Skip to content

Update coroot operator with new TLS Support configs #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
def merged 6 commits into from
May 1, 2026
Merged

Update coroot operator with new TLS Support configs #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ca44c4c
Update coroot operator with new TLS Support configs
vishnukumarkvs Apr 20, 2026
98fcbad
bump controller-gen and run make generate
vishnukumarkvs Apr 22, 2026
f4840bb
add coroot_tls.yaml in samples
vishnukumarkvs Apr 23, 2026
b9ad4a0
Add HTTPDisabled conditions for ports and ingress specs
vishnukumarkvs Apr 25, 2026
dd340c8
Use strconv for parsing port
vishnukumarkvs Apr 25, 2026
7d7589b
Refactor TLS, CASecret logic
vishnukumarkvs Apr 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ $(LOCALBIN):
CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen

## Tool Versions
CONTROLLER_TOOLS_VERSION ?= v0.16.1
CONTROLLER_TOOLS_VERSION ?= v0.20.1

.PHONY: controller-gen
controller-gen: $(CONTROLLER_GEN) ## Download controller-gen locally if necessary.
Expand Down
20 changes: 20 additions & 0 deletions api/v1/coroot_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,13 @@ type AgentsOnlySpec struct {
TLSSkipVerify bool `json:"tlsSkipVerify,omitempty"`
}

type AgentTLSSpec struct {
// Secret containing the CA certificate to verify the Coroot server's certificate.
CASecret *corev1.SecretKeySelector `json:"caSecret,omitempty"`
// Whether to skip verification of the Coroot server's TLS certificate.
TLSSkipVerify bool `json:"tlsSkipVerify,omitempty"`
}

type NodeAgentSpec struct {
// Priority class for the node-agent pods.
PriorityClassName string `json:"priorityClassName,omitempty"`
Expand All @@ -50,6 +57,8 @@ type NodeAgentSpec struct {
// Environment variables for the node-agent.
Env []corev1.EnvVar `json:"env,omitempty"`
Image ImageSpec `json:"image,omitempty"`
// TLS settings for connecting to Coroot.
TLS *AgentTLSSpec `json:"tls,omitempty"`

LogCollector LogCollectorSpec `json:"logCollector,omitempty"`
EbpfTracer EbpfTracerSpec `json:"ebpfTracer,omitempty"`
Expand Down Expand Up @@ -90,6 +99,8 @@ type ClusterAgentSpec struct {
// Environment variables for the cluster-agent.
Env []corev1.EnvVar `json:"env,omitempty"`
Image ImageSpec `json:"image,omitempty"`
// TLS settings for connecting to Coroot.
TLS *AgentTLSSpec `json:"tls,omitempty"`

KubeStateMetrics KubeStateMetricsSpec `json:"kubeStateMetrics,omitempty"`
}
Expand Down Expand Up @@ -254,6 +265,10 @@ type ServiceSpec struct {
GRPCPort int32 `json:"grpcPort,omitempty"`
// gRPC nodePort (if type is NodePort).
GRPCNodePort int32 `json:"grpcNodePort,omitempty"`
// HTTPS port (optional).
HTTPSPort int32 `json:"httpsPort,omitempty"`
// HTTPS nodePort (if type is NodePort).
HTTPSNodePort int32 `json:"httpsNodePort,omitempty"`
// Annotations for the service.
Annotations map[string]string `json:"annotations,omitempty"`
}
Expand All @@ -273,6 +288,7 @@ type TLSSpec struct {
}

type CorootSpec struct {

// Specifies the metric resolution interval.
// +kubebuilder:validation:Pattern="^[0-9]+[sm]$"
MetricsRefreshInterval string `json:"metricsRefreshInterval,omitempty"`
Expand All @@ -292,6 +308,10 @@ type CorootSpec struct {
AuthAnonymousRole string `json:"authAnonymousRole,omitempty"`
// Initial admin password for bootstrapping.
AuthBootstrapAdminPassword string `json:"authBootstrapAdminPassword,omitempty"`
// Disable plain HTTP.
HTTPDisabled bool `json:"httpDisabled,omitempty"`
// HTTPS listen address (default: :8443).
HTTPSListen string `json:"httpsListen,omitempty"`
// Secret containing the initial admin password.
AuthBootstrapAdminPasswordSecret *corev1.SecretKeySelector `json:"authBootstrapAdminPasswordSecret,omitempty"`
// gRPC settings.
Expand Down
30 changes: 30 additions & 0 deletions api/v1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

82 changes: 81 additions & 1 deletion config/crd/coroot.com_coroots.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ kind: CustomResourceDefinition
metadata:
annotations:
argocd.argoproj.io/sync-options: Replace=true
controller-gen.kubebuilder.io/version: v0.16.1
controller-gen.kubebuilder.io/version: v0.20.1
name: coroots.coroot.com
spec:
group: coroot.com
Expand Down Expand Up @@ -4674,6 +4674,39 @@ spec:
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
type: object
tls:
description: TLS settings for connecting to Coroot.
properties:
caSecret:
description: Secret containing the CA certificate to verify
the Coroot server's certificate.
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
optional:
description: Specify whether the Secret or its key must
be defined
type: boolean
required:
- key
type: object
x-kubernetes-map-type: atomic
tlsSkipVerify:
description: Whether to skip verification of the Coroot server's
TLS certificate.
type: boolean
type: object
tolerations:
items:
description: |-
Expand Down Expand Up @@ -5096,6 +5129,12 @@ spec:
description: Disables gRPC server.
type: boolean
type: object
httpDisabled:
description: Disable plain HTTP.
type: boolean
httpsListen:
description: 'HTTPS listen address (default: :8443).'
type: string
ingress:
description: Ingress configuration for Coroot.
properties:
Expand Down Expand Up @@ -6330,6 +6369,39 @@ spec:
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
type: object
tls:
description: TLS settings for connecting to Coroot.
properties:
caSecret:
description: Secret containing the CA certificate to verify
the Coroot server's certificate.
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
optional:
description: Specify whether the Secret or its key must
be defined
type: boolean
required:
- key
type: object
x-kubernetes-map-type: atomic
tlsSkipVerify:
description: Whether to skip verification of the Coroot server's
TLS certificate.
type: boolean
type: object
tolerations:
items:
description: |-
Expand Down Expand Up @@ -8397,6 +8469,14 @@ spec:
description: gRPC port (default 4317).
format: int32
type: integer
httpsNodePort:
description: HTTPS nodePort (if type is NodePort).
format: int32
type: integer
httpsPort:
description: HTTPS port (optional).
format: int32
type: integer
nodePort:
description: Service nodePort (if type is NodePort).
format: int32
Expand Down
74 changes: 73 additions & 1 deletion config/crd/coroot.com_coroots_legacy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ kind: CustomResourceDefinition
metadata:
annotations:
argocd.argoproj.io/sync-options: Replace=true
controller-gen.kubebuilder.io/version: v0.16.1
controller-gen.kubebuilder.io/version: v0.20.1
name: coroots.coroot.com
spec:
group: coroot.com
Expand Down Expand Up @@ -4208,6 +4208,34 @@ spec:
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
type: object
tls:
description: TLS settings for connecting to Coroot.
properties:
caSecret:
description: Secret containing the CA certificate to verify the Coroot server's certificate.
properties:
key:
description: The key of the secret to select from. Must be a valid secret key.
type: string
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
optional:
description: Specify whether the Secret or its key must be defined
type: boolean
required:
- key
type: object
tlsSkipVerify:
description: Whether to skip verification of the Coroot server's TLS certificate.
type: boolean
type: object
tolerations:
items:
description: |-
Expand Down Expand Up @@ -4596,6 +4624,14 @@ spec:
type: boolean
type: object
nullable: true
httpDisabled:
description: Disable plain HTTP.
type: boolean
nullable: true
httpsListen:
description: 'HTTPS listen address (default: :8443).'
type: string
nullable: true
ingress:
description: Ingress configuration for Coroot.
properties:
Expand Down Expand Up @@ -5707,6 +5743,34 @@ spec:
More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
type: object
type: object
tls:
description: TLS settings for connecting to Coroot.
properties:
caSecret:
description: Secret containing the CA certificate to verify the Coroot server's certificate.
properties:
key:
description: The key of the secret to select from. Must be a valid secret key.
type: string
name:
default: ""
description: |-
Name of the referent.
This field is effectively required, but due to backwards compatibility is
allowed to be empty. Instances of this type with an empty value here are
almost certainly wrong.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
type: string
optional:
description: Specify whether the Secret or its key must be defined
type: boolean
required:
- key
type: object
tlsSkipVerify:
description: Whether to skip verification of the Coroot server's TLS certificate.
type: boolean
type: object
tolerations:
items:
description: |-
Expand Down Expand Up @@ -7588,6 +7652,14 @@ spec:
description: gRPC port (default 4317).
format: int32
type: integer
httpsNodePort:
description: HTTPS nodePort (if type is NodePort).
format: int32
type: integer
httpsPort:
description: HTTPS port (optional).
format: int32
type: integer
nodePort:
description: Service nodePort (if type is NodePort).
format: int32
Expand Down
40 changes: 40 additions & 0 deletions config/samples/coroot_tls.yaml
View file
Open in desktop

@vishnukumarkvs vishnukumarkvs Apr 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I ran k3s in ubuntu vm. I have used openssl and created certs and keys. Used this custom resource and deployed coroot to start in TLS mode

I ran make run to test this operator code

@vishnukumarkvs vishnukumarkvs Apr 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image

@vishnukumarkvs vishnukumarkvs Apr 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc: @def

Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
apiVersion: coroot.com/v1
kind: Coroot
metadata:
name: coroot
namespace: coroot
spec:
tls:
certSecret:
name: coroot-server-tls
key: tls.crt
keySecret:
name: coroot-server-tls
key: tls.key

httpDisabled: true

apiKeySecret:
name: coroot-api-key
key: key

projects:
- name: "My Cluster"
apiKeys:
- keySecret:
name: coroot-api-key
key: key

clusterAgent:
tls:
caSecret:
name: coroot-ca-cert
key: ca.crt
tlsSkipVerify: false

nodeAgent:
tls:
caSecret:
name: coroot-ca-cert
key: ca.crt
tlsSkipVerify: false
Loading
Loading