From 99603adb18c620e3e4b47e2ee3dceeb80fcf9b87 Mon Sep 17 00:00:00 2001 From: Krzysztof Ostrowski Date: Fri, 21 Aug 2026 15:41:17 +0200 Subject: [PATCH 1/2] config/v1: forbid setting vault kmsPluginImage The plugin image comes from the KMS plugin provider ConfigMap, not from the APIServer resource. Make the field optional and reject any value via a CEL rule on VaultKMSPluginConfig. The field-level format validations become unreachable and are dropped with their tests. --- .../KMSEncryption.yaml | 1 - .../VaultKMS.yaml | 353 ++++++++---------- config/v1/types_kmsencryption.go | 27 +- 3 files changed, 171 insertions(+), 210 deletions(-) diff --git a/config/v1/tests/apiservers.config.openshift.io/KMSEncryption.yaml b/config/v1/tests/apiservers.config.openshift.io/KMSEncryption.yaml index b0e0e05cf5c..16c4fd36f2f 100644 --- a/config/v1/tests/apiservers.config.openshift.io/KMSEncryption.yaml +++ b/config/v1/tests/apiservers.config.openshift.io/KMSEncryption.yaml @@ -69,7 +69,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole diff --git a/config/v1/tests/apiservers.config.openshift.io/VaultKMS.yaml b/config/v1/tests/apiservers.config.openshift.io/VaultKMS.yaml index b37f2841a19..1700bf862d0 100644 --- a/config/v1/tests/apiservers.config.openshift.io/VaultKMS.yaml +++ b/config/v1/tests/apiservers.config.openshift.io/VaultKMS.yaml @@ -16,45 +16,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - expected: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - audit: - profile: Default - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - - - name: Should accept kmsPluginImage with simple two-level path like quay.io/vault/kms-plugin - initial: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: quay.io/vault/kms-plugin@sha256:abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789 vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -73,7 +34,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: quay.io/vault/kms-plugin@sha256:abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789 vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -92,7 +52,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/hashicorp/vault-plugin@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890 vaultAddress: https://vault.prod.example.com:8200 vaultNamespace: my-team vaultAuthNamespace: central-auth @@ -117,7 +76,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/hashicorp/vault-plugin@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890 vaultAddress: https://vault.prod.example.com:8200 vaultNamespace: my-team vaultAuthNamespace: central-auth @@ -132,83 +90,6 @@ tests: name: vault-approle-credentials vaultKeyPath: custom/transit/path/keys/production-encryption-key - # Multi-level namespace path tests - - name: Should accept kmsPluginImage with multi-level namespace path - initial: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: registry.example.com/org/team/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - expected: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - audit: - profile: Default - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: registry.example.com/org/team/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - - - name: Should accept kmsPluginImage with deep multi-level namespace path - initial: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: registry.io/org_name/team.name/project/subproject/vault_plugin@sha256:abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234 - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - expected: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - audit: - profile: Default - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: registry.io/org_name/team.name/project/subproject/vault_plugin@sha256:abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234 - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - # vaultKeyPath valid tests - name: Should accept vaultKeyPath with multi-segment mount initial: | @@ -220,7 +101,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -239,7 +119,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -258,7 +137,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -277,7 +155,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -296,7 +173,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -315,7 +191,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -334,7 +209,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -353,7 +227,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -373,7 +246,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -393,7 +265,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -413,7 +284,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -433,7 +303,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -453,7 +322,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -473,7 +341,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -493,7 +360,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -513,7 +379,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -533,7 +398,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -553,7 +417,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -574,7 +437,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -606,7 +468,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -614,7 +475,7 @@ tests: expectedError: "appRole config is required when authentication type is AppRole" # kmsPluginImage validation tests - - name: Should reject kmsPluginImage with tag instead of digest + - name: Should reject kmsPluginImage set by user initial: | apiVersion: config.openshift.io/v1 kind: APIServer @@ -624,27 +485,7 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin:latest - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-key - expectedError: "the OCI Image reference must end with a valid '@sha256:' suffix" - - - name: Should reject kmsPluginImage without registry hostname - initial: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef + kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -652,9 +493,9 @@ tests: secret: name: vault-approle vaultKeyPath: transit/keys/my-key - expectedError: "the OCI Image name should follow the host[:port][/namespace]/name format" + expectedError: "kmsPluginImage is managed by the platform and may not be set" - - name: Should reject kmsPluginImage with invalid digest length + - name: Should reject kmsPluginImage set to an empty string initial: | apiVersion: config.openshift.io/v1 kind: APIServer @@ -664,7 +505,7 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault@sha256:abc123 + kmsPluginImage: "" vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -672,7 +513,7 @@ tests: secret: name: vault-approle vaultKeyPath: transit/keys/my-key - expectedError: "the OCI Image reference must end with a valid '@sha256:' suffix, where '' is 64 characters long" + expectedError: "kmsPluginImage is managed by the platform and may not be set" # vaultAddress validation tests - name: Should reject vaultAddress with http scheme @@ -685,7 +526,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: http://vault.example.com:8200 authentication: type: AppRole @@ -705,7 +545,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200/v1 authentication: type: AppRole @@ -725,7 +564,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200?key=value authentication: type: AppRole @@ -745,7 +583,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200#fragment authentication: type: AppRole @@ -765,7 +602,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://user:password@vault.example.com:8200 authentication: type: AppRole @@ -786,7 +622,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: my-namespace/ authentication: @@ -807,7 +642,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: my namespace authentication: @@ -828,7 +662,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: root authentication: @@ -849,7 +682,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: sys authentication: @@ -870,7 +702,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: audit authentication: @@ -891,7 +722,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: auth authentication: @@ -912,7 +742,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: cubbyhole authentication: @@ -933,7 +762,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: identity authentication: @@ -955,7 +783,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: transit-ns vaultAuthNamespace: auth-ns @@ -976,7 +803,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: transit-ns vaultAuthNamespace: auth-ns @@ -997,7 +823,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultAuthNamespace: my-auth-ns/ authentication: @@ -1018,7 +843,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultAuthNamespace: my auth ns authentication: @@ -1039,7 +863,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultAuthNamespace: root authentication: @@ -1060,7 +883,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultAuthNamespace: identity authentication: @@ -1082,7 +904,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 tls: serverName: invalid_hostname! @@ -1105,7 +926,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -1125,7 +945,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 tls: caBundle: @@ -1136,4 +955,162 @@ tests: secret: name: vault-approle vaultKeyPath: transit/keys/my-key - expectedError: "name must be a valid DNS subdomain name" \ No newline at end of file + expectedError: "name must be a valid DNS subdomain name" + onUpdate: + # kmsPluginImage used to be required, so persisted resources may still set it. + # Ratcheting keeps those editable as long as the vault stanza is untouched. + - name: Should allow updating outside the vault stanza when kmsPluginImage is already set + initialCRDPatches: + - op: remove + path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/encryption/properties/kms/properties/vault/x-kubernetes-validations + initial: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + encryption: + type: KMS + kms: + type: Vault + vault: + kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef + vaultAddress: https://vault.example.com:8200 + authentication: + type: AppRole + appRole: + secret: + name: vault-approle + vaultKeyPath: transit/keys/my-key + updated: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + audit: + profile: WriteRequestBodies + encryption: + type: KMS + kms: + type: Vault + vault: + kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef + vaultAddress: https://vault.example.com:8200 + authentication: + type: AppRole + appRole: + secret: + name: vault-approle + vaultKeyPath: transit/keys/my-key + expected: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + audit: + profile: WriteRequestBodies + encryption: + type: KMS + kms: + type: Vault + vault: + kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef + vaultAddress: https://vault.example.com:8200 + authentication: + type: AppRole + appRole: + secret: + name: vault-approle + vaultKeyPath: transit/keys/my-key + + - name: Should reject updating the vault stanza while kmsPluginImage is still set + initialCRDPatches: + - op: remove + path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/encryption/properties/kms/properties/vault/x-kubernetes-validations + initial: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + encryption: + type: KMS + kms: + type: Vault + vault: + kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef + vaultAddress: https://vault.example.com:8200 + authentication: + type: AppRole + appRole: + secret: + name: vault-approle + vaultKeyPath: transit/keys/my-key + updated: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + encryption: + type: KMS + kms: + type: Vault + vault: + kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef + vaultAddress: https://vault.changed.example.com:8200 + authentication: + type: AppRole + appRole: + secret: + name: vault-approle + vaultKeyPath: transit/keys/my-key + expectedError: "kmsPluginImage is managed by the platform and may not be set" + + - name: Should allow dropping kmsPluginImage while updating the vault stanza + initialCRDPatches: + - op: remove + path: /spec/versions/0/schema/openAPIV3Schema/properties/spec/properties/encryption/properties/kms/properties/vault/x-kubernetes-validations + initial: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + encryption: + type: KMS + kms: + type: Vault + vault: + kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef + vaultAddress: https://vault.example.com:8200 + authentication: + type: AppRole + appRole: + secret: + name: vault-approle + vaultKeyPath: transit/keys/my-key + updated: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + encryption: + type: KMS + kms: + type: Vault + vault: + vaultAddress: https://vault.changed.example.com:8200 + authentication: + type: AppRole + appRole: + secret: + name: vault-approle + vaultKeyPath: transit/keys/my-key + expected: | + apiVersion: config.openshift.io/v1 + kind: APIServer + spec: + audit: + profile: Default + encryption: + type: KMS + kms: + type: Vault + vault: + vaultAddress: https://vault.changed.example.com:8200 + authentication: + type: AppRole + appRole: + secret: + name: vault-approle + vaultKeyPath: transit/keys/my-key diff --git a/config/v1/types_kmsencryption.go b/config/v1/types_kmsencryption.go index e2f94ae1f37..51cfd00d1a8 100644 --- a/config/v1/types_kmsencryption.go +++ b/config/v1/types_kmsencryption.go @@ -121,29 +121,14 @@ type VaultAppRoleAuthentication struct { } // VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS +// +kubebuilder:validation:XValidation:rule="!has(self.kmsPluginImage)",message="kmsPluginImage is managed by the platform and may not be set" type VaultKMSPluginConfig struct { - // kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. + // kmsPluginImage must not be set. The container image for the HashiCorp Vault + // KMS plugin is sourced by the platform from the KMS plugin provider ConfigMap. + // The field exists so the controller can carry that value in memory; it is + // never persisted on this resource and any value provided here is rejected. // - // The image must be a fully qualified OCI image pull spec with a SHA256 digest. - // The format is: host[:port][/namespace]/name@sha256: - // where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - // The total length must be between 75 and 447 characters. - // - // Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - // The registry hostname must be included and must contain at least one dot. - // Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - // - // Consult the OpenShift documentation for compatible plugin versions with your cluster version, - // then obtain the image digest for that version from HashiCorp's container registry. - // - // For disconnected environments, mirror the plugin image to an accessible registry - // and reference the mirrored location with its digest. - // - // +kubebuilder:validation:MinLength=75 - // +kubebuilder:validation:MaxLength=447 - // +kubebuilder:validation:XValidation:rule=`(self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$'))`,message="the OCI Image reference must end with a valid '@sha256:' suffix, where '' is 64 characters long" - // +kubebuilder:validation:XValidation:rule=`(self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$'))`,message="the OCI Image name should follow the host[:port][/namespace]/name format, resembling a valid URL without the scheme. Short names are not allowed, the registry hostname must be included." - // +required + // +optional KMSPluginImage string `json:"kmsPluginImage,omitempty"` // vaultAddress specifies the address of the HashiCorp Vault instance. From e4055c01e69cdf0517b6723685873de03def17b7 Mon Sep 17 00:00:00 2001 From: Krzysztof Ostrowski Date: Fri, 21 Aug 2026 15:41:18 +0200 Subject: [PATCH 2/2] make update --- ...tor_01_apiservers-CustomNoUpgrade.crd.yaml | 37 ++++--------------- ...01_apiservers-DevPreviewNoUpgrade.crd.yaml | 37 ++++--------------- ...1_apiservers-TechPreviewNoUpgrade.crd.yaml | 37 ++++--------------- .../KMSEncryption.yaml | 37 ++++--------------- .../v1/zz_generated.swagger_doc_generated.go | 2 +- .../generated_openapi/zz_generated.openapi.go | 4 +- openapi/openapi.json | 3 +- ...tor_01_apiservers-CustomNoUpgrade.crd.yaml | 37 ++++--------------- ...01_apiservers-DevPreviewNoUpgrade.crd.yaml | 37 ++++--------------- ...1_apiservers-TechPreviewNoUpgrade.crd.yaml | 37 ++++--------------- 10 files changed, 60 insertions(+), 208 deletions(-) diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index f3793fac61d..aca7c8898e2 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -237,35 +237,11 @@ spec: : !has(self.appRole)' kmsPluginImage: description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 + kmsPluginImage must not be set. The container image for the HashiCorp Vault + KMS plugin is sourced by the platform from the KMS plugin provider ConfigMap. + The field exists so the controller can carry that value in memory; it is + never persisted on this resource and any value provided here is rejected. type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,10 +413,13 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object + x-kubernetes-validations: + - message: kmsPluginImage is managed by the platform and may + not be set + rule: '!has(self.kmsPluginImage)' required: - type type: object diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index d06cd26ca79..c71cd316ed6 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -237,35 +237,11 @@ spec: : !has(self.appRole)' kmsPluginImage: description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 + kmsPluginImage must not be set. The container image for the HashiCorp Vault + KMS plugin is sourced by the platform from the KMS plugin provider ConfigMap. + The field exists so the controller can carry that value in memory; it is + never persisted on this resource and any value provided here is rejected. type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,10 +413,13 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object + x-kubernetes-validations: + - message: kmsPluginImage is managed by the platform and may + not be set + rule: '!has(self.kmsPluginImage)' required: - type type: object diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index cce33594546..638d7ca8895 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -237,35 +237,11 @@ spec: : !has(self.appRole)' kmsPluginImage: description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 + kmsPluginImage must not be set. The container image for the HashiCorp Vault + KMS plugin is sourced by the platform from the KMS plugin provider ConfigMap. + The field exists so the controller can carry that value in memory; it is + never persisted on this resource and any value provided here is rejected. type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,10 +413,13 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object + x-kubernetes-validations: + - message: kmsPluginImage is managed by the platform and may + not be set + rule: '!has(self.kmsPluginImage)' required: - type type: object diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml index 22c41067598..69ecd69bf92 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml @@ -237,35 +237,11 @@ spec: : !has(self.appRole)' kmsPluginImage: description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 + kmsPluginImage must not be set. The container image for the HashiCorp Vault + KMS plugin is sourced by the platform from the KMS plugin provider ConfigMap. + The field exists so the controller can carry that value in memory; it is + never persisted on this resource and any value provided here is rejected. type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,10 +413,13 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object + x-kubernetes-validations: + - message: kmsPluginImage is managed by the platform and may + not be set + rule: '!has(self.kmsPluginImage)' required: - type type: object diff --git a/config/v1/zz_generated.swagger_doc_generated.go b/config/v1/zz_generated.swagger_doc_generated.go index 0519119af44..ba86bf46f84 100644 --- a/config/v1/zz_generated.swagger_doc_generated.go +++ b/config/v1/zz_generated.swagger_doc_generated.go @@ -2504,7 +2504,7 @@ func (VaultConfigMapReference) SwaggerDoc() map[string]string { var map_VaultKMSPluginConfig = map[string]string{ "": "VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS", - "kmsPluginImage": "kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.\n\nThe image must be a fully qualified OCI image pull spec with a SHA256 digest. The format is: host[:port][/namespace]/name@sha256: where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. The total length must be between 75 and 447 characters.\n\nShort names (e.g., \"vault-plugin\" or \"hashicorp/vault-plugin\") are not allowed. The registry hostname must be included and must contain at least one dot. Image tags (e.g., \":latest\", \":v1.0.0\") are not allowed.\n\nConsult the OpenShift documentation for compatible plugin versions with your cluster version, then obtain the image digest for that version from HashiCorp's container registry.\n\nFor disconnected environments, mirror the plugin image to an accessible registry and reference the mirrored location with its digest.", + "kmsPluginImage": "kmsPluginImage must not be set. The container image for the HashiCorp Vault KMS plugin is sourced by the platform from the KMS plugin provider ConfigMap. The field exists so the controller can carry that value in memory; it is never persisted on this resource and any value provided here is rejected.", "vaultAddress": "vaultAddress specifies the address of the HashiCorp Vault instance. The value must be a valid HTTPS URL containing only scheme, host, and optional port. Paths, user info, query parameters, and fragments are not allowed.\n\nFormat: https://hostname[:port] Example: https://vault.example.com:8200\n\nThe value must be between 1 and 512 characters.", "vaultNamespace": "vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. This is only applicable for Vault Enterprise installations. When this field is not set, no namespace is used.\n\nThe value must be between 1 and 4096 characters. The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", "vaultAuthNamespace": "vaultAuthNamespace specifies the Vault namespace to use for authentication. This is only applicable for Vault Enterprise installations where authentication and Transit operations may be in different namespaces. When this field is not set, the value of vaultNamespace is used for both authentication and Transit key operations.\n\nThe value must be between 1 and 4096 characters. The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", diff --git a/openapi/generated_openapi/zz_generated.openapi.go b/openapi/generated_openapi/zz_generated.openapi.go index ef30e142d5a..c13c7f39346 100644 --- a/openapi/generated_openapi/zz_generated.openapi.go +++ b/openapi/generated_openapi/zz_generated.openapi.go @@ -23200,7 +23200,7 @@ func schema_openshift_api_config_v1_VaultKMSPluginConfig(ref common.ReferenceCal Properties: map[string]spec.Schema{ "kmsPluginImage": { SchemaProps: spec.SchemaProps{ - Description: "kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.\n\nThe image must be a fully qualified OCI image pull spec with a SHA256 digest. The format is: host[:port][/namespace]/name@sha256: where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. The total length must be between 75 and 447 characters.\n\nShort names (e.g., \"vault-plugin\" or \"hashicorp/vault-plugin\") are not allowed. The registry hostname must be included and must contain at least one dot. Image tags (e.g., \":latest\", \":v1.0.0\") are not allowed.\n\nConsult the OpenShift documentation for compatible plugin versions with your cluster version, then obtain the image digest for that version from HashiCorp's container registry.\n\nFor disconnected environments, mirror the plugin image to an accessible registry and reference the mirrored location with its digest.", + Description: "kmsPluginImage must not be set. The container image for the HashiCorp Vault KMS plugin is sourced by the platform from the KMS plugin provider ConfigMap. The field exists so the controller can carry that value in memory; it is never persisted on this resource and any value provided here is rejected.", Type: []string{"string"}, Format: "", }, @@ -23248,7 +23248,7 @@ func schema_openshift_api_config_v1_VaultKMSPluginConfig(ref common.ReferenceCal }, }, }, - Required: []string{"kmsPluginImage", "vaultAddress", "authentication", "vaultKeyPath"}, + Required: []string{"vaultAddress", "authentication", "vaultKeyPath"}, }, }, Dependencies: []string{ diff --git a/openapi/openapi.json b/openapi/openapi.json index 26bf2c9e39c..d7206a7666e 100644 --- a/openapi/openapi.json +++ b/openapi/openapi.json @@ -12594,7 +12594,6 @@ "description": "VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS", "type": "object", "required": [ - "kmsPluginImage", "vaultAddress", "authentication", "vaultKeyPath" @@ -12606,7 +12605,7 @@ "$ref": "#/definitions/com.github.openshift.api.config.v1.VaultAuthentication" }, "kmsPluginImage": { - "description": "kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.\n\nThe image must be a fully qualified OCI image pull spec with a SHA256 digest. The format is: host[:port][/namespace]/name@sha256: where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. The total length must be between 75 and 447 characters.\n\nShort names (e.g., \"vault-plugin\" or \"hashicorp/vault-plugin\") are not allowed. The registry hostname must be included and must contain at least one dot. Image tags (e.g., \":latest\", \":v1.0.0\") are not allowed.\n\nConsult the OpenShift documentation for compatible plugin versions with your cluster version, then obtain the image digest for that version from HashiCorp's container registry.\n\nFor disconnected environments, mirror the plugin image to an accessible registry and reference the mirrored location with its digest.", + "description": "kmsPluginImage must not be set. The container image for the HashiCorp Vault KMS plugin is sourced by the platform from the KMS plugin provider ConfigMap. The field exists so the controller can carry that value in memory; it is never persisted on this resource and any value provided here is rejected.", "type": "string" }, "tls": { diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index f3793fac61d..aca7c8898e2 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -237,35 +237,11 @@ spec: : !has(self.appRole)' kmsPluginImage: description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 + kmsPluginImage must not be set. The container image for the HashiCorp Vault + KMS plugin is sourced by the platform from the KMS plugin provider ConfigMap. + The field exists so the controller can carry that value in memory; it is + never persisted on this resource and any value provided here is rejected. type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,10 +413,13 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object + x-kubernetes-validations: + - message: kmsPluginImage is managed by the platform and may + not be set + rule: '!has(self.kmsPluginImage)' required: - type type: object diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index d06cd26ca79..c71cd316ed6 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -237,35 +237,11 @@ spec: : !has(self.appRole)' kmsPluginImage: description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 + kmsPluginImage must not be set. The container image for the HashiCorp Vault + KMS plugin is sourced by the platform from the KMS plugin provider ConfigMap. + The field exists so the controller can carry that value in memory; it is + never persisted on this resource and any value provided here is rejected. type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,10 +413,13 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object + x-kubernetes-validations: + - message: kmsPluginImage is managed by the platform and may + not be set + rule: '!has(self.kmsPluginImage)' required: - type type: object diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index cce33594546..638d7ca8895 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -237,35 +237,11 @@ spec: : !has(self.appRole)' kmsPluginImage: description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 + kmsPluginImage must not be set. The container image for the HashiCorp Vault + KMS plugin is sourced by the platform from the KMS plugin provider ConfigMap. + The field exists so the controller can carry that value in memory; it is + never persisted on this resource and any value provided here is rejected. type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,10 +413,13 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object + x-kubernetes-validations: + - message: kmsPluginImage is managed by the platform and may + not be set + rule: '!has(self.kmsPluginImage)' required: - type type: object