feat: implement '-external-certificate' flag to edge and reencrypt route

Adds support for referencing TLS certificates from a TLS Secret when creating
edge and reencrypt routes. The new '--external-certificate' flag accepts a Secret
name and populates 'route.Spec.TLS.ExternalCertificate' as a LocalObjectReference.

This flag is mutually exclusive with '--cert' and '--key', since inline certificates and
secret-backed certificates are alternative sources. The '--ca-cert' flag (and
'--dest-ca-cert' for reencrypt routes) remains compatible with '--external-certificate'.

Author: lunarwhite

pkg/cli/create/routeedge.go

@@ -34,21 +34,25 @@ var (
 		# Create an edge route that exposes the frontend service and specify a path
 		# If the route name is omitted, the service name will be used
 		oc create route edge --service=frontend --path /assets
+
+		# Create an edge route that uses an external certificate from a secret
+		oc create route edge --service=frontend --external-certificate=my-cert-secret
 	`)
 )
 
 type CreateEdgeRouteOptions struct {
 	CreateRouteSubcommandOptions *CreateRouteSubcommandOptions
 
-	Hostname       string
-	Port           string
-	InsecurePolicy string
-	Service        string
-	Path           string
-	Cert           string
-	Key            string
-	CACert         string
-	WildcardPolicy string
+	Hostname            string
+	Port                string
+	InsecurePolicy      string
+	Service             string
+	Path                string
+	Cert                string
+	Key                 string
+	CACert              string
+	ExternalCertificate string
+	WildcardPolicy      string
 }
 
 // NewCmdCreateEdgeRoute is a macro command to create an edge route.
@@ -79,6 +83,7 @@ func NewCmdCreateEdgeRoute(f kcmdutil.Factory, streams genericiooptions.IOStream
 	cmd.MarkFlagFilename("key")
 	cmd.Flags().StringVar(&o.CACert, "ca-cert", o.CACert, "Path to a CA certificate file.")
 	cmd.MarkFlagFilename("ca-cert")
+	cmd.Flags().StringVar(&o.ExternalCertificate, "external-certificate", o.ExternalCertificate, "Name of a secret that contains the TLS certificate and key. The secret must contain keys named tls.crt and tls.key. Mutually exclusive with --cert and --key.")
 	cmd.Flags().StringVar(&o.WildcardPolicy, "wildcard-policy", o.WildcardPolicy, "Sets the WilcardPolicy for the hostname, the default is \"None\". valid values are \"None\" and \"Subdomain\"")
 
 	kcmdutil.AddValidateFlags(cmd)
@@ -93,6 +98,13 @@ func (o *CreateEdgeRouteOptions) Complete(f kcmdutil.Factory, cmd *cobra.Command
 }
 
 func (o *CreateEdgeRouteOptions) Run() error {
+	if len(o.Cert) > 0 && len(o.ExternalCertificate) > 0 {
+		return fmt.Errorf("--cert and --external-certificate are mutually exclusive")
+	}
+	if len(o.Key) > 0 && len(o.ExternalCertificate) > 0 {
+		return fmt.Errorf("--key and --external-certificate are mutually exclusive")
+	}
+
 	serviceName, err := resolveServiceName(o.CreateRouteSubcommandOptions.Mapper, o.Service)
 	if err != nil {
 		return err
@@ -127,6 +139,12 @@ func (o *CreateEdgeRouteOptions) Run() error {
 	}
 	route.Spec.TLS.CACertificate = string(caCert)
 
+	if len(o.ExternalCertificate) > 0 {
+		route.Spec.TLS.ExternalCertificate = &routev1.LocalObjectReference{
+			Name: o.ExternalCertificate,
+		}
+	}
+
 	if len(o.InsecurePolicy) > 0 {
 		route.Spec.TLS.InsecureEdgeTerminationPolicy = routev1.InsecureEdgeTerminationPolicyType(o.InsecurePolicy)
 	}

pkg/cli/create/routeedge_test.go

@@ -0,0 +1,262 @@
+package create
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"strings"
+	"testing"
+
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/cli-runtime/pkg/genericclioptions"
+	"k8s.io/cli-runtime/pkg/genericiooptions"
+	fakekubernetes "k8s.io/client-go/kubernetes/fake"
+	kcmdutil "k8s.io/kubectl/pkg/cmd/util"
+
+	routefake "github.com/openshift/client-go/route/clientset/versioned/fake"
+)
+
+func writeTestFile(t *testing.T, path, content string) {
+	t.Helper()
+	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
+		t.Fatalf("failed to write test file %s: %v", path, err)
+	}
+}
+
+func newTestService() *corev1.Service {
+	return &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "my-service",
+			Namespace: "default",
+		},
+		Spec: corev1.ServiceSpec{
+			Ports: []corev1.ServicePort{
+				{
+					Name:       "http",
+					Port:       80,
+					TargetPort: intstr.FromInt32(8080),
+					Protocol:   corev1.ProtocolTCP,
+				},
+			},
+		},
+	}
+}
+
+func newTestEdgeRouteOptions(t *testing.T) (*CreateEdgeRouteOptions, *routefake.Clientset, *bytes.Buffer) {
+	t.Helper()
+	service := newTestService()
+	streams, _, out, _ := genericiooptions.NewTestIOStreams()
+	fakeKubeClient := fakekubernetes.NewClientset(service)
+	fakeRouteClientset := routefake.NewClientset()
+	mapper := meta.NewDefaultRESTMapper(nil)
+
+	printFlags := genericclioptions.NewPrintFlags("created").WithTypeSetter(createCmdScheme)
+	printer, err := printFlags.ToPrinter()
+	if err != nil {
+		t.Fatalf("failed to create printer: %v", err)
+	}
+
+	o := &CreateEdgeRouteOptions{
+		CreateRouteSubcommandOptions: &CreateRouteSubcommandOptions{
+			PrintFlags: printFlags,
+			Name:       "my-route",
+			Namespace:  "default",
+			Mapper:     mapper,
+			Client:     fakeRouteClientset.RouteV1(),
+			CoreClient: fakeKubeClient.CoreV1(),
+			Printer:    printer,
+			IOStreams:   streams,
+		},
+		Service: "my-service",
+	}
+
+	return o, fakeRouteClientset, out
+}
+
+func TestCreateEdgeRoute_MutualExclusivity(t *testing.T) {
+	tmpDir := t.TempDir()
+	certFile := tmpDir + "/tls.crt"
+	keyFile := tmpDir + "/tls.key"
+	writeTestFile(t, certFile, "test-cert-data")
+	writeTestFile(t, keyFile, "test-key-data")
+
+	tests := []struct {
+		name                string
+		cert                string
+		key                 string
+		externalCertificate string
+		expectError         string
+	}{
+		{
+			name: "neither --cert nor --external-certificate set",
+		},
+		{
+			name: "only --cert set",
+			cert: certFile,
+		},
+		{
+			name:                "only --external-certificate set",
+			externalCertificate: "my-secret",
+		},
+		{
+			name:                "both --cert and --external-certificate set",
+			cert:                certFile,
+			externalCertificate: "my-secret",
+			expectError:         "--cert and --external-certificate are mutually exclusive",
+		},
+		{
+			name:                "both --key and --external-certificate set",
+			key:                 keyFile,
+			externalCertificate: "my-secret",
+			expectError:         "--key and --external-certificate are mutually exclusive",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			o, _, _ := newTestEdgeRouteOptions(t)
+			o.Cert = tt.cert
+			o.Key = tt.key
+			o.ExternalCertificate = tt.externalCertificate
+
+			err := o.Run()
+			if tt.expectError != "" {
+				if err == nil {
+					t.Fatal("expected error but got nil")
+				}
+				if !strings.Contains(err.Error(), tt.expectError) {
+					t.Fatalf("expected error containing %q, got: %v", tt.expectError, err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+		})
+	}
+}
+
+func TestCreateEdgeRoute_ExternalCertificateWiring(t *testing.T) {
+	o, fakeRouteClientset, _ := newTestEdgeRouteOptions(t)
+	o.ExternalCertificate = "my-cert-secret"
+
+	if err := o.Run(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	routes, err := fakeRouteClientset.RouteV1().Routes("default").List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		t.Fatalf("failed to list routes: %v", err)
+	}
+	if len(routes.Items) != 1 {
+		t.Fatalf("expected 1 route, got %d", len(routes.Items))
+	}
+
+	route := routes.Items[0]
+	if route.Name != "my-route" {
+		t.Errorf("expected route name %q, got %q", "my-route", route.Name)
+	}
+	if route.Spec.TLS == nil {
+		t.Fatal("expected TLS config to be set")
+	}
+	if route.Spec.TLS.ExternalCertificate == nil {
+		t.Fatal("expected ExternalCertificate to be set")
+	}
+	if route.Spec.TLS.ExternalCertificate.Name != "my-cert-secret" {
+		t.Errorf("expected ExternalCertificate.Name %q, got %q", "my-cert-secret", route.Spec.TLS.ExternalCertificate.Name)
+	}
+	if route.Spec.TLS.Certificate != "" {
+		t.Errorf("expected no inline certificate, got %q", route.Spec.TLS.Certificate)
+	}
+	if route.Spec.TLS.Termination != "edge" {
+		t.Errorf("expected termination %q, got %q", "edge", route.Spec.TLS.Termination)
+	}
+}
+
+func TestCreateEdgeRoute_ExternalCertificateWithCACert(t *testing.T) {
+	o, fakeRouteClientset, _ := newTestEdgeRouteOptions(t)
+	o.ExternalCertificate = "my-cert-secret"
+
+	tmpDir := t.TempDir()
+	caCertFile := tmpDir + "/ca.crt"
+	writeTestFile(t, caCertFile, "test-ca-cert-data")
+	o.CACert = caCertFile
+
+	if err := o.Run(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	routes, err := fakeRouteClientset.RouteV1().Routes("default").List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		t.Fatalf("failed to list routes: %v", err)
+	}
+	if len(routes.Items) != 1 {
+		t.Fatalf("expected 1 route, got %d", len(routes.Items))
+	}
+
+	route := routes.Items[0]
+	if route.Spec.TLS.ExternalCertificate == nil {
+		t.Fatal("expected ExternalCertificate to be set")
+	}
+	if route.Spec.TLS.ExternalCertificate.Name != "my-cert-secret" {
+		t.Errorf("expected ExternalCertificate.Name %q, got %q", "my-cert-secret", route.Spec.TLS.ExternalCertificate.Name)
+	}
+	if route.Spec.TLS.CACertificate != "test-ca-cert-data" {
+		t.Errorf("expected CACertificate %q, got %q", "test-ca-cert-data", route.Spec.TLS.CACertificate)
+	}
+}
+
+func TestCreateEdgeRoute_NoExternalCertificate(t *testing.T) {
+	o, fakeRouteClientset, _ := newTestEdgeRouteOptions(t)
+
+	if err := o.Run(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	routes, err := fakeRouteClientset.RouteV1().Routes("default").List(context.TODO(), metav1.ListOptions{})
+	if err != nil {
+		t.Fatalf("failed to list routes: %v", err)
+	}
+	if len(routes.Items) != 1 {
+		t.Fatalf("expected 1 route, got %d", len(routes.Items))
+	}
+
+	route := routes.Items[0]
+	if route.Spec.TLS == nil {
+		t.Fatal("expected TLS config to be set")
+	}
+	if route.Spec.TLS.ExternalCertificate != nil {
+		t.Errorf("expected no ExternalCertificate, got %+v", route.Spec.TLS.ExternalCertificate)
+	}
+}
+
+func TestCreateEdgeRoute_DryRunYAMLOutput(t *testing.T) {
+	o, _, out := newTestEdgeRouteOptions(t)
+	o.ExternalCertificate = "my-cert-secret"
+	o.CreateRouteSubcommandOptions.DryRunStrategy = kcmdutil.DryRunClient
+
+	yamlFormat := "yaml"
+	o.CreateRouteSubcommandOptions.PrintFlags.OutputFormat = &yamlFormat
+	printer, err := o.CreateRouteSubcommandOptions.PrintFlags.ToPrinter()
+	if err != nil {
+		t.Fatalf("failed to create yaml printer: %v", err)
+	}
+	o.CreateRouteSubcommandOptions.Printer = printer
+
+	if err := o.Run(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	output := out.String()
+	if !strings.Contains(output, "externalCertificate") {
+		t.Errorf("expected YAML output to contain 'externalCertificate', got:\n%s", output)
+	}
+	if !strings.Contains(output, "my-cert-secret") {
+		t.Errorf("expected YAML output to contain 'my-cert-secret', got:\n%s", output)
+	}
+	if !strings.Contains(output, "termination: edge") {
+		t.Errorf("expected YAML output to contain 'termination: edge', got:\n%s", output)
+	}
+}