MINOR: add ca file for runtime update

ivanmatmati · ivanmatmati · commit 3ac45e309428 · 2025-06-25T14:46:05.000+02:00
diff --git a/crs/api/ingress/v1/backend.go b/crs/api/ingress/v1/backend.go
@@ -22,7 +22,7 @@ import (
 
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.16-0.20250120132445-428abe2a833d"
+// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.18-0.20250618120639-fbea0cb7be62"
 
 // Backend is a specification for a Backend resource
 type Backend struct {
diff --git a/crs/api/ingress/v1/defaults.go b/crs/api/ingress/v1/defaults.go
@@ -22,7 +22,7 @@ import (
 
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.16-0.20250120132445-428abe2a833d"
+// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.18-0.20250618120639-fbea0cb7be62"
 
 // Defaults is a specification for a Defaults resource
 type Defaults struct {
diff --git a/crs/api/ingress/v1/global.go b/crs/api/ingress/v1/global.go
@@ -22,7 +22,7 @@ import (
 
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.16-0.20250120132445-428abe2a833d"
+// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.18-0.20250618120639-fbea0cb7be62"
 // +kubebuilder:validation:XValidation:rule="!has(self.spec.config.default_path)", message="spec.config.default_path is set by ingress controller internally"
 // +kubebuilder:validation:XValidation:rule="!has(self.spec.config.master__dash__worker)", message="spec.config.master-worker is set by ingress controller internally"
 // +kubebuilder:validation:XValidation:rule="!has(self.spec.config.pidfile)", message="spec.config.pidfile is set by ingress controller internally"
diff --git a/crs/api/ingress/v1/tcp.go b/crs/api/ingress/v1/tcp.go
@@ -23,7 +23,7 @@ import (
 
 // +genclient
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
-// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.16-0.20250120132445-428abe2a833d"
+// +kubebuilder:metadata:annotations="haproxy.org/client-native=v5.1.18-0.20250618120639-fbea0cb7be62"
 
 // TCP is a specification for a TCP resource
 type TCP struct {
diff --git a/crs/definition/ingress.v1.haproxy.org_backends.yaml b/crs/definition/ingress.v1.haproxy.org_backends.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    haproxy.org/client-native: v5.1.16-0.20250120132445-428abe2a833d
+    haproxy.org/client-native: v5.1.18-0.20250618120639-fbea0cb7be62
   name: backends.ingress.v1.haproxy.org
 spec:
   group: ingress.v1.haproxy.org
@@ -2583,7 +2583,7 @@ spec:
                       description: |-
                         type
                         Required: true
-                        Enum: [add-acl add-header allow auth cache-use capture del-acl del-header del-map deny disable-l7-retry do-resolve early-hint lua normalize-uri redirect reject replace-header replace-path replace-pathq replace-uri replace-value return sc-add-gpc sc-inc-gpc sc-inc-gpc0 sc-inc-gpc1 sc-set-gpt sc-set-gpt0 send-spoe-group set-dst set-dst-port set-header set-log-level set-map set-mark set-method set-nice set-path set-pathq set-priority-class set-priority-offset set-query set-src set-src-port set-timeout set-tos set-uri set-var silent-drop strict-mode tarpit track-sc0 track-sc1 track-sc2 track-sc unset-var use-service wait-for-body wait-for-handshake set-bandwidth-limit]
+                        Enum: [add-acl add-header allow auth cache-use capture del-acl del-header del-map deny disable-l7-retry do-resolve early-hint lua normalize-uri redirect reject replace-header replace-path replace-pathq replace-uri replace-value return sc-add-gpc sc-inc-gpc sc-inc-gpc0 sc-inc-gpc1 sc-set-gpt sc-set-gpt0 send-spoe-group set-dst set-dst-port set-header set-log-level set-map set-mark set-method set-nice set-path set-pathq set-priority-class set-priority-offset set-query set-src set-src-port set-timeout set-tos set-uri set-var set-var-fmt silent-drop strict-mode tarpit track-sc0 track-sc1 track-sc2 track-sc unset-var use-service wait-for-body wait-for-handshake set-bandwidth-limit]
                       enum:
                       - add-acl
                       - add-header
@@ -2634,6 +2634,7 @@ spec:
                       - set-tos
                       - set-uri
                       - set-var
+                      - set-var-fmt
                       - silent-drop
                       - strict-mode
                       - tarpit
diff --git a/crs/definition/ingress.v1.haproxy.org_defaults.yaml b/crs/definition/ingress.v1.haproxy.org_defaults.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    haproxy.org/client-native: v5.1.16-0.20250120132445-428abe2a833d
+    haproxy.org/client-native: v5.1.18-0.20250618120639-fbea0cb7be62
   name: defaults.ingress.v1.haproxy.org
 spec:
   group: ingress.v1.haproxy.org
diff --git a/crs/definition/ingress.v1.haproxy.org_globals.yaml b/crs/definition/ingress.v1.haproxy.org_globals.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    haproxy.org/client-native: v5.1.16-0.20250120132445-428abe2a833d
+    haproxy.org/client-native: v5.1.18-0.20250618120639-fbea0cb7be62
   name: globals.ingress.v1.haproxy.org
 spec:
   group: ingress.v1.haproxy.org
diff --git a/crs/definition/ingress.v1.haproxy.org_tcps.yaml b/crs/definition/ingress.v1.haproxy.org_tcps.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    haproxy.org/client-native: v5.1.16-0.20250120132445-428abe2a833d
+    haproxy.org/client-native: v5.1.18-0.20250618120639-fbea0cb7be62
   name: tcps.ingress.v1.haproxy.org
 spec:
   group: ingress.v1.haproxy.org
diff --git a/go.mod b/go.mod
@@ -10,7 +10,7 @@ require (
 	github.com/google/go-cmp v0.7.0
 	github.com/google/renameio v1.0.1
 	github.com/haproxytech/client-native/v3 v3.1.2-0.20230607075433-231591da68ed
-	github.com/haproxytech/client-native/v5 v5.1.16-0.20250120132445-428abe2a833d
+	github.com/haproxytech/client-native/v5 v5.1.18-0.20250618120639-fbea0cb7be62
 	github.com/jessevdk/go-flags v1.4.0
 	github.com/pires/go-proxyproto v0.8.1
 	github.com/prometheus/client_golang v1.22.0
diff --git a/go.sum b/go.sum
@@ -68,8 +68,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/haproxytech/client-native/v3 v3.1.2-0.20230607075433-231591da68ed h1:qjKxpoe4wYQmpGrrooqau88Fgusy9VQfulpXghBDqx8=
 github.com/haproxytech/client-native/v3 v3.1.2-0.20230607075433-231591da68ed/go.mod h1:xRVluo27FAjK4ag33+jUfpnNf9olXQlTRHUl3VMvq98=
-github.com/haproxytech/client-native/v5 v5.1.16-0.20250120132445-428abe2a833d h1:CSIkA9flJLOYabKfDR7DUJ8qL+SkWh1rqXXjBqctWn4=
-github.com/haproxytech/client-native/v5 v5.1.16-0.20250120132445-428abe2a833d/go.mod h1:/ms7QkqUYwCBm31zYl/qT/0r/TBDRt60pusERVZ2j0Q=
+github.com/haproxytech/client-native/v5 v5.1.18-0.20250618120639-fbea0cb7be62 h1:tPi+TAeicU7XSjiD2rP4G8S4IVOWXJDxYZ5C43y1sCM=
+github.com/haproxytech/client-native/v5 v5.1.18-0.20250618120639-fbea0cb7be62/go.mod h1:/ms7QkqUYwCBm31zYl/qT/0r/TBDRt60pusERVZ2j0Q=
 github.com/haproxytech/go-logger v1.1.0 h1:HgGtYaI1ApkvbQdsm7f9AzQQoxTB7w37criTflh7IQE=
 github.com/haproxytech/go-logger v1.1.0/go.mod h1:OekUd8HCb7ubxMplzHUPBTHNxZmddOWfOjWclZsqIeM=
 github.com/jessevdk/go-flags v1.4.0 h1:4IU2WS7AumrZ/40jfhf4QVDMsQwqA7VEHozFRrGARJA=
diff --git a/pkg/haproxy/api/api.go b/pkg/haproxy/api/api.go
@@ -105,6 +105,7 @@ type HAProxyClient interface { //nolint:interfacebloat
 	UserListExistsByGroup(group string) (bool, error)
 	UserListCreateByGroup(group string, userPasswordMap map[string][]byte) error
 	Cert
+	CertAuth
 }
 
 type Cert interface {
@@ -117,6 +118,14 @@ type Cert interface {
 	CertEntryDelete(filename string) error
 }
 
+type CertAuth interface {
+	CertAuthEntryCreate(filename string) error
+	CertAuthEntrySet(filename string, payload []byte) error
+	CertAuthEntryCommit(filename string) error
+	CertEntryAbort(filename string) error
+	CertEntryDelete(filename string) error
+}
+
 type clientNative struct {
 	nativeAPI                   clientnative.HAProxyClient
 	activeBackends              map[string]struct{}
diff --git a/pkg/haproxy/api/runtime.go b/pkg/haproxy/api/runtime.go
@@ -289,3 +289,35 @@ func (c *clientNative) CertEntryDelete(filename string) error {
 	}
 	return runtime.DeleteCertEntry(filename)
 }
+
+func (c *clientNative) CertAuthEntryCreate(filename string) error {
+	runtime, err := c.nativeAPI.Runtime()
+	if err != nil {
+		return err
+	}
+	return runtime.NewCAFile(filename)
+}
+
+func (c *clientNative) CertAuthEntrySet(filename string, payload []byte) error {
+	runtime, err := c.nativeAPI.Runtime()
+	if err != nil {
+		return err
+	}
+	return runtime.SetCAFile(filename, string(payload))
+}
+
+func (c *clientNative) CertAuthEntryCommit(filename string) error {
+	runtime, err := c.nativeAPI.Runtime()
+	if err != nil {
+		return err
+	}
+	return runtime.CommitCAFile(filename)
+}
+
+func (c *clientNative) CertAuthEntryAbort(filename string) error {
+	runtime, err := c.nativeAPI.Runtime()
+	if err != nil {
+		return err
+	}
+	return runtime.AbortCAFile(filename)
+}
diff --git a/pkg/haproxy/certs/main.go b/pkg/haproxy/certs/main.go
@@ -46,6 +46,7 @@ type cert struct {
 	path    string
 	inUse   bool
 	updated bool
+	ca      bool
 }
 
 type SecretType int
@@ -110,7 +111,7 @@ func (c *certs) AddSecret(secret *store.Secret, secretType SecretType) (certPath
 
 	var certs map[string]*cert
 	var crt *cert
-	var crtOk, privateKeyNull bool
+	var crtOk, isCa bool
 	var certName string
 	switch secretType {
 	case FT_DEFAULT_CERT:
@@ -130,7 +131,7 @@ func (c *certs) AddSecret(secret *store.Secret, secretType SecretType) (certPath
 		certName = fmt.Sprintf("%s_%s", secret.Namespace, secret.Name)
 		certPath = path.Join(env.CaDir, certName)
 		certs = c.ca
-		privateKeyNull = true
+		isCa = true
 	case TCP_CERT:
 		certName = fmt.Sprintf("%s_%s", secret.Namespace, secret.Name)
 		certPath = path.Join(env.TCPCRDir, certName)
@@ -149,28 +150,39 @@ func (c *certs) AddSecret(secret *store.Secret, secretType SecretType) (certPath
 		path:  certPath,
 		name:  fmt.Sprintf("%s/%s", secret.Namespace, secret.Name),
 		inUse: true,
+		ca:    isCa,
 	}
-	err = c.writeSecret(secret, crt, privateKeyNull)
+	err = c.writeSecret(secret, crt, isCa)
 	if err != nil {
 		return "", err
 	}
 	certs[certName] = crt
 	return crt.path, nil
 }
 
-func (c *certs) updateRuntime(filename string, payload []byte) (bool, error) {
+func (c *certs) updateRuntime(filename string, payload []byte, isCa bool) (bool, error) {
 	if instance.NeedReload() {
 		return false, nil
 	}
 	// Only 1 transaction in parallel is possible for now in haproxy
 	// Keep this mutex for now to ensure that we perform 1 transaction at a time
+	certType := "cert"
+	entryCreate := c.client.CertEntryCreate
+	entrySet := c.client.CertEntrySet
+	entryCommit := c.client.CertEntryCommit
+	if isCa {
+		entryCreate = c.client.CertAuthEntryCreate
+		entrySet = c.client.CertAuthEntrySet
+		entryCommit = c.client.CertAuthEntryCommit
+		certType = "ca"
+	}
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
 	var err error
 	var updated, alreadyExists bool
 
-	err = c.client.CertEntryCreate(filename)
+	err = entryCreate(filename)
 	// If already exists
 	if err != nil {
 		if strings.Contains(err.Error(), "already exists") {
@@ -179,16 +191,16 @@ func (c *certs) updateRuntime(filename string, payload []byte) (bool, error) {
 			return updated, err
 		}
 	} else {
-		utils.GetLogger().Debugf("`new ssl cert` ok[%s]", filename)
+		utils.GetLogger().Debugf("`new ssl %s` ok[%s]", certType, filename)
 	}
 
-	err = c.client.CertEntrySet(filename, payload)
+	err = entrySet(filename, payload)
 	if err != nil {
 		return updated, err
 	}
-	utils.GetLogger().Debugf("`set ssl cert` ok[%s]", filename)
+	utils.GetLogger().Debugf("`set ssl %s` ok[%s]", certType, filename)
 
-	err = c.client.CertEntryCommit(filename)
+	err = entryCommit(filename)
 	if err != nil {
 		// Abort transaction
 		errAbort := c.client.CertEntryAbort(filename)
@@ -200,19 +212,20 @@ func (c *certs) updateRuntime(filename string, payload []byte) (bool, error) {
 
 		return updated, err
 	}
+
 	updated = true
-	utils.GetLogger().Debugf("commit ssl cert` ok [%s]", filename)
+	utils.GetLogger().Debugf("`commit ssl %s` ok [%s]", certType, filename)
 
-	if !alreadyExists {
-		crtListPath := filepath.Dir(filename)
-		err = c.client.CrtListEntryAdd(crtListPath,
+	if !alreadyExists && !isCa {
+		dirPath := filepath.Dir(filename)
+		err := c.client.CrtListEntryAdd(dirPath,
 			runtime.CrtListEntry{
 				File: filename,
 			})
 		if err != nil {
 			return false, err
 		}
-		utils.GetLogger().Debugf("`crt-list add` ok [%s] [%s] ", crtListPath, filename)
+		utils.GetLogger().Debugf("`%s-list add` ok [%s] [%s] ", certType, dirPath, filename)
 	}
 
 	return updated, nil
@@ -320,18 +333,18 @@ func (c *certs) refreshCerts(certs map[string]*cert, certDir string) {
 	}
 }
 
-func (c *certs) writeSecret(secret *store.Secret, cert *cert, privateKeyNull bool) (err error) {
+func (c *certs) writeSecret(secret *store.Secret, cert *cert, isCa bool) (err error) {
 	var crtValue, keyValue []byte
 	var crtOk, keyOk, pemOk bool
 	var certPath string
-	if privateKeyNull {
+	if isCa {
 		crtValue, crtOk = secret.Data["tls.crt"]
 		if !crtOk {
 			return fmt.Errorf("certificate missing in %s/%s", secret.Namespace, secret.Name)
 		}
 		cert.path += ".pem"
 		content := certContent([]byte(""), crtValue)
-		return c.writeCert(cert, cert.path, content)
+		return c.writeCert(cert, cert.path, content, isCa)
 	}
 	for _, k := range []string{"tls", "rsa", "ecdsa", "dsa"} {
 		keyValue, keyOk = secret.Data[k+".key"]
@@ -344,7 +357,7 @@ func (c *certs) writeSecret(secret *store.Secret, cert *cert, privateKeyNull boo
 				certPath = fmt.Sprintf("%s.%s", certPath, k)
 			}
 			content := certContent(keyValue, crtValue)
-			err = c.writeCert(cert, certPath, content)
+			err = c.writeCert(cert, certPath, content, isCa)
 			if err != nil {
 				return err
 			}
@@ -357,7 +370,7 @@ func (c *certs) writeSecret(secret *store.Secret, cert *cert, privateKeyNull boo
 	return nil
 }
 
-func (c *certs) writeCert(cert *cert, filename string, content []byte) error {
+func (c *certs) writeCert(cert *cert, filename string, content []byte, isCa bool) error {
 	fs.Writer.Write(func() {
 		if _, err := os.Stat(filename); err != nil {
 			// If file does not exist, contrary to the map files, it's not working to create an empty file.
@@ -376,8 +389,7 @@ func (c *certs) writeCert(cert *cert, filename string, content []byte) error {
 				return
 			}
 		}
-
-		updated, err := c.updateRuntime(filename, content)
+		updated, err := c.updateRuntime(filename, content, isCa)
 		if err != nil {
 			instance.Reload("Runtime update of cert file '%s' failed : %s", filename, err.Error())
 		} else if updated {
