fix: correct tls reconciler and add tenantowners

.github/workflows/e2e.yml

@@ -64,10 +64,9 @@ jobs:
       fail-fast: false
       matrix:
         k8s-version:
-          - 'v1.31.0'
           - 'v1.32.0'
-          - 'v1.33.0'
-          - 'v1.34.0'
+          - 'v1.33.12'
+          - 'v1.34.8'
     runs-on:
       labels: ubuntu-latest-8-cores
     steps:

Makefile

@@ -186,6 +186,7 @@ dev-setup:
 		--create-namespace \
 		--version=$(CHART_VERSION) \
 		--set 'proxy.enabled=true' \
+		--set 'proxy.certManager.generateCertificates=false' \
 		--set 'crds.install=true' \
 		--set 'crds.exclusive=true'\
 		--set 'crds.createConfig=true'\
@@ -194,8 +195,8 @@ dev-setup:
 		--set "monitoring.diagnostics.enabled=true"\
 		--set "manager.rbac.minimal=true"\
 		--set 'certManager.generateCertificates=false' \
-		--set 'tls.enableController=true' \
-		--set 'tls.create=true' \
+		--set 'tls.enableController=false' \
+		--set 'tls.create=false' \
 		--set "webhooks.exclusive=true"\
 		--set "webhooks.service.url=$${WEBHOOK_URL}" \
 		--set "webhooks.service.caBundle=$${CA_BUNDLE}" \
@@ -453,7 +454,7 @@ e2e-build: kind
 	$(MAKE) e2e-install
 
 .PHONY: e2e-install
-e2e-install: helm-controller-version ko-build-all
+e2e-install: helm-controller-version ko-build-all dev-install-gw-api-crds
 	$(MAKE) e2e-load-image CLUSTER_NAME=$(CLUSTER_NAME) IMAGE=$(CAPSULE_IMG) VERSION=$(VERSION)
 	$(KUBECTL) label clusterrole admin projectcapsule.dev/aggregate-to-controller=true
 	$(HELM) upgrade \
@@ -470,7 +471,7 @@ e2e-install: helm-controller-version ko-build-all
 		--set 'manager.resources=null'\
 		--set "manager.image.tag=$(VERSION)" \
 		--set 'manager.livenessProbe.failureThreshold=10' \
-		--set 'manager.options.logLevel=debug' \
+		--set-string 'manager.options.logLevel=5' \
 		--set 'manager.options.workers=4' \
 		--set 'manager.options.clientConnectionQPS=2000' \
 		--set 'manager.options.clientConnectionQPS=1000' \

api/v1beta2/tenantowner_types.go

@@ -6,6 +6,7 @@ package v1beta2
 import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
+	"github.com/projectcapsule/capsule/pkg/api/meta"
 	"github.com/projectcapsule/capsule/pkg/api/rbac"
 )
 
@@ -26,11 +27,23 @@ type TenantOwnerStatus struct {
 	// ObservedGeneration is the most recent generation the controller has observed.
 	// +optional
 	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
+
+	// Tenants lists the names of all Tenants that this TenantOwner is currently matched to
+	// via the Tenant's spec.permissions.matchOwners selectors.
+	// +optional
+	// +listType=atomic
+	Tenants []string `json:"tenants,omitempty"`
+
+	// Conditions contains the reconciliation conditions for this TenantOwner.
+	// +optional
+	Conditions meta.ConditionList `json:"conditions,omitempty"`
 }
 
 // +kubebuilder:object:root=true
 // +kubebuilder:subresource:status
 // +kubebuilder:resource:scope=Cluster,shortName=to
+// +kubebuilder:printcolumn:name="Ready",type="string",JSONPath=".status.conditions[?(@.type==\"Ready\")].status",description="Reconcile status of this TenantOwner"
+// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="Age"
 
 // TenantOwner is the Schema for the tenantowners API.
 type TenantOwner struct {

charts/capsule/crds/capsule.clastix.io_tenantowners.yaml

@@ -16,7 +16,16 @@ spec:
     singular: tenantowner
   scope: Cluster
   versions:
-  - name: v1beta2
+  - additionalPrinterColumns:
+    - description: Reconcile status of this TenantOwner
+      jsonPath: .status.conditions[?(@.type=="Ready")].status
+      name: Ready
+      type: string
+    - description: Age
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1beta2
     schema:
       openAPIV3Schema:
         description: TenantOwner is the Schema for the tenantowners API.
@@ -75,11 +84,77 @@ spec:
           status:
             description: status defines the observed state of TenantOwner.
             properties:
+              conditions:
+                description: Conditions contains the reconciliation conditions for
+                  this TenantOwner.
+                items:
+                  description: Condition contains details for one aspect of the current
+                    state of this API Resource.
+                  properties:
+                    lastTransitionTime:
+                      description: |-
+                        lastTransitionTime is the last time the condition transitioned from one status to another.
+                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
+                      format: date-time
+                      type: string
+                    message:
+                      description: |-
+                        message is a human readable message indicating details about the transition.
+                        This may be an empty string.
+                      maxLength: 32768
+                      type: string
+                    observedGeneration:
+                      description: |-
+                        observedGeneration represents the .metadata.generation that the condition was set based upon.
+                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+                        with respect to the current state of the instance.
+                      format: int64
+                      minimum: 0
+                      type: integer
+                    reason:
+                      description: |-
+                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
+                        Producers of specific condition types may define expected values and meanings for this field,
+                        and whether the values are considered a guaranteed API.
+                        The value should be a CamelCase string.
+                        This field may not be empty.
+                      maxLength: 1024
+                      minLength: 1
+                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
+                      type: string
+                    status:
+                      description: status of the condition, one of True, False, Unknown.
+                      enum:
+                      - "True"
+                      - "False"
+                      - Unknown
+                      type: string
+                    type:
+                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
+                      maxLength: 316
+                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
+                      type: string
+                  required:
+                  - lastTransitionTime
+                  - message
+                  - reason
+                  - status
+                  - type
+                  type: object
+                type: array
               observedGeneration:
                 description: ObservedGeneration is the most recent generation the
                   controller has observed.
                 format: int64
                 type: integer
+              tenants:
+                description: |-
+                  Tenants lists the names of all Tenants that this TenantOwner is currently matched to
+                  via the Tenant's spec.permissions.matchOwners selectors.
+                items:
+                  type: string
+                type: array
+                x-kubernetes-list-type: atomic
             type: object
         required:
         - spec

cmd/main.go

@@ -53,6 +53,7 @@ import (
 	rulestatuscontroller "github.com/projectcapsule/capsule/internal/controllers/rulestatus"
 	servicelabelscontroller "github.com/projectcapsule/capsule/internal/controllers/servicelabels"
 	tenantcontroller "github.com/projectcapsule/capsule/internal/controllers/tenant"
+	tenantownercontroller "github.com/projectcapsule/capsule/internal/controllers/tenantowner"
 	tlscontroller "github.com/projectcapsule/capsule/internal/controllers/tls"
 	utilscontroller "github.com/projectcapsule/capsule/internal/controllers/utils"
 	"github.com/projectcapsule/capsule/internal/metrics"
@@ -321,7 +322,7 @@ func main() {
 		}
 
 		// Reconcile TLS certificates before starting controllers and webhooks
-		if err = tlsReconciler.ReconcileCertificates(ctx, tlsCert); err != nil {
+		if err = tlsReconciler.ReconcileCertificates(ctx, ctrl.Log.WithName("capsule.setup").WithName("tls"), tlsCert); err != nil {
 			setupLog.Error(err, "unable to reconcile Capsule TLS secret")
 			os.Exit(1)
 		}
@@ -687,6 +688,14 @@ func main() {
 		os.Exit(1)
 	}
 
+	if err = (&tenantownercontroller.TenantOwnerManager{
+		Log:    ctrl.Log.WithName("capsule.ctrl").WithName("tenantowners"),
+		Client: manager.GetClient(),
+	}).SetupWithManager(manager, controllerConfig); err != nil {
+		setupLog.Error(err, "unable to create controller", "controller", "TenantOwners")
+		os.Exit(1)
+	}
+
 	if err = (&servicelabelscontroller.ServicesLabelsReconciler{
 		Log: ctrl.Log.WithName("capsule.ctrl").WithName("services"),
 	}).SetupWithManager(ctx, manager); err != nil {

e2e/owner_webhooks_test.go → e2e/tenant_owner_webhooks_test.go

@@ -21,7 +21,7 @@ import (
 	"github.com/projectcapsule/capsule/pkg/api/rbac"
 )
 
-var _ = Describe("when Tenant owner interacts with the webhooks", Ordered, Label("tenant"), func() {
+var _ = Describe("when Tenant owner interacts with the webhooks", Ordered, Label("tenant", "permissions", "owners"), func() {
 	tnt := &capsulev1beta2.Tenant{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: "e2e-owner-admission",