Skip to content

Commit bc1e241

Browse files
stefanprodanstefanprodan
committed
Promote Bucket API to v1
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
1 parent 823224e commit bc1e241

19 files changed

+1875
-285
lines changed

‎PROJECT

+3
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,7 @@ resources:
3737
- group: source
3838
kind: OCIRepository
3939
version: v1beta2
40+
- group: source
41+
kind: Bucket
42+
version: v1
4043
version: "2"

‎api/v1/bucket_types.go

+278
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,278 @@
1+
/*
2+
Copyright 2024 The Flux authors
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1
18+
19+
import (
20+
"time"
21+
22+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
23+
24+
"github.com/fluxcd/pkg/apis/acl"
25+
"github.com/fluxcd/pkg/apis/meta"
26+
)
27+
28+
const (
29+
// BucketKind is the string representation of a Bucket.
30+
BucketKind = "Bucket"
31+
)
32+
33+
const (
34+
// BucketProviderGeneric for any S3 API compatible storage Bucket.
35+
BucketProviderGeneric string = "generic"
36+
// BucketProviderAmazon for an AWS S3 object storage Bucket.
37+
// Provides support for retrieving credentials from the AWS EC2 service.
38+
BucketProviderAmazon string = "aws"
39+
// BucketProviderGoogle for a Google Cloud Storage Bucket.
40+
// Provides support for authentication using a workload identity.
41+
BucketProviderGoogle string = "gcp"
42+
// BucketProviderAzure for an Azure Blob Storage Bucket.
43+
// Provides support for authentication using a Service Principal,
44+
// Managed Identity or Shared Key.
45+
BucketProviderAzure string = "azure"
46+
)
47+
48+
// BucketSpec specifies the required configuration to produce an Artifact for
49+
// an object storage bucket.
50+
// +kubebuilder:validation:XValidation:rule="self.provider == 'aws' || self.provider == 'generic' || !has(self.sts)", message="STS configuration is only supported for the 'aws' and 'generic' Bucket providers"
51+
// +kubebuilder:validation:XValidation:rule="self.provider != 'aws' || !has(self.sts) || self.sts.provider == 'aws'", message="'aws' is the only supported STS provider for the 'aws' Bucket provider"
52+
// +kubebuilder:validation:XValidation:rule="self.provider != 'generic' || !has(self.sts) || self.sts.provider == 'ldap'", message="'ldap' is the only supported STS provider for the 'generic' Bucket provider"
53+
// +kubebuilder:validation:XValidation:rule="!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.secretRef)", message="spec.sts.secretRef is not required for the 'aws' STS provider"
54+
// +kubebuilder:validation:XValidation:rule="!has(self.sts) || self.sts.provider != 'aws' || !has(self.sts.certSecretRef)", message="spec.sts.certSecretRef is not required for the 'aws' STS provider"
55+
type BucketSpec struct {
56+
// Provider of the object storage bucket.
57+
// Defaults to 'generic', which expects an S3 (API) compatible object
58+
// storage.
59+
// +kubebuilder:validation:Enum=generic;aws;gcp;azure
60+
// +kubebuilder:default:=generic
61+
// +optional
62+
Provider string `json:"provider,omitempty"`
63+
64+
// BucketName is the name of the object storage bucket.
65+
// +required
66+
BucketName string `json:"bucketName"`
67+
68+
// Endpoint is the object storage address the BucketName is located at.
69+
// +required
70+
Endpoint string `json:"endpoint"`
71+
72+
// STS specifies the required configuration to use a Security Token
73+
// Service for fetching temporary credentials to authenticate in a
74+
// Bucket provider.
75+
//
76+
// This field is only supported for the `aws` and `generic` providers.
77+
// +optional
78+
STS *BucketSTSSpec `json:"sts,omitempty"`
79+
80+
// Insecure allows connecting to a non-TLS HTTP Endpoint.
81+
// +optional
82+
Insecure bool `json:"insecure,omitempty"`
83+
84+
// Region of the Endpoint where the BucketName is located in.
85+
// +optional
86+
Region string `json:"region,omitempty"`
87+
88+
// Prefix to use for server-side filtering of files in the Bucket.
89+
// +optional
90+
Prefix string `json:"prefix,omitempty"`
91+
92+
// SecretRef specifies the Secret containing authentication credentials
93+
// for the Bucket.
94+
// +optional
95+
SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`
96+
97+
// CertSecretRef can be given the name of a Secret containing
98+
// either or both of
99+
//
100+
// - a PEM-encoded client certificate (`tls.crt`) and private
101+
// key (`tls.key`);
102+
// - a PEM-encoded CA certificate (`ca.crt`)
103+
//
104+
// and whichever are supplied, will be used for connecting to the
105+
// bucket. The client cert and key are useful if you are
106+
// authenticating with a certificate; the CA cert is useful if
107+
// you are using a self-signed server certificate. The Secret must
108+
// be of type `Opaque` or `kubernetes.io/tls`.
109+
//
110+
// This field is only supported for the `generic` provider.
111+
// +optional
112+
CertSecretRef *meta.LocalObjectReference `json:"certSecretRef,omitempty"`
113+
114+
// ProxySecretRef specifies the Secret containing the proxy configuration
115+
// to use while communicating with the Bucket server.
116+
// +optional
117+
ProxySecretRef *meta.LocalObjectReference `json:"proxySecretRef,omitempty"`
118+
119+
// Interval at which the Bucket Endpoint is checked for updates.
120+
// This interval is approximate and may be subject to jitter to ensure
121+
// efficient use of resources.
122+
// +kubebuilder:validation:Type=string
123+
// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
124+
// +required
125+
Interval metav1.Duration `json:"interval"`
126+
127+
// Timeout for fetch operations, defaults to 60s.
128+
// +kubebuilder:default="60s"
129+
// +kubebuilder:validation:Type=string
130+
// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m))+$"
131+
// +optional
132+
Timeout *metav1.Duration `json:"timeout,omitempty"`
133+
134+
// Ignore overrides the set of excluded patterns in the .sourceignore format
135+
// (which is the same as .gitignore). If not provided, a default will be used,
136+
// consult the documentation for your version to find out what those are.
137+
// +optional
138+
Ignore *string `json:"ignore,omitempty"`
139+
140+
// Suspend tells the controller to suspend the reconciliation of this
141+
// Bucket.
142+
// +optional
143+
Suspend bool `json:"suspend,omitempty"`
144+
145+
// AccessFrom specifies an Access Control List for allowing cross-namespace
146+
// references to this object.
147+
// NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092
148+
// +optional
149+
AccessFrom *acl.AccessFrom `json:"accessFrom,omitempty"`
150+
}
151+
152+
// BucketSTSSpec specifies the required configuration to use a Security Token
153+
// Service for fetching temporary credentials to authenticate in a Bucket
154+
// provider.
155+
type BucketSTSSpec struct {
156+
// Provider of the Security Token Service.
157+
// +kubebuilder:validation:Enum=aws;ldap
158+
// +required
159+
Provider string `json:"provider"`
160+
161+
// Endpoint is the HTTP/S endpoint of the Security Token Service from
162+
// where temporary credentials will be fetched.
163+
// +required
164+
// +kubebuilder:validation:Pattern="^(http|https)://.*$"
165+
Endpoint string `json:"endpoint"`
166+
167+
// SecretRef specifies the Secret containing authentication credentials
168+
// for the STS endpoint. This Secret must contain the fields `username`
169+
// and `password` and is supported only for the `ldap` provider.
170+
// +optional
171+
SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`
172+
173+
// CertSecretRef can be given the name of a Secret containing
174+
// either or both of
175+
//
176+
// - a PEM-encoded client certificate (`tls.crt`) and private
177+
// key (`tls.key`);
178+
// - a PEM-encoded CA certificate (`ca.crt`)
179+
//
180+
// and whichever are supplied, will be used for connecting to the
181+
// STS endpoint. The client cert and key are useful if you are
182+
// authenticating with a certificate; the CA cert is useful if
183+
// you are using a self-signed server certificate. The Secret must
184+
// be of type `Opaque` or `kubernetes.io/tls`.
185+
//
186+
// This field is only supported for the `ldap` provider.
187+
// +optional
188+
CertSecretRef *meta.LocalObjectReference `json:"certSecretRef,omitempty"`
189+
}
190+
191+
// BucketStatus records the observed state of a Bucket.
192+
type BucketStatus struct {
193+
// ObservedGeneration is the last observed generation of the Bucket object.
194+
// +optional
195+
ObservedGeneration int64 `json:"observedGeneration,omitempty"`
196+
197+
// Conditions holds the conditions for the Bucket.
198+
// +optional
199+
Conditions []metav1.Condition `json:"conditions,omitempty"`
200+
201+
// URL is the dynamic fetch link for the latest Artifact.
202+
// It is provided on a "best effort" basis, and using the precise
203+
// BucketStatus.Artifact data is recommended.
204+
// +optional
205+
URL string `json:"url,omitempty"`
206+
207+
// Artifact represents the last successful Bucket reconciliation.
208+
// +optional
209+
Artifact *Artifact `json:"artifact,omitempty"`
210+
211+
// ObservedIgnore is the observed exclusion patterns used for constructing
212+
// the source artifact.
213+
// +optional
214+
ObservedIgnore *string `json:"observedIgnore,omitempty"`
215+
216+
meta.ReconcileRequestStatus `json:",inline"`
217+
}
218+
219+
const (
220+
// BucketOperationSucceededReason signals that the Bucket listing and fetch
221+
// operations succeeded.
222+
BucketOperationSucceededReason string = "BucketOperationSucceeded"
223+
224+
// BucketOperationFailedReason signals that the Bucket listing or fetch
225+
// operations failed.
226+
BucketOperationFailedReason string = "BucketOperationFailed"
227+
)
228+
229+
// GetConditions returns the status conditions of the object.
230+
func (in *Bucket) GetConditions() []metav1.Condition {
231+
return in.Status.Conditions
232+
}
233+
234+
// SetConditions sets the status conditions on the object.
235+
func (in *Bucket) SetConditions(conditions []metav1.Condition) {
236+
in.Status.Conditions = conditions
237+
}
238+
239+
// GetRequeueAfter returns the duration after which the source must be reconciled again.
240+
func (in *Bucket) GetRequeueAfter() time.Duration {
241+
return in.Spec.Interval.Duration
242+
}
243+
244+
// GetArtifact returns the latest artifact from the source if present in the status sub-resource.
245+
func (in *Bucket) GetArtifact() *Artifact {
246+
return in.Status.Artifact
247+
}
248+
249+
// +genclient
250+
// +kubebuilder:storageversion
251+
// +kubebuilder:object:root=true
252+
// +kubebuilder:subresource:status
253+
// +kubebuilder:printcolumn:name="Endpoint",type=string,JSONPath=`.spec.endpoint`
254+
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description=""
255+
// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description=""
256+
// +kubebuilder:printcolumn:name="Status",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].message",description=""
257+
258+
// Bucket is the Schema for the buckets API.
259+
type Bucket struct {
260+
metav1.TypeMeta `json:",inline"`
261+
metav1.ObjectMeta `json:"metadata,omitempty"`
262+
263+
Spec BucketSpec `json:"spec,omitempty"`
264+
// +kubebuilder:default={"observedGeneration":-1}
265+
Status BucketStatus `json:"status,omitempty"`
266+
}
267+
268+
// BucketList contains a list of Bucket objects.
269+
// +kubebuilder:object:root=true
270+
type BucketList struct {
271+
metav1.TypeMeta `json:",inline"`
272+
metav1.ListMeta `json:"metadata,omitempty"`
273+
Items []Bucket `json:"items"`
274+
}
275+
276+
func init() {
277+
SchemeBuilder.Register(&Bucket{}, &BucketList{})
278+
}

‎api/v1/sts_types.go

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
/*
2+
Copyright 2024 The Flux authors
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package v1
18+
19+
const (
20+
// STSProviderAmazon represents the AWS provider for Security Token Service.
21+
// Provides support for fetching temporary credentials from an AWS STS endpoint.
22+
STSProviderAmazon string = "aws"
23+
// STSProviderLDAP represents the LDAP provider for Security Token Service.
24+
// Provides support for fetching temporary credentials from an LDAP endpoint.
25+
STSProviderLDAP string = "ldap"
26+
)

0 commit comments

Comments
 (0)