Add support for cert-manager

.checkstyle/import-control.xml

@@ -32,6 +32,7 @@ We also control imports only in production classes and not in tests. This is con
         <allow pkg="com.fasterxml.jackson" />
         <allow pkg="io.fabric8.zjsonpatch" />
         <allow pkg="io.fabric8.kubernetes.api.model" />
+        <allow pkg="io.fabric8.certmanager.api.model" />
         <allow class="io.fabric8.kubernetes.client.utils.Serialization" />
         <allow class="io.fabric8.kubernetes.client.CustomResource" />
 
@@ -59,6 +60,7 @@ We also control imports only in production classes and not in tests. This is con
         <allow pkg="io.fabric8.zjsonpatch" />
         <allow pkg="io.fabric8.openshift.api.model" />
         <allow pkg="io.fabric8.kubernetes.api.model" />
+        <allow pkg="io.fabric8.certmanager.api.model" />
         <allow pkg="io.vertx.core.json" />
         <allow pkg="com.fathzer.soft.javaluator" />
         <allow class="edu.umd.cs.findbugs.annotations.SuppressFBWarnings" />
@@ -98,6 +100,7 @@ We also control imports only in production classes and not in tests. This is con
         <allow pkg="io.strimzi.api.kafka" />
         <allow pkg="io.strimzi.certs" />
         <allow pkg="io.strimzi.operator.common.model" />
+        <allow pkg="io.strimzi.operator.user.ca" />
         <allow pkg="io.strimzi.operator.user.model" />
         <allow pkg="io.strimzi.operator.common.ca" />
         <allow class="io.strimzi.operator.common.Annotations" />

CHANGELOG.md

@@ -4,6 +4,8 @@
 
 * (Early Access) Configurable internal cluster security allows users to configure encryption and authentication on the internal connections within the Apache Kafka cluster.
 * Support for mounting projected service account tokens into Strimzi-managed Pods
+* (Early Access) Integration with cert-manager for issuing certificates. Users can set `spec.clusterCa.type` and/or `spec.clientsCa.type` to `cert-manager.io` to delegate end-entity certificate issuance to a cert-manager `Issuer` or `ClusterIssuer`.
+  While the cert-manager feature is in Early Access it is not recommended for use in production.
 
 ### Major changes, deprecations, and removals
 

api/src/main/java/io/strimzi/api/kafka/model/common/CertificateAuthority.java

@@ -6,6 +6,8 @@
 
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonPropertyOrder;
+import io.strimzi.api.kafka.model.kafka.certmanager.CertManager;
+import io.strimzi.crdgenerator.annotations.CelValidation;
 import io.strimzi.crdgenerator.annotations.Description;
 import io.strimzi.crdgenerator.annotations.Minimum;
 import io.sundr.builder.annotations.Buildable;
@@ -22,9 +24,23 @@
         editableEnabled = false,
         builderPackage = Constants.FABRIC8_KUBERNETES_API
 )
+@CelValidation(rules = {
+    @CelValidation.CelValidationRule(
+        rule = "(has(self.type) && self.type != 'strimzi') || !has(self.certManager)",
+        message = "'certManager' cannot be configured with 'type: strimzi'"
+        ),
+    @CelValidation.CelValidationRule(
+        rule = "!has(self.type) || self.type != 'cert-manager' || has(self.certManager)",
+        message = "'certManager' must be set for 'type: cert-manager'"
+        ),
+    @CelValidation.CelValidationRule(
+        rule = "!has(self.type) || self.type != 'cert-manager' || (has(self.generateCertificateAuthority) && !self.generateCertificateAuthority)",
+        message = "'generateCertificateAuthority' must be set to false for 'type: cert-manager'"
+        )
+})
 @JsonInclude(JsonInclude.Include.NON_DEFAULT)
-@JsonPropertyOrder({ "generateCertificateAuthority", "generateSecretOwnerReference", "validityDays",
-    "renewalDays", "certificateExpirationPolicy" })
+@JsonPropertyOrder({ "generateCertificateAuthority", "type", "generateSecretOwnerReference", "validityDays",
+    "renewalDays", "certificateExpirationPolicy", "certManager" })
 @EqualsAndHashCode
 @ToString
 public class CertificateAuthority implements UnknownPropertyPreserving {
@@ -33,9 +49,11 @@ public class CertificateAuthority implements UnknownPropertyPreserving {
 
     private int validityDays;
     private boolean generateCertificateAuthority = true;
+    private CertificateManagerType type = CertificateManagerType.STRIMZI;
     private boolean generateSecretOwnerReference = true;
     private int renewalDays;
     private CertificateExpirationPolicy certificateExpirationPolicy;
+    private CertManager certManager;
     private Map<String, Object> additionalProperties;
 
     @Description("The number of days generated certificates should be valid for. The default is 365.")
@@ -61,6 +79,18 @@ public void setGenerateCertificateAuthority(boolean generateCertificateAuthority
         this.generateCertificateAuthority = generateCertificateAuthority;
     }
 
+    @Description("The type of certificate manager. " +
+            "The available types are `strimzi` and `cert-manager`. " +
+            "Default is `strimzi`.")
+    @JsonInclude(JsonInclude.Include.NON_DEFAULT)
+    public CertificateManagerType getType() {
+        return type;
+    }
+
+    public void setType(CertificateManagerType type) {
+        this.type = type;
+    }
+
     @Description("If `true`, the Cluster and Client CA Secrets are configured with the `ownerReference` set to the `Kafka` resource. " +
             "If the `Kafka` resource is deleted when `true`, the CA Secrets are also deleted. " +
             "If `false`, the `ownerReference` is disabled. " +
@@ -100,6 +130,16 @@ public void setCertificateExpirationPolicy(CertificateExpirationPolicy certifica
         this.certificateExpirationPolicy = certificateExpirationPolicy;
     }
 
+    @Description("Configuration for using cert-manager to issue certificates. " +
+            "This only applies if the CA type is set to `cert-manager`.")
+    public CertManager getCertManager() {
+        return certManager;
+    }
+
+    public void setCertManager(CertManager certManager) {
+        this.certManager = certManager;
+    }
+
     @Override
     public Map<String, Object> getAdditionalProperties() {
         return this.additionalProperties != null ? this.additionalProperties : Map.of();

api/src/main/java/io/strimzi/api/kafka/model/common/CertificateManagerType.java

@@ -0,0 +1,33 @@
+/*
+ * Copyright Strimzi authors.
+ * License: Apache License 2.0 (see the file LICENSE or http://apache.org/licenses/LICENSE-2.0.html).
+ */
+package io.strimzi.api.kafka.model.common;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonValue;
+
+/**
+ * Defines values for the spec.clusterCa/clientsCa.type field
+ */
+public enum CertificateManagerType {
+    STRIMZI,
+    CERT_MANAGER;
+
+    @JsonCreator
+    public static CertificateManagerType forValue(String value) {
+        return switch (value) {
+            case "strimzi" -> STRIMZI;
+            case "cert-manager" -> CERT_MANAGER;
+            default -> throw new IllegalArgumentException(String.format("Unknown certificate manager type: %s. Must be %s or %s.", value, STRIMZI.toValue(), CERT_MANAGER.toValue()));
+        };
+    }
+
+    @JsonValue
+    public String toValue() {
+        return switch (this) {
+            case STRIMZI -> "strimzi";
+            case CERT_MANAGER -> "cert-manager";
+        };
+    }
+}

api/src/main/java/io/strimzi/api/kafka/model/kafka/certmanager/CaCertRef.java

@@ -0,0 +1,70 @@
+/*
+ * Copyright Strimzi authors.
+ * License: Apache License 2.0 (see the file LICENSE or http://apache.org/licenses/LICENSE-2.0.html).
+ */
+package io.strimzi.api.kafka.model.kafka.certmanager;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
+import io.strimzi.api.kafka.model.common.Constants;
+import io.strimzi.api.kafka.model.common.UnknownPropertyPreserving;
+import io.strimzi.crdgenerator.annotations.Description;
+import io.sundr.builder.annotations.Buildable;
+import lombok.EqualsAndHashCode;
+import lombok.ToString;
+
+import java.util.HashMap;
+import java.util.Map;
+
+@Description("Reference to the Secret containing the CA certificate (public key) " +
+        "that trusts certificates issued by cert-manager. " +
+        "This only applies if the CA type is set to `cert-manager`.")
+@Buildable(
+        editableEnabled = false,
+        builderPackage = Constants.FABRIC8_KUBERNETES_API
+)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonPropertyOrder({ "secretName", "certificate" })
+@EqualsAndHashCode
+@ToString
+public class CaCertRef implements UnknownPropertyPreserving {
+    private String secretName;
+    private String certificate;
+    private Map<String, Object> additionalProperties;
+
+    @Description("The name of the Secret. " +
+            "Required.")
+    @JsonProperty(required = true)
+    public String getSecretName() {
+        return secretName;
+    }
+
+    public void setSecretName(String secretName) {
+        this.secretName = secretName;
+    }
+
+    @Description("The key under which the CA certificate is stored in the Secret. " +
+            "Required.")
+    @JsonProperty(required = true)
+    public String getCertificate() {
+        return certificate;
+    }
+
+    public void setCertificate(String certificate) {
+        this.certificate = certificate;
+    }
+
+    @Override
+    public Map<String, Object> getAdditionalProperties() {
+        return this.additionalProperties != null ? this.additionalProperties : Map.of();
+    }
+
+    @Override
+    public void setAdditionalProperty(String name, Object value) {
+        if (this.additionalProperties == null) {
+            this.additionalProperties = new HashMap<>(2);
+        }
+        this.additionalProperties.put(name, value);
+    }
+}

api/src/main/java/io/strimzi/api/kafka/model/kafka/certmanager/CertManager.java

@@ -0,0 +1,70 @@
+/*
+ * Copyright Strimzi authors.
+ * License: Apache License 2.0 (see the file LICENSE or http://apache.org/licenses/LICENSE-2.0.html).
+ */
+package io.strimzi.api.kafka.model.kafka.certmanager;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonPropertyOrder;
+import io.strimzi.api.kafka.model.common.Constants;
+import io.strimzi.api.kafka.model.common.UnknownPropertyPreserving;
+import io.strimzi.crdgenerator.annotations.Description;
+import io.sundr.builder.annotations.Buildable;
+import lombok.EqualsAndHashCode;
+import lombok.ToString;
+
+import java.util.HashMap;
+import java.util.Map;
+
+@Description("Configuration for using cert-manager to issue certificates. " +
+        "This only applies if the CA type is set to `cert-manager`.")
+@Buildable(
+        editableEnabled = false,
+        builderPackage = Constants.FABRIC8_KUBERNETES_API
+)
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JsonPropertyOrder({ "issuerRef", "caCertRef" })
+@EqualsAndHashCode
+@ToString
+public class CertManager implements UnknownPropertyPreserving {
+    private IssuerRef issuerRef;
+    private CaCertRef caCertRef;
+    private Map<String, Object> additionalProperties;
+
+    @Description("Reference to the cert-manager issuer to use for issuing certificates. " +
+            "Required.")
+    @JsonProperty(required = true)
+    public IssuerRef getIssuerRef() {
+        return issuerRef;
+    }
+
+    public void setIssuerRef(IssuerRef issuerRef) {
+        this.issuerRef = issuerRef;
+    }
+
+    @Description("Reference to the Secret containing the CA certificate (public key) " +
+            "that trusts certificates issued by cert-manager. " +
+            "Required.")
+    @JsonProperty(required = true)
+    public CaCertRef getCaCertRef() {
+        return caCertRef;
+    }
+
+    public void setCaCertRef(CaCertRef caCertRef) {
+        this.caCertRef = caCertRef;
+    }
+
+    @Override
+    public Map<String, Object> getAdditionalProperties() {
+        return this.additionalProperties != null ? this.additionalProperties : Map.of();
+    }
+
+    @Override
+    public void setAdditionalProperty(String name, Object value) {
+        if (this.additionalProperties == null) {
+            this.additionalProperties = new HashMap<>(2);
+        }
+        this.additionalProperties.put(name, value);
+    }
+}

api/src/main/java/io/strimzi/api/kafka/model/kafka/certmanager/IssuerKind.java

@@ -0,0 +1,47 @@
+/*
+ * Copyright Strimzi authors.
+ * License: Apache License 2.0 (see the file LICENSE or http://apache.org/licenses/LICENSE-2.0.html).
+ */
+package io.strimzi.api.kafka.model.kafka.certmanager;
+
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonValue;
+
+/**
+ * The type of Issuer to use for Certificate resources that will be reconciled by cert-manager.
+ * cert-manager supports two kinds: Issuer and ClusterIssuer.
+ */
+public enum IssuerKind {
+    /**
+     * Issuer kind that is referenced by Certificate resources in the same namespace
+     */
+    ISSUER,
+    /**
+     * Issuer that kind that can be referenced by Certificate resources in any namespace
+     */
+    CLUSTER_ISSUER;
+
+    @JsonCreator
+    public static IssuerKind forValue(String value) {
+        switch (value) {
+            case "Issuer":
+                return ISSUER;
+            case "ClusterIssuer":
+                return CLUSTER_ISSUER;
+            default:
+                throw new IllegalArgumentException("Unknown IssuerKind: " + value + ". Must be 'Issuer' or 'ClusterIssuer'.");
+        }
+    }
+
+    @JsonValue
+    public String toValue() {
+        switch (this) {
+            case ISSUER:
+                return "Issuer";
+            case CLUSTER_ISSUER:
+                return "ClusterIssuer";
+            default:
+                return null;
+        }
+    }
+}