Skip to content

NO-JIRA: Move AdditionalAnnotations to pkg/operator/tlsartifact #2146

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sanchezl wants to merge 2 commits into
base: master
Choose a base branch
from
Open

NO-JIRA: Move AdditionalAnnotations to pkg/operator/tlsartifact #2146

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b2333f7
refactor: move certrtation/annotations.go to new tlsartifact package
sanchezl Mar 20, 2026
8cc05c8
refactor: replace certrotation with tlsartifact across components
sanchezl Mar 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions pkg/certs/cert-inspection/certgraphanalysis/metadata_options.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

"github.com/openshift/library-go/pkg/certs/cert-inspection/certgraphapi"
"github.com/openshift/library-go/pkg/operator/certrotation"
"github.com/openshift/library-go/pkg/operator/tlsartifact"
corev1 "k8s.io/api/core/v1"
)

Expand Down Expand Up @@ -172,7 +172,7 @@ var (
)

func humanizeRefreshPeriodFromMetadata(annotations map[string]string) {
period, ok := annotations[certrotation.CertificateRefreshPeriodAnnotation]
period, ok := annotations[tlsartifact.CertificateRefreshPeriodAnnotation]
if !ok {
return
}
Expand All @@ -182,7 +182,7 @@ func humanizeRefreshPeriodFromMetadata(annotations map[string]string) {
return
}
humanReadableDate := durationToHumanReadableString(d)
annotations[certrotation.CertificateRefreshPeriodAnnotation] = humanReadableDate
annotations[tlsartifact.CertificateRefreshPeriodAnnotation] = humanReadableDate
annotations[rewritePrefix+"RewriteRefreshPeriod"] = period
return
}
Expand Down
5 changes: 3 additions & 2 deletions pkg/operator/certrotation/cabundle.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ import (
"github.com/openshift/library-go/pkg/crypto"
"github.com/openshift/library-go/pkg/operator/events"
"github.com/openshift/library-go/pkg/operator/resource/resourcehelper"
"github.com/openshift/library-go/pkg/operator/tlsartifact"
)

// CABundleConfigMap maintains a CA bundle config map, by adding new CA certs coming from RotatedSigningCASecret, and by removing expired old ones.
Expand All @@ -37,7 +38,7 @@ type CABundleConfigMap struct {
// Owner is an optional reference to add to the secret that this rotator creates.
Owner *metav1.OwnerReference
// AdditionalAnnotations is a collection of annotations set for the secret
AdditionalAnnotations AdditionalAnnotations
AdditionalAnnotations tlsartifact.AdditionalAnnotations
// Plumbing:
Informer corev1informers.ConfigMapInformer
Lister corev1listers.ConfigMapLister
Expand All @@ -58,7 +59,7 @@ func (c CABundleConfigMap) EnsureConfigMapCABundle(ctx context.Context, signingC
caBundleConfigMap := originalCABundleConfigMap.DeepCopy()
if apierrors.IsNotFound(err) {
// create an empty one
caBundleConfigMap = &corev1.ConfigMap{ObjectMeta: NewTLSArtifactObjectMeta(
caBundleConfigMap = &corev1.ConfigMap{ObjectMeta: tlsartifact.NewTLSArtifactObjectMeta(
c.Name,
c.Namespace,
c.AdditionalAnnotations,
Expand Down
3 changes: 2 additions & 1 deletion pkg/operator/certrotation/client_cert_rotation_controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (
"github.com/openshift/api/annotations"
"github.com/openshift/library-go/pkg/crypto"
"github.com/openshift/library-go/pkg/operator/events"
"github.com/openshift/library-go/pkg/operator/tlsartifact"
corev1 "k8s.io/api/core/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
Expand Down Expand Up @@ -280,7 +281,7 @@ func TestCertRotationController_SyncWorker(t *testing.T) {
Lister: informerFactory.Core().V1().ConfigMaps().Lister(),
Client: fakeClient.CoreV1(),
EventRecorder: events.NewInMemoryRecorder("test", clock.RealClock{}),
AdditionalAnnotations: AdditionalAnnotations{
AdditionalAnnotations: tlsartifact.AdditionalAnnotations{
JiraComponent: "test",
},
},
Expand Down
3 changes: 2 additions & 1 deletion pkg/operator/certrotation/metadata.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
package certrotation

import (
"github.com/openshift/library-go/pkg/operator/tlsartifact"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

func ensureOwnerRefAndTLSAnnotations(secret *corev1.Secret, owner *metav1.OwnerReference, additionalAnnotations AdditionalAnnotations) bool {
func ensureOwnerRefAndTLSAnnotations(secret *corev1.Secret, owner *metav1.OwnerReference, additionalAnnotations tlsartifact.AdditionalAnnotations) bool {
needsMetadataUpdate := false
// no ownerReference set
if owner != nil {
Expand Down
15 changes: 8 additions & 7 deletions pkg/operator/certrotation/signer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"github.com/openshift/library-go/pkg/crypto"
"github.com/openshift/library-go/pkg/operator/events"
"github.com/openshift/library-go/pkg/operator/resource/resourcehelper"
"github.com/openshift/library-go/pkg/operator/tlsartifact"
corev1 "k8s.io/api/core/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
Expand Down Expand Up @@ -46,7 +47,7 @@ type RotatedSigningCASecret struct {
Owner *metav1.OwnerReference

// AdditionalAnnotations is a collection of annotations set for the secret
AdditionalAnnotations AdditionalAnnotations
AdditionalAnnotations tlsartifact.AdditionalAnnotations
Copy link
Copy Markdown
Contributor

@p0lyn0mial p0lyn0mial Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

since this change affects a significant number of repositories, would it make sense to use type aliases to preserve backward compatibility?


// Plumbing:
Informer corev1informers.SecretInformer
Expand All @@ -68,7 +69,7 @@ func (c RotatedSigningCASecret) EnsureSigningCertKeyPair(ctx context.Context) (*
if apierrors.IsNotFound(err) {
// create an empty one
signingCertKeyPairSecret = &corev1.Secret{
ObjectMeta: NewTLSArtifactObjectMeta(
ObjectMeta: tlsartifact.NewTLSArtifactObjectMeta(
c.Name,
c.Namespace,
c.AdditionalAnnotations,
Expand Down Expand Up @@ -179,15 +180,15 @@ func needNewSigningCertKeyPair(secret *corev1.Secret, refresh time.Duration, ref
}

func getValidityFromAnnotations(annotations map[string]string) (notBefore time.Time, notAfter time.Time, reason string) {
notAfterString := annotations[CertificateNotAfterAnnotation]
notAfterString := annotations[tlsartifact.CertificateNotAfterAnnotation]
if len(notAfterString) == 0 {
return notBefore, notAfter, "missing notAfter"
}
notAfter, err := time.Parse(time.RFC3339, notAfterString)
if err != nil {
return notBefore, notAfter, fmt.Sprintf("bad expiry: %q", notAfterString)
}
notBeforeString := annotations[CertificateNotBeforeAnnotation]
notBeforeString := annotations[tlsartifact.CertificateNotBeforeAnnotation]
if len(notBeforeString) == 0 {
return notBefore, notAfter, "missing notBefore"
}
Expand All @@ -201,7 +202,7 @@ func getValidityFromAnnotations(annotations map[string]string) (notBefore time.T

// setSigningCertKeyPairSecretAndTLSAnnotations generates a new signing certificate and key pair,
// stores them in the specified secret, and adds predefined TLS annotations to that secret.
func setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret *corev1.Secret, validity, refresh time.Duration, tlsAnnotations AdditionalAnnotations) error {
func setSigningCertKeyPairSecretAndTLSAnnotations(signingCertKeyPairSecret *corev1.Secret, validity, refresh time.Duration, tlsAnnotations tlsartifact.AdditionalAnnotations) error {
ca, err := setSigningCertKeyPairSecret(signingCertKeyPairSecret, validity)
if err != nil {
return err
Expand Down Expand Up @@ -243,8 +244,8 @@ func setSigningCertKeyPairSecret(signingCertKeyPairSecret *corev1.Secret, validi
//
// These assumptions are safe because this function is only called after the secret
// has been initialized in setSigningCertKeyPairSecret.
func setTLSAnnotationsOnSigningCertKeyPairSecret(signingCertKeyPairSecret *corev1.Secret, ca *crypto.TLSCertificateConfig, refresh time.Duration, tlsAnnotations AdditionalAnnotations) {
signingCertKeyPairSecret.Annotations[CertificateIssuer] = ca.Certs[0].Issuer.CommonName
func setTLSAnnotationsOnSigningCertKeyPairSecret(signingCertKeyPairSecret *corev1.Secret, ca *crypto.TLSCertificateConfig, refresh time.Duration, tlsAnnotations tlsartifact.AdditionalAnnotations) {
signingCertKeyPairSecret.Annotations[tlsartifact.CertificateIssuer] = ca.Certs[0].Issuer.CommonName

tlsAnnotations.NotBefore = ca.Certs[0].NotBefore.Format(time.RFC3339)
tlsAnnotations.NotAfter = ca.Certs[0].NotAfter.Format(time.RFC3339)
Expand Down
3 changes: 2 additions & 1 deletion pkg/operator/certrotation/signer_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ import (

"github.com/openshift/api/annotations"
"github.com/openshift/library-go/pkg/operator/events"
"github.com/openshift/library-go/pkg/operator/tlsartifact"
)

func TestEnsureSigningCertKeyPair(t *testing.T) {
Expand Down Expand Up @@ -260,7 +261,7 @@ func TestEnsureSigningCertKeyPair(t *testing.T) {
Client: client.CoreV1(),
Lister: corev1listers.NewSecretLister(indexer),
EventRecorder: recorder,
AdditionalAnnotations: AdditionalAnnotations{
AdditionalAnnotations: tlsartifact.AdditionalAnnotations{
JiraComponent: "test",
},
Owner: &metav1.OwnerReference{
Expand Down
17 changes: 9 additions & 8 deletions pkg/operator/certrotation/target.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ import (
"github.com/openshift/library-go/pkg/crypto"
"github.com/openshift/library-go/pkg/operator/events"
"github.com/openshift/library-go/pkg/operator/resource/resourcehelper"
"github.com/openshift/library-go/pkg/operator/tlsartifact"
corev1informers "k8s.io/client-go/informers/core/v1"
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
corev1listers "k8s.io/client-go/listers/core/v1"
Expand Down Expand Up @@ -59,7 +60,7 @@ type RotatedSelfSignedCertKeySecret struct {
Owner *metav1.OwnerReference

// AdditionalAnnotations is a collection of annotations set for the secret
AdditionalAnnotations AdditionalAnnotations
AdditionalAnnotations tlsartifact.AdditionalAnnotations

// CertCreator does the actual cert generation.
CertCreator TargetCertCreator
Expand Down Expand Up @@ -102,7 +103,7 @@ func (c RotatedSelfSignedCertKeySecret) EnsureTargetCertKeyPair(ctx context.Cont
if apierrors.IsNotFound(err) {
// create an empty one
targetCertKeyPairSecret = &corev1.Secret{
ObjectMeta: NewTLSArtifactObjectMeta(
ObjectMeta: tlsartifact.NewTLSArtifactObjectMeta(
c.Name,
c.Namespace,
c.AdditionalAnnotations,
Expand Down Expand Up @@ -170,7 +171,7 @@ func needNewTargetCertKeyPair(secret *corev1.Secret, signer *crypto.CA, caBundle
}

// check the signer common name against all the common names in our ca bundle so we don't refresh early
signerCommonName := annotations[CertificateIssuer]
signerCommonName := annotations[tlsartifact.CertificateIssuer]
if len(signerCommonName) == 0 {
return "missing issuer name"
}
Expand Down Expand Up @@ -239,7 +240,7 @@ func needNewTargetCertKeyPairForTime(annotations map[string]string, signer *cryp

// setTargetCertKeyPairSecretAndTLSAnnotations generates a new cert/key pair,
// stores them in the specified secret, and adds predefined TLS annotations to that secret.
func setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret *corev1.Secret, validity, refresh time.Duration, signer *crypto.CA, certCreator TargetCertCreator, tlsAnnotations AdditionalAnnotations) error {
func setTargetCertKeyPairSecretAndTLSAnnotations(targetCertKeyPairSecret *corev1.Secret, validity, refresh time.Duration, signer *crypto.CA, certCreator TargetCertCreator, tlsAnnotations tlsartifact.AdditionalAnnotations) error {
certKeyPair, err := setTargetCertKeyPairSecret(targetCertKeyPairSecret, validity, signer, certCreator)
if err != nil {
return err
Expand Down Expand Up @@ -282,8 +283,8 @@ func setTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, validity
//
// These assumptions are safe because this function is only called after the secret
// has been initialized in setTargetCertKeyPairSecret.
func setTLSAnnotationsOnTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, certKeyPair *crypto.TLSCertificateConfig, certCreator TargetCertCreator, refresh time.Duration, tlsAnnotations AdditionalAnnotations) {
targetCertKeyPairSecret.Annotations[CertificateIssuer] = certKeyPair.Certs[0].Issuer.CommonName
func setTLSAnnotationsOnTargetCertKeyPairSecret(targetCertKeyPairSecret *corev1.Secret, certKeyPair *crypto.TLSCertificateConfig, certCreator TargetCertCreator, refresh time.Duration, tlsAnnotations tlsartifact.AdditionalAnnotations) {
targetCertKeyPairSecret.Annotations[tlsartifact.CertificateIssuer] = certKeyPair.Certs[0].Issuer.CommonName

tlsAnnotations.NotBefore = certKeyPair.Certs[0].NotBefore.Format(time.RFC3339)
tlsAnnotations.NotAfter = certKeyPair.Certs[0].NotAfter.Format(time.RFC3339)
Expand Down Expand Up @@ -336,7 +337,7 @@ func (r *ServingRotation) NeedNewTargetCertKeyPair(currentCertSecret *corev1.Sec
}

func (r *ServingRotation) missingHostnames(annotations map[string]string) string {
existingHostnames := sets.New(strings.Split(annotations[CertificateHostnames], ",")...)
existingHostnames := sets.New(strings.Split(annotations[tlsartifact.CertificateHostnames], ",")...)
requiredHostnames := sets.New(r.Hostnames()...)
if !existingHostnames.Equal(requiredHostnames) {
existingNotRequired := existingHostnames.Difference(requiredHostnames)
Expand All @@ -357,7 +358,7 @@ func (r *ServingRotation) SetAnnotations(cert *crypto.TLSCertificateConfig, anno
}

// List does a sort so that we have a consistent representation
annotations[CertificateHostnames] = strings.Join(sets.List(hostnames), ",")
annotations[tlsartifact.CertificateHostnames] = strings.Join(sets.List(hostnames), ",")
return annotations
}

Expand Down
Loading