1,7 +1,12 @@
+import base64
+from unittest.mock import AsyncMock, MagicMock
 
-from kubernetes_asyncio.client.models import V1ObjectMeta
+import pytest
+from kubernetes_asyncio.client.exceptions import ApiException
+from kubernetes_asyncio.client.models import V1ConfigMap, V1ObjectMeta, V1Secret
 
 from jumpstarter_kubernetes import V1Alpha1Client, V1Alpha1ClientStatus
+from jumpstarter_kubernetes.clients import ClientsV1Alpha1Api
 
 TEST_CLIENT = V1Alpha1Client(
     api_version="jumpstarter.dev/v1alpha1",
@@ -123,7 +128,6 @@ def test_client_from_dict_without_status():
 
 def test_client_rich_add_columns():
     """Test V1Alpha1Client.rich_add_columns"""
-    from unittest.mock import MagicMock
 
     mock_table = MagicMock()
     V1Alpha1Client.rich_add_columns(mock_table)
@@ -134,7 +138,6 @@ def test_client_rich_add_columns():
 
 def test_client_rich_add_rows_with_status():
     """Test V1Alpha1Client.rich_add_rows with status"""
-    from unittest.mock import MagicMock
 
     mock_table = MagicMock()
     TEST_CLIENT.rich_add_rows(mock_table)
@@ -143,7 +146,6 @@ def test_client_rich_add_rows_with_status():
 
 def test_client_rich_add_rows_without_status():
     """Test V1Alpha1Client.rich_add_rows without status"""
-    from unittest.mock import MagicMock
 
     client = V1Alpha1Client(
         api_version="jumpstarter.dev/v1alpha1",
@@ -205,7 +207,6 @@ def test_client_list_from_dict():
 
 def test_client_list_rich_add_columns():
     """Test V1Alpha1ClientList.rich_add_columns"""
-    from unittest.mock import MagicMock
 
     from jumpstarter_kubernetes import V1Alpha1ClientList
 
@@ -216,7 +217,6 @@ def test_client_list_rich_add_columns():
 
 def test_client_list_rich_add_rows():
     """Test V1Alpha1ClientList.rich_add_rows"""
-    from unittest.mock import MagicMock
 
     from jumpstarter_kubernetes import V1Alpha1ClientList
 
@@ -234,3 +234,179 @@ def test_client_list_rich_add_names():
     names = []
     client_list.rich_add_names(names)
     assert names == ["client.jumpstarter.dev/test-client"]
+
+
+# Tests for get_ca_bundle and get_client_config
+
+
+@pytest.mark.asyncio
+async def test_get_ca_bundle_with_ca_cert():
+    """Test get_ca_bundle returns base64-encoded CA certificate"""
+    api = ClientsV1Alpha1Api(namespace="test-namespace")
+    api.core_api = AsyncMock()
+
+    # Mock ConfigMap with CA certificate
+    ca_cert_pem = "-----BEGIN CERTIFICATE-----\nMIIBtest\n-----END CERTIFICATE-----"
+    mock_configmap = V1ConfigMap(data={"ca.crt": ca_cert_pem})
+    api.core_api.read_namespaced_config_map = AsyncMock(return_value=mock_configmap)
+
+    result = await api.get_ca_bundle()
+
+    # Verify it's base64-encoded
+    expected = base64.b64encode(ca_cert_pem.encode("utf-8")).decode("utf-8")
+    assert result == expected
+    api.core_api.read_namespaced_config_map.assert_called_once_with(
+        "jumpstarter-service-ca-cert", "test-namespace"
+    )
+
+
+@pytest.mark.asyncio
+async def test_get_ca_bundle_empty_ca_cert():
+    """Test get_ca_bundle returns empty string when ca.crt is empty"""
+    api = ClientsV1Alpha1Api(namespace="test-namespace")
+    api.core_api = AsyncMock()
+
+    # Mock ConfigMap with empty CA certificate
+    mock_configmap = V1ConfigMap(data={"ca.crt": ""})
+    api.core_api.read_namespaced_config_map = AsyncMock(return_value=mock_configmap)
+
+    result = await api.get_ca_bundle()
+
+    assert result == ""
+
+
+@pytest.mark.asyncio
+async def test_get_ca_bundle_missing_ca_crt_key():
+    """Test get_ca_bundle returns empty string when ca.crt key is missing"""
+    api = ClientsV1Alpha1Api(namespace="test-namespace")
+    api.core_api = AsyncMock()
+
+    # Mock ConfigMap without ca.crt key
+    mock_configmap = V1ConfigMap(data={"other-key": "value"})
+    api.core_api.read_namespaced_config_map = AsyncMock(return_value=mock_configmap)
+
+    result = await api.get_ca_bundle()
+
+    assert result == ""
+
+
+@pytest.mark.asyncio
+async def test_get_ca_bundle_configmap_not_found():
+    """Test get_ca_bundle returns empty string when ConfigMap doesn't exist"""
+    api = ClientsV1Alpha1Api(namespace="test-namespace")
+    api.core_api = AsyncMock()
+
+    # Mock 404 error
+    api.core_api.read_namespaced_config_map = AsyncMock(
+        side_effect=ApiException(status=404, reason="Not Found")
+    )
+
+    result = await api.get_ca_bundle()
+
+    assert result == ""
+
+
+@pytest.mark.asyncio
+async def test_get_ca_bundle_other_api_error():
+    """Test get_ca_bundle raises exception for non-404 errors"""
+    api = ClientsV1Alpha1Api(namespace="test-namespace")
+    api.core_api = AsyncMock()
+
+    # Mock 403 error
+    api.core_api.read_namespaced_config_map = AsyncMock(
+        side_effect=ApiException(status=403, reason="Forbidden")
+    )
+
+    with pytest.raises(ApiException) as exc_info:
+        await api.get_ca_bundle()
+
+    assert exc_info.value.status == 403
+
+
+@pytest.mark.asyncio
+async def test_get_client_config_includes_ca_bundle():
+    """Test get_client_config includes CA bundle from ConfigMap"""
+    api = ClientsV1Alpha1Api(namespace="test-namespace")
+    api.api = AsyncMock()
+    api.core_api = AsyncMock()
+
+    # Mock client response
+    client_dict = {
+        "apiVersion": "jumpstarter.dev/v1alpha1",
+        "kind": "Client",
+        "metadata": {
+            "creationTimestamp": "2021-10-01T00:00:00Z",
+            "generation": 1,
+            "name": "test-client",
+            "namespace": "test-namespace",
+            "resourceVersion": "1",
+            "uid": "test-uid",
+        },
+        "status": {
+            "credential": {"name": "test-secret"},
+            "endpoint": "https://test-endpoint:8082",
+        },
+    }
+    api.api.get_namespaced_custom_object = AsyncMock(return_value=client_dict)
+
+    # Mock secret with token
+    token = "test-token-value"
+    mock_secret = V1Secret(data={"token": base64.b64encode(token.encode()).decode()})
+    api.core_api.read_namespaced_secret = AsyncMock(return_value=mock_secret)
+
+    # Mock ConfigMap with CA certificate
+    ca_cert_pem = "-----BEGIN CERTIFICATE-----\nMIIBtest\n-----END CERTIFICATE-----"
+    mock_configmap = V1ConfigMap(data={"ca.crt": ca_cert_pem})
+    api.core_api.read_namespaced_config_map = AsyncMock(return_value=mock_configmap)
+
+    config = await api.get_client_config("test-client", allow=[], unsafe=False)
+
+    # Verify CA bundle is included and base64-encoded
+    expected_ca = base64.b64encode(ca_cert_pem.encode("utf-8")).decode("utf-8")
+    assert config.tls.ca == expected_ca
+    assert config.endpoint == "https://test-endpoint:8082"
+    assert config.token == token
+
+
+@pytest.mark.asyncio
+async def test_get_client_config_without_ca_bundle():
+    """Test get_client_config works when CA ConfigMap doesn't exist"""
+    api = ClientsV1Alpha1Api(namespace="test-namespace")
+    api.api = AsyncMock()
+    api.core_api = AsyncMock()
+
+    # Mock client response
+    client_dict = {
+        "apiVersion": "jumpstarter.dev/v1alpha1",
+        "kind": "Client",
+        "metadata": {
+            "creationTimestamp": "2021-10-01T00:00:00Z",
+            "generation": 1,
+            "name": "test-client",
+            "namespace": "test-namespace",
+            "resourceVersion": "1",
+            "uid": "test-uid",
+        },
+        "status": {
+            "credential": {"name": "test-secret"},
+            "endpoint": "https://test-endpoint:8082",
+        },
+    }
+    api.api.get_namespaced_custom_object = AsyncMock(return_value=client_dict)
+
+    # Mock secret with token
+    token = "test-token-value"
+    mock_secret = V1Secret(data={"token": base64.b64encode(token.encode()).decode()})
+    api.core_api.read_namespaced_secret = AsyncMock(return_value=mock_secret)
+
+    # Mock ConfigMap not found
+    api.core_api.read_namespaced_config_map = AsyncMock(
+        side_effect=ApiException(status=404, reason="Not Found")
+    )
+
+    config = await api.get_client_config("test-client", allow=[], unsafe=False)
+
+    # Verify CA bundle is empty
+    assert config.tls.ca == ""
+    assert config.endpoint == "https://test-endpoint:8082"
+    assert config.token == token

python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/exporters.py

@@ -12,6 +12,7 @@
 from .util import AbstractAsyncCustomObjectApi
 from jumpstarter.config.common import ObjectMeta
 from jumpstarter.config.exporter import ExporterConfigV1Alpha1
+from jumpstarter.config.tls import TLSConfigV1Alpha1
 
 CREATE_EXPORTER_DELAY = 1
 CREATE_EXPORTER_COUNT = 10
@@ -178,6 +179,8 @@ async def get_exporter_config(self, name: str) -> ExporterConfigV1Alpha1:
         secret = await self.core_api.read_namespaced_secret(exporter.status.credential.name, self.namespace)
         endpoint = exporter.status.endpoint
         token = base64.b64decode(secret.data["token"]).decode("utf8")
+        # Get CA bundle from ConfigMap (base64-encoded)
+        ca_bundle = await self.get_ca_bundle()
         return ExporterConfigV1Alpha1(
             alias=name,
             metadata=ObjectMeta(
@@ -187,6 +190,7 @@ async def get_exporter_config(self, name: str) -> ExporterConfigV1Alpha1:
             endpoint=endpoint,
             token=token,
             export={},
+            tls=TLSConfigV1Alpha1(ca=ca_bundle),
         )
 
     async def delete_exporter(self, name: str):