tls: enable tls.ca setting in client/exporter config files #177

mangelajo · 2026-01-30T17:56:35Z

This PR adds the following elements:

Exposing of the certificate authority bundle as a configmap for the jmp admin tool, the CA can be either auto-generated when a self signed CA is enabled, or an external authority / or certificate issuer in the language of cert-manager, in that case, when using an external issuer, the administrator needs to provide the new CABundle field, which could be empty for a public CA (i.e. ACME+letsencrypt or equivalent)
Adding support in the jmp admin tool to insert the CA bundle in the client/exporter config files when doing a jmp admin create [exporter|client]
E2E testing the above.

There is a follow up PR that enables OIDC logins "easy-login" where the server provides the CA to the jmp login (as well as some extra details like: endpoint, namespace, etc.

Summary by CodeRabbit

New Features
- Support for supplying a custom base64-encoded CA bundle for external certificate issuers
- CA bundle published to a ConfigMap (jumpstarter-service-ca-cert) so clients can verify TLS
- Clients and exporters now include TLS config that uses the CA bundle when present
Tests
- New end-to-end and unit tests validating CA ConfigMap behavior and client/exporter TLS handling

coderabbitai · 2026-01-30T17:56:42Z

📝 Walkthrough

Walkthrough

Adds an optional base64-encoded PEM caBundle to IssuerReference, reconciles a CA ConfigMap (jumpstarter-service-ca-cert) from issuer CABundle or self-signed secret, and propagates the CA bundle to Python clients/exporters with tests and CRD/schema updates.

Changes

Cohort / File(s)	Summary
API & CRD `controller/deploy/operator/api/v1alpha1/jumpstarter_types.go`, `controller/deploy/operator/api/v1alpha1/zz_generated.deepcopy.go`, `controller/deploy/operator/config/crd/bases/operator.jumpstarter.dev_jumpstarters.yaml`, `controller/deploy/operator/bundle/manifests/operator.jumpstarter.dev_jumpstarters.yaml`	Added optional `CABundle []byte` (`json:"caBundle,omitempty"`) to `IssuerReference`, updated deepcopy to deep-copy the slice, and extended CRD/CSV manifests with `caBundle` schema property.
Operator CA ConfigMap Reconciliation `controller/deploy/operator/internal/controller/jumpstarter/certificates.go`	Added CA ConfigMap reconciliation (create/update) named `jumpstarter-service-ca-cert`, deriving `ca.crt` from Issuer.CABundle, self-signed CA secret, or leaving empty; introduced `GetCAConfigMapName`, `reconcileCAConfigMap`, and related constant.
End-to-end & BATS tests `controller/deploy/operator/test/e2e/e2e_test.go`, `e2e/tests.bats`	Added e2e tests validating CA ConfigMap contents for self-signed and external issuer modes and a BATS test validating legacy client TLS CA usage.
Python client/exporter integration `python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/util/async_custom_object_api.py`, `python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/clients.py`, `python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/exporters.py`, `python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/clients_test.py`, `python/packages/jumpstarter-kubernetes/jumpstarter_kubernetes/exporters_test.py`	Added `get_ca_bundle()` to fetch base64 CA from ConfigMap `jumpstarter-service-ca-cert`, wired CA into client/exporter configs as `TLSConfigV1Alpha1(ca=...)`, and expanded tests covering presence/absence and encoding scenarios.
CSV timestamp-only change `controller/deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml`	Updated `createdAt` timestamp only.

Sequence Diagram(s)

sequenceDiagram
    participant Operator as Operator (controller)
    participant K8sAPI as Kubernetes API
    participant CM as ConfigMap (jumpstarter-service-ca-cert)
    participant Client as Python Client/Exporter
    participant TLS as TLS stack

    Operator->>K8sAPI: reconcileCAConfigMap(js) — ensure ConfigMap exists
    K8sAPI-->>CM: create/update ca.crt (from Issuer.CABundle or CA secret)
    Client->>K8sAPI: read ConfigMap jumpstarter-service-ca-cert
    K8sAPI-->>Client: return ConfigMap (ca.crt or empty)
    Client->>Client: base64-decode/encode ca.crt -> TLSConfigV1Alpha1(ca=...)
    Client->>TLS: establish TLS connection using provided CA bundle
    TLS->>TLS: verify server cert against CA bundle
    TLS-->>Client: connection result

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Possibly related PRs

Operator cert manager #139 — Prior cert-manager/IssuerReference work that introduced IssuerReference and is extended here by adding caBundle and CA ConfigMap orchestration.

Suggested labels

administration, operator

Suggested reviewers

evakhoni
bennyz

Poem

🐰 I hop with joy to guard the crt,
tucked in a ConfigMap, tiny and neat.
From issuer or secret it finds its place,
clients sip TLS with a confident face.
A carrot for secure connections, oh sweet! 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main objective of the pull request: enabling TLS CA certificate support in client and exporter configuration files.
Docstring Coverage	✅ Passed	Docstring coverage is 96.88% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch config-ca-certs

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

mangelajo · 2026-02-02T08:37:43Z

Hmm, this isn't running some of the CI jobs, why?

mangelajo · 2026-02-02T08:41:03Z

ah, this is not over the base branch main...

mangelajo · 2026-02-02T17:09:55Z

controller/deploy/operator/internal/controller/jumpstarter/certificates.go

+			}, caSecret)
+			if err != nil {
+				// CA secret doesn't exist yet - this is expected during initial setup
+				// The ConfigMap will be updated once the CA certificate is ready


In the follow up PR we wait until this is really ready before creating the configmap to avoid the service from having a "blank" CA bundle injected. In this PR we still don't use it from jumpstarter-controller, only jmp admin, so it's not a problem really, but on the later patch we start using this from jumpstarter-controller and we can't populate empty so you will see this change.

Thanks for clarifying this part!

mangelajo · 2026-02-03T10:24:04Z

hmm CI is not running because this was first on top of another branch, let me update last commit message to trigger it

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@controller/deploy/operator/internal/controller/jumpstarter/certificates.go`:
- Around line 511-525: The current error handling around r.Client.Get when
reading the CA secret (caSecret, caSecretName) treats all errors as "not found"
and proceeds to create an empty CA ConfigMap; change this to differentiate
NotFound vs other errors by using apierrors.IsNotFound(err) (from
k8s.io/apimachinery/pkg/api/errors) — if apierrors.IsNotFound(err) keep the
existing log and continue, otherwise return the error (or requeue) from the
reconcile function so transient/API/RBAC failures are retried and not silently
masked; update imports to include apierrors if missing.

controller/deploy/operator/internal/controller/jumpstarter/certificates.go

mangelajo · 2026-02-03T12:13:14Z

Thank you @bkhizgiy !!

cert-manager: expose ca-bundle as configmap for jmp

77c7f09

mangelajo changed the title ~~Config ca certs~~ tls: enable tls.ca setting in client/exporter config files Feb 2, 2026

mangelajo changed the base branch from e2e-with-operator to main February 2, 2026 17:02

mangelajo requested a review from evakhoni February 2, 2026 17:05

mangelajo commented Feb 2, 2026

View reviewed changes

cert-manager: add jmp admin legacy client support, oidc missing yet

aed490a

mangelajo force-pushed the config-ca-certs branch from 65220b3 to aed490a Compare February 3, 2026 10:24

update bundle

03ba022

coderabbitai bot reviewed Feb 3, 2026

View reviewed changes

controller/deploy/operator/internal/controller/jumpstarter/certificates.go Show resolved Hide resolved

cert-manager: log/handle issues with transient API/RBAC access

65541e4

bkhizgiy approved these changes Feb 3, 2026

View reviewed changes

mangelajo merged commit 96e1a1e into main Feb 3, 2026
28 checks passed

coderabbitai bot mentioned this pull request Feb 3, 2026

tls ca distribution to OIDC login users + easier login #180

Merged

tls: enable tls.ca setting in client/exporter config files #177

tls: enable tls.ca setting in client/exporter config files #177

Uh oh!

Conversation

mangelajo commented Jan 30, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Uh oh!

mangelajo commented Feb 2, 2026

Uh oh!

mangelajo commented Feb 2, 2026

Uh oh!

mangelajo Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

bkhizgiy Feb 3, 2026

Choose a reason for hiding this comment

Uh oh!

mangelajo commented Feb 3, 2026

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mangelajo commented Feb 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mangelajo commented Jan 30, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Jan 30, 2026 •

edited

Loading