replace field with existing TlsClientDetails struct

Author: adwk67

crates/stackable-operator/crds/DummyCluster.yaml

@@ -84,12 +84,6 @@ spec:
 
                       Since git-sync v4.x.x this field is mapped to the flag `--ref`.
                     type: string
-                  caCertSecretName:
-                    description: |-
-                      An optional secret used for holding CA certificates that will be used to verify the git server's TLS certificate by passing it to the git config option `http.sslCAInfo` passed with the gitsync command. The secret must have a key named `ca.crt` whose value is the PEM-encoded certificate bundle.
-                      If `http.sslCAInfo` is also set via `gitSyncConf` (the `--git-config` option) then a warning will be logged.
-                    nullable: true
-                    type: string
                   credentials:
                     description: An optional secret used for git access.
                     nullable: true
@@ -148,6 +142,51 @@ spec:
                     description: 'The git repository URL that will be cloned, for example: `https://github.com/stackabletech/airflow-operator` or `ssh://git@github.com:stackable-airflow/dags.git`.'
                     format: uri
                     type: string
+                  tls:
+                    description: Use a TLS connection. If not specified no TLS will be used.
+                    nullable: true
+                    properties:
+                      verification:
+                        description: The verification method used to verify the certificates of the server and/or the client.
+                        oneOf:
+                        - required:
+                          - none
+                        - required:
+                          - server
+                        properties:
+                          none:
+                            description: Use TLS but don't verify certificates.
+                            type: object
+                          server:
+                            description: Use TLS and a CA certificate to verify the server.
+                            properties:
+                              caCert:
+                                description: CA cert to verify the server.
+                                oneOf:
+                                - required:
+                                  - webPki
+                                - required:
+                                  - secretClass
+                                properties:
+                                  secretClass:
+                                    description: |-
+                                      Name of the [SecretClass](https://docs.stackable.tech/home/nightly/secret-operator/secretclass) which will provide the CA certificate.
+                                      Note that a SecretClass does not need to have a key but can also work with just a CA certificate,
+                                      so if you got provided with a CA cert but don't have access to the key you can still use this method.
+                                    type: string
+                                  webPki:
+                                    description: |-
+                                      Use TLS and the CA certificates trusted by the common web browsers to verify the server.
+                                      This can be useful when you e.g. use public AWS S3 or other public available services.
+                                    type: object
+                                type: object
+                            required:
+                            - caCert
+                            type: object
+                        type: object
+                    required:
+                    - verification
+                    type: object
                   wait:
                     default: 20s
                     description: |-

crates/stackable-operator/src/crd/git_sync/mod.rs

@@ -7,13 +7,17 @@ use serde::{Deserialize, Serialize};
 use stackable_shared::time::Duration;
 use url::Url;
 
-use crate::{crd::git_sync::v1alpha2::Credentials, versioned::versioned};
+use crate::{
+    commons::tls_verification::TlsClientDetails, crd::git_sync::v1alpha2::Credentials,
+    versioned::versioned,
+};
 
 mod v1alpha1_impl;
 mod v1alpha2_impl;
 
 #[versioned(version(name = "v1alpha1"), version(name = "v1alpha2"))]
 pub mod versioned {
+
     pub mod v1alpha1 {
         pub use v1alpha1_impl::{Error, GitSyncResources};
     }
@@ -69,10 +73,11 @@ pub mod versioned {
         ))]
         pub credentials: Option<Credentials>,
 
-        /// An optional secret used for holding CA certificates that will be used to verify the git server's TLS certificate by passing it to the git config option `http.sslCAInfo` passed with the gitsync command. The secret must have a key named `ca.crt` whose value is the PEM-encoded certificate bundle.
+        /// An optional field used for referencing CA certificates that will be used to verify the git server's TLS certificate by passing it to the git config option `http.sslCAInfo` passed with the gitsync command. The secret must have a key named `ca.crt` whose value is the PEM-encoded certificate bundle.
         /// If `http.sslCAInfo` is also set via `gitSyncConf` (the `--git-config` option) then a warning will be logged.
-        #[versioned(added(since = "v1alpha2"))]
-        pub ca_cert_secret_name: Option<String>,
+        /// If not specified no TLS will be used, defaulting to github/lab using commonly-recognised certificates.
+        #[serde(flatten)]
+        pub tls: TlsClientDetails,
     }
 
     #[derive(strum::Display, Clone, Debug, Deserialize, Eq, JsonSchema, PartialEq, Serialize)]

crates/stackable-operator/src/crd/git_sync/v1alpha2_impl.rs

@@ -12,7 +12,9 @@ use crate::{
         resources::ResourceRequirementsBuilder,
         volume::{VolumeBuilder, VolumeMountBuilder},
     },
-    commons::product_image_selection::ResolvedProductImage,
+    commons::{
+        self, product_image_selection::ResolvedProductImage, secret_class::SecretClassVolume,
+    },
     crd::git_sync::v1alpha2::{Credentials, GitSync},
     product_config_utils::insert_or_update_env_vars,
     product_logging::{
@@ -46,6 +48,11 @@ pub enum Error {
     AddVolumeMount {
         source: crate::builder::pod::container::Error,
     },
+
+    #[snafu(display("failed to convert secret class volume into named Kubernetes volume"))]
+    SecretClassVolume {
+        source: commons::secret_class::SecretClassVolumeError,
+    },
 }
 
 /// Kubernetes resources generated from `GitSync` specifications which should be added to the Pod.
@@ -161,7 +168,7 @@ impl GitSyncResources {
                 git_sync_container_volume_mounts.push(ssh_volume_mount);
             }
 
-            if git_sync.ca_cert_secret_name.is_some() {
+            if git_sync.tls.tls_ca_cert_secret_class().is_some() {
                 let ca_cert_secret_mount_path = format!("{CA_CERT_MOUNT_PATH_PREFIX}-{i}");
                 let ca_cert_secret_volume_name = format!("{CA_CERT_VOLUME_NAME_PREFIX}-{i}");
 
@@ -171,9 +178,9 @@ impl GitSyncResources {
                 git_sync_container_volume_mounts.push(ca_cert_volume_mount);
             }
 
-            let ca_cert_path: Option<String> = git_sync
-                .ca_cert_secret_name
-                .as_ref()
+            let ca_cert_path = git_sync
+                .tls
+                .tls_ca_cert_secret_class()
                 .map(|_| format!("{CA_CERT_MOUNT_PATH_PREFIX}-{i}/ca.crt"));
 
             let container = Self::create_git_sync_container(
@@ -235,11 +242,12 @@ impl GitSyncResources {
                 resources.git_ssh_volumes.push(ssh_secret_volume);
             }
 
-            if let Some(ca_cert_secret_name) = &git_sync.ca_cert_secret_name {
-                let ca_cert_secret_volume_name = format!("{CA_CERT_VOLUME_NAME_PREFIX}-{i}");
-                let ca_cert_secret_volume = VolumeBuilder::new(&ca_cert_secret_volume_name)
-                    .with_secret(ca_cert_secret_name, false)
-                    .build();
+            if let Some(secret_class) = git_sync.tls.tls_ca_cert_secret_class() {
+                let secret_class_volume = SecretClassVolume::new(secret_class.clone(), None);
+                let volume_name = format!("{CA_CERT_VOLUME_NAME_PREFIX}-{i}");
+                let ca_cert_secret_volume = secret_class_volume
+                    .to_volume(&volume_name)
+                    .context(SecretClassVolumeSnafu)?;
                 resources.git_ca_cert_volumes.push(ca_cert_secret_volume);
             }
         }
@@ -1157,7 +1165,11 @@ secret:
             gitFolder: ""
             depth: 3
             wait: 1m
-            caCertSecretName: git-ca-cert
+            tls:
+              verification:
+                server:
+                  caCert:
+                    secretClass: git-tls-ca
             gitSyncConf:
               --rev: HEAD
           "#;
@@ -1335,10 +1347,19 @@ name: content-from-git-0
         assert_eq!(1, git_sync_resources.git_ca_cert_volumes.len());
 
         assert_eq!(
-            "name: ca-cert-0
-secret:
-  optional: false
-  secretName: git-ca-cert
+            "ephemeral:
+  volumeClaimTemplate:
+    metadata:
+      annotations:
+        secrets.stackable.tech/class: git-tls-ca
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: '1'
+      storageClassName: secrets.stackable.tech
+name: ca-cert-0
 ",
             serde_yaml::to_string(&git_sync_resources.git_ca_cert_volumes.first()).unwrap()
         );