kaniop-operator 0.16.4

Core library for the Kanidm Kubernetes operator
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137

use crate::kanidm::crd::Kanidm;

use gateway_api::apis::standard::backendtlspolicies::{
    BackendTLSPolicy, BackendTlsPolicySpec, BackendTlsPolicyTargetRefs, BackendTlsPolicyValidation,
    BackendTlsPolicyValidationCaCertificateRefs,
};
use gateway_api::apis::standard::httproutes::{
    HTTPRoute, HttpRouteParentRefs, HttpRouteRules, HttpRouteRulesBackendRefs, HttpRouteSpec,
};
use kube::api::ObjectMeta;
use kube::{Resource, ResourceExt};

pub trait GatewayExt {
    fn create_http_route(&self) -> Option<HTTPRoute>;
    fn create_backend_tls_policy(&self) -> Option<BackendTLSPolicy>;
}

impl GatewayExt for Kanidm {
    fn create_http_route(&self) -> Option<HTTPRoute> {
        self.spec.gateway.as_ref().map(|gateway| {
            let labels = self.generate_labels();
            let hostnames = gateway
                .hostnames
                .clone()
                .or_else(|| Some(vec![self.spec.domain.clone()]));

            let parent_refs: Vec<HttpRouteParentRefs> = gateway
                .parent_refs
                .iter()
                .map(|parent_ref| HttpRouteParentRefs {
                    group: parent_ref
                        .group
                        .clone()
                        .or_else(|| Some("gateway.networking.k8s.io".to_string())),
                    kind: parent_ref
                        .kind
                        .clone()
                        .or_else(|| Some("Gateway".to_string())),
                    name: parent_ref.name.clone(),
                    namespace: parent_ref.namespace.clone(),
                    port: parent_ref.port.map(|p| p as i32),
                    section_name: parent_ref.section_name.clone(),
                })
                .collect();

            let rules = gateway.rules.clone().or_else(|| {
                Some(vec![HttpRouteRules {
                    backend_refs: Some(vec![HttpRouteRulesBackendRefs {
                        group: Some("".to_string()),
                        kind: Some("Service".to_string()),
                        name: self.name_any(),
                        namespace: None,
                        port: Some(8443),
                        weight: Some(1),
                        filters: None,
                    }]),
                    ..HttpRouteRules::default()
                }])
            });

            HTTPRoute {
                metadata: ObjectMeta {
                    name: Some(self.name_any()),
                    namespace: Some(self.namespace().unwrap()),
                    labels: Some(labels),
                    annotations: gateway.annotations.clone(),
                    owner_references: self.controller_owner_ref(&()).map(|oref| vec![oref]),
                    ..ObjectMeta::default()
                },
                spec: HttpRouteSpec {
                    hostnames,
                    parent_refs: Some(parent_refs),
                    rules,
                },
                status: None,
            }
        })
    }

    fn create_backend_tls_policy(&self) -> Option<BackendTLSPolicy> {
        self.spec.gateway.as_ref().and_then(|gateway| {
            gateway.backend_tls_policy.as_ref().map(|tls_policy| {
                let labels = self.generate_labels();
                let hostname = tls_policy
                    .validation
                    .hostname
                    .clone()
                    .unwrap_or_else(|| self.spec.domain.clone());

                let ca_certificate_refs =
                    tls_policy
                        .validation
                        .ca_certificate_refs
                        .as_ref()
                        .map(|refs| {
                            refs.iter()
                                .map(|ref_| BackendTlsPolicyValidationCaCertificateRefs {
                                    group: ref_.group.clone().unwrap_or_else(|| "".to_string()),
                                    kind: ref_.kind.clone().unwrap_or_else(|| "Secret".to_string()),
                                    name: ref_.name.clone(),
                                })
                                .collect()
                        });

                BackendTLSPolicy {
                    metadata: ObjectMeta {
                        name: Some(self.name_any()),
                        namespace: Some(self.namespace().unwrap()),
                        labels: Some(labels),
                        annotations: tls_policy.annotations.clone(),
                        owner_references: self.controller_owner_ref(&()).map(|oref| vec![oref]),
                        ..ObjectMeta::default()
                    },
                    spec: BackendTlsPolicySpec {
                        options: None,
                        target_refs: vec![BackendTlsPolicyTargetRefs {
                            group: "".to_string(),
                            kind: "Service".to_string(),
                            name: self.name_any(),
                            section_name: Some("https".to_string()),
                        }],
                        validation: BackendTlsPolicyValidation {
                            hostname,
                            well_known_ca_certificates: tls_policy
                                .validation
                                .well_known_ca_certificates
                                .clone(),
                            ca_certificate_refs,
                            subject_alt_names: None,
                        },
                    },
                    status: None,
                }
            })
        })
    }
}