feat: add generic signer extensions

[sampras343]

Summary

Add signer-agnostic pod customization fields to FulcioSpec and CTlogSpec, enabling users to inject init containers, volumes, volume mounts, and authentication credentials regardless of which signer backend is active. This lays the groundwork for PKCS#11/HSM support (separate follow-up PR) and any future signer backends (KMS, Tink).

API Changes

• InitContainerSpec in common.go — curated corev1.Container subset (name, image, command, args, env, envFrom, volumeMounts, resources, securityContext, imagePullPolicy). Shared by both Fulcio and CTLog.
• InitContainers []InitContainerSpec on FulcioSpec and CTlogSpec — top-level, pod-wide
• Volumes []corev1.Volume on FulcioSpec and CTlogSpec — additional pod volumes
• VolumeMounts []corev1.VolumeMount on FulcioSpec and CTlogSpec — main server container mounts
• Auth *Auth on FulcioSigner and CTlogSigner — env vars and secret mounts for the server container (uniform placement on both Signers)
• SecureSign.SetDefaults() calls Signer.SetDefaults() for both Fulcio and CTLog so signer.type: file is explicit on the parent CR

Controller Changes

• User-defined InitContainers/Volumes/VolumeMounts/Auth applied in shared deployment path before branching on signer type — works in file mode, not gated behind any specific backend
• Shared helpers extracted to internal/utils/kubernetes/ensure/pod_spec.go: HasVolume, HasMountPath, EnsureVolumeDefaultMode, ReconcileInitContainers
• Fulcio deployment scaffolding extracted into ensureCommonDeployment to prevent divergence between file and future signer modes

Housekeeping

• Remove dead FindConfigMap function (no callers)
• v1alpha1 conversion preserves new fields via MarshalData annotations
• Roundtrip fuzzer coverage for new fields

Review Comments Addressed

(#2128):

#	Comment	Status
3	Extract hasVolume/ensureVolumeDefaultMode to shared package	Done
5	Extract shared deployment scaffolding	Done
6	Remove dead FindConfigMap	Done
7	Rename PKCS11InitContainerSpec → InitContainerSpec, move to common.go	Done
9	Remove duplicate v1alpha1 CSV entries	Done
10	InitContainers/Volumes/Auth ignored in Fulcio file mode	Done — applied in shared path
11	Same for CTLog	Done

Test plan

• make build and make test pass
• v1alpha1 roundtrip tests pass (65s)
• Shared helper unit tests pass
• Zero PKCS#11 references in non-test, non-generated code
• Deploy file-mode CR — signer.type: file defaulted, new fields available in oc explain
• Deploy CR with custom initContainers/volumes in file mode — fields applied to pod
• cosign sign + verify passes (file mode regression)

Jira: SECURESIGN-5014

🤖 Generated with Claude Code

[qodo-for-securesign]

PR Summary by Qodo

feat: signer-agnostic InitContainers, Volumes, VolumeMounts and Auth for Fulcio/CTlog

✨ Enhancement 🧪 Tests ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Add signer-agnostic pod customization fields to Fulcio/CTlog APIs (initContainers, volumes,
 mounts, auth).
• Apply these fields in the shared deployment path so they work in file mode.
• Extract shared pod-spec reconciliation helpers and add unit/roundtrip coverage.

Diagram

graph TD
  A["FulcioSpec / CTlogSpec"] --> B["Controllers"] --> C["ensure/pod_spec.go"]
  C --> D["PodSpec (Deployment)"] --> E["Signer type branch"]
  E --> F["File signer"]
  E --> G["Future signers"]
  subgraph Legend
    direction LR
    _api(["API Spec"]) ~~~ _ctl(["Controller"]) ~~~ _mod(["Ensure helpers"]) ~~~ _pod(["PodSpec"]) 
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Move HSM-specific init-container behavior out of generic helper

• ➕ Keeps ensure.ReconcileInitContainers fully signer-agnostic
• ➕ Avoids surprising HSM assumptions (volume names, lib-export container) for non-HSM backends
• ➖ Requires additional PKCS11-specific scaffolding in the follow-up PR
• ➖ Slightly more plumbing between shared and backend-specific code

Recommendation: The top-level, signer-agnostic fields on FulcioSpec/CTlogSpec are the right API shape because they avoid per-backend duplication and can be applied before signer branching (fixing file-mode gaps). The main architectural concern is that ReconcileInitContainers, while positioned as a shared helper, still contains HSM/PKCS#11-specific conventions (e.g., hsm volume mounts and optional hsm-lib-export). Consider moving that vendor-specific portion to backend-specific code in a follow-up to keep the shared helper generic.

Files changed (19) +6342 / -74

Enhancement (8) +240 / -0

common.goIntroduce InitContainerSpec for curated init container configuration +37/-0

Introduce InitContainerSpec for curated init container configuration

• Adds InitContainerSpec, a subset of corev1.Container fields intended for user-supplied init containers shared by Fulcio and CTlog.

api/v1/common.go

ctlog_types.goAdd InitContainers/Volumes/VolumeMounts to CTlogSpec and Auth to CTlogSigner +13/-0

Add InitContainers/Volumes/VolumeMounts to CTlogSpec and Auth to CTlogSigner

• Extends CTlogSpec with signer-agnostic pod customization fields and adds Auth to CTlogSigner for consistent credential injection across backends.

api/v1/ctlog_types.go

fulcio_types.goAdd InitContainers/Volumes/VolumeMounts to FulcioSpec and Auth to FulcioSigner +13/-0

Add InitContainers/Volumes/VolumeMounts to FulcioSpec and Auth to FulcioSigner

• Extends FulcioSpec with signer-agnostic pod customization fields and adds Auth to FulcioSigner to support uniform credential injection.

api/v1/fulcio_types.go

ctlog_conversion.goPreserve new CTlog fields via restored MarshalData on conversion +4/-0

Preserve new CTlog fields via restored MarshalData on conversion

• Restores InitContainers/Volumes/VolumeMounts and Signer.Auth from stored marshal data when converting v1alpha1 -> v1.

api/v1alpha1/ctlog_conversion.go

fulcio_conversion.goPreserve new Fulcio fields via restored MarshalData on conversion +4/-0

Preserve new Fulcio fields via restored MarshalData on conversion

• Restores InitContainers/Volumes/VolumeMounts and Signer.Auth from stored marshal data when converting v1alpha1 -> v1.

api/v1alpha1/fulcio_conversion.go

securesign_conversion.goPreserve Fulcio/Ctlog signer extension fields in Securesign conversion +8/-0

Preserve Fulcio/Ctlog signer extension fields in Securesign conversion

• Restores the new extension fields for both Fulcio and Ctlog sub-specs when converting Securesign v1alpha1 -> v1.

api/v1alpha1/securesign_conversion.go

deployment.goApply generic pod extensions (initContainers/volumes/mounts/auth) to CTlog deployment +25/-0

Apply generic pod extensions (initContainers/volumes/mounts/auth) to CTlog deployment

• Reconciles user-provided init containers, volumes, volume mounts, and auth into the CTlog deployment template so they apply regardless of signer type.

internal/controller/ctlog/actions/deployment.go

pod_spec.goAdd shared PodSpec reconciliation helpers for volumes and init containers +136/-0

Add shared PodSpec reconciliation helpers for volumes and init containers

• Introduces HasVolume, HasMountPath, EnsureVolumeDefaultMode (prevents reconcile loops due to nil vs defaulted modes), and ReconcileInitContainers (upsert/remove by name; optional HSM lib-export behavior).

internal/utils/kubernetes/ensure/pod_spec.go

Bug fix (1) +2 / -1

securesign_defaults.goDefault signer types from Securesign umbrella CR +2/-1

Default signer types from Securesign umbrella CR

• Calls Fulcio.Signer.SetDefaults() and Ctlog.Signer.SetDefaults() from Securesign.SetDefaults() so signer.type is explicit on the parent CR.

api/v1/securesign_defaults.go

Refactor (1) +103 / -68

deployment.goRefactor Fulcio deployment scaffolding and apply generic pod extensions +103/-68

Refactor Fulcio deployment scaffolding and apply generic pod extensions

• Extracts ensureCommonDeployment for shared deployment setup, renames ensureDeployment to ensureFileCADeployment, and applies initContainers/volumes/mounts/auth before signer-specific logic so file mode also gets extensions.

internal/controller/fulcio/actions/deployment.go

Other (9) +5997 / -5

zz_generated.deepcopy.goRegenerate deepcopy implementations for new fields +108/-0

Regenerate deepcopy implementations for new fields

• Adds autogenerated DeepCopy support for InitContainerSpec and the new InitContainers/Volumes/VolumeMounts/Auth fields on Fulcio/CTlog types.

api/v1/zz_generated.deepcopy.go

conversion_roundtrip_test.goUpdate conversion fuzzers for v1-only signer extension fields +74/-1

Update conversion fuzzers for v1-only signer extension fields

• Adds fuzzer functions to nil out v1-only extension fields (initContainers/volumes/mounts/auth) that have no v1alpha1 counterpart, preventing false roundtrip failures.

api/v1alpha1/conversion_roundtrip_test.go

zz_generated.conversion.goRegenerate conversion warnings for new non-peer fields +6/-0

Regenerate conversion warnings for new non-peer fields

• Updates autogenerated conversion code to flag InitContainers/Volumes/VolumeMounts as manual-conversion fields (no peer type in v1alpha1).

api/v1alpha1/zz_generated.conversion.go

rhtas.redhat.com_ctlogs.yamlRegenerate CTlog CRD schema for new extension fields +2715/-0

Regenerate CTlog CRD schema for new extension fields

• Adds OpenAPI schema entries for initContainers and other new pod customization fields on CTlog.

config/crd/bases/rhtas.redhat.com_ctlogs.yaml

rhtas.redhat.com_fulcios.yamlRegenerate Fulcio CRD schema for new extension fields +2715/-0

Regenerate Fulcio CRD schema for new extension fields

• Adds OpenAPI schema entries for initContainers and other new pod customization fields on Fulcio.

config/crd/bases/rhtas.redhat.com_fulcios.yaml

kustomization.yamlUpdate manager image reference in kustomization +3/-3

Update manager image reference in kustomization

• Adjusts the controller image name/tag settings for the manager kustomization.

config/manager/kustomization.yaml

rhtas-operator.clusterserviceversion.yamlAdd v1alpha1 owned resource entries to CSV +35/-0

Add v1alpha1 owned resource entries to CSV

• Adds v1alpha1 versions for multiple owned CRDs to the CSV to address previous duplication/omissions.

config/manifests/bases/rhtas-operator.clusterserviceversion.yaml

fulcio_deployment_test.goTest that user-defined volumes/mounts are applied in Fulcio file mode +84/-1

Test that user-defined volumes/mounts are applied in Fulcio file mode

• Adds a regression test ensuring Volumes/VolumeMounts are honored even when Fulcio uses file signer mode, and updates references to the renamed ensure function.

internal/controller/fulcio/actions/fulcio_deployment_test.go

pod_spec_test.goAdd unit tests for pod_spec helpers +257/-0

Add unit tests for pod_spec helpers

• Covers HasVolume, EnsureVolumeDefaultMode across supported volume sources, and ReconcileInitContainers behaviors including pruning stale containers and adding the optional lib-export init container.

internal/utils/kubernetes/ensure/pod_spec_test.go

[codecov-commenter]

Codecov Report

❌ Patch coverage is 61.99095% with 84 lines in your changes missing coverage. Please review.
✅ Project coverage is 56.42%. Comparing base (3fa5719) to head (6f9e6c1).

Files with missing lines	Patch %	Lines
api/v1/zz_generated.deepcopy.go	0.00%	69 Missing and 8 partials ⚠️
internal/utils/kubernetes/ensure/pod_spec.go	92.50%	1 Missing and 2 partials ⚠️
internal/controller/ctlog/actions/deployment.go	88.88%	1 Missing and 1 partial ⚠️
internal/controller/fulcio/actions/deployment.go	97.05%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2175      +/-   ##
==========================================
- Coverage   57.12%   56.42%   -0.71%     
==========================================
  Files         286      286              
  Lines       16129    16295     +166     
==========================================
- Hits         9214     9194      -20     
- Misses       5970     6131     +161     
- Partials      945      970      +25     

Flag	Coverage Δ
e2e	67.17% <72.09%> (-2.61%)	⬇️
unit	36.15% <59.72%> (+0.47%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[qodo-for-securesign]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. InitContainers never cleared ✓ Resolved 🐞 Bug ☼ Reliability

Description

Fulcio and CTlog only call ReconcileInitContainers when len(spec.initContainers) > 0, so
removing spec.initContainers from the CR will not remove previously-applied init containers from
the Deployment. This makes initContainers sticky and breaks declarative reconciliation.

Code

internal/controller/fulcio/actions/deployment.go[R146-149]

+	// Apply user-defined init containers
+	if len(instance.Spec.InitContainers) > 0 {
+		ensure.ReconcileInitContainers(&template.Spec, instance.Spec.InitContainers, "")
+	}

Relevance

●●● Strong

Sticky initContainers breaks declarative reconciliation; team often accepts controller reliability
hardening.

PR-#1928

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Both controllers gate the call on len(initContainers) > 0 while the helper explicitly supports
clearing when the desired set is empty.

internal/controller/fulcio/actions/deployment.go[146-149]
internal/controller/ctlog/actions/deployment.go[152-155]
internal/utils/kubernetes/ensure/pod_spec.go[183-187]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Init container reconciliation is guarded by `len(...) > 0`, preventing cleanup when the user removes `spec.initContainers`.

### Issue Context
`ensure.ReconcileInitContainers()` already contains explicit logic to clear `podSpec.InitContainers` when the desired list is empty, but that branch is unreachable due to the controller guards.

### Fix Focus Areas
- internal/controller/fulcio/actions/deployment.go[146-149]
- internal/controller/ctlog/actions/deployment.go[152-155]
- internal/utils/kubernetes/ensure/pod_spec.go[183-187]

### Suggested fix
Call `ensure.ReconcileInitContainers(&template.Spec, instance.Spec.InitContainers, ...)` unconditionally (or at least whenever the CR field is present), so that empty/nil desired state triggers cleanup.
If you’re concerned about deleting operator-managed init containers, adjust `ReconcileInitContainers` to only manage a clearly owned subset (e.g., names with an operator prefix) instead of clearing all init containers when the desired list is empty.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. HSM mounts without volumes ✓ Resolved 🐞 Bug ≡ Correctness

Description

ReconcileInitContainers always injects volume mounts for hsm-tokens and hsm-lib into every user
init container, but Fulcio/CTlog only add volumes from spec.volumes. If a user sets
spec.initContainers without also defining those volumes, the resulting Pod template references
non-existent volumes and will be rejected by Kubernetes.

Code

internal/utils/kubernetes/ensure/pod_spec.go[R154-168]

+		// Build volume mounts: user-specified + operator-managed (skip duplicates by path).
+		mounts := append([]core.VolumeMount{}, spec.VolumeMounts...)
+		if !hasMountPath(mounts, hsmTokenMountPath) {
+			mounts = append(mounts, core.VolumeMount{
+				Name:      hsmTokensVolumeName,
+				MountPath: hsmTokenMountPath,
+			})
+		}
+		if !hasMountPath(mounts, hsmLibMountPath) {
+			mounts = append(mounts, core.VolumeMount{
+				Name:      hsmLibVolumeName,
+				MountPath: hsmLibMountPath,
+			})
+		}
+		c.VolumeMounts = mounts

Relevance

●●● Strong

Pod would be invalid if injected mounts reference missing volumes; concrete correctness issue likely
to be fixed.

PR-#1243

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The helper injects mounts named hsm-tokens/hsm-lib purely based on mountPath presence, but the
controllers only attach user-provided volumes; there’s no automatic creation of these volumes.

internal/utils/kubernetes/ensure/pod_spec.go[117-169]
internal/controller/fulcio/actions/deployment.go[146-156]
internal/controller/ctlog/actions/deployment.go[152-162]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`ReconcileInitContainers()` unconditionally appends mounts that reference volumes `hsm-tokens` and `hsm-lib`. Fulcio/CTlog do not create those volumes automatically, so `spec.initContainers` can produce an invalid PodSpec (volumeMount refers to missing volume).

### Issue Context
This helper is used for the new generic initContainer extension path in Fulcio and CTlog.

### Fix Focus Areas
- internal/utils/kubernetes/ensure/pod_spec.go[154-168]
- internal/controller/fulcio/actions/deployment.go[146-156]
- internal/controller/ctlog/actions/deployment.go[152-162]

### Suggested fix
Choose one:
1) Only inject the `hsm-*` mounts when the corresponding volumes already exist on the PodSpec (or when `modulePath` is non-empty / HSM mode explicitly enabled).
2) If the intent is “initContainers imply HSM”, then automatically create the required volumes (`hsm-tokens`, `hsm-lib`) when reconciling initContainers (e.g., EmptyDir for `hsm-lib`, and require/validate a PVC/volume for `hsm-tokens`).
Also consider validating/rejecting configs where initContainers are set but required volumes are missing, to fail early with a clear error.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Reserved volume name collision ✓ Resolved 🐞 Bug ≡ Correctness

Description

User-defined volumes/mounts are upserted by name and can overwrite operator-required ones. In CTlog,
a user volume named keys overwrites the operator’s keys Secret volume and can break the required
/ctfe-keys mount; in Fulcio, user-supplied VolumeSource for fulcio-config/fulcio-cert can
later be combined with operator-set sources, producing invalid volumes with multiple sources set.

Code

internal/controller/ctlog/actions/deployment.go[R157-170]

+		// Apply user-defined volumes
+		for _, vol := range instance.Spec.Volumes {
+			v := kubernetes.FindVolumeByNameOrCreate(&template.Spec, vol.Name)
+			v.VolumeSource = vol.VolumeSource
+			ensure.EnsureVolumeDefaultMode(v)
+		}
+
+		// Apply user-defined volume mounts
+		for _, vm := range instance.Spec.VolumeMounts {
+			m := kubernetes.FindVolumeMountByNameOrCreate(container, vm.Name)
+			m.MountPath = vm.MountPath
+			m.SubPath = vm.SubPath
+			m.ReadOnly = vm.ReadOnly
+		}

Relevance

●● Moderate

Real correctness risk, but may conflict with intended “user override” customization; no close
precedent found.

PR-#1243

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

CTlog creates a keys Secret volume and mounts it, but the new loop later assigns `v.VolumeSource =
vol.VolumeSource` by name and user mounts can overwrite by name. Fulcio applies user volumes by
assigning the whole VolumeSource, then later sets individual sources like ConfigMap/Projected
without clearing other fields, enabling multi-source invalid volumes on name collisions.

internal/controller/ctlog/actions/deployment.go[117-122]
internal/controller/ctlog/actions/deployment.go[148-150]
internal/controller/ctlog/actions/deployment.go[157-170]
internal/controller/fulcio/actions/deployment.go[151-156]
internal/controller/fulcio/actions/deployment.go[279-288]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The new extension reconciliation upserts volumes/mounts purely by name, allowing users to collide with operator-managed names.
- CTlog: user `spec.volumes[].name: keys` overwrites the operator-created Secret-backed `keys` volume (required for `/ctfe-keys`).
- Fulcio: user volumes are applied first by assigning `v.VolumeSource = vol.VolumeSource`, then the operator later sets `config.ConfigMap` / `cert.Projected` without clearing other VolumeSource fields; a colliding user volume can result in multiple volume source fields being set (invalid PodSpec).

### Issue Context
This is enabled by the new generic `spec.volumes` / `spec.volumeMounts` fields.

### Fix Focus Areas
- internal/controller/ctlog/actions/deployment.go[117-122]
- internal/controller/ctlog/actions/deployment.go[157-170]
- internal/controller/fulcio/actions/deployment.go[151-164]
- internal/controller/fulcio/actions/deployment.go[279-288]

### Suggested fix
1) Define a reserved-name set per component (e.g., CTlog: `keys`; Fulcio: `fulcio-config`, `fulcio-cert`, `oidc-info`, etc.).
2) When applying user volumes/mounts, **reject** (return error) or **skip** entries that collide with reserved names.
3) Additionally, when operator configures its own volumes, consider resetting the entire `VolumeSource` (or explicitly clearing other source fields) to guarantee only one source type is set.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

4. Auth config cannot be removed 🐞 Bug ☼ Reliability

Description

The new signer auth extension is only applied when non-nil, and ensure.ContainerAuth only adds
env/secret mounts without any cleanup path. Clearing spec.signer.auth later will leave stale auth
volume/mount (and potentially env vars) in the Deployment.

Code

internal/controller/fulcio/actions/deployment.go[R166-169]

+	// Apply auth env vars and secret mounts
+	if auth := instance.Spec.Signer.Auth; auth != nil {
+		ensure.ContainerAuth(container, auth)(&template.Spec)
+	}

Relevance

●●● Strong

Stale auth mounts/env after clearing spec is a clear reconcile bug; similar upgrade/self-heal fixes
were accepted.

PR-#1928

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Controllers only call ContainerAuth when auth is non-nil, and the helper has no branch that
removes the projected volume or mount when auth is nil.

internal/controller/fulcio/actions/deployment.go[166-169]
internal/controller/ctlog/actions/deployment.go[172-175]
internal/utils/kubernetes/ensure/auth.go[22-45]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`ContainerAuth()` mutates the PodSpec only when `auth != nil` and never removes the auth volume/mount when `auth` is cleared, making the new `spec.signer.auth` effectively sticky.

### Issue Context
The `auth` volume name is fixed (`auth`), so cleanup can be ownership-safe at least for the volume and mount.

### Fix Focus Areas
- internal/controller/fulcio/actions/deployment.go[166-169]
- internal/controller/ctlog/actions/deployment.go[172-175]
- internal/utils/kubernetes/ensure/auth.go[22-45]

### Suggested fix
- Update `ensure.ContainerAuth` so that when `auth == nil` it removes the `auth` volume mount and the `auth` volume (using existing helpers `RemoveVolumeMountByName` / `RemoveVolumeByName`).
- Consider also removing previously-added env vars in an ownership-safe way (e.g., track managed env var names in an annotation, or only remove env vars that match a recorded prior desired set).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}