feat: Support `certificateAuthorityCertSecretRef` on `TwingateResource` CRD #807

clement0010 · 2025-10-09T09:30:20Z

Changes

Add certificateAuthorityCertSecretRef on TwingateResource CRD. This enables Kubernetes Resource CRD to reference K8s secret object to update/reconcile the certificate authority cert value on Twingate via Public API.
Extract k8s_get_secret to utils_k8s
Move get_ca_cert to ResourceProxy

clement0010 · 2025-10-09T09:31:20Z

app/handlers/tests/test_handlers_services.py

                example_cluster_ip_gateway_service_body, "default"
            )

-    def test_kubernetes_resource_type_annotation_with_invalid_secret_type(


These tests are moved to test_utils_k8s

Copilot

Pull Request Overview

This PR adds support for referencing Kubernetes Secret objects in the TwingateResource CRD to manage certificate authority certificates, providing an alternative to inline certificate strings.

Add certificateAuthorityCertSecretRef field to TwingateResource CRD schema with validation
Update resource creation handlers to use secret references instead of inline certificates
Extract certificate handling utilities to shared utils_k8s module for better code organization

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
deploy/twingate-operator/crds/twingate.com.twingateresources.yaml	Updates CRD schema to support `certificateAuthorityCertSecretRef` with oneOf validation
app/crds.py	Adds secret reference support to `ResourceProxy` class with certificate retrieval logic
app/utils_k8s.py	Extracts and consolidates Kubernetes secret handling utilities
app/handlers/handlers_services.py	Updates service handler to use secret references instead of inline certificates
tests_integration/test_resource_flows.py	Adds comprehensive integration test for Kubernetes resource flows with secret references
tests_integration/test_crds_resource.py	Adds validation tests for new CRD schema constraints
app/tests/test_*.py	Updates unit tests to use extracted utilities and test new functionality
tests_integration/utils.py	Adds utility function for log message validation
app/conftest.py	Moves shared test fixture to common location

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

app/crds.py

tests_integration/test_resource_flows.py

minhtule

Fix & merge!

app/utils_k8s.py

minhtule · 2025-10-09T13:53:40Z

app/utils_k8s.py

+            f"Kubernetes Secret object: {tls_secret_name} type is invalid."
+        )
+
+    if not (ca_cert := tls_secret.data.get("ca.crt")):


This ca.crt is a convention in Gateway. I think it's good enough for now. Later we might want to make it customizable like ACMEIssuer.privateKeySecretRef in cert-manager.

PrivateKey is the name of a Kubernetes Secret resource that will be used to store the automatically generated ACME account private key. Optionally, a key may be specified to select a specific entry within the named Secret resource. If key is not specified, a default of tls.key will be used.

tests_integration/test_resource_flows.py

app/tests/test_utils_k8s.py

minhtule

Fix & merge!

app/utils_k8s.py

app/crds.py

app/tests/test_utils_k8s.py

app/handlers/handlers_services.py

app/crds.py

ekampf · 2025-10-17T20:57:20Z

app/utils_k8s.py

        raise
+
+
+def k8s_get_secret(namespace: str, name: str) -> kubernetes.client.V1Secret | None:


Other methods in this module also get the kapi: kubernetes.client.CoreV1Api | None = None kwarg and only instanciate a new CoreV1API if not given one.
Lets keep the same behavior here?

Yes, agree! I also updated the naming to k8s_read_namespaced_secret to match other methods in this module

ekampf · 2025-10-17T21:04:21Z

app/utils_k8s.py

+        raise
+
+
+def get_ca_cert(secret: kubernetes.client.V1Secret) -> str:


I wonder if this should be here because its not purely a "k8s utility" thats general - its very specific to the CA secret of ResourceProxy - maybe it should be there?

Moved the method to ResourceProxy

clement0010 · 2025-10-20T13:39:51Z

app/handlers/handlers_services.py

+                "certificateAuthorityCert": base64.b64encode(
+                    ResourceProxy.read_certificate_authority_cert_from_secret(
+                        secret
+                    ).encode()
+                ).decode(),


This is conversion is temporary, it'll be removed in this PR

coveralls · 2025-10-20T17:13:32Z

Pull Request Test Coverage Report for Build 18672859610

Details

42 of 43 (97.67%) changed or added relevant lines in 4 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage decreased (-0.08%) to 96.522%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
app/crds.py	24	25	96.0%

Totals
Change from base Build 18672848609:	-0.08%
Covered Lines:	1241
Relevant Lines:	1267

💛 - Coveralls

clement0010 added 2 commits October 9, 2025 16:48

Refactor k8s_get_tls_secret and get_ca_cert to common util

e0bedce

Support certificateAuthorityCertSecretRef to TwingateResource CRD

618107a

clement0010 requested review from Copilot and minhtule October 9, 2025 09:30

clement0010 commented Oct 9, 2025

View reviewed changes

Copilot AI reviewed Oct 9, 2025

View reviewed changes

app/crds.py Outdated Show resolved Hide resolved

tests_integration/test_resource_flows.py Show resolved Hide resolved

Update test

fe84bfc

clement0010 force-pushed the feat/support-ca-cert-secret-ref branch from 693f5d5 to fe84bfc Compare October 9, 2025 09:46

clement0010 mentioned this pull request Oct 9, 2025

feat: Update service handler to use certificateAuthorityCertSecretRef #808

Open

minhtule approved these changes Oct 9, 2025

View reviewed changes

Update k8s_get_tls_secret to k8s_get_secret

9ea0ddb

clement0010 force-pushed the feat/support-ca-cert-secret-ref branch from a850ad4 to 9ea0ddb Compare October 10, 2025 02:57

Remove tls in secret name variable

66ae0e4

minhtule approved these changes Oct 10, 2025

View reviewed changes

app/utils_k8s.py Outdated Show resolved Hide resolved

app/crds.py Outdated Show resolved Hide resolved

app/tests/test_utils_k8s.py Outdated Show resolved Hide resolved

app/handlers/handlers_services.py Outdated Show resolved Hide resolved

Update tls_secret_name to secret_name

cffd976

clement0010 requested a review from ekampf October 10, 2025 07:46

ekampf reviewed Oct 17, 2025

View reviewed changes

app/crds.py Outdated Show resolved Hide resolved

ekampf reviewed Oct 17, 2025

View reviewed changes

clement0010 and others added 3 commits October 20, 2025 15:41

Address PR review

bc85869

Update service handler

9b33d72

Merge branch 'main' into feat/support-ca-cert-secret-ref

e02c366

clement0010 requested a review from ekampf October 20, 2025 13:38

clement0010 commented Oct 20, 2025

View reviewed changes

Merge branch 'main' into feat/support-ca-cert-secret-ref

cd5436e

Update min connector version

e31b36e

clement0010 force-pushed the feat/support-ca-cert-secret-ref branch from 75ba988 to e31b36e Compare October 21, 2025 02:55

Merge branch 'main' into feat/support-ca-cert-secret-ref

575fe1e

		raise


		def k8s_get_secret(namespace: str, name: str) -> kubernetes.client.V1Secret \| None:

		raise


		def get_ca_cert(secret: kubernetes.client.V1Secret) -> str:

feat: Support certificateAuthorityCertSecretRef on TwingateResource CRD #807

Are you sure you want to change the base?

feat: Support certificateAuthorityCertSecretRef on TwingateResource CRD #807

Uh oh!

Conversation

clement0010 commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

clement0010 Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

minhtule left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

minhtule Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

minhtule left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ekampf Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

clement0010 Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

ekampf Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

clement0010 Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

clement0010 Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

coveralls commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 18672859610

Details

💛 - Coveralls

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

feat: Support `certificateAuthorityCertSecretRef` on `TwingateResource` CRD #807

feat: Support `certificateAuthorityCertSecretRef` on `TwingateResource` CRD #807

clement0010 commented Oct 9, 2025 •

edited

Loading

coveralls commented Oct 20, 2025 •

edited

Loading