Skip to content

Commit a302c71

Browse files
aryan9600aryan9600
authored
Merge pull request #1194 from fluxcd/tls-secret
Adopt Kubernetes style TLS Secrets
2 parents de31a12 + 2a7f67d commit a302c71

18 files changed

+662
-298
lines changed

‎api/v1beta2/helmrepository_types.go

+15-4
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,21 @@ type HelmRepositorySpec struct {
5656
// +optional
5757
SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`
5858

59-
// CertSecretRef specifies the Secret containing the TLS authentication
60-
// data. The secret must contain a 'certFile' and 'keyFile', and/or 'caFile'
61-
// fields. It takes precedence over the values specified in the Secret
62-
// referred to by `.spec.secretRef`.
59+
// CertSecretRef can be given the name of a Secret containing
60+
// either or both of
61+
//
62+
// - a PEM-encoded client certificate (`tls.crt`) and private
63+
// key (`tls.key`);
64+
// - a PEM-encoded CA certificate (`ca.crt`)
65+
//
66+
// and whichever are supplied, will be used for connecting to the
67+
// registry. The client cert and key are useful if you are
68+
// authenticating with a certificate; the CA cert is useful if
69+
// you are using a self-signed server certificate. The Secret must
70+
// be of type `Opaque` or `kubernetes.io/tls`.
71+
//
72+
// It takes precedence over the values specified in the Secret referred
73+
// to by `.spec.secretRef`.
6374
// +optional
6475
CertSecretRef *meta.LocalObjectReference `json:"certSecretRef,omitempty"`
6576

‎api/v1beta2/ocirepository_types.go

+12-8
Original file line numberDiff line numberDiff line change
@@ -97,17 +97,21 @@ type OCIRepositorySpec struct {
9797
// +optional
9898
ServiceAccountName string `json:"serviceAccountName,omitempty"`
9999

100-
// CertSecretRef can be given the name of a secret containing
100+
// CertSecretRef can be given the name of a Secret containing
101101
// either or both of
102102
//
103-
// - a PEM-encoded client certificate (`certFile`) and private
104-
// key (`keyFile`);
105-
// - a PEM-encoded CA certificate (`caFile`)
103+
// - a PEM-encoded client certificate (`tls.crt`) and private
104+
// key (`tls.key`);
105+
// - a PEM-encoded CA certificate (`ca.crt`)
106106
//
107-
// and whichever are supplied, will be used for connecting to the
108-
// registry. The client cert and key are useful if you are
109-
// authenticating with a certificate; the CA cert is useful if
110-
// you are using a self-signed server certificate.
107+
// and whichever are supplied, will be used for connecting to the
108+
// registry. The client cert and key are useful if you are
109+
// authenticating with a certificate; the CA cert is useful if
110+
// you are using a self-signed server certificate. The Secret must
111+
// be of type `Opaque` or `kubernetes.io/tls`.
112+
//
113+
// Note: Support for the `caFile`, `certFile` and `keyFile` keys have
114+
// been deprecated.
111115
// +optional
112116
CertSecretRef *meta.LocalObjectReference `json:"certSecretRef,omitempty"`
113117

‎config/crd/bases/source.toolkit.fluxcd.io_helmrepositories.yaml

+9-4
Original file line numberDiff line numberDiff line change
@@ -297,10 +297,15 @@ spec:
297297
- namespaceSelectors
298298
type: object
299299
certSecretRef:
300-
description: CertSecretRef specifies the Secret containing the TLS
301-
authentication data. The secret must contain a 'certFile' and 'keyFile',
302-
and/or 'caFile' fields. It takes precedence over the values specified
303-
in the Secret referred to by `.spec.secretRef`.
300+
description: "CertSecretRef can be given the name of a Secret containing
301+
either or both of \n - a PEM-encoded client certificate (`tls.crt`)
302+
and private key (`tls.key`); - a PEM-encoded CA certificate (`ca.crt`)
303+
\n and whichever are supplied, will be used for connecting to the
304+
registry. The client cert and key are useful if you are authenticating
305+
with a certificate; the CA cert is useful if you are using a self-signed
306+
server certificate. The Secret must be of type `Opaque` or `kubernetes.io/tls`.
307+
\n It takes precedence over the values specified in the Secret referred
308+
to by `.spec.secretRef`."
304309
properties:
305310
name:
306311
description: Name of the referent.

‎config/crd/bases/source.toolkit.fluxcd.io_ocirepositories.yaml

+6-4
Original file line numberDiff line numberDiff line change
@@ -50,13 +50,15 @@ spec:
5050
description: OCIRepositorySpec defines the desired state of OCIRepository
5151
properties:
5252
certSecretRef:
53-
description: "CertSecretRef can be given the name of a secret containing
54-
either or both of \n - a PEM-encoded client certificate (`certFile`)
55-
and private key (`keyFile`); - a PEM-encoded CA certificate (`caFile`)
53+
description: "CertSecretRef can be given the name of a Secret containing
54+
either or both of \n - a PEM-encoded client certificate (`tls.crt`)
55+
and private key (`tls.key`); - a PEM-encoded CA certificate (`ca.crt`)
5656
\n and whichever are supplied, will be used for connecting to the
5757
registry. The client cert and key are useful if you are authenticating
5858
with a certificate; the CA cert is useful if you are using a self-signed
59-
server certificate."
59+
server certificate. The Secret must be of type `Opaque` or `kubernetes.io/tls`.
60+
\n Note: Support for the `caFile`, `certFile` and `keyFile` keys
61+
have been deprecated."
6062
properties:
6163
name:
6264
description: Name of the referent.

‎docs/api/v1beta2/source.md

+44-18
Original file line numberDiff line numberDiff line change
@@ -811,10 +811,20 @@ github.com/fluxcd/pkg/apis/meta.LocalObjectReference
811811
</td>
812812
<td>
813813
<em>(Optional)</em>
814-
<p>CertSecretRef specifies the Secret containing the TLS authentication
815-
data. The secret must contain a &lsquo;certFile&rsquo; and &lsquo;keyFile&rsquo;, and/or &lsquo;caFile&rsquo;
816-
fields. It takes precedence over the values specified in the Secret
817-
referred to by <code>.spec.secretRef</code>.</p>
814+
<p>CertSecretRef can be given the name of a Secret containing
815+
either or both of</p>
816+
<ul>
817+
<li>a PEM-encoded client certificate (<code>tls.crt</code>) and private
818+
key (<code>tls.key</code>);</li>
819+
<li>a PEM-encoded CA certificate (<code>ca.crt</code>)</li>
820+
</ul>
821+
<p>and whichever are supplied, will be used for connecting to the
822+
registry. The client cert and key are useful if you are
823+
authenticating with a certificate; the CA cert is useful if
824+
you are using a self-signed server certificate. The Secret must
825+
be of type <code>Opaque</code> or <code>kubernetes.io/tls</code>.</p>
826+
<p>It takes precedence over the values specified in the Secret referred
827+
to by <code>.spec.secretRef</code>.</p>
818828
</td>
819829
</tr>
820830
<tr>
@@ -1109,17 +1119,20 @@ github.com/fluxcd/pkg/apis/meta.LocalObjectReference
11091119
</td>
11101120
<td>
11111121
<em>(Optional)</em>
1112-
<p>CertSecretRef can be given the name of a secret containing
1122+
<p>CertSecretRef can be given the name of a Secret containing
11131123
either or both of</p>
11141124
<ul>
1115-
<li>a PEM-encoded client certificate (<code>certFile</code>) and private
1116-
key (<code>keyFile</code>);</li>
1117-
<li>a PEM-encoded CA certificate (<code>caFile</code>)</li>
1125+
<li>a PEM-encoded client certificate (<code>tls.crt</code>) and private
1126+
key (<code>tls.key</code>);</li>
1127+
<li>a PEM-encoded CA certificate (<code>ca.crt</code>)</li>
11181128
</ul>
11191129
<p>and whichever are supplied, will be used for connecting to the
11201130
registry. The client cert and key are useful if you are
11211131
authenticating with a certificate; the CA cert is useful if
1122-
you are using a self-signed server certificate.</p>
1132+
you are using a self-signed server certificate. The Secret must
1133+
be of type <code>Opaque</code> or <code>kubernetes.io/tls</code>.</p>
1134+
<p>Note: Support for the <code>caFile</code>, <code>certFile</code> and <code>keyFile</code> keys have
1135+
been deprecated.</p>
11231136
</td>
11241137
</tr>
11251138
<tr>
@@ -2503,10 +2516,20 @@ github.com/fluxcd/pkg/apis/meta.LocalObjectReference
25032516
</td>
25042517
<td>
25052518
<em>(Optional)</em>
2506-
<p>CertSecretRef specifies the Secret containing the TLS authentication
2507-
data. The secret must contain a &lsquo;certFile&rsquo; and &lsquo;keyFile&rsquo;, and/or &lsquo;caFile&rsquo;
2508-
fields. It takes precedence over the values specified in the Secret
2509-
referred to by <code>.spec.secretRef</code>.</p>
2519+
<p>CertSecretRef can be given the name of a Secret containing
2520+
either or both of</p>
2521+
<ul>
2522+
<li>a PEM-encoded client certificate (<code>tls.crt</code>) and private
2523+
key (<code>tls.key</code>);</li>
2524+
<li>a PEM-encoded CA certificate (<code>ca.crt</code>)</li>
2525+
</ul>
2526+
<p>and whichever are supplied, will be used for connecting to the
2527+
registry. The client cert and key are useful if you are
2528+
authenticating with a certificate; the CA cert is useful if
2529+
you are using a self-signed server certificate. The Secret must
2530+
be of type <code>Opaque</code> or <code>kubernetes.io/tls</code>.</p>
2531+
<p>It takes precedence over the values specified in the Secret referred
2532+
to by <code>.spec.secretRef</code>.</p>
25102533
</td>
25112534
</tr>
25122535
<tr>
@@ -3004,17 +3027,20 @@ github.com/fluxcd/pkg/apis/meta.LocalObjectReference
30043027
</td>
30053028
<td>
30063029
<em>(Optional)</em>
3007-
<p>CertSecretRef can be given the name of a secret containing
3030+
<p>CertSecretRef can be given the name of a Secret containing
30083031
either or both of</p>
30093032
<ul>
3010-
<li>a PEM-encoded client certificate (<code>certFile</code>) and private
3011-
key (<code>keyFile</code>);</li>
3012-
<li>a PEM-encoded CA certificate (<code>caFile</code>)</li>
3033+
<li>a PEM-encoded client certificate (<code>tls.crt</code>) and private
3034+
key (<code>tls.key</code>);</li>
3035+
<li>a PEM-encoded CA certificate (<code>ca.crt</code>)</li>
30133036
</ul>
30143037
<p>and whichever are supplied, will be used for connecting to the
30153038
registry. The client cert and key are useful if you are
30163039
authenticating with a certificate; the CA cert is useful if
3017-
you are using a self-signed server certificate.</p>
3040+
you are using a self-signed server certificate. The Secret must
3041+
be of type <code>Opaque</code> or <code>kubernetes.io/tls</code>.</p>
3042+
<p>Note: Support for the <code>caFile</code>, <code>certFile</code> and <code>keyFile</code> keys have
3043+
been deprecated.</p>
30183044
</td>
30193045
</tr>
30203046
<tr>

‎docs/spec/v1/gitrepositories.md

+4-3
Original file line numberDiff line numberDiff line change
@@ -161,8 +161,9 @@ data:
161161
#### HTTPS Certificate Authority
162162

163163
To provide a Certificate Authority to trust while connecting with a Git
164-
repository over HTTPS, the referenced Secret can contain a `.data.caFile`
165-
value.
164+
repository over HTTPS, the referenced Secret's `.data` can contain a `ca.crt`
165+
or `caFile` key. `ca.crt` takes precedence over `caFile`, i.e. if both keys
166+
are present, the value of `ca.crt` will be taken into consideration.
166167

167168
```yaml
168169
---
@@ -173,7 +174,7 @@ metadata:
173174
namespace: default
174175
type: Opaque
175176
data:
176-
caFile: <BASE64>
177+
ca.crt: <BASE64>
177178
```
178179

179180
#### SSH authentication

‎docs/spec/v1beta2/helmrepositories.md

+20-18
Original file line numberDiff line numberDiff line change
@@ -467,32 +467,33 @@ flux create secret oci ghcr-auth \
467467
--password=${GITHUB_PAT}
468468
```
469469

470-
**Note:** Support for specifying TLS authentication data using this API has been
470+
**Warning:** Support for specifying TLS authentication data using this API has been
471471
deprecated. Please use [`.spec.certSecretRef`](#cert-secret-reference) instead.
472472
If the controller uses the secret specfied by this field to configure TLS, then
473473
a deprecation warning will be logged.
474474

475475
### Cert secret reference
476476

477-
`.spec.certSecretRef.name` is an optional field to specify a secret containing TLS
478-
certificate data. The secret can contain the following keys:
477+
`.spec.certSecretRef.name` is an optional field to specify a secret containing
478+
TLS certificate data. The secret can contain the following keys:
479479

480-
* `certFile` and `keyFile`, to specify the client certificate and private key used for
481-
TLS client authentication. These must be used in conjunction, i.e. specifying one without
482-
the other will lead to an error.
483-
* `caFile`, to specify the CA certificate used to verify the server, which is required
484-
if the server is using a self-signed certificate.
480+
* `tls.crt` and `tls.key`, to specify the client certificate and private key used
481+
for TLS client authentication. These must be used in conjunction, i.e.
482+
specifying one without the other will lead to an error.
483+
* `ca.crt`, to specify the CA certificate used to verify the server, which is
484+
required if the server is using a self-signed certificate.
485485

486-
If the server is using a self-signed certificate and has TLS client authentication enabled,
487-
all three values are required.
486+
If the server is using a self-signed certificate and has TLS client
487+
authentication enabled, all three values are required.
488488

489-
All the files in the secret are expected to be [PEM-encoded][pem-encoding]. Assuming you have
490-
three files; `client.key`, `client.crt` and `ca.crt` for the client private key, client
491-
certificate and the CA certificate respectively, you can generate the required secret using
492-
the `flux creat secret helm` command:
489+
The Secret should be of type `Opaque` or `kubernetes.io/tls`. All the files in
490+
the Secret are expected to be [PEM-encoded][pem-encoding]. Assuming you have
491+
three files; `client.key`, `client.crt` and `ca.crt` for the client private key,
492+
client certificate and the CA certificate respectively, you can generate the
493+
required Secret using the `flux create secret tls` command:
493494

494495
```sh
495-
flux create secret helm tls --key-file=client.key --cert-file=client.crt --ca-file=ca.crt
496+
flux create secret tls --tls-key-file=client.key --tls-crt-file=client.crt --ca-crt-file=ca.crt
496497
```
497498

498499
Example usage:
@@ -515,11 +516,12 @@ kind: Secret
515516
metadata:
516517
name: example-tls
517518
namespace: default
519+
type: kubernetes.io/tls # or Opaque
518520
data:
519-
certFile: <BASE64>
520-
keyFile: <BASE64>
521+
tls.crt: <BASE64>
522+
tls.key: <BASE64>
521523
# NOTE: Can be supplied without the above values
522-
caFile: <BASE64>
524+
ca.crt: <BASE64>
523525
```
524526

525527
### Pass credentials

‎docs/spec/v1beta2/ocirepositories.md

+46-26
Original file line numberDiff line numberDiff line change
@@ -310,42 +310,62 @@ fetch the image pull secrets attached to the service account and use them for au
310310
**Note:** that for a publicly accessible image repository, you don't need to provide a `secretRef`
311311
nor `serviceAccountName`.
312312

313-
### TLS Certificates
313+
### Cert secret reference
314314

315-
`.spec.certSecretRef` field names a secret with TLS certificate data. This is for two separate
316-
purposes:
315+
`.spec.certSecretRef.name` is an optional field to specify a secret containing
316+
TLS certificate data. The secret can contain the following keys:
317317

318-
- to provide a client certificate and private key, if you use a certificate to authenticate with
319-
the container registry; and,
320-
- to provide a CA certificate, if the registry uses a self-signed certificate.
318+
* `tls.crt` and `tls.key`, to specify the client certificate and private key used
319+
for TLS client authentication. These must be used in conjunction, i.e.
320+
specifying one without the other will lead to an error.
321+
* `ca.crt`, to specify the CA certificate used to verify the server, which is
322+
required if the server is using a self-signed certificate.
321323

322-
These will often go together, if you are hosting a container registry yourself. All the files in the
323-
secret are expected to be [PEM-encoded][pem-encoding]. This is an ASCII format for certificates and
324-
keys; `openssl` and such tools will typically give you an option of PEM output.
324+
If the server is using a self-signed certificate and has TLS client
325+
authentication enabled, all three values are required.
325326

326-
Assuming you have obtained a certificate file and private key and put them in the files `client.crt`
327-
and `client.key` respectively, you can create a secret with `kubectl` like this:
327+
The Secret should be of type `Opaque` or `kubernetes.io/tls`. All the files in
328+
the Secret are expected to be [PEM-encoded][pem-encoding]. Assuming you have
329+
three files; `client.key`, `client.crt` and `ca.crt` for the client private key,
330+
client certificate and the CA certificate respectively, you can generate the
331+
required Secret using the `flux create secret tls` command:
328332

329-
```bash
330-
kubectl create secret generic tls-certs \
331-
--from-file=certFile=client.crt \
332-
--from-file=keyFile=client.key
333+
```sh
334+
flux create secret tls --tls-key-file=client.key --tls-crt-file=client.crt --ca-crt-file=ca.crt
333335
```
334336

335-
You could also [prepare a secret and encrypt it][sops-guide]; the important bit is that the data
336-
keys in the secret are `certFile` and `keyFile`.
337-
338-
If you have a CA certificate for the client to use, the data key for that is `caFile`. Adapting the
339-
previous example, if you have the certificate in the file `ca.crt`, and the client certificate and
340-
key as before, the whole command would be:
337+
Example usage:
341338

342-
```bash
343-
kubectl create secret generic tls-certs \
344-
--from-file=certFile=client.crt \
345-
--from-file=keyFile=client.key \
346-
--from-file=caFile=ca.crt
339+
```yaml
340+
---
341+
apiVersion: source.toolkit.fluxcd.io/v1beta2
342+
kind: OCIRepository
343+
metadata:
344+
name: example
345+
namespace: default
346+
spec:
347+
interval: 5m0s
348+
url: oci://example.com
349+
certSecretRef:
350+
name: example-tls
351+
---
352+
apiVersion: v1
353+
kind: Secret
354+
metadata:
355+
name: example-tls
356+
namespace: default
357+
type: kubernetes.io/tls # or Opaque
358+
data:
359+
tls.crt: <BASE64>
360+
tls.key: <BASE64>
361+
# NOTE: Can be supplied without the above values
362+
ca.crt: <BASE64>
347363
```
348364

365+
**Warning:** Support for the `caFile`, `certFile` and `keyFile` keys have been
366+
deprecated. If you have any Secrets using these keys and specified in an
367+
OCIRepository, the controller will log a deprecation warning.
368+
349369
### Insecure
350370

351371
`.spec.insecure` is an optional field to allow connecting to an insecure (HTTP)

0 commit comments

Comments
 (0)