add tls module

Cargo.toml

@@ -8,26 +8,30 @@ homepage = "https://rustfs.com"
 
 
 [dependencies]
-num-traits = "0.2.19"
 serde = { version = "1.0.219", features = ["derive"] }
 tokio = { version = "1.45.0", features = ["rt", "rt-multi-thread", "macros", "fs", "io-std", "io-util"] }
 thiserror = "2.0.12"
 futures = "0.3.31"
 tracing = "0.1.41"
 tracing-subscriber = { version = "0.3.19" }
-byte-unit = "5.1.6"
-bytes = "1.10.1"
-dotenvy = "0.15.7"
 serde_json = "1.0.141"
 serde_yaml = "0.9.33"
 strum = { version = "0.27.2", features = ["derive"] }
-anyhow = "1.0.98"
 k8s-openapi = { git = "https://github.com/Arnavion/k8s-openapi.git", rev = "e9a9eaf", features = ["v1_30", "schemars"] }
 kube = { git = "https://github.com/kube-rs/kube.git", rev = "06e843bf026d0838dca159433e8af8268b6cc0bf", features = ["runtime", "derive", "client"] }
 schemars = "1"
 clap = { version = "4.5.41", features = ["derive"] }
-backon = "1.5.1"
-rand = "0.9"
+x509-parser = "0.17.0"
+rustls-pemfile = "2.2.0"
+rustls-pki-types = "1.12.0"
+rsa = "0.9.8"
+pkcs1 = { version = "0.7.5", features = ["pkcs8"] }
+p256 = { version = "0.13.2", features = ["ecdsa"] }
+ed25519-dalek = { version = "2.2.0", features = ["pkcs8"] }
+pkcs8 = "0.10.2"
+sec1 = "0.7.3"
+
+[dev-dependencies]
 
 [lints.rust]
-unused_variables = "allow"
+unused_variables = "allow"

src/lib.rs

@@ -30,6 +30,7 @@ pub mod error;
 pub mod error_policy;
 pub mod reconcile;
 pub mod types;
+pub mod utils;
 
 pub async fn run() -> Result<(), Box<dyn std::error::Error>> {
     tracing_subscriber::fmt().with_level(true).init();

src/reconcile.rs

@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+pub(crate) mod certificate;
 pub(crate) mod pool;
 pub(crate) mod service;
 pub(crate) mod service_account;

src/reconcile/certificate.rs

@@ -0,0 +1,56 @@
+// Copyright 2025 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#![allow(dead_code)]
+
+use crate::context::Context;
+use crate::error::Error;
+use crate::types::v1alpha1::tenant::Tenant;
+
+use crate::utils::tls;
+use k8s_openapi::api::core::v1 as corev1;
+
+pub async fn check_certificate_status(tenant: &Tenant, ctx: &Context) -> Result<(), Error> {
+    let secret = ctx
+        .get::<corev1::Secret>(&tenant.secret_name(), &tenant.namespace()?)
+        .await?;
+
+    Ok(())
+}
+
+// check the secret need renew or not.
+fn renew(secret: &corev1::Secret) -> Result<bool, Error> {
+    let Some(ref data) = secret.data else {
+        return Err(Error::StrError("empty data for minio secret".into()));
+    };
+
+    let (pub_key, pri_key) = match secret.type_.as_deref() {
+        Some("kubernetes.io/tls")
+        | Some("cert-manager.io/v1alpha2")
+        | Some("cert-manager.io/v1") => ("tls.crt", "tls.key"),
+        _ => ("public.crt", "private.key"),
+    };
+
+    let cert_pub_key = data
+        .get(pub_key)
+        .ok_or(Error::StrError("miss public key".into()))?;
+
+    let cert_pri_key = data
+        .get(pri_key)
+        .ok_or(Error::StrError("miss private key".into()))?;
+
+    tls::x509_key_pair(&cert_pub_key.0[..], &cert_pri_key.0[..]);
+
+    Ok(false)
+}

src/types/v1alpha1/tenant.rs

@@ -14,6 +14,7 @@
 
 use crate::error::Error;
 use crate::types::v1alpha1::pool::Pool;
+use k8s_openapi::api::apps::v1;
 use k8s_openapi::api::core::v1 as corev1;
 use k8s_openapi::api::rbac::v1 as rbacv1;
 use k8s_openapi::apimachinery::pkg::apis::meta::v1 as metav1;
@@ -282,6 +283,12 @@ impl Tenant {
         }
     }
 
+    pub fn new_statefulset(&self, pool: &Pool) -> v1::StatefulSet {
+        v1::StatefulSet {
+            ..Default::default()
+        }
+    }
+
     pub fn console_service_name(&self) -> String {
         format!("{}-console", self.name())
     }
@@ -301,4 +308,12 @@ impl Tenant {
     pub fn service_account_name(&self) -> String {
         format!("{}-sa", self.name())
     }
+
+    pub fn statefulset_name(&self, pool: &Pool) -> String {
+        format!("{}-{}", self.name(), pool.name)
+    }
+
+    pub fn secret_name(&self) -> String {
+        format!("{}-tls", self.name())
+    }
 }

src/utils.rs

@@ -0,0 +1,15 @@
+// Copyright 2025 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+pub mod tls;