CNF-18992: HTTP01 Challenge Proxy for cert-manager-operator - #1929
Open
sebrandon1 wants to merge 3 commits into
Open
CNF-18992: HTTP01 Challenge Proxy for cert-manager-operator#1929sebrandon1 wants to merge 3 commits into
sebrandon1 wants to merge 3 commits into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@sebrandon1: This pull request references CNF-18992 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
sebrandon1
force-pushed
the
enhancement_cert_manager_http01_proxy
branch
from
January 26, 2026 21:15
23bfec3 to
58b2f96
Compare
Member
Author
|
/retest |
sebrandon1
force-pushed
the
enhancement_cert_manager_http01_proxy
branch
from
January 27, 2026 15:14
58b2f96 to
f1cbdfd
Compare
Member
Author
|
/retest |
|
Inactive enhancement proposals go stale after 28d of inactivity. See https://github.com/openshift/enhancements#life-cycle for details. Mark the proposal as fresh by commenting If this proposal is safe to close now please do so with /lifecycle stale |
openshift-ci
Bot
added
the
lifecycle/stale
Contributor
|
/remove-lifecycle stale |
openshift-ci
Bot
removed
the
lifecycle/stale
sebrandon1
force-pushed
the
enhancement_cert_manager_http01_proxy
branch
from
March 9, 2026 13:31
f1cbdfd to
697f4bc
Compare
sebrandon1
force-pushed
the
enhancement_cert_manager_http01_proxy
branch
from
March 18, 2026 19:06
697f4bc to
c62f651
Compare
sebrandon1
added a commit
to sebrandon1/cert-manager-operator
that referenced
this pull request
Apr 6, 2026
Add the HTTP01 Challenge Proxy feature to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. This follows the IstioCSR controller pattern and includes: - HTTP01Proxy CRD with mode (DefaultDeployment/CustomDeployment) and optional customDeployment.internalPort configuration - Full controller-runtime reconciler with finalizer handling, status conditions (Ready/Degraded), and managed resource watches - DaemonSet deployment on control plane nodes with hostNetwork, nftables NET_ADMIN capability, and hostnetwork-v2 SCC - RBAC for reading Infrastructure/Ingress cluster config - NetworkPolicies for deny-all and allow-egress - FeatureHTTP01Proxy feature gate (Alpha, default: false) - Composed cache builder for shared controller-runtime manager - Generated clientset, informers, listers, and apply configurations Ref: openshift/enhancements#1929
sebrandon1
added a commit
to sebrandon1/cert-manager-operator
that referenced
this pull request
Apr 6, 2026
Add the HTTP01 Challenge Proxy feature to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. This follows the IstioCSR controller pattern and includes: - HTTP01Proxy CRD with mode (DefaultDeployment/CustomDeployment) and optional customDeployment.internalPort configuration - Full controller-runtime reconciler with finalizer handling, status conditions (Ready/Degraded), and managed resource watches - DaemonSet deployment on control plane nodes with hostNetwork, nftables NET_ADMIN capability, and hostnetwork-v2 SCC - RBAC for reading Infrastructure/Ingress cluster config - NetworkPolicies for deny-all and allow-egress - FeatureHTTP01Proxy feature gate (Alpha, default: false) - Integrated with unified cache builder and common package - Generated clientset, informers, listers, and apply configurations Ref: openshift/enhancements#1929
sebrandon1
added a commit
to sebrandon1/cert-manager-operator
that referenced
this pull request
Apr 6, 2026
Add the HTTP01 Challenge Proxy feature to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. This follows the IstioCSR/TrustManager controller pattern and includes: - HTTP01Proxy CRD with mode (DefaultDeployment/CustomDeployment) and optional customDeployment.internalPort configuration - Full controller-runtime reconciler with finalizer handling, status conditions (Ready/Degraded), and managed resource watches - Platform validation via Infrastructure CR — only deploys on BareMetal platforms with distinct API/Ingress VIPs, sets Degraded condition with descriptive message on unsupported platforms - DaemonSet deployment on control plane nodes with hostNetwork, nftables NET_ADMIN capability, and privileged SCC - RBAC for reading cluster config and managing MachineConfig resources - NetworkPolicies for deny-all and allow-egress - FeatureHTTP01Proxy feature gate (Alpha, default: false) - Integrated with unified cache builder and common package utilities - Controller-runtime metrics on :8085 to avoid library-go port conflict - Generated clientset, informers, listers, and apply configurations Ref: openshift/enhancements#1929
sebrandon1
added a commit
to sebrandon1/cert-manager-operator
that referenced
this pull request
Apr 6, 2026
Add the HTTP01 Challenge Proxy feature to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. This follows the IstioCSR/TrustManager controller pattern and includes: - HTTP01Proxy CRD with mode (DefaultDeployment/CustomDeployment) and optional customDeployment.internalPort configuration - Full controller-runtime reconciler with finalizer handling, status conditions (Ready/Degraded), and managed resource watches - Platform validation via Infrastructure CR — only deploys on BareMetal platforms with distinct API/Ingress VIPs, sets Degraded condition with descriptive message on unsupported platforms - DaemonSet deployment on control plane nodes with hostNetwork, nftables NET_ADMIN capability, and privileged SCC - RBAC for reading cluster config and managing MachineConfig resources - NetworkPolicies for deny-all and allow-egress - FeatureHTTP01Proxy feature gate (Alpha, default: false) - Integrated with unified cache builder and common package utilities - Controller-runtime metrics on :8085 to avoid library-go port conflict - Generated clientset, informers, listers, and apply configurations Ref: openshift/enhancements#1929
sebrandon1
added a commit
to sebrandon1/cert-manager-operator
that referenced
this pull request
Apr 6, 2026
Add the HTTP01 Challenge Proxy feature to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. This follows the IstioCSR/TrustManager controller pattern and includes: - HTTP01Proxy CRD with mode (DefaultDeployment/CustomDeployment) and optional customDeployment.internalPort configuration - Full controller-runtime reconciler with finalizer handling, status conditions (Ready/Degraded), and managed resource watches - Platform validation via Infrastructure CR — only deploys on BareMetal platforms with distinct API/Ingress VIPs, sets Degraded condition with descriptive message on unsupported platforms - DaemonSet deployment on control plane nodes with hostNetwork, nftables NET_ADMIN capability, and privileged SCC - RBAC for reading cluster config and managing MachineConfig resources - NetworkPolicies for deny-all and allow-egress - FeatureHTTP01Proxy feature gate (Alpha, default: false) - Integrated with unified cache builder and common package utilities - Controller-runtime metrics on :8085 to avoid library-go port conflict - Generated clientset, informers, listers, and apply configurations Ref: openshift/enhancements#1929
sebrandon1
added a commit
to sebrandon1/cert-manager-operator
that referenced
this pull request
Apr 7, 2026
Add the HTTP01 Challenge Proxy feature to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. This follows the IstioCSR/TrustManager controller pattern and includes: - HTTP01Proxy CRD with mode (DefaultDeployment/CustomDeployment) and optional customDeployment.internalPort configuration - Full controller-runtime reconciler with finalizer handling, status conditions (Ready/Degraded), and managed resource watches - Platform validation via Infrastructure CR — only deploys on BareMetal platforms with distinct API/Ingress VIPs, sets Degraded condition with descriptive message on unsupported platforms - DaemonSet deployment on control plane nodes with hostNetwork, nftables NET_ADMIN capability, and privileged SCC - RBAC for reading cluster config and managing MachineConfig resources - NetworkPolicies for deny-all and allow-egress - FeatureHTTP01Proxy feature gate (Alpha, default: false) - Integrated with unified cache builder and common package utilities - Controller-runtime metrics on :8085 to avoid library-go port conflict - Generated clientset, informers, listers, and apply configurations Ref: openshift/enhancements#1929
|
Inactive enhancement proposals go stale after 28d of inactivity. See https://github.com/openshift/enhancements#life-cycle for details. Mark the proposal as fresh by commenting If this proposal is safe to close now please do so with /lifecycle stale |
openshift-ci
Bot
added
the
lifecycle/stale
Member
Author
|
/remove-lifecycle stale |
openshift-ci
Bot
removed
the
lifecycle/stale
anandkuma77
approved these changes
Jun 18, 2026
Contributor
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: anandkuma77 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
sebrandon1
added a commit
to sebrandon1/cert-manager-operator
that referenced
this pull request
Jun 25, 2026
Adds the HTTP01 Challenge Proxy controller to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. When a user creates an HTTP01Proxy CR with mode DefaultDeployment, the operator validates the platform is BareMetal with distinct API and Ingress VIPs, then deploys a DaemonSet on control plane nodes running a reverse proxy. The proxy uses nftables to redirect HTTP traffic from API_VIP:80 to a local proxy port (default 8888). Only /.well-known/acme-challenge/* requests are forwarded to the Ingress VIP; all other requests are rejected. Feature gate: HTTP01Proxy (Alpha, disabled by default) Enable via: --unsupported-addon-features=HTTP01Proxy=true Jira: https://issues.redhat.com/browse/CM-716 Enhancement: openshift/enhancements#1929
sebrandon1
added a commit
to sebrandon1/cert-manager-operator
that referenced
this pull request
Jun 25, 2026
Adds the HTTP01 Challenge Proxy controller to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. When a user creates an HTTP01Proxy CR with mode DefaultDeployment, the operator validates the platform is BareMetal with distinct API and Ingress VIPs, then deploys a DaemonSet on control plane nodes running a reverse proxy. The proxy uses nftables to redirect HTTP traffic from API_VIP:80 to a local proxy port (default 8888). Only /.well-known/acme-challenge/* requests are forwarded to the Ingress VIP; all other requests are rejected. Feature gate: HTTP01Proxy (Alpha, disabled by default) Enable via: --unsupported-addon-features=HTTP01Proxy=true Jira: https://issues.redhat.com/browse/CM-716 Enhancement: openshift/enhancements#1929
sebrandon1
added a commit
to sebrandon1/cert-manager-operator
that referenced
this pull request
Jun 25, 2026
Adds the HTTP01 Challenge Proxy controller to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. When a user creates an HTTP01Proxy CR with mode DefaultDeployment, the operator validates the platform is BareMetal with distinct API and Ingress VIPs, then deploys a DaemonSet on control plane nodes running a reverse proxy. The proxy uses nftables to redirect HTTP traffic from API_VIP:80 to a local proxy port (default 8888). Only /.well-known/acme-challenge/* requests are forwarded to the Ingress VIP; all other requests are rejected. Feature gate: HTTP01Proxy (Alpha, disabled by default) Enable via: --unsupported-addon-features=HTTP01Proxy=true Jira: https://issues.redhat.com/browse/CM-716 Enhancement: openshift/enhancements#1929
sebrandon1
added a commit
to sebrandon1/cert-manager-operator
that referenced
this pull request
Jun 25, 2026
Adds the HTTP01 Challenge Proxy controller to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. When a user creates an HTTP01Proxy CR with mode DefaultDeployment, the operator validates the platform is BareMetal with distinct API and Ingress VIPs, then deploys a DaemonSet on control plane nodes running a reverse proxy. The proxy uses nftables to redirect HTTP traffic from API_VIP:80 to a local proxy port (default 8888). Only /.well-known/acme-challenge/* requests are forwarded to the Ingress VIP; all other requests are rejected. Feature gate: HTTP01Proxy (Alpha, disabled by default) Enable via: --unsupported-addon-features=HTTP01Proxy=true Jira: https://issues.redhat.com/browse/CM-716 Enhancement: openshift/enhancements#1929
sebrandon1
added a commit
to sebrandon1/cert-manager-operator
that referenced
this pull request
Jul 6, 2026
Adds the HTTP01 Challenge Proxy controller to cert-manager-operator, enabling cert-manager to complete HTTP01 ACME challenges for the API endpoint on baremetal platforms where the API VIP is not exposed via OpenShift Ingress. When a user creates an HTTP01Proxy CR with mode DefaultDeployment, the operator validates the platform is BareMetal with distinct API and Ingress VIPs, then deploys a DaemonSet on control plane nodes running a reverse proxy. The proxy uses nftables to redirect HTTP traffic from API_VIP:80 to a local proxy port (default 8888). Only /.well-known/acme-challenge/* requests are forwarded to the Ingress VIP; all other requests are rejected. Feature gate: HTTP01Proxy (Alpha, disabled by default) Enable via: --unsupported-addon-features=HTTP01Proxy=true Jira: https://issues.redhat.com/browse/CM-716 Enhancement: openshift/enhancements#1929
sebrandon1
force-pushed
the
enhancement_cert_manager_http01_proxy
branch
3 times, most recently
from
July 8, 2026 19:13
59494aa to
58d42f7
Compare
This was referenced Jul 16, 2026
Update the enhancement to reflect the MachineConfig-based DNAT+SNAT implementation, replacing the previous DaemonSet + reverse proxy design. The operator now creates a MachineConfig that deploys nftables DNAT rules and a systemd oneshot service on master nodes. Traffic to API_VIP:80 is forwarded at the kernel level to INGRESS_VIP:80 via DNAT+MASQUERADE, eliminating the need for a userspace proxy, container image, DaemonSet, RBAC, SCC, or NetworkPolicies. The superseded DaemonSet approach is documented in the Alternatives section.
sebrandon1
force-pushed
the
enhancement_cert_manager_http01_proxy
branch
from
July 17, 2026 20:59
58d42f7 to
ceeaef9
Compare
|
@sebrandon1: This pull request references CNF-18992 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
- Break 3 lines exceeding 400-char limit into shorter lines - Add language specifier to fenced code block (text) - Fix unordered list indentation (2 items)
…late The template-lint check requires the exact heading "## Alternatives (Not Implemented)".
Contributor
|
@sebrandon1: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add enhancement for HTTP01 Challenge Proxy as a controller within cert-manager-operator, following the istio-csr-controller pattern.
This enables cert-manager to complete HTTP01 challenges for the API endpoint (api.cluster.example.com) on baremetal platforms where DNS01 is not available.
Supersedes: #1773
Key Design Decisions
Implementation Approach
The operator creates a MachineConfig (98-nftables-crtmgr-http01-dnat) that deploys nftables DNAT rules and a systemd oneshot service on control plane master nodes. Traffic to API_VIP:80 is forwarded at the kernel level to INGRESS_VIP:80 via DNAT+MASQUERADE — no userspace proxy, container image, DaemonSet, or additional RBAC required.
Changes from Previous Approaches
The original enhancement (PR #1773) proposed adding configuration to the APIServer CRD in cluster-kube-apiserver-operator. This was updated to use a dedicated HTTP01Proxy CRD within cert-manager-operator.
The initial implementation used a DaemonSet running a Go reverse proxy binary. This was superseded by the MachineConfig-based DNAT approach for operational simplicity, smaller attack surface, and elimination of a separate container image lifecycle. The superseded DaemonSet approach is documented in the Alternatives section of the enhancement.
Tracking