Add espejote-managed dynamic fact for cluster CA

class/capi-provider-talos.yml

@@ -51,6 +51,10 @@ parameters:
         args:
           - ${_base_directory}/manifests/capi-controlplane-provider-talos-rendered
           - \${compiled_target_dir}/capi-provider-talos/controlplane/10_kustomize
+      - input_paths:
+          - ${_base_directory}/component/ca-fact.jsonnet
+        input_type: jsonnet
+        output_path: ${_instance}/
 
       # Cleanup intermediate manifests
       - input_type: remove

class/defaults.yml

@@ -4,6 +4,8 @@ parameters:
       multi_tenant: true
     namespace: syn-cluster-api
 
+    clusterName: ${cluster:name}
+
     images:
       capi-bootstrap-provider-talos:
         registry: ghcr.io

component/ca-fact.jsonnet

@@ -0,0 +1,111 @@
+local esp = import 'lib/espejote.libsonnet';
+local kap = import 'lib/kapitan.libjsonnet';
+local kube = import 'lib/kube.libjsonnet';
+local inv = kap.inventory();
+
+local params = inv.parameters.capi_provider_talos;
+local ca_secret_name = '%s-ca' % params.clusterName;
+
+local syn_namespace = 'syn';
+
+local sa = kube.ServiceAccount('cluster-ca-dynamic-fact-manager') {
+  metadata+: {
+    namespace: params.namespace,
+  },
+};
+
+local syn_role = kube.Role('capi-provider-talos:ca-dynamic-fact-manager') {
+  metadata+: {
+    namespace: syn_namespace,
+  },
+  rules: [
+    {
+      apiGroups: [ '' ],
+      resources: [ 'configmaps' ],
+      verbs: [ 'get', 'list', 'watch' ],
+    },
+    {
+      apiGroups: [ '' ],
+      resources: [ 'configmaps' ],
+      resourceNames: [ 'capi-talos-ca-fact' ],
+      verbs: [ 'create', 'update', 'patch' ],
+    },
+  ],
+};
+
+local role = kube.Role('capi-provider-talos:ca-dynamic-fact-manager') {
+  metadata+: {
+    namespace: params.namespace,
+  },
+  rules: [
+    {
+      apiGroups: [ '' ],
+      resources: [ 'secrets' ],
+      resourceNames: [ ca_secret_name ],
+      verbs: [ 'get', 'list', 'watch' ],
+    },
+  ],
+};
+
+local syn_rolebinding =
+  kube.RoleBinding('capi-provider-talos:ca-dynamic-fact-manager') {
+    metadata+: {
+      namespace: syn_namespace,
+    },
+    roleRef_: syn_role,
+    subjects_: [ sa ],
+  };
+
+local rolebinding =
+  kube.RoleBinding('capi-provider-talos:ca-dynamic-fact-manager') {
+    metadata+: {
+      namespace: params.namespace,
+    },
+    roleRef_: role,
+    subjects_: [ sa ],
+  };
+
+
+local mr = esp.managedResource('cluster-ca-dynamic-fact', params.namespace) {
+  spec: {
+    // Set force=true so we can take ownership of previously manually edited
+    // fields in `data`.
+    applyOptions: { force: true },
+    serviceAccountRef: { name: sa.metadata.name },
+    context: [
+      {
+        name: 'source',
+        resource: {
+          apiVersion: 'v1',
+          kind: 'Secret',
+          name: ca_secret_name,
+        },
+      },
+    ],
+    triggers: [
+      {
+        name: 'source',
+        watchContextResource: {
+          name: 'source',
+        },
+      },
+      {
+        name: 'target',
+        watchResource: {
+          apiVersion: 'v1',
+          kind: 'ConfigMap',
+          namespace: syn_namespace,
+          name: 'capi-talos-ca-fact',
+        },
+      },
+    ],
+    template: importstr 'espejote-templates/manage-ca-fact.jsonnet',
+  },
+};
+
+if std.member(inv.applications, 'espejote') then {
+  cluster_ca_dynamic_fact: [ sa, role, rolebinding, syn_role, syn_rolebinding, mr ],
+} else std.trace(
+  'Not rendering Espejote-managed CA fact because component-espejote is missing.',
+  {}
+)

component/espejote-templates/manage-ca-fact.jsonnet

@@ -0,0 +1,22 @@
+local esp = import 'espejote.libsonnet';
+local src =
+  local srcs = esp.context().source;
+  assert std.length(srcs) == 1 : 'Expected source context to have length 1';
+  srcs[0];
+{
+  apiVersion: 'v1',
+  kind: 'ConfigMap',
+  metadata: {
+    name: 'capi-talos-ca-fact',
+    namespace: 'syn',
+    labels: {
+      'app.kubernetes.io/managed-by': 'espejote',
+      'steward.syn.tools/include-facts': '',
+    },
+  },
+  data: {
+    facts: std.manifestJsonMinified({
+      talosAPICertificateAuthorityData: src.data['tls.crt'],
+    }),
+  },
+}

docs/modules/ROOT/pages/references/parameters.adoc

@@ -11,6 +11,16 @@ default:: `syn-cluster-api`
 The namespace in which to deploy this component.
 The component assumes that this namespace already exists via dependency `component-capi-core`.
 
+== `clusterName`
+
+[horizontal]
+type:: string
+default:: `${cluster:name}`
+
+The name of the cluster this component is installed on.
+If Espejote is installed, this component will automatically expose the cluster's CA certificate data as an additional fact in Steward.
+It uses Espejote to manage the additional fact, and uses the provided cluster name to identify the correct CA secret.
+
 == `images`
 
 [horizontal]

tests/defaults.yml

@@ -2,13 +2,18 @@
 
 applications:
   - capi-core
+  - espejote
 
 parameters:
   kapitan:
     dependencies:
       - type: https
         source: https://raw.githubusercontent.com/projectsyn/component-capi-core/master/lib/capi-core.libsonnet
         output_path: vendor/lib/capi-core.libsonnet
+      - type: https
+        source: https://raw.githubusercontent.com/projectsyn/component-espejote/master/lib/espejote.libsonnet
+        output_path: vendor/lib/espejote.libsonnet
 
   capi_core:
+    clusterName: c-holy-fire-1337
     namespace: syn-cluster-api

tests/golden/defaults/capi-provider-talos/capi-provider-talos/cluster_ca_dynamic_fact.yaml

@@ -0,0 +1,144 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations: {}
+  labels:
+    name: cluster-ca-dynamic-fact-manager
+  name: cluster-ca-dynamic-fact-manager
+  namespace: syn-cluster-api
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations: {}
+  labels:
+    name: capi-provider-talos-ca-dynamic-fact-manager
+  name: capi-provider-talos:ca-dynamic-fact-manager
+  namespace: syn-cluster-api
+rules:
+  - apiGroups:
+      - ''
+    resourceNames:
+      - c-green-test-1234-ca
+    resources:
+      - secrets
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations: {}
+  labels:
+    name: capi-provider-talos-ca-dynamic-fact-manager
+  name: capi-provider-talos:ca-dynamic-fact-manager
+  namespace: syn-cluster-api
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: capi-provider-talos:ca-dynamic-fact-manager
+subjects:
+  - kind: ServiceAccount
+    name: cluster-ca-dynamic-fact-manager
+    namespace: syn-cluster-api
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  annotations: {}
+  labels:
+    name: capi-provider-talos-ca-dynamic-fact-manager
+  name: capi-provider-talos:ca-dynamic-fact-manager
+  namespace: syn
+rules:
+  - apiGroups:
+      - ''
+    resources:
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - ''
+    resourceNames:
+      - capi-talos-ca-fact
+    resources:
+      - configmaps
+    verbs:
+      - create
+      - update
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  annotations: {}
+  labels:
+    name: capi-provider-talos-ca-dynamic-fact-manager
+  name: capi-provider-talos:ca-dynamic-fact-manager
+  namespace: syn
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: capi-provider-talos:ca-dynamic-fact-manager
+subjects:
+  - kind: ServiceAccount
+    name: cluster-ca-dynamic-fact-manager
+    namespace: syn-cluster-api
+---
+apiVersion: espejote.io/v1alpha1
+kind: ManagedResource
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  labels:
+    app.kubernetes.io/name: cluster-ca-dynamic-fact
+  name: cluster-ca-dynamic-fact
+  namespace: syn-cluster-api
+spec:
+  applyOptions:
+    force: true
+  context:
+    - name: source
+      resource:
+        apiVersion: v1
+        kind: Secret
+        name: c-green-test-1234-ca
+  serviceAccountRef:
+    name: cluster-ca-dynamic-fact-manager
+  template: |
+    local esp = import 'espejote.libsonnet';
+    local src =
+      local srcs = esp.context().source;
+      assert std.length(srcs) == 1 : 'Expected source context to have length 1';
+      srcs[0];
+    {
+      apiVersion: 'v1',
+      kind: 'ConfigMap',
+      metadata: {
+        name: 'capi-talos-ca-fact',
+        namespace: 'syn',
+        labels: {
+          'app.kubernetes.io/managed-by': 'espejote',
+          'steward.syn.tools/include-facts': '',
+        },
+      },
+      data: {
+        facts: std.manifestJsonMinified({
+          talosAPICertificateAuthorityData: src.data['tls.crt'],
+        }),
+      },
+    }
+  triggers:
+    - name: source
+      watchContextResource:
+        name: source
+    - name: target
+      watchResource:
+        apiVersion: v1
+        kind: ConfigMap
+        name: capi-talos-ca-fact
+        namespace: syn