Generic code for Certificates (#8489)

Make Certifacte factory more generic

Signed-off-by: Matthias Wessendorf <[email protected]>

pkg/reconciler/integration/sink/resources/certificate.go → pkg/certificates/certificate.go

@@ -1,5 +1,5 @@
 /*
-Copyright 2024 The Knative Authors
+Copyright 2025 The Knative Authors
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
@@ -14,39 +14,40 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package resources
+package certificates
 
 import (
 	"fmt"
 	"time"
 
+	"knative.dev/eventing/pkg/reconciler/integration/sink/resources"
+
 	cmv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
 	cmmeta "github.com/cert-manager/cert-manager/pkg/apis/meta/v1"
 	"knative.dev/pkg/kmeta"
 
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"knative.dev/eventing/pkg/apis/sinks/v1alpha1"
 )
 
-func CertificateName(sinkName string) string {
-	return kmeta.ChildName(sinkName, "-server-tls")
+func CertificateName(objName string) string {
+	return kmeta.ChildName(objName, "-server-tls")
 }
 
-func MakeCertificate(sink *v1alpha1.IntegrationSink) *cmv1.Certificate {
+func MakeCertificate(obj kmeta.OwnerRefableAccessor, name string) *cmv1.Certificate {
 	return &cmv1.Certificate{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      CertificateName(sink.Name),
-			Namespace: sink.Namespace,
+			Name:      CertificateName(name),
+			Namespace: obj.GetNamespace(),
 			OwnerReferences: []metav1.OwnerReference{
-				*kmeta.NewControllerRef(sink),
+				*kmeta.NewControllerRef(obj),
 			},
 		},
 		Spec: cmv1.CertificateSpec{
-			SecretName: CertificateName(sink.Name),
+			SecretName: CertificateName(name),
 			SecretTemplate: &cmv1.CertificateSecretTemplate{
 				Labels: map[string]string{
 					"app.kubernetes.io/component": "knative-eventing",
-					"app.kubernetes.io/name":      sink.Name,
+					"app.kubernetes.io/name":      name,
 				},
 			},
 			Duration: &metav1.Duration{
@@ -66,8 +67,8 @@ func MakeCertificate(sink *v1alpha1.IntegrationSink) *cmv1.Certificate {
 				RotationPolicy: cmv1.RotationPolicyAlways,
 			},
 			DNSNames: []string{
-				fmt.Sprintf("%s.%s.svc.cluster.local", DeploymentName(sink.Name), sink.Namespace),
-				fmt.Sprintf("%s.%s.svc", DeploymentName(sink.Name), sink.Namespace),
+				fmt.Sprintf("%s.%s.svc.cluster.local", resources.DeploymentName(name), obj.GetNamespace()),
+				fmt.Sprintf("%s.%s.svc", resources.DeploymentName(name), obj.GetNamespace()),
 			},
 			IssuerRef: cmmeta.ObjectReference{
 				Name:  "knative-eventing-ca-issuer",

pkg/certificates/certificate_test.go

@@ -0,0 +1,92 @@
+/*
+Copyright 2025 The Knative Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package certificates
+
+import (
+	"fmt"
+	"testing"
+	"time"
+
+	cmv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
+	cmmeta "github.com/cert-manager/cert-manager/pkg/apis/meta/v1"
+	"github.com/google/go-cmp/cmp"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	sourcesv1 "knative.dev/eventing/pkg/apis/sources/v1"
+	"knative.dev/pkg/kmeta"
+)
+
+func TestNewCertificate(t *testing.T) {
+
+	testNS := "test-ns"
+	testName := "test-name"
+	obj := &sourcesv1.PingSource{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      testName,
+			Namespace: testNS,
+		},
+	}
+
+	want := &cmv1.Certificate{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      CertificateName(obj.GetName()),
+			Namespace: obj.GetNamespace(),
+			OwnerReferences: []metav1.OwnerReference{
+				*kmeta.NewControllerRef(obj),
+			},
+		},
+		Spec: cmv1.CertificateSpec{
+			SecretName: CertificateName(obj.GetName()),
+			SecretTemplate: &cmv1.CertificateSecretTemplate{
+				Labels: map[string]string{
+					"app.kubernetes.io/component": "knative-eventing",
+					"app.kubernetes.io/name":      obj.GetName(),
+				},
+			},
+			Duration: &metav1.Duration{
+				Duration: 90 * 24 * time.Hour, // 90 days
+			},
+			RenewBefore: &metav1.Duration{
+				Duration: 15 * 24 * time.Hour, // 15 days
+			},
+
+			Subject: &cmv1.X509Subject{
+				Organizations: []string{"local"},
+			},
+			PrivateKey: &cmv1.CertificatePrivateKey{
+				Algorithm:      cmv1.RSAKeyAlgorithm,
+				Encoding:       cmv1.PKCS1,
+				Size:           2048,
+				RotationPolicy: cmv1.RotationPolicyAlways,
+			},
+			DNSNames: []string{
+				fmt.Sprintf("%s.%s.svc.cluster.local", obj.GetName()+"-deployment", obj.GetNamespace()),
+				fmt.Sprintf("%s.%s.svc", obj.GetName()+"-deployment", obj.GetNamespace()),
+			},
+			IssuerRef: cmmeta.ObjectReference{
+				Name:  "knative-eventing-ca-issuer",
+				Kind:  "ClusterIssuer",
+				Group: "cert-manager.io",
+			},
+		},
+	}
+
+	got := MakeCertificate(obj, testName)
+
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Error("unexpected condition (-want, +got) =", diff)
+	}
+}

pkg/reconciler/integration/sink/integrationsink.go

@@ -20,6 +20,8 @@ import (
 	"context"
 	"fmt"
 
+	"knative.dev/eventing/pkg/certificates"
+
 	cmv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
 
 	v1 "k8s.io/api/apps/v1"
@@ -170,7 +172,7 @@ func (r *Reconciler) reconcileService(ctx context.Context, sink *sinks.Integrati
 
 func (r *Reconciler) reconcileCMCertificate(ctx context.Context, sink *sinks.IntegrationSink) (*cmv1.Certificate, error) {
 
-	expected := resources.MakeCertificate(sink)
+	expected := certificates.MakeCertificate(sink, sink.Name)
 
 	cert, err := r.cmCertificateLister.Certificates(sink.Namespace).Get(expected.Name)
 	if apierrors.IsNotFound(err) {
@@ -248,9 +250,9 @@ func (r *Reconciler) reconcileAddress(ctx context.Context, sink *sinks.Integrati
 }
 
 func (r *Reconciler) getCaCerts(sink *sinks.IntegrationSink) (*string, error) {
-	secret, err := r.secretLister.Secrets(sink.Namespace).Get(resources.CertificateName(sink.Name))
+	secret, err := r.secretLister.Secrets(sink.Namespace).Get(certificates.CertificateName(sink.Name))
 	if err != nil {
-		return nil, fmt.Errorf("failed to get CA certs from %s/%s: %w", sink.Namespace, resources.CertificateName(sink.Name), err)
+		return nil, fmt.Errorf("failed to get CA certs from %s/%s: %w", sink.Namespace, certificates.CertificateName(sink.Name), err)
 	}
 	caCerts, ok := secret.Data[eventingtls.SecretCACert]
 	if !ok {