Add kube-cert-agent controller for getting kube API keypair

pkg/config/api/types.go

@@ -5,9 +5,10 @@ package api
 
 // Config contains knobs to setup an instance of Pinniped.
 type Config struct {
-	DiscoveryInfo DiscoveryInfoSpec `json:"discovery"`
-	APIConfig     APIConfigSpec     `json:"api"`
-	NamesConfig   NamesConfigSpec   `json:"names"`
+	DiscoveryInfo       DiscoveryInfoSpec `json:"discovery"`
+	APIConfig           APIConfigSpec     `json:"api"`
+	NamesConfig         NamesConfigSpec   `json:"names"`
+	KubeCertAgentConfig KubeCertAgentSpec `json:"kubeCertAgent"`
 }
 
 // DiscoveryInfoSpec contains configuration knobs specific to
@@ -49,3 +50,15 @@ type ServingCertificateConfigSpec struct {
 	// seconds (about 9 months).
 	RenewBeforeSeconds *int64 `json:"renewBeforeSeconds,omitempty"`
 }
+
+type KubeCertAgentSpec struct {
+	// NamePrefix is the prefix of the name of the kube-cert-agent pods. For example, if this field is
+	// set to "some-prefix-", then the name of the pods will look like "some-prefix-blah". The default
+	// for this value is "pinniped-kube-cert-agent-".
+	NamePrefix *string `json:"namePrefix,omitempty"`
+
+	// Image is the container image that will be used by the kube-cert-agent pod. The container image
+	// should contain at least 2 binaries: /bin/sleep and cat (somewhere on the $PATH). The default
+	// for this value is "debian:latest".
+	Image *string `json:"image"`
+}

pkg/config/config.go

@@ -40,6 +40,7 @@ func FromPath(path string) (*api.Config, error) {
 	}
 
 	maybeSetAPIDefaults(&config.APIConfig)
+	maybeSetKubeCertAgentDefaults(&config.KubeCertAgentConfig)
 
 	if err := validateAPI(&config.APIConfig); err != nil {
 		return nil, fmt.Errorf("validate api: %w", err)
@@ -62,6 +63,16 @@ func maybeSetAPIDefaults(apiConfig *api.APIConfigSpec) {
 	}
 }
 
+func maybeSetKubeCertAgentDefaults(cfg *api.KubeCertAgentSpec) {
+	if cfg.NamePrefix == nil {
+		cfg.NamePrefix = stringPtr("pinniped-kube-cert-agent-")
+	}
+
+	if cfg.Image == nil {
+		cfg.Image = stringPtr("debian:latest")
+	}
+}
+
 func validateNames(names *api.NamesConfigSpec) error {
 	missingNames := []string{}
 	if names == nil {
@@ -98,3 +109,7 @@ func validateAPI(apiConfig *api.APIConfigSpec) error {
 func int64Ptr(i int64) *int64 {
 	return &i
 }
+
+func stringPtr(s string) *string {
+	return &s
+}

pkg/config/config_test.go

@@ -35,6 +35,10 @@ func TestFromPath(t *testing.T) {
 				  servingCertificateSecret: pinniped-api-tls-serving-certificate
 				  credentialIssuerConfig: pinniped-config
 				  apiService: pinniped-api
+				  kubeCertAgentPrefix: kube-cert-agent-prefix
+				KubeCertAgent:
+				  namePrefix: kube-cert-agent-name-prefix-
+				  image: kube-cert-agent-image
 			`),
 			wantConfig: &api.Config{
 				DiscoveryInfo: api.DiscoveryInfoSpec{
@@ -51,6 +55,10 @@ func TestFromPath(t *testing.T) {
 					CredentialIssuerConfig:   "pinniped-config",
 					APIService:               "pinniped-api",
 				},
+				KubeCertAgentConfig: api.KubeCertAgentSpec{
+					NamePrefix: stringPtr("kube-cert-agent-name-prefix-"),
+					Image:      stringPtr("kube-cert-agent-image"),
+				},
 			},
 		},
 		{
@@ -77,6 +85,10 @@ func TestFromPath(t *testing.T) {
 					CredentialIssuerConfig:   "pinniped-config",
 					APIService:               "pinniped-api",
 				},
+				KubeCertAgentConfig: api.KubeCertAgentSpec{
+					NamePrefix: stringPtr("pinniped-kube-cert-agent-"),
+					Image:      stringPtr("debian:latest"),
+				},
 			},
 		},
 		{
@@ -187,7 +199,3 @@ func TestFromPath(t *testing.T) {
 		})
 	}
 }
-
-func stringPtr(s string) *string {
-	return &s
-}