Skip to content

CM-830: Add trust-manager controller implementation - #485

Open
openshift-app-platform-shift[bot] wants to merge 2 commits into
cert-manager-1.18from
feature/controller-impl-1914-v2
Open

CM-830: Add trust-manager controller implementation#485
openshift-app-platform-shift[bot] wants to merge 2 commits into
cert-manager-1.18from
feature/controller-impl-1914-v2

Conversation

@openshift-app-platform-shift

@openshift-app-platform-shift openshift-app-platform-shift Bot commented Aug 27, 2026

Copy link
Copy Markdown

Summary

  • Adds complete trust-manager controller implementation following the IstioCSR controller pattern
  • Implements controller-runtime based reconciler with static manifest loading from bindata/
  • Includes 13 YAML manifests for trust-manager deployment (ServiceAccount, RBAC, Deployment, Services, Webhook, Certificates)
  • Integrates with operator feature gates (TrustManager feature, Alpha) and OpenShift FeatureSet (TechPreviewNoUpgrade)
  • Dynamic RBAC generation based on SecretTargets policy configuration
  • Support for DefaultCAPackage with OpenShift trusted CA bundle injection
  • Adds ControllerManagerOptions to setup_manager.go for conditional controller registration
  • Modifies starter.go to check both IstioCSR and TrustManager feature gates

New Files

  • bindata/trust-manager/ - 13 static YAML manifests for trust-manager operand
  • pkg/controller/trustmanager/ - 12 Go files implementing the controller:
    • constants.go - Controller name, finalizer, env vars, asset paths
    • client.go - ctrlClient interface wrapping controller-runtime client
    • errors.go - ReconcileError types (irrecoverable/retry-required)
    • controller.go - Reconciler, SetupWithManager, Reconcile loop
    • utils.go - Status updates, finalizers, decode helpers, validation
    • install_trustmanager.go - Orchestrates all resource reconciliation
    • serviceaccounts.go - ServiceAccount reconciliation
    • rbacs.go - Dynamic ClusterRole, all RBAC resources
    • deployments.go - Deployment with dynamic args and scheduling config
    • services.go - Webhook and metrics services
    • certificates.go - Issuer and Certificate for webhook TLS
    • webhooks.go - ValidatingWebhookConfiguration

Modified Files

  • pkg/operator/setup_manager.go - ControllerManagerOptions, composite cache builder
  • pkg/operator/starter.go - TrustManager feature gate check
  • pkg/operator/assets/bindata.go - Regenerated with trust-manager assets
  • config/rbac/role.yaml - Regenerated with trust-manager RBAC rules

Test plan

  • make generate completes without errors
  • make build completes without errors
  • make manifests produces consistent output
  • Unit tests pass: go test ./pkg/controller/trustmanager/...
  • Feature gate disabled by default (TrustManager controller does not start unless enabled)
  • TrustManager CR creation triggers deployment reconciliation
  • All managed resources are created with correct owner references
  • Cleanup on CR deletion removes all managed resources via finalizer

🤖 Generated with Claude Code

openshift-app-platform-shift Bot and others added 2 commits August 27, 2026 10:00
@openshift-app-platform-shift @claude
CM-830: Add TrustManager API type definitions for trust-manager operand
02d35d3 
Introduces the TrustManager CRD (trustmanagers.operator.openshift.io/v1alpha1)
to support deploying and managing the trust-manager operand via cert-manager-operator.

This adds:
- TrustManager API types with spec/status fields for configuring trust-manager
  operand behavior (log level/format, trust namespace, secret targets,
  default CA package, filtering expired certificates, scheduling)
- TrustManager FeatureGate (Alpha/TechPreview, default disabled)
- Singleton enforcement via XValidation (name must be "cluster")
- Immutability on trustNamespace via XValidation
- Cross-field CEL validation on SecretTargetsConfig
- Integration test suite (.testsuite.yaml) covering create and update scenarios
- Generated deepcopy, CRD manifest, clientset, informers, listers, and
  apply configurations

Ref: openshift/enhancements#1914

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@openshift-app-platform-shift @claude
CM-830: Add trust-manager controller implementation
4ba0499 
Implements the trust-manager controller for cert-manager-operator following
the IstioCSR controller patterns. The controller reconciles TrustManager CRs
to deploy and manage the trust-manager operand in the cert-manager namespace.

This adds:
- Controller package (pkg/controller/trustmanager/) with full reconciliation
  logic for ServiceAccount, RBAC, Certificate/Issuer, Deployment, Services,
  and ValidatingWebhookConfiguration resources
- Dynamic Deployment args based on TrustManager CR spec (log level/format,
  trust namespace, secret targets, default CA package, expired cert filtering)
- Dynamic ClusterRole rules based on secretTargets.policy configuration
- DefaultCAPackage support using OpenShift trusted CA bundle injection
- Static YAML manifests in bindata/trust-manager/ for all managed resources
- Controller registration in setup_manager.go with composite cache builder
- Feature gate check in starter.go (TrustManager gate, Alpha/TechPreview)
- Updated RBAC role manifest for trust-manager controller permissions

Ref: openshift/enhancements#1914

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 27, 2026
@openshift-ci-robot

openshift-ci-robot commented Aug 27, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@openshift-app-platform-shift[bot]: This pull request references CM-830 which is a valid jira issue.

Details

In response to this:

Summary

  • Adds complete trust-manager controller implementation following the IstioCSR controller pattern
  • Implements controller-runtime based reconciler with static manifest loading from bindata/
  • Includes 13 YAML manifests for trust-manager deployment (ServiceAccount, RBAC, Deployment, Services, Webhook, Certificates)
  • Integrates with operator feature gates (TrustManager feature, Alpha) and OpenShift FeatureSet (TechPreviewNoUpgrade)
  • Dynamic RBAC generation based on SecretTargets policy configuration
  • Support for DefaultCAPackage with OpenShift trusted CA bundle injection
  • Adds ControllerManagerOptions to setup_manager.go for conditional controller registration
  • Modifies starter.go to check both IstioCSR and TrustManager feature gates

New Files

  • bindata/trust-manager/ - 13 static YAML manifests for trust-manager operand
  • pkg/controller/trustmanager/ - 12 Go files implementing the controller:
  • constants.go - Controller name, finalizer, env vars, asset paths
  • client.go - ctrlClient interface wrapping controller-runtime client
  • errors.go - ReconcileError types (irrecoverable/retry-required)
  • controller.go - Reconciler, SetupWithManager, Reconcile loop
  • utils.go - Status updates, finalizers, decode helpers, validation
  • install_trustmanager.go - Orchestrates all resource reconciliation
  • serviceaccounts.go - ServiceAccount reconciliation
  • rbacs.go - Dynamic ClusterRole, all RBAC resources
  • deployments.go - Deployment with dynamic args and scheduling config
  • services.go - Webhook and metrics services
  • certificates.go - Issuer and Certificate for webhook TLS
  • webhooks.go - ValidatingWebhookConfiguration

Modified Files

  • pkg/operator/setup_manager.go - ControllerManagerOptions, composite cache builder
  • pkg/operator/starter.go - TrustManager feature gate check
  • pkg/operator/assets/bindata.go - Regenerated with trust-manager assets
  • config/rbac/role.yaml - Regenerated with trust-manager RBAC rules

Test plan

  • make generate completes without errors
  • make build completes without errors
  • make manifests produces consistent output
  • Unit tests pass: go test ./pkg/controller/trustmanager/...
  • Feature gate disabled by default (TrustManager controller does not start unless enabled)
  • TrustManager CR creation triggers deployment reconciliation
  • All managed resources are created with correct owner references
  • Cleanup on CR deletion removes all managed resources via finalizer

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: openshift-app-platform-shift[bot]
Once this PR has been reviewed and has the lgtm label, please assign mytreya-rh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 27, 2026
@openshift-ci

openshift-ci Bot commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

Hi @openshift-app-platform-shift[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-app-platform-shift openshift-app-platform-shift Bot mentioned this pull request Aug 27, 2026
Open
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bharath-b-rh bharath-b-rh Awaiting requested review from bharath-b-rh
@TrilokGeer TrilokGeer Awaiting requested review from TrilokGeer

Assignees

No one assigned

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@openshift-ci-robot