feat(multicluster): sync target cluster trust roots into Link status

controller/gen/apis/link/v1alpha3/types.go

@@ -62,6 +62,37 @@ type LinkStatus struct {
 	MirrorServices []ServiceStatus `json:"mirrorServices,omitempty"`
 	// +optional
 	FederatedServices []ServiceStatus `json:"federatedServices,omitempty"`
+	// TrustRoots holds trust observations synchronized from the target
+	// cluster. These are controller-owned runtime state used to gate
+	// multicluster-aware trust anchor rotation; they must never be authored in
+	// spec.
+	// +optional
+	TrustRoots *TrustRootsStatus `json:"trustRoots,omitempty"`
+}
+
+// TrustRootsStatus holds the trust information synchronized from the target
+// cluster of a Link, giving visibility into the certificates a linked cluster
+// advertises and trusts.
+type TrustRootsStatus struct {
+	// TargetClusterLocalTrustRoots is the target cluster's
+	// linkerd-identity-trust-roots-local bundle.
+	// +optional
+	TargetClusterLocalTrustRoots string `json:"targetClusterLocalTrustRoots,omitempty"`
+	// TargetClusterFullTrustRoots is the target cluster's effective
+	// linkerd-identity-trust-roots bundle.
+	// +optional
+	TargetClusterFullTrustRoots string `json:"targetClusterFullTrustRoots,omitempty"`
+	// TargetClusterTrustMetadata mirrors the annotations of the target
+	// cluster's linkerd-identity-trust-roots ConfigMap, so that controllers
+	// managing trust bundles can propagate auxiliary bundle metadata across
+	// clusters without extending this API. Well-known noisy annotations such
+	// as kubectl.kubernetes.io/last-applied-configuration are excluded.
+	// +optional
+	TargetClusterTrustMetadata map[string]string `json:"targetClusterTrustMetadata,omitempty"`
+	// LastSyncedTime is when the trust information was last refreshed
+	// successfully.
+	// +optional
+	LastSyncedTime *metav1.Time `json:"lastSyncedTime,omitempty"`
 }
 
 type ServiceStatus struct {

multicluster/charts/linkerd-multicluster/templates/controller/deployment.yaml

@@ -58,6 +58,7 @@ spec:
         - -enable-namespace-creation
         {{- end }}
         - -enable-pprof={{ dig "enablePprof" $.Values.controllerDefaults.enablePprof . }}
+        - -enable-trust-roots-mirroring={{ dig "enableTrustRootsMirroring" $.Values.controllerDefaults.enableTrustRootsMirroring . }}
         - -probe-service=probe-{{.link.ref.name}}
         - {{.link.ref.name}}
         {{- if or $.Values.serviceMirrorAdditionalEnv $.Values.serviceMirrorExperimentalEnv }}

multicluster/charts/linkerd-multicluster/templates/link-crd.yaml

@@ -990,6 +990,30 @@ spec:
                   required:
                   - controllerName
                   - remoteRef
+              trustRoots:
+                description: Trust information synchronized from the target cluster,
+                  giving visibility into the certificates it advertises and trusts
+                type: object
+                properties:
+                  targetClusterLocalTrustRoots:
+                    description: The target cluster's linkerd-identity-trust-roots-local
+                      bundle
+                    type: string
+                  targetClusterFullTrustRoots:
+                    description: The target cluster's effective linkerd-identity-trust-roots
+                      bundle
+                    type: string
+                  targetClusterTrustMetadata:
+                    description: Annotations mirrored from the target cluster's
+                      linkerd-identity-trust-roots ConfigMap, carrying auxiliary
+                      trust bundle metadata across clusters
+                    type: object
+                    additionalProperties:
+                      type: string
+                  lastSyncedTime:
+                    description: When the trust information was last refreshed successfully
+                    format: date-time
+                    type: string
             type: object
     subresources:
       status: {}

multicluster/charts/linkerd-multicluster/templates/remote-access-service-mirror-rbac.yaml

@@ -33,7 +33,7 @@ rules:
 - apiGroups: [""]
   resources: ["configmaps"]
   verbs: ["get"]
-  resourceNames: ["linkerd-config"]
+  resourceNames: ["linkerd-config", "linkerd-identity-trust-roots-local", "linkerd-identity-trust-roots"]
 - apiGroups: [""]
   resources: ["events"]
   verbs: ["create", "patch"]

multicluster/charts/linkerd-multicluster/values.yaml

@@ -208,6 +208,9 @@ controllerDefaults:
   logFormat: plain
   # -- Toggle support for mirroring headless services
   enableHeadlessServices: false
+  # -- Toggle mirroring of the target cluster's trust roots into the Link
+  # status (`status.trustRoots`)
+  enableTrustRootsMirroring: false
   # -- Enables the use of pprof endpoints for the controller
   enablePprof: false
   UID: 2103

multicluster/cmd/service-mirror/main.go

@@ -54,6 +54,7 @@ func Main(args []string) {
 	enableHeadlessSvc := cmd.Bool("enable-headless-services", false, "toggle support for headless service mirroring")
 	enableNamespaceCreation := cmd.Bool("enable-namespace-creation", false, "toggle support for namespace creation")
 	enablePprof := cmd.Bool("enable-pprof", false, "Enable pprof endpoints on the admin server")
+	enableTrustRootsMirroring := cmd.Bool("enable-trust-roots-mirroring", false, "toggle mirroring of the target cluster's trust roots into the Link status")
 	localMirror := cmd.Bool("local-mirror", false, "watch the local cluster for federated service members")
 	federatedServiceSelector := cmd.String("federated-service-selector", k8s.DefaultFederatedServiceSelector, "Selector (label query) for federated service members in the local cluster")
 	exludedAnnotations := cmd.String("excluded-annotations", "", "Annotations to exclude when mirroring services")
@@ -200,7 +201,7 @@ func Main(args []string) {
 						if err != nil {
 							log.Errorf("Failed to load remote cluster credentials: %s", err)
 						}
-						err = restartClusterWatcher(ctx, link, *namespace, *probeSvc, creds, controllerK8sAPI, linksAPI, *requeueLimit, *repairPeriod, metrics, *enableHeadlessSvc, *enableNamespaceCreation)
+						err = restartClusterWatcher(ctx, link, *namespace, *probeSvc, creds, controllerK8sAPI, linksAPI, *requeueLimit, *repairPeriod, metrics, *enableHeadlessSvc, *enableNamespaceCreation, *enableTrustRootsMirroring)
 						if err != nil {
 							// failed to restart cluster watcher; give a bit of slack
 							// and requeue the link to give it another try
@@ -329,6 +330,7 @@ func restartClusterWatcher(
 	metrics servicemirror.ProbeMetricVecs,
 	enableHeadlessSvc bool,
 	enableNamespaceCreation bool,
+	enableTrustRootsMirroring bool,
 ) error {
 
 	cleanupWorkers()
@@ -369,6 +371,7 @@ func restartClusterWatcher(
 		ch,
 		enableHeadlessSvc,
 		enableNamespaceCreation,
+		enableTrustRootsMirroring,
 	)
 	if err != nil {
 		return fmt.Errorf("unable to create cluster watcher: %w", err)
@@ -406,6 +409,8 @@ func startLocalClusterWatcher(
 		make(chan bool),
 		enableHeadlessSvc,
 		enableNamespaceCreation,
+		// The local mirror has no target cluster, so it never mirrors trust roots.
+		false,
 	)
 	if err != nil {
 		return fmt.Errorf("unable to create cluster watcher: %w", err)