Add companion TSIG API and BindTSIGAPI CRD #8
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: unkin/bind-operator#8
Reference in New Issue
Block a user
Delete Branch "benvin/tsig-companion-api"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Why
The
vault-plugin-secrets-bind-tsigplugin needs an HTTP endpoint that creates, reads, rotates and deletes TSIG keys on its behalf, so Vault never talks to the Kubernetes API directly. This adds that companion API and lets the operator deploy it declaratively via a new CRD.Changes
BindTSIGAPICRD: creating one makes the operator reconcile a Deployment, Service, ConfigMap (env vars), token Secret and namespaced RBAC for the companion API. Spec covers image, replicas, port,targetNamespace,tokenSecretName, extra env, service exposure and resources.VaultStaticSecretmay pre-seed/overwrite it; the operator does not own that Secret.internal/tsigapi): bearer-auth HTTP contract —POST /v1/keys,GET/DELETE /v1/keys/{name},POST /v1/keys/{name}/rotate— backed byBindTSIGKeycustom resources the operator reconciles into key material.cmd/tsigapientrypoint andDockerfile.tsigapi(distroless, nonroot).setup.go, regenerate CRDs/RBAC/deepcopy.bind-tsig-apiimage.Follow-ups (separate PRs)
BindTSIGAPIresource and broaden the operator's deployed RBAC to include deployments/serviceaccounts/roles/rolebindings.vault-plugin-secrets-bind-tsigconfig at the API endpoint.The vault-plugin-secrets-bind-tsig plugin needs an HTTP endpoint that creates, reads, rotates and deletes TSIG keys on its behalf, decoupling Vault from direct Kubernetes API access. This adds that companion API and lets the operator deploy it declaratively. - Add BindTSIGAPI CRD: creating one makes the operator reconcile a Deployment, Service, ConfigMap (env vars), token Secret and namespaced RBAC for the companion API. Spec covers image, replicas, port, targetNamespace, tokenSecretName, extra env, service exposure and resources. - Generate the master access token Secret only when absent, so a VaultStaticSecret may pre-seed/overwrite it; the operator does not own it. - Add the companion API server (internal/tsigapi): bearer-auth HTTP contract POST /v1/keys, GET/DELETE /v1/keys/{name}, POST /v1/keys/{name}/rotate, backed by BindTSIGKey custom resources the operator reconciles into key material. - Add cmd/tsigapi entrypoint and Dockerfile.tsigapi (distroless). - Wire the reconciler into setup, regenerate CRDs/RBAC/deepcopy, and add Woodpecker build (PR dry-run) and release (tag push) steps for the bind-tsig-api image. - Cover the API server with auth and key-lifecycle unit tests.