Skip to content

Commit 7bdfde1

Browse files
sanchezlsanchezl
committed
NO-JIRA: Move AdditionalAnnotations to pkg/operator/tlsartifact
Move the AdditionalAnnotations type, Certificate* annotation constants, and NewTLSArtifactObjectMeta helper from pkg/operator/certrotation to a new pkg/operator/tlsartifact package. These are part of the TLS Artifacts Registry and are used by packages that have no relation to cert rotation (resourcesynccontroller, csr, cert-inspection). Moving them removes unnecessary cross-package dependencies on certrotation. Backward-compatible type aliases and re-exported constants remain in pkg/operator/certrotation/annotations.go.
1 parent 72bf34f commit 7bdfde1

5 files changed

Lines changed: 137 additions & 98 deletions

File tree

‎pkg/certs/cert-inspection/certgraphanalysis/metadata_options.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import (
1111
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1212

1313
"github.com/openshift/library-go/pkg/certs/cert-inspection/certgraphapi"
14-
"github.com/openshift/library-go/pkg/operator/certrotation"
14+
"github.com/openshift/library-go/pkg/operator/tlsartifact"
1515
corev1 "k8s.io/api/core/v1"
1616
)
1717

@@ -172,7 +172,7 @@ var (
172172
)
173173

174174
func humanizeRefreshPeriodFromMetadata(annotations map[string]string) {
175-
period, ok := annotations[certrotation.CertificateRefreshPeriodAnnotation]
175+
period, ok := annotations[tlsartifact.CertificateRefreshPeriodAnnotation]
176176
if !ok {
177177
return
178178
}
@@ -182,7 +182,7 @@ func humanizeRefreshPeriodFromMetadata(annotations map[string]string) {
182182
return
183183
}
184184
humanReadableDate := durationToHumanReadableString(d)
185-
annotations[certrotation.CertificateRefreshPeriodAnnotation] = humanReadableDate
185+
annotations[tlsartifact.CertificateRefreshPeriodAnnotation] = humanReadableDate
186186
annotations[rewritePrefix+"RewriteRefreshPeriod"] = period
187187
return
188188
}

‎pkg/operator/certrotation/annotations.go‎

Lines changed: 22 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -1,102 +1,36 @@
11
package certrotation
22

3-
import (
4-
"github.com/google/go-cmp/cmp"
5-
"github.com/openshift/api/annotations"
6-
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
7-
"k8s.io/klog/v2"
8-
)
3+
import "github.com/openshift/library-go/pkg/operator/tlsartifact"
4+
5+
// AdditionalAnnotations is an alias for tlsartifact.AdditionalAnnotations.
6+
// Deprecated: Use tlsartifact.AdditionalAnnotations directly.
7+
type AdditionalAnnotations = tlsartifact.AdditionalAnnotations
98

109
const (
1110
// CertificateNotBeforeAnnotation contains the certificate expiration date in RFC3339 format.
12-
CertificateNotBeforeAnnotation = "auth.openshift.io/certificate-not-before"
11+
// Deprecated: Use tlsartifact.CertificateNotBeforeAnnotation directly.
12+
CertificateNotBeforeAnnotation = tlsartifact.CertificateNotBeforeAnnotation
1313
// CertificateNotAfterAnnotation contains the certificate expiration date in RFC3339 format.
14-
CertificateNotAfterAnnotation = "auth.openshift.io/certificate-not-after"
14+
// Deprecated: Use tlsartifact.CertificateNotAfterAnnotation directly.
15+
CertificateNotAfterAnnotation = tlsartifact.CertificateNotAfterAnnotation
1516
// CertificateIssuer contains the common name of the certificate that signed another certificate.
16-
CertificateIssuer = "auth.openshift.io/certificate-issuer"
17+
// Deprecated: Use tlsartifact.CertificateIssuer directly.
18+
CertificateIssuer = tlsartifact.CertificateIssuer
1719
// CertificateHostnames contains the hostnames used by a signer.
18-
CertificateHostnames = "auth.openshift.io/certificate-hostnames"
20+
// Deprecated: Use tlsartifact.CertificateHostnames directly.
21+
CertificateHostnames = tlsartifact.CertificateHostnames
1922
// CertificateTestNameAnnotation is an e2e test name which verifies that TLS artifact is created and used correctly
20-
CertificateTestNameAnnotation string = "certificates.openshift.io/test-name"
23+
// Deprecated: Use tlsartifact.CertificateTestNameAnnotation directly.
24+
CertificateTestNameAnnotation = tlsartifact.CertificateTestNameAnnotation
2125
// CertificateAutoRegenerateAfterOfflineExpiryAnnotation contains a link to PR adding this annotation which verifies
2226
// that TLS artifact is correctly regenerated after it has expired
23-
CertificateAutoRegenerateAfterOfflineExpiryAnnotation string = "certificates.openshift.io/auto-regenerate-after-offline-expiry"
27+
// Deprecated: Use tlsartifact.CertificateAutoRegenerateAfterOfflineExpiryAnnotation directly.
28+
CertificateAutoRegenerateAfterOfflineExpiryAnnotation = tlsartifact.CertificateAutoRegenerateAfterOfflineExpiryAnnotation
2429
// CertificateRefreshPeriodAnnotation is the interval at which the certificate should be refreshed.
25-
CertificateRefreshPeriodAnnotation string = "certificates.openshift.io/refresh-period"
30+
// Deprecated: Use tlsartifact.CertificateRefreshPeriodAnnotation directly.
31+
CertificateRefreshPeriodAnnotation = tlsartifact.CertificateRefreshPeriodAnnotation
2632
)
2733

28-
type AdditionalAnnotations struct {
29-
// JiraComponent annotates tls artifacts so that owner could be easily found
30-
JiraComponent string
31-
// Description is a human-readable one sentence description of certificate purpose
32-
Description string
33-
// TestName is an e2e test name which verifies that TLS artifact is created and used correctly
34-
TestName string
35-
// AutoRegenerateAfterOfflineExpiry contains a link to PR which adds this annotation on the TLS artifact
36-
AutoRegenerateAfterOfflineExpiry string
37-
// NotBefore contains certificate the certificate creation date in RFC3339 format.
38-
NotBefore string
39-
// NotAfter contains certificate the certificate validity date in RFC3339 format.
40-
NotAfter string
41-
// RefreshPeriod contains the interval at which the certificate should be refreshed.
42-
RefreshPeriod string
43-
}
44-
45-
func (a AdditionalAnnotations) EnsureTLSMetadataUpdate(meta *metav1.ObjectMeta) bool {
46-
modified := false
47-
if meta.Annotations == nil {
48-
meta.Annotations = make(map[string]string)
49-
}
50-
if len(a.JiraComponent) > 0 && meta.Annotations[annotations.OpenShiftComponent] != a.JiraComponent {
51-
diff := cmp.Diff(meta.Annotations[annotations.OpenShiftComponent], a.JiraComponent)
52-
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", annotations.OpenShiftComponent, meta.Namespace, meta.Name, diff)
53-
meta.Annotations[annotations.OpenShiftComponent] = a.JiraComponent
54-
modified = true
55-
}
56-
if len(a.Description) > 0 && meta.Annotations[annotations.OpenShiftDescription] != a.Description {
57-
diff := cmp.Diff(meta.Annotations[annotations.OpenShiftDescription], a.Description)
58-
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", annotations.OpenShiftDescription, meta.Namespace, meta.Name, diff)
59-
meta.Annotations[annotations.OpenShiftDescription] = a.Description
60-
modified = true
61-
}
62-
if len(a.TestName) > 0 && meta.Annotations[CertificateTestNameAnnotation] != a.TestName {
63-
diff := cmp.Diff(meta.Annotations[CertificateTestNameAnnotation], a.TestName)
64-
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateTestNameAnnotation, meta.Name, meta.Namespace, diff)
65-
meta.Annotations[CertificateTestNameAnnotation] = a.TestName
66-
modified = true
67-
}
68-
if len(a.AutoRegenerateAfterOfflineExpiry) > 0 && meta.Annotations[CertificateAutoRegenerateAfterOfflineExpiryAnnotation] != a.AutoRegenerateAfterOfflineExpiry {
69-
diff := cmp.Diff(meta.Annotations[CertificateAutoRegenerateAfterOfflineExpiryAnnotation], a.AutoRegenerateAfterOfflineExpiry)
70-
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateAutoRegenerateAfterOfflineExpiryAnnotation, meta.Namespace, meta.Name, diff)
71-
meta.Annotations[CertificateAutoRegenerateAfterOfflineExpiryAnnotation] = a.AutoRegenerateAfterOfflineExpiry
72-
modified = true
73-
}
74-
if len(a.NotBefore) > 0 && meta.Annotations[CertificateNotBeforeAnnotation] != a.NotBefore {
75-
diff := cmp.Diff(meta.Annotations[CertificateNotBeforeAnnotation], a.NotBefore)
76-
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateNotBeforeAnnotation, meta.Name, meta.Namespace, diff)
77-
meta.Annotations[CertificateNotBeforeAnnotation] = a.NotBefore
78-
modified = true
79-
}
80-
if len(a.NotAfter) > 0 && meta.Annotations[CertificateNotAfterAnnotation] != a.NotAfter {
81-
diff := cmp.Diff(meta.Annotations[CertificateNotAfterAnnotation], a.NotAfter)
82-
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateNotAfterAnnotation, meta.Name, meta.Namespace, diff)
83-
meta.Annotations[CertificateNotAfterAnnotation] = a.NotAfter
84-
modified = true
85-
}
86-
if len(a.RefreshPeriod) > 0 && meta.Annotations[CertificateRefreshPeriodAnnotation] != a.RefreshPeriod {
87-
diff := cmp.Diff(meta.Annotations[CertificateRefreshPeriodAnnotation], a.RefreshPeriod)
88-
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateRefreshPeriodAnnotation, meta.Name, meta.Namespace, diff)
89-
meta.Annotations[CertificateRefreshPeriodAnnotation] = a.RefreshPeriod
90-
modified = true
91-
}
92-
return modified
93-
}
94-
95-
func NewTLSArtifactObjectMeta(name, namespace string, annotations AdditionalAnnotations) metav1.ObjectMeta {
96-
meta := metav1.ObjectMeta{
97-
Namespace: namespace,
98-
Name: name,
99-
}
100-
_ = annotations.EnsureTLSMetadataUpdate(&meta)
101-
return meta
102-
}
34+
// NewTLSArtifactObjectMeta creates a new ObjectMeta with TLS artifact annotations.
35+
// Deprecated: Use tlsartifact.NewTLSArtifactObjectMeta directly.
36+
var NewTLSArtifactObjectMeta = tlsartifact.NewTLSArtifactObjectMeta

‎pkg/operator/csr/cert_controller.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import (
1111
"time"
1212

1313
"github.com/openshift/library-go/pkg/controller/factory"
14-
"github.com/openshift/library-go/pkg/operator/certrotation"
14+
"github.com/openshift/library-go/pkg/operator/tlsartifact"
1515
"github.com/openshift/library-go/pkg/operator/events"
1616

1717
certificates "k8s.io/api/certificates/v1"
@@ -67,7 +67,7 @@ type ClientCertOption struct {
6767
// AdditonalSecretData contains data that will be added into client certificate secret besides tls.key/tls.crt
6868
AdditonalSecretData map[string][]byte
6969
// AdditionalAnnotations is a collection of annotations set for the secret
70-
AdditionalAnnotations certrotation.AdditionalAnnotations
70+
AdditionalAnnotations tlsartifact.AdditionalAnnotations
7171
}
7272

7373
// clientCertificateController implements the common logic of hub client certification creation/rotation. It
@@ -154,7 +154,7 @@ func (c *clientCertificateController) sync(ctx context.Context, syncCtx factory.
154154
switch {
155155
case errors.IsNotFound(err):
156156
secret = &corev1.Secret{
157-
ObjectMeta: certrotation.NewTLSArtifactObjectMeta(
157+
ObjectMeta: tlsartifact.NewTLSArtifactObjectMeta(
158158
c.SecretName,
159159
c.SecretNamespace,
160160
c.AdditionalAnnotations,

‎pkg/operator/resourcesynccontroller/core.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ import (
1111
"k8s.io/client-go/util/cert"
1212

1313
"github.com/openshift/library-go/pkg/crypto"
14-
"github.com/openshift/library-go/pkg/operator/certrotation"
14+
"github.com/openshift/library-go/pkg/operator/tlsartifact"
1515
)
1616

17-
func CombineCABundleConfigMaps(destinationConfigMap ResourceLocation, lister corev1listers.ConfigMapLister, additionalAnnotations certrotation.AdditionalAnnotations, inputConfigMaps ...ResourceLocation) (*corev1.ConfigMap, error) {
17+
func CombineCABundleConfigMaps(destinationConfigMap ResourceLocation, lister corev1listers.ConfigMapLister, additionalAnnotations tlsartifact.AdditionalAnnotations, inputConfigMaps ...ResourceLocation) (*corev1.ConfigMap, error) {
1818
certificates := []*x509.Certificate{}
1919
for _, input := range inputConfigMaps {
2020
inputConfigMap, err := lister.ConfigMaps(input.Namespace).Get(input.Name)
@@ -59,7 +59,7 @@ func CombineCABundleConfigMaps(destinationConfigMap ResourceLocation, lister cor
5959
}
6060

6161
cm := &corev1.ConfigMap{
62-
ObjectMeta: certrotation.NewTLSArtifactObjectMeta(
62+
ObjectMeta: tlsartifact.NewTLSArtifactObjectMeta(
6363
destinationConfigMap.Name,
6464
destinationConfigMap.Namespace,
6565
additionalAnnotations,
@@ -71,7 +71,7 @@ func CombineCABundleConfigMaps(destinationConfigMap ResourceLocation, lister cor
7171
return cm, nil
7272
}
7373

74-
func CombineCABundleConfigMapsOptimistically(destinationConfigMap *corev1.ConfigMap, lister corev1listers.ConfigMapLister, additionalAnnotations certrotation.AdditionalAnnotations, inputConfigMaps ...ResourceLocation) (*corev1.ConfigMap, bool, error) {
74+
func CombineCABundleConfigMapsOptimistically(destinationConfigMap *corev1.ConfigMap, lister corev1listers.ConfigMapLister, additionalAnnotations tlsartifact.AdditionalAnnotations, inputConfigMaps ...ResourceLocation) (*corev1.ConfigMap, bool, error) {
7575
var cm *corev1.ConfigMap
7676
if destinationConfigMap == nil {
7777
cm = &corev1.ConfigMap{}

‎pkg/operator/tlsartifact/annotations.go‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
package tlsartifact
2+
3+
import (
4+
"github.com/google/go-cmp/cmp"
5+
"github.com/openshift/api/annotations"
6+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
7+
"k8s.io/klog/v2"
8+
)
9+
10+
const (
11+
// CertificateNotBeforeAnnotation contains the certificate expiration date in RFC3339 format.
12+
CertificateNotBeforeAnnotation = "auth.openshift.io/certificate-not-before"
13+
// CertificateNotAfterAnnotation contains the certificate expiration date in RFC3339 format.
14+
CertificateNotAfterAnnotation = "auth.openshift.io/certificate-not-after"
15+
// CertificateIssuer contains the common name of the certificate that signed another certificate.
16+
CertificateIssuer = "auth.openshift.io/certificate-issuer"
17+
// CertificateHostnames contains the hostnames used by a signer.
18+
CertificateHostnames = "auth.openshift.io/certificate-hostnames"
19+
// CertificateTestNameAnnotation is an e2e test name which verifies that TLS artifact is created and used correctly
20+
CertificateTestNameAnnotation string = "certificates.openshift.io/test-name"
21+
// CertificateAutoRegenerateAfterOfflineExpiryAnnotation contains a link to PR adding this annotation which verifies
22+
// that TLS artifact is correctly regenerated after it has expired
23+
CertificateAutoRegenerateAfterOfflineExpiryAnnotation string = "certificates.openshift.io/auto-regenerate-after-offline-expiry"
24+
// CertificateRefreshPeriodAnnotation is the interval at which the certificate should be refreshed.
25+
CertificateRefreshPeriodAnnotation string = "certificates.openshift.io/refresh-period"
26+
)
27+
28+
// AdditionalAnnotations holds TLS artifact metadata annotations as defined by
29+
// the TLS Artifacts Registry enhancement. These annotations identify the
30+
// owning component, purpose, and lifecycle of managed TLS artifacts.
31+
type AdditionalAnnotations struct {
32+
// JiraComponent annotates tls artifacts so that owner could be easily found
33+
JiraComponent string
34+
// Description is a human-readable one sentence description of certificate purpose
35+
Description string
36+
// TestName is an e2e test name which verifies that TLS artifact is created and used correctly
37+
TestName string
38+
// AutoRegenerateAfterOfflineExpiry contains a link to PR which adds this annotation on the TLS artifact
39+
AutoRegenerateAfterOfflineExpiry string
40+
// NotBefore contains certificate the certificate creation date in RFC3339 format.
41+
NotBefore string
42+
// NotAfter contains certificate the certificate validity date in RFC3339 format.
43+
NotAfter string
44+
// RefreshPeriod contains the interval at which the certificate should be refreshed.
45+
RefreshPeriod string
46+
}
47+
48+
func (a AdditionalAnnotations) EnsureTLSMetadataUpdate(meta *metav1.ObjectMeta) bool {
49+
modified := false
50+
if meta.Annotations == nil {
51+
meta.Annotations = make(map[string]string)
52+
}
53+
if len(a.JiraComponent) > 0 && meta.Annotations[annotations.OpenShiftComponent] != a.JiraComponent {
54+
diff := cmp.Diff(meta.Annotations[annotations.OpenShiftComponent], a.JiraComponent)
55+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", annotations.OpenShiftComponent, meta.Namespace, meta.Name, diff)
56+
meta.Annotations[annotations.OpenShiftComponent] = a.JiraComponent
57+
modified = true
58+
}
59+
if len(a.Description) > 0 && meta.Annotations[annotations.OpenShiftDescription] != a.Description {
60+
diff := cmp.Diff(meta.Annotations[annotations.OpenShiftDescription], a.Description)
61+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", annotations.OpenShiftDescription, meta.Namespace, meta.Name, diff)
62+
meta.Annotations[annotations.OpenShiftDescription] = a.Description
63+
modified = true
64+
}
65+
if len(a.TestName) > 0 && meta.Annotations[CertificateTestNameAnnotation] != a.TestName {
66+
diff := cmp.Diff(meta.Annotations[CertificateTestNameAnnotation], a.TestName)
67+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateTestNameAnnotation, meta.Name, meta.Namespace, diff)
68+
meta.Annotations[CertificateTestNameAnnotation] = a.TestName
69+
modified = true
70+
}
71+
if len(a.AutoRegenerateAfterOfflineExpiry) > 0 && meta.Annotations[CertificateAutoRegenerateAfterOfflineExpiryAnnotation] != a.AutoRegenerateAfterOfflineExpiry {
72+
diff := cmp.Diff(meta.Annotations[CertificateAutoRegenerateAfterOfflineExpiryAnnotation], a.AutoRegenerateAfterOfflineExpiry)
73+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateAutoRegenerateAfterOfflineExpiryAnnotation, meta.Namespace, meta.Name, diff)
74+
meta.Annotations[CertificateAutoRegenerateAfterOfflineExpiryAnnotation] = a.AutoRegenerateAfterOfflineExpiry
75+
modified = true
76+
}
77+
if len(a.NotBefore) > 0 && meta.Annotations[CertificateNotBeforeAnnotation] != a.NotBefore {
78+
diff := cmp.Diff(meta.Annotations[CertificateNotBeforeAnnotation], a.NotBefore)
79+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateNotBeforeAnnotation, meta.Name, meta.Namespace, diff)
80+
meta.Annotations[CertificateNotBeforeAnnotation] = a.NotBefore
81+
modified = true
82+
}
83+
if len(a.NotAfter) > 0 && meta.Annotations[CertificateNotAfterAnnotation] != a.NotAfter {
84+
diff := cmp.Diff(meta.Annotations[CertificateNotAfterAnnotation], a.NotAfter)
85+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateNotAfterAnnotation, meta.Name, meta.Namespace, diff)
86+
meta.Annotations[CertificateNotAfterAnnotation] = a.NotAfter
87+
modified = true
88+
}
89+
if len(a.RefreshPeriod) > 0 && meta.Annotations[CertificateRefreshPeriodAnnotation] != a.RefreshPeriod {
90+
diff := cmp.Diff(meta.Annotations[CertificateRefreshPeriodAnnotation], a.RefreshPeriod)
91+
klog.V(2).Infof("Updating %q annotation for %s/%s, diff: %s", CertificateRefreshPeriodAnnotation, meta.Name, meta.Namespace, diff)
92+
meta.Annotations[CertificateRefreshPeriodAnnotation] = a.RefreshPeriod
93+
modified = true
94+
}
95+
return modified
96+
}
97+
98+
func NewTLSArtifactObjectMeta(name, namespace string, annotations AdditionalAnnotations) metav1.ObjectMeta {
99+
meta := metav1.ObjectMeta{
100+
Namespace: namespace,
101+
Name: name,
102+
}
103+
_ = annotations.EnsureTLSMetadataUpdate(&meta)
104+
return meta
105+
}

0 commit comments

Comments
 (0)