gateway-provisoner: customize the cert's lifetime

apis/projectcontour/v1alpha1/contourdeployment.go

@@ -140,6 +140,13 @@ type ContourSettings struct {
 	// +kubebuilder:validation:MinItems=1
 	// +kubebuilder:validation:MaxItems=42
 	DisabledFeatures []contour_v1.Feature `json:"disabledFeatures,omitempty"`
+
+	// CertLifetime is the number of days for which certificates will be valid.
+	// defaults to 365.
+	//
+	// +kubebuilder:validation:Minimum=0
+	// +optional
+	CertLifetime uint32 `json:"certLifetime,omitempty"`
 }
 
 // DeploymentSettings contains settings for Deployment resources.

changelogs/unreleased/6604-izturn-minor.md

@@ -0,0 +1,4 @@
+
+## Customize the certificate's lifetime
+
+By setting `ContourDeployment.Spec.certLifetime`, you can customize the validity period of certificates generated by the `provisioner`. The default value is 365 days.

examples/contour/01-crds.yaml

@@ -1416,6 +1416,13 @@ spec:
                   and associated resources, including things like replica count
                   for the Deployment, and node placement constraints for the pods.
                 properties:
+                  certLifetime:
+                    description: |-
+                      CertLifetime is the number of days for which certificates will be valid.
+                      defaults to 365.
+                    format: int32
+                    minimum: 0
+                    type: integer
                   deployment:
                     description: Deployment describes the settings for running contour
                       as a `Deployment`.

examples/render/contour-deployment.yaml

@@ -1636,6 +1636,13 @@ spec:
                   and associated resources, including things like replica count
                   for the Deployment, and node placement constraints for the pods.
                 properties:
+                  certLifetime:
+                    description: |-
+                      CertLifetime is the number of days for which certificates will be valid.
+                      defaults to 365.
+                    format: int32
+                    minimum: 0
+                    type: integer
                   deployment:
                     description: Deployment describes the settings for running contour
                       as a `Deployment`.

examples/render/contour-gateway-provisioner.yaml

@@ -1427,6 +1427,13 @@ spec:
                   and associated resources, including things like replica count
                   for the Deployment, and node placement constraints for the pods.
                 properties:
+                  certLifetime:
+                    description: |-
+                      CertLifetime is the number of days for which certificates will be valid.
+                      defaults to 365.
+                    format: int32
+                    minimum: 0
+                    type: integer
                   deployment:
                     description: Deployment describes the settings for running contour
                       as a `Deployment`.

examples/render/contour-gateway.yaml

@@ -1452,6 +1452,13 @@ spec:
                   and associated resources, including things like replica count
                   for the Deployment, and node placement constraints for the pods.
                 properties:
+                  certLifetime:
+                    description: |-
+                      CertLifetime is the number of days for which certificates will be valid.
+                      defaults to 365.
+                    format: int32
+                    minimum: 0
+                    type: integer
                   deployment:
                     description: Deployment describes the settings for running contour
                       as a `Deployment`.

examples/render/contour.yaml

@@ -1636,6 +1636,13 @@ spec:
                   and associated resources, including things like replica count
                   for the Deployment, and node placement constraints for the pods.
                 properties:
+                  certLifetime:
+                    description: |-
+                      CertLifetime is the number of days for which certificates will be valid.
+                      defaults to 365.
+                    format: int32
+                    minimum: 0
+                    type: integer
                   deployment:
                     description: Deployment describes the settings for running contour
                       as a `Deployment`.

internal/provisioner/controller/gateway.go

@@ -262,6 +262,11 @@ func (r *gatewayReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 			for k, v := range contourParams.PodAnnotations {
 				contourModel.Spec.ContourPodAnnotations[k] = v
 			}
+
+			if contourParams.CertLifetime > 0 {
+				contourModel.Spec.CertLifetime = contourParams.CertLifetime
+			}
+
 		}
 
 		if gatewayClassParams.Spec.Envoy != nil {

internal/provisioner/controller/gateway_test.go

@@ -15,7 +15,10 @@ package controller
 
 import (
 	"context"
+	"crypto/x509"
+	"encoding/pem"
 	"testing"
+	"time"
 
 	"github.com/go-logr/logr"
 	"github.com/stretchr/testify/assert"
@@ -1396,6 +1399,32 @@ func TestGatewayReconcile(t *testing.T) {
 				}
 			},
 		},
+		"The generated certificates' lifetime is specified": {
+			gatewayClass: reconcilableGatewayClassWithParams("gatewayclass-1", controller),
+			gatewayClassParams: &contour_v1alpha1.ContourDeployment{
+				ObjectMeta: meta_v1.ObjectMeta{
+					Namespace: "projectcontour",
+					Name:      "gatewayclass-1-params",
+				},
+				Spec: contour_v1alpha1.ContourDeploymentSpec{
+					Contour: &contour_v1alpha1.ContourSettings{
+						CertLifetime: 123,
+					},
+				},
+			},
+			gateway: makeGateway(),
+			assertions: func(t *testing.T, r *gatewayReconciler, _ *gatewayapi_v1.Gateway, _ error) {
+				s := &core_v1.Secret{
+					ObjectMeta: meta_v1.ObjectMeta{
+						Namespace: "gateway-1",
+						Name:      "contourcert-gateway-1",
+					},
+				}
+
+				require.NoError(t, r.client.Get(context.Background(), keyFor(s), s))
+				verifyCert(t, s.Data["ca.crt"], 123)
+			},
+		},
 	}
 
 	for name, tc := range tests {
@@ -1451,3 +1480,23 @@ func assertEnvoyServiceLoadBalancerIP(t *testing.T, gateway *gatewayapi_v1.Gatew
 	// Verify expected Spec.LoadBalancerIP.
 	assert.Equal(t, want, envoyService.Spec.LoadBalancerIP)
 }
+
+func verifyCert(t *testing.T, certPEM []byte, day int) {
+	block, _ := pem.Decode(certPEM)
+	if block == nil {
+		require.FailNow(t, "decode the certificate from PEM form is failed")
+		return
+	}
+
+	if block.Bytes == nil {
+		require.FailNow(t, "the certificate is empty")
+		return
+	}
+
+	cert, err := x509.ParseCertificate(block.Bytes)
+	require.NoError(t, err, "parse the certificate is failed")
+
+	if cert.NotAfter.After(time.Now().AddDate(0, 0, day)) {
+		require.FailNow(t, "the certificate is not valid")
+	}
+}

internal/provisioner/model/model.go

@@ -79,6 +79,7 @@ func Default(namespace, name string) *Contour {
 			ResourceAnnotations:   map[string]string{},
 			EnvoyPodAnnotations:   map[string]string{},
 			ContourPodAnnotations: map[string]string{},
+			CertLifetime:          365,
 		},
 	}
 }
@@ -257,6 +258,10 @@ type ContourSpec struct {
 	// DisabledFeatures defines an array of resources that will be ignored by
 	// contour reconciler.
 	DisabledFeatures []contour_v1.Feature
+
+	// CertLifetime is the number of days for which certificates will be valid.
+	// default to 365
+	CertLifetime uint32
 }
 
 func NamespacesToStrings(ns []contour_v1.Namespace) []string {

internal/provisioner/objects/secret/secret.go

@@ -44,7 +44,7 @@ func EnsureXDSSecrets(ctx context.Context, cli client.Client, contour *model.Con
 
 	certs, err := certs.GenerateCerts(
 		&certs.Configuration{
-			Lifetime:  365,
+			Lifetime:  uint(contour.Spec.CertLifetime),
 			Namespace: contour.Namespace,
 		},
 	)

site/content/docs/main/config/api-reference.html

@@ -6408,6 +6408,20 @@ <h3 id="projectcontour.io/v1alpha1.ContourSettings">ContourSettings
 contour reconciler.</p>
 </td>
 </tr>
+<tr>
+<td style="white-space:nowrap">
+<code>certLifetime</code>
+<br>
+<em>
+uint32
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>CertLifetime is the number of days for which certificates will be valid.
+defaults to 365.</p>
+</td>
+</tr>
 </tbody>
 </table>
 <h3 id="projectcontour.io/v1alpha1.CustomTag">CustomTag