8000 support ClusterTrustBundle to v1beta1 API by AritraDey-Dev · Pull Request #56727 · istio/istio · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

support ClusterTrustBundle to v1beta1 API #56727

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jun 23, 2025
Merged

support ClusterTrustBundle to v1beta1 API #56727

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
feb45d8
refactor: migrate ClusterTrustBundle to v1beta1 API
AritraDey-Dev Jun 22, 2025
953ae04
added release notes
AritraDey-Dev Jun 22, 2025
51368fa
modified metadata.yaml
AritraDey-Dev Jun 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions pilot/pkg/config/kube/clustertrustbundle/controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
package clustertrustbundle

import (
certificatesv1alpha1 "k8s.io/api/certificates/v1alpha1"
certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/types"

Expand Down Expand Up @@ -47,7 +47,7 @@ const (
type Controller struct {
caBundleWatcher *keycertbundle.Watcher
queue controllers.Queue
clustertrustbundles kclient.Client[*certificatesv1alpha1.ClusterTrustBundle]
clustertrustbundles kclient.Client[*certificatesv1beta1.ClusterTrustBundle]
}

// NewController creates a new ClusterTrustBundleController
Expand All @@ -60,7 +60,7 @@ func NewController(kubeClient kube.Client, caBundleWatcher *keycertbundle.Watche
controllers.WithReconciler(c.reconcileClusterTrustBundle),
controllers.WithMaxAttempts(maxRetries))

c.clustertrustbundles = kclient.NewFiltered[*certificatesv1alpha1.ClusterTrustBundle](kubeClient, kclient.Filter{
c.clustertrustbundles = kclient.NewFiltered[*certificatesv1beta1.ClusterTrustBundle](kubeClient, kclient.Filter{
FieldSelector: "metadata.name=" + istioClusterTrustBundleName,
ObjectFilter: kubeClient.ObjectFilter(),
})
Expand All @@ -77,7 +77,7 @@ func (c *Controller) startCaBundleWatcher(stop <-chan struct{}) {
for {
select {
case <-watchCh:
c.queue.AddObject(&certificatesv1alpha1.ClusterTrustBundle{
c.queue.AddObject(&certificatesv1beta1.ClusterTrustBundle{
ObjectMeta: metav1.ObjectMeta{
Name: istioClusterTrustBundleName,
},
Expand All @@ -103,7 +103,7 @@ func (c *Controller) Run(stopCh <-chan struct{}) {
go c.startCaBundleWatcher(stopCh)

// queue an initial event
c.queue.AddObject(&certificatesv1alpha1.ClusterTrustBundle{
c.queue.AddObject(&certificatesv1beta1.ClusterTrustBundle{
ObjectMeta: metav1.ObjectMeta{
Name: istioClusterTrustBundleName,
},
Expand All @@ -115,11 +115,11 @@ func (c *Controller) Run(stopCh <-chan struct{}) {

// updateClusterTrustBundle updates the root certificate in the ClusterTrustBundle
func (c *Controller) updateClusterTrustBundle(rootCert []byte) error {
bundle := &certificatesv1alpha1.ClusterTrustBundle{
bundle := &certificatesv1beta1.ClusterTrustBundle{
ObjectMeta: metav1.ObjectMeta{
Name: istioClusterTrustBundleName,
},
Spec: certificatesv1alpha1.ClusterTrustBundleSpec{
Spec: certificatesv1beta1.ClusterTrustBundleSpec{
SignerName: istioClusterTrustBundleSignerName,
TrustBundle: string(rootCert),
},
Expand Down
6 changes: 3 additions & 3 deletions pilot/pkg/config/kube/clustertrustbundle/controller_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ import (
"testing"

. "github.com/onsi/gomega"
"k8s.io/api/certificates/v1alpha1"
certificatesv1beta1 "k8s.io/api/certificates/v1beta1"
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"

"istio.io/istio/pilot/pkg/keycertbundle"
Expand Down Expand Up @@ -64,11 +64,11 @@ func TestController(t *testing.T) {
watcher.SetAndNotify(nil, nil, []byte(tc.rootcertUpdate))
expectedTrustBundle = tc.rootcertUpdate
} else if tc.trustbundleUpdate != "" {
controller.clustertrustbundles.Update(&v1alpha1.ClusterTrustBundle{
controller.clustertrustbundles.Update(&certificatesv1beta1.ClusterTrustBundle{
ObjectMeta: v1.ObjectMeta{
Name: istioClusterTrustBundleName,
},
Spec: v1alpha1.ClusterTrustBundleSpec{
Spec: certificatesv1beta1.ClusterTrustBundleSpec{
SignerName: istioClusterTrustBundleSignerName,
TrustBundle: tc.trustbundleUpdate,
},
Expand Down
4 changes: 2 additions & 2 deletions pilot/pkg/config/kube/crdclient/types.gen.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

10 changes: 5 additions & 5 deletions pkg/config/schema/collections/collections.gen.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion pkg/config/schema/gvk/resources.gen.go
View file 8000
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion pkg/config/schema/gvr/resources.gen.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

16 changes: 8 additions & 8 deletions pkg/config/schema/kubeclient/resources.gen.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions pkg/config/schema/kubetypes/resources.gen.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions pkg/config/schema/metadata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,11 +154,11 @@ resources:
- kind: "ClusterTrustBundle"
plural: "clustertrustbundles"
group: "certificates.k8s.io"
version: "v1alpha1"
version: "v1beta1"
builtin: true
clusterScoped: true
proto: "k8s.io.api.certificates.v1alpha1.ClusterTrustBundleSpec"
protoPackage: "k8s.io/api/certificates/v1alpha1"
proto: "k8s.io.api.certificates.v1beta1.ClusterTrustBundleSpec"
protoPackage: "k8s.io/api/certificates/v1beta1"

- kind: "Ingress"
plural: "ingresses"
Expand Down
7 changes: 7 additions & 0 deletions releasenotes/notes/56306.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
apiVersion: release-notes/v2
kind: feature
area: security
issue: [56306]
releaseNotes:
- |
**Added** support for ClusterTrustBundle by migrating from `certificates.k8s.io/v1alpha1` to the stable `v1beta1` API in Kubernetes 1.33+. This improves compatibility and future-proofs Istio’s certificate distribution mechanism.
0