Added endpoint for update tenant certificates (minio/console) (#258)

restapi/admin_tenants.go

@@ -18,9 +18,7 @@ package restapi
 
 import (
 	"context"
-	"crypto"
 	"encoding/base64"
-	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -32,11 +30,8 @@ import (
 	"strings"
 	"time"
 
-	"github.com/minio/console/pkg/kes"
-	"gopkg.in/yaml.v2"
 	"k8s.io/apimachinery/pkg/api/resource"
 	"k8s.io/apimachinery/pkg/types"
-	"k8s.io/client-go/kubernetes"
 
 	corev1 "k8s.io/api/core/v1"
 
@@ -126,6 +121,7 @@ func registerTenantHandlers(api *operations.ConsoleAPI) {
 		return admin_api.NewUpdateTenantCreated()
 	})
 
+	// Add Tenant Zones
 	api.AdminAPITenantAddZoneHandler = admin_api.TenantAddZoneHandlerFunc(func(params admin_api.TenantAddZoneParams, session *models.Principal) middleware.Responder {
 		err := getTenantAddZoneResponse(session, params)
 		if err != nil {
@@ -135,6 +131,7 @@ func registerTenantHandlers(api *operations.ConsoleAPI) {
 		return admin_api.NewTenantAddZoneCreated()
 	})
 
+	// Get Tenant Usage
 	api.AdminAPIGetTenantUsageHandler = admin_api.GetTenantUsageHandlerFunc(func(params admin_api.GetTenantUsageParams, session *models.Principal) middleware.Responder {
 		payload, err := getTenantUsageResponse(session, params)
 		if err != nil {
@@ -144,6 +141,7 @@ func registerTenantHandlers(api *operations.ConsoleAPI) {
 		return admin_api.NewGetTenantUsageOK().WithPayload(payload)
 	})
 
+	// Update Tenant Zones
 	api.AdminAPITenantUpdateZonesHandler = admin_api.TenantUpdateZonesHandlerFunc(func(params admin_api.TenantUpdateZonesParams, session *models.Principal) middleware.Responder {
 		resp, err := getTenantUpdateZoneResponse(session, params)
 		if err != nil {
@@ -152,6 +150,26 @@ func registerTenantHandlers(api *operations.ConsoleAPI) {
 		}
 		return admin_api.NewTenantUpdateZonesOK().WithPayload(resp)
 	})
+
+	// Update Tenant Certificates
+	api.AdminAPITenantUpdateCertificateHandler = admin_api.TenantUpdateCertificateHandlerFunc(func(params admin_api.TenantUpdateCertificateParams, session *models.Principal) middleware.Responder {
+		err := getTenantUpdateCertificatesResponse(session, params)
+		if err != nil {
+			log.Println(err)
+			return admin_api.NewGetTenantUsageDefault(500).WithPayload(&models.Error{Code: 500, Message: swag.String("Unable to update tenant certificates")})
+		}
+		return admin_api.NewTenantUpdateCertificateCreated()
+	})
+
+	// Update Tenant Encryption Configuration
+	api.AdminAPITenantUpdateEncryptionHandler = admin_api.TenantUpdateEncryptionHandlerFunc(func(params admin_api.TenantUpdateEncryptionParams, session *models.Principal) middleware.Responder {
+		err := getTenantUpdateEncryptionResponse(session, params)
+		if err != nil {
+			log.Println(err)
+			return admin_api.NewGetTenantUsageDefault(500).WithPayload(&models.Error{Code: 500, Message: swag.String("Unable to update encryption configuration")})
+		}
+		return admin_api.NewTenantUpdateCertificateCreated()
+	})
 }
 
 // getDeleteTenantResponse gets the output of deleting a minio instance
@@ -180,7 +198,7 @@ func getDeleteTenantResponse(session *models.Principal, params admin_api.DeleteT
 // It also adds the option of deleting the tenant's underlying pvcs if deletePvcs set
 func deleteTenantAction(
 	ctx context.Context,
-	operatorClient OperatorClient,
+	operatorClient OperatorClientI,
 	clientset v1.CoreV1Interface,
 	namespace, tenantName string,
 	deletePvcs bool) error {
@@ -216,7 +234,7 @@ func getTenantScheme(mi *operator.Tenant) string {
 	return scheme
 }
 
-func getTenantAdminClient(ctx context.Context, client K8sClient, namespace, tenantName, serviceName, scheme string, insecure bool) (*madmin.AdminClient, error) {
+func getTenantAdminClient(ctx context.Context, client K8sClientI, namespace, tenantName, serviceName, scheme string, insecure bool) (*madmin.AdminClient, error) {
 	// get admin credentials from secret
 	creds, err := client.getSecret(ctx, namespace, fmt.Sprintf("%s-secret", tenantName), metav1.GetOptions{})
 	if err != nil {
@@ -239,7 +257,7 @@ func getTenantAdminClient(ctx context.Context, client K8sClient, namespace, tena
 	return mAdmin, nil
 }
 
-func getTenant(ctx context.Context, operatorClient OperatorClient, namespace, tenantName string) (*operator.Tenant, error) {
+func getTenant(ctx context.Context, operatorClient OperatorClientI, namespace, tenantName string) (*operator.Tenant, error) {
 	minInst, err := operatorClient.TenantGet(ctx, namespace, tenantName, metav1.GetOptions{})
 	if err != nil {
 		return nil, err
@@ -292,7 +310,7 @@ func getTenantInfoResponse(session *models.Principal, params admin_api.TenantInf
 	return info, nil
 }
 
-func listTenants(ctx context.Context, operatorClient OperatorClient, namespace string, limit *int32) (*models.ListTenantsResponse, error) {
+func listTenants(ctx context.Context, operatorClient OperatorClientI, namespace string, limit *int32) (*models.ListTenantsResponse, error) {
 	listOpts := metav1.ListOptions{
 		Limit: 10,
 	}
@@ -389,7 +407,10 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
 		}
 	}
 	// get Kubernetes Client
-	clientset, err := cluster.K8sClient(session.SessionToken)
+	clientSet, err := cluster.K8sClient(session.SessionToken)
+	k8sClient := k8sClient{
+		client: clientSet,
+	}
 	if err != nil {
 		return nil, err
 	}
@@ -425,7 +446,7 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
 		},
 	}
 
-	_, err = clientset.CoreV1().Secrets(ns).Create(ctx, &instanceSecret, metav1.CreateOptions{})
+	_, err = clientSet.CoreV1().Secrets(ns).Create(ctx, &instanceSecret, metav1.CreateOptions{})
 	if err != nil {
 		return nil, err
 	}
@@ -518,43 +539,15 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
 	if !minInst.Spec.RequestAutoCert && tenantReq.TLS != nil && tenantReq.TLS.Minio != nil {
 		// User provided TLS certificates for MinIO
 		isEncryptionAvailable = true
-		externalTLSCertificateSecretName := fmt.Sprintf("%s-instance-external-certificates", secretName)
 		// disable autoCert
 		minInst.Spec.RequestAutoCert = false
-
-		tlsCrt, err := base64.StdEncoding.DecodeString(*tenantReq.TLS.Minio.Crt)
+		// Certificates used by the MinIO instance
+		externalCertSecretName := fmt.Sprintf("%s-instance-external-certificates", secretName)
+		externalCertSecret, err := createOrReplaceExternalCertSecret(ctx, &k8sClient, ns, tenantReq.TLS.Minio, externalCertSecretName, tenantName)
 		if err != nil {
 			return nil, err
 		}
-
-		tlsKey, err := base64.StdEncoding.DecodeString(*tenantReq.TLS.Minio.Key)
-		if err != nil {
-			return nil, err
-		}
-
-		externalTLSCertificateSecret := corev1.Secret{
-			ObjectMeta: metav1.ObjectMeta{
-				Name: externalTLSCertificateSecretName,
-				Labels: map[string]string{
-					operator.TenantLabel: tenantName,
-				},
-			},
-			Type:      corev1.SecretTypeTLS,
-			Immutable: &imm,
-			Data: map[string][]byte{
-				"tls.crt": tlsCrt,
-				"tls.key": tlsKey,
-			},
-		}
-		_, err = clientset.CoreV1().Secrets(ns).Create(ctx, &externalTLSCertificateSecret, metav1.CreateOptions{})
-		if err != nil {
-			return nil, err
-		}
-		// Certificates used by the minio instance
-		minInst.Spec.ExternalCertSecret = &operator.LocalCertificateReference{
-			Name: externalTLSCertificateSecretName,
-			Type: "kubernetes.io/tls",
-		}
+		minInst.Spec.ExternalCertSecret = externalCertSecret
 	}
 
 	if tenantReq.Encryption != nil && isEncryptionAvailable {
@@ -565,13 +558,14 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
 		})
 		// KES client mTLSCertificates used by MinIO instance, only if autoCert is not enabled
 		if !minInst.Spec.RequestAutoCert {
-			minInst.Spec.ExternalClientCertSecret, err = getTenantExternalClientCertificates(ctx, clientset, ns, tenantReq.Encryption, secretName, tenantName)
+			tenantExternalClientCertSecretName := fmt.Sprintf("%s-tenant-external-client-cert", secretName)
+			minInst.Spec.ExternalClientCertSecret, err = createOrReplaceExternalCertSecret(ctx, &k8sClient, ns, tenantReq.Encryption.Client, tenantExternalClientCertSecretName, tenantName)
 			if err != nil {
 				return nil, err
 			}
 		}
 		// KES configuration for Tenant instance
-		minInst.Spec.KES, err = getKESConfiguration(ctx, clientset, ns, tenantReq.Encryption, secretName, tenantName, minInst.Spec.RequestAutoCert)
+		minInst.Spec.KES, err = getKESConfiguration(ctx, &k8sClient, ns, tenantReq.Encryption, secretName, tenantName, minInst.Spec.RequestAutoCert)
 		if err != nil {
 			return nil, err
 		}
@@ -630,7 +624,7 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
 			}
 		}
 
-		_, err = clientset.CoreV1().Secrets(ns).Create(ctx, &instanceSecret, metav1.CreateOptions{})
+		_, err = clientSet.CoreV1().Secrets(ns).Create(ctx, &instanceSecret, metav1.CreateOptions{})
 		if err != nil {
 			return nil, err
 		}
@@ -646,42 +640,15 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
 				},
 			},
 		}
-
 		if !minInst.Spec.RequestAutoCert && tenantReq.TLS != nil && tenantReq.TLS.Console != nil {
-			consoleExternalTLSCertificateSecretName := fmt.Sprintf("%s-console-external-certificates", secretName)
-			tlsCrt, err := base64.StdEncoding.DecodeString(*tenantReq.TLS.Console.Crt)
+			// Certificates used by the console instance
+			externalCertSecretName := fmt.Sprintf("%s-console-external-certificates", secretName)
+			externalCertSecret, err := createOrReplaceExternalCertSecret(ctx, &k8sClient, ns, tenantReq.TLS.Console, externalCertSecretName, tenantName)
 			if err != nil {
 				return nil, err
 			}
-			tlsKey, err := base64.StdEncoding.DecodeString(*tenantReq.TLS.Console.Key)
-			if err != nil {
-				return nil, err
-			}
-			consoleExternalTLSCertificateSecret := corev1.Secret{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: consoleExternalTLSCertificateSecretName,
-					Labels: map[string]string{
-						operator.TenantLabel: tenantName,
-					},
-				},
-				Type:      corev1.SecretTypeTLS,
-				Immutable: &imm,
-				Data: map[string][]byte{
-					"tls.crt": tlsCrt,
-					"tls.key": tlsKey,
-				},
-			}
-			_, err = clientset.CoreV1().Secrets(ns).Create(ctx, &consoleExternalTLSCertificateSecret, metav1.CreateOptions{})
-			if err != nil {
-				return nil, err
-			}
-			// Certificates used by the minio instance
-			minInst.Spec.Console.ExternalCertSecret = &operator.LocalCertificateReference{
-				Name: consoleExternalTLSCertificateSecretName,
-				Type: "kubernetes.io/tls",
-			}
+			minInst.Spec.Console.ExternalCertSecret = externalCertSecret
 		}
-
 	}
 
 	// set the service name if provided
@@ -718,7 +685,7 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
 
 	if tenantReq.ImagePullSecret != "" {
 		imagePullSecret = tenantReq.ImagePullSecret
-	} else if imagePullSecret, err = setImageRegistry(ctx, tenantName, tenantReq.ImageRegistry, clientset.CoreV1(), ns); err != nil {
+	} else if imagePullSecret, err = setImageRegistry(ctx, tenantName, tenantReq.ImageRegistry, clientSet.CoreV1(), ns); err != nil {
 		log.Println("error setting image registry secret:", err)
 		return nil, err
 	}
@@ -753,7 +720,7 @@ func getTenantCreatedResponse(session *models.Principal, params admin_api.Create
 
 	// Integratrions
 	if os.Getenv("GKE_INTEGRATION") != "" {
-		err := gkeIntegration(clientset, tenantName, ns, session.SessionToken)
+		err := gkeIntegration(clientSet, tenantName, ns, session.SessionToken)
 		if err != nil {
 			return nil, err
 		}
@@ -832,7 +799,7 @@ func setImageRegistry(ctx context.Context, tenantName string, req *models.ImageR
 }
 
 // updateTenantAction does an update on the minioTenant by patching the desired changes
-func updateTenantAction(ctx context.Context, operatorClient OperatorClient, clientset v1.CoreV1Interface, httpCl cluster.HTTPClientI, namespace string, params admin_api.UpdateTenantParams) error {
+func updateTenantAction(ctx context.Context, operatorClient OperatorClientI, clientset v1.CoreV1Interface, httpCl cluster.HTTPClientI, namespace string, params admin_api.UpdateTenantParams) error {
 	imageToUpdate := params.Body.Image
 	imageRegistryReq := params.Body.ImageRegistry
 
@@ -908,7 +875,7 @@ func getUpdateTenantResponse(session *models.Principal, params admin_api.UpdateT
 }
 
 // addTenantZone creates a zone to a defined tenant
-func addTenantZone(ctx context.Context, operatorClient OperatorClient, params admin_api.TenantAddZoneParams) error {
+func addTenantZone(ctx context.Context, operatorClient OperatorClientI, params admin_api.TenantAddZoneParams) error {
 	tenant, err := operatorClient.TenantGet(ctx, params.Namespace, params.Tenant, metav1.GetOptions{})
 	if err != nil {
 		return err
@@ -1423,344 +1390,6 @@ func parseNodeSelectorTerm(term *corev1.NodeSelectorTerm) *models.NodeSelectorTe
 	return &t
 }
 
-func getTenantExternalClientCertificates(ctx context.Context, clientSet *kubernetes.Clientset, ns string, encryptionCfg *models.EncryptionConfiguration, secretName, tenantName string) (clientCertificates *operator.LocalCertificateReference, err error) {
-	instanceExternalClientCertificateSecretName := fmt.Sprintf("%s-instance-external-client-mtls-certificates", secretName)
-	// If there's an error during this process we delete all KES configuration secrets
-	defer func() {
-		if err != nil {
-			errDelete := clientSet.CoreV1().Secrets(ns).Delete(ctx, instanceExternalClientCertificateSecretName, metav1.DeleteOptions{})
-			if errDelete != nil {
-				log.Print(errDelete)
-			}
-			return
-		}
-	}()
-	imm := true
-	// Secret to store KES clients TLS mTLSCertificates (mTLS authentication)
-	clientTLSCrt, err := base64.StdEncoding.DecodeString(*encryptionCfg.Client.Crt)
-	if err != nil {
-		return nil, err
-	}
-	clientTLSKey, err := base64.StdEncoding.DecodeString(*encryptionCfg.Client.Key)
-	if err != nil {
-		return nil, err
-	}
-	instanceExternalClientCertificateSecret := corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: instanceExternalClientCertificateSecretName,
-			Labels: map[string]string{
-				operator.TenantLabel: tenantName,
-			},
-		},
-		Type:      corev1.SecretTypeTLS,
-		Immutable: &imm,
-		Data: map[string][]byte{
-			"tls.crt": clientTLSCrt,
-			"tls.key": clientTLSKey,
-		},
-	}
-	_, err = clientSet.CoreV1().Secrets(ns).Create(ctx, &instanceExternalClientCertificateSecret, metav1.CreateOptions{})
-	if err != nil {
-		return nil, err
-	}
-	// KES client mTLSCertificates used by MinIO instance
-	clientCertificates = &operator.LocalCertificateReference{
-		Name: instanceExternalClientCertificateSecretName,
-		Type: "kubernetes.io/tls",
-	}
-	return clientCertificates, nil
-}
-
-func getKESConfiguration(ctx context.Context, clientSet *kubernetes.Clientset, ns string, encryptionCfg *models.EncryptionConfiguration, secretName, tenantName string, autoCert bool) (kesConfiguration *operator.KESConfig, err error) {
-	// secrets used by the KES configuration
-	instanceExternalClientCertificateSecretName := fmt.Sprintf("%s-instance-external-client-mtls-certificates", secretName)
-	kesExternalCertificateSecretName := fmt.Sprintf("%s-kes-external-mtls-certificates", secretName)
-	kesClientCertSecretName := fmt.Sprintf("%s-kes-mtls-certificates", secretName)
-	kesConfigurationSecretName := fmt.Sprintf("%s-kes-configuration", secretName)
-	// If there's an error during this process we delete all KES configuration secrets
-	defer func() {
-		if err != nil {
-			errDelete := clientSet.CoreV1().Secrets(ns).Delete(ctx, instanceExternalClientCertificateSecretName, metav1.DeleteOptions{})
-			if errDelete != nil {
-				log.Print(errDelete)
-			}
-			errDelete = clientSet.CoreV1().Secrets(ns).Delete(ctx, kesExternalCertificateSecretName, metav1.DeleteOptions{})
-			if errDelete != nil {
-				log.Print(errDelete)
-			}
-			errDelete = clientSet.CoreV1().Secrets(ns).Delete(ctx, kesClientCertSecretName, metav1.DeleteOptions{})
-			if errDelete != nil {
-				log.Print(errDelete)
-			}
-			errDelete = clientSet.CoreV1().Secrets(ns).Delete(ctx, kesConfigurationSecretName, metav1.DeleteOptions{})
-			if errDelete != nil {
-				log.Print(errDelete)
-			}
-			return
-		}
-	}()
-
-	imm := true
-	kesConfiguration = &operator.KESConfig{
-		Image:    "minio/kes:v0.11.0",
-		Replicas: 1,
-		Metadata: nil,
-	}
-	// Using custom image for KES
-	if encryptionCfg.Image != "" {
-		kesConfiguration.Image = encryptionCfg.Image
-	}
-	// if autoCert is enabled then Operator will generate the client certificates, calculate the client cert identity
-	// and pass it to KES via the $MINIO_KES_IDENTITY variable
-	clientCrtIdentity := "$MINIO_KES_IDENTITY"
-	// Generate server certificates for KES only if autoCert is disabled
-	if !autoCert {
-		serverTLSCrt, err := base64.StdEncoding.DecodeString(*encryptionCfg.Server.Crt)
-		if err != nil {
-			return nil, err
-		}
-		serverTLSKey, err := base64.StdEncoding.DecodeString(*encryptionCfg.Server.Key)
-		if err != nil {
-			return nil, err
-		}
-		// Secret to store KES server TLS mTLSCertificates
-		kesExternalCertificateSecret := corev1.Secret{
-			ObjectMeta: metav1.ObjectMeta{
-				Name: kesExternalCertificateSecretName,
-				Labels: map[string]string{
-					operator.TenantLabel: tenantName,
-				},
-			},
-			Type:      corev1.SecretTypeTLS,
-			Immutable: &imm,
-			Data: map[string][]byte{
-				"tls.crt": serverTLSCrt,
-				"tls.key": serverTLSKey,
-			},
-		}
-		_, err = clientSet.CoreV1().Secrets(ns).Create(ctx, &kesExternalCertificateSecret, metav1.CreateOptions{})
-		if err != nil {
-			return nil, err
-		}
-		// External mTLSCertificates used by KES
-		kesConfiguration.ExternalCertSecret = &operator.LocalCertificateReference{
-			Name: kesExternalCertificateSecretName,
-			Type: "kubernetes.io/tls",
-		}
-
-		// Client certificate for KES used by Minio to mTLS
-		clientTLSCrt, err := base64.StdEncoding.DecodeString(*encryptionCfg.Client.Crt)
-		if err != nil {
-			return nil, err
-		}
-		// Calculate the client cert identity based on the clientTLSCrt
-		h := crypto.SHA256.New()
-		certificate, err := kes.ParseCertificate(clientTLSCrt)
-		if err != nil {
-			return nil, err
-		}
-		h.Write(certificate.RawSubjectPublicKeyInfo)
-		clientCrtIdentity = hex.EncodeToString(h.Sum(nil))
-	}
-
-	// Default kesConfiguration for KES
-	kesConfig := kes.ServerConfig{
-		Addr: "0.0.0.0:7373",
-		Root: "disabled",
-		TLS: kes.TLS{
-			KeyPath:  "/tmp/kes/server.key",
-			CertPath: "/tmp/kes/server.crt",
-		},
-		Policies: map[string]kes.Policy{
-			"default-policy": {
-				Paths: []string{
-					"/v1/key/create/my-minio-key",
-					"/v1/key/generate/my-minio-key",
-					"/v1/key/decrypt/my-minio-key",
-				},
-				Identities: []kes.Identity{
-					kes.Identity(clientCrtIdentity),
-				},
-			},
-		},
-		Cache: kes.Cache{
-			Expiry: &kes.Expiry{
-				Any:    5 * time.Minute,
-				Unused: 20 * time.Second,
-			},
-		},
-		Log: kes.Log{
-			Error: "on",
-			Audit: "off",
-		},
-		Keys: kes.Keys{},
-	}
-
-	// operator will mount the mTLSCertificates in the following paths
-	// therefore we set these values in the KES yaml kesConfiguration
-	var mTLSClientCrtPath = "/tmp/kes/client.crt"
-	var mTLSClientKeyPath = "/tmp/kes/client.key"
-	var mTLSClientCaPath = "/tmp/kes/ca.crt"
-	// map to hold mTLSCertificates for KES mTLS against Vault
-	mTLSCertificates := map[string][]byte{}
-
-	// if encryption is enabled and encryption is configured to use Vault
-	if encryptionCfg.Vault != nil {
-		// Initialize Vault Config
-
-		kesConfig.Keys.Vault = &kes.Vault{
-			Endpoint:   *encryptionCfg.Vault.Endpoint,
-			EnginePath: encryptionCfg.Vault.Engine,
-			Namespace:  encryptionCfg.Vault.Namespace,
-			Prefix:     encryptionCfg.Vault.Prefix,
-			Status: &kes.VaultStatus{
-				Ping: 10 * time.Second,
-			},
-		}
-		// Vault AppRole credentials
-		if encryptionCfg.Vault.Approle != nil {
-			kesConfig.Keys.Vault.AppRole = &kes.AppRole{
-				EnginePath: encryptionCfg.Vault.Approle.Engine,
-				ID:         *encryptionCfg.Vault.Approle.ID,
-				Secret:     *encryptionCfg.Vault.Approle.Secret,
-				Retry:      15 * time.Second,
-			}
-		} else {
-			return nil, errors.New("approle credentials missing for kes")
-		}
-
-		// Vault mTLS kesConfiguration
-		if encryptionCfg.Vault.TLS != nil {
-			vaultTLSConfig := encryptionCfg.Vault.TLS
-			kesConfig.Keys.Vault.TLS = &kes.VaultTLS{}
-			if vaultTLSConfig.Crt != "" {
-				clientCrt, err := base64.StdEncoding.DecodeString(vaultTLSConfig.Crt)
-				if err != nil {
-					return nil, err
-				}
-				mTLSCertificates["client.crt"] = clientCrt
-				kesConfig.Keys.Vault.TLS.CertPath = mTLSClientCrtPath
-			}
-			if vaultTLSConfig.Key != "" {
-				clientKey, err := base64.StdEncoding.DecodeString(vaultTLSConfig.Key)
-				if err != nil {
-					return nil, err
-				}
-				mTLSCertificates["client.key"] = clientKey
-				kesConfig.Keys.Vault.TLS.KeyPath = mTLSClientKeyPath
-			}
-			if vaultTLSConfig.Ca != "" {
-				caCrt, err := base64.StdEncoding.DecodeString(vaultTLSConfig.Ca)
-				if err != nil {
-					return nil, err
-				}
-				mTLSCertificates["ca.crt"] = caCrt
-				kesConfig.Keys.Vault.TLS.CAPath = mTLSClientCaPath
-			}
-		}
-	} else if encryptionCfg.Aws != nil {
-		// Initialize AWS
-		kesConfig.Keys.Aws = &kes.Aws{
-			SecretsManager: &kes.AwsSecretManager{},
-		}
-		// AWS basic kesConfiguration
-		if encryptionCfg.Aws.Secretsmanager != nil {
-			kesConfig.Keys.Aws.SecretsManager.Endpoint = *encryptionCfg.Aws.Secretsmanager.Endpoint
-			kesConfig.Keys.Aws.SecretsManager.Region = *encryptionCfg.Aws.Secretsmanager.Region
-			kesConfig.Keys.Aws.SecretsManager.KmsKey = encryptionCfg.Aws.Secretsmanager.Kmskey
-			// AWS credentials
-			if encryptionCfg.Aws.Secretsmanager.Credentials != nil {
-				kesConfig.Keys.Aws.SecretsManager.Login = &kes.AwsSecretManagerLogin{
-					AccessKey:    *encryptionCfg.Aws.Secretsmanager.Credentials.Accesskey,
-					SecretKey:    *encryptionCfg.Aws.Secretsmanager.Credentials.Secretkey,
-					SessionToken: encryptionCfg.Aws.Secretsmanager.Credentials.Token,
-				}
-			}
-		}
-	} else if encryptionCfg.Gemalto != nil {
-		// Initialize Gemalto
-		kesConfig.Keys.Gemalto = &kes.Gemalto{
-			KeySecure: &kes.GemaltoKeySecure{},
-		}
-		// Gemalto Configuration
-		if encryptionCfg.Gemalto.Keysecure != nil {
-			kesConfig.Keys.Gemalto.KeySecure.Endpoint = *encryptionCfg.Gemalto.Keysecure.Endpoint
-			// Gemalto TLS kesConfiguration
-			if encryptionCfg.Gemalto.Keysecure.TLS != nil {
-				if encryptionCfg.Gemalto.Keysecure.TLS.Ca != nil {
-					caCrt, err := base64.StdEncoding.DecodeString(*encryptionCfg.Gemalto.Keysecure.TLS.Ca)
-					if err != nil {
-						return nil, err
-					}
-					mTLSCertificates["ca.crt"] = caCrt
-					kesConfig.Keys.Gemalto.KeySecure.TLS = &kes.GemaltoTLS{
-						CAPath: mTLSClientCaPath,
-					}
-				}
-			}
-			// Gemalto Login
-			if encryptionCfg.Gemalto.Keysecure.Credentials != nil {
-				kesConfig.Keys.Gemalto.KeySecure.Credentials = &kes.GemaltoCredentials{
-					Token:  *encryptionCfg.Gemalto.Keysecure.Credentials.Token,
-					Domain: *encryptionCfg.Gemalto.Keysecure.Credentials.Domain,
-					Retry:  15 * time.Second,
-				}
-			}
-		}
-	}
-
-	// if mTLSCertificates contains elements we create the kubernetes secret
-	if len(mTLSCertificates) > 0 {
-		// Secret to store KES mTLS kesConfiguration
-		kesClientCertSecret := corev1.Secret{
-			ObjectMeta: metav1.ObjectMeta{
-				Name: kesClientCertSecretName,
-				Labels: map[string]string{
-					operator.TenantLabel: tenantName,
-				},
-			},
-			Immutable: &imm,
-			Data:      mTLSCertificates,
-		}
-		_, err = clientSet.CoreV1().Secrets(ns).Create(ctx, &kesClientCertSecret, metav1.CreateOptions{})
-		if err != nil {
-			return nil, err
-		}
-		// kubernetes generic secret
-		kesConfiguration.ClientCertSecret = &operator.LocalCertificateReference{
-			Name: kesClientCertSecretName,
-		}
-	}
-
-	// Generate Yaml kesConfiguration for KES
-	serverConfigYaml, err := yaml.Marshal(kesConfig)
-	if err != nil {
-		return nil, err
-	}
-	// Secret to store KES server kesConfiguration
-	kesConfigurationSecret := corev1.Secret{
-		ObjectMeta: metav1.ObjectMeta{
-			Name: kesConfigurationSecretName,
-			Labels: map[string]string{
-				operator.TenantLabel: tenantName,
-			},
-		},
-		Immutable: &imm,
-		Data: map[string][]byte{
-			"server-config.yaml": serverConfigYaml,
-		},
-	}
-	_, err = clientSet.CoreV1().Secrets(ns).Create(ctx, &kesConfigurationSecret, metav1.CreateOptions{})
-	if err != nil {
-		return nil, err
-	}
-	// Configuration used by KES
-	kesConfiguration.Configuration = &corev1.LocalObjectReference{
-		Name: kesConfigurationSecretName,
-	}
-	return kesConfiguration, nil
-}
-
 func getTenantUpdateZoneResponse(session *models.Principal, params admin_api.TenantUpdateZonesParams) (*models.Tenant, error) {
 	ctx := context.Background()
 	opClientClientSet, err := cluster.OperatorClient(session.SessionToken)
@@ -1789,7 +1418,7 @@ func getTenantUpdateZoneResponse(session *models.Principal, params admin_api.Ten
 // It does the equivalent to a PUT request on Tenant's zones
 func updateTenantZones(
 	ctx context.Context,
-	operatorClient OperatorClient,
+	operatorClient OperatorClientI,
 	namespace string,
 	tenantName string,
 	zonesReq []*models.Zone) (*operator.Tenant, error) {