Separately specify Trustee KBS port and public Trustee address

Makefile

@@ -63,7 +63,7 @@ ifndef TRUSTEE_ADDR
 	$(error TRUSTEE_ADDR is undefined)
 endif
 	scripts/clean-cluster-kind.sh $(OPERATOR_IMAGE) $(COMPUTE_PCRS_IMAGE) $(REG_SERVER_IMAGE)
-	yq '.spec.trusteeAddr = "$(TRUSTEE_ADDR):8080" | .spec.registerServerPort = 8000' \
+	yq '.spec.publicTrusteeAddr = "$(TRUSTEE_ADDR):8080" | .spec.trusteeKbsPort = 8080 | .spec.registerServerPort = 8000' \
 		-i manifests/confidential_cluster_cr.yaml
 	$(KUBECTL) apply -f manifests/operator.yaml
 	$(KUBECTL) apply -f manifests/confidential_cluster_crd.yaml

crds/src/lib.rs

@@ -9,7 +9,7 @@ use serde::{Deserialize, Serialize};
 
 #[derive(CustomResource, Default, Debug, Clone, Deserialize, Serialize, JsonSchema)]
 #[kube(
-    group = "confidential-containers.io",
+    group = "confidential-clusters.io",
     version = "v1alpha1",
     kind = "ConfidentialCluster",
     namespaced,
@@ -21,14 +21,16 @@ pub struct ConfidentialClusterSpec {
     pub pcrs_compute_image: String,
     pub register_server_image: String,
     #[serde(skip_serializing_if = "Option::is_none")]
-    pub trustee_addr: Option<String>,
+    pub public_trustee_addr: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub trustee_kbs_port: Option<i32>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub register_server_port: Option<i32>,
 }
 
 #[derive(CustomResource, Debug, Clone, Deserialize, Serialize, JsonSchema)]
 #[kube(
-    group = "confidential-containers.io",
+    group = "confidential-clusters.io",
     version = "v1alpha1",
     kind = "Machine",
     namespaced,

manifest-gen/src/main.rs

@@ -201,7 +201,7 @@ fn generate_operator(args: &Args) -> Result<()> {
                 ..Default::default()
             },
             PolicyRule {
-                api_groups: Some(vec!["confidential-containers.io".to_string()]),
+                api_groups: Some(vec![Machine::group(&()).to_string()]),
                 resources: Some(vec!["machines".to_string()]),
                 verbs: vec![
                     "create".to_string(),

operator/src/main.rs

@@ -104,11 +104,8 @@ async fn install_trustee_configuration(client: Client, cocl: &ConfidentialCluste
     }
 
     let name = operator::name_or_default(&cocl.metadata);
-    let err = format!("ConfidentialCluster {name} did not specify a Trustee address");
-    let trustee_addr = cocl.spec.trustee_addr.clone().context(err)?;
-    let mut split = trustee_addr.split(":");
-    // TODO upgrade to 443 once supported
-    let kbs_port: i32 = split.nth(1).and_then(|s| s.parse().ok()).unwrap_or(80);
+    let err = format!("ConfidentialCluster {name} did not specify a Trustee KBS port");
+    let kbs_port = cocl.spec.trustee_kbs_port.context(err)?;
     match trustee::generate_kbs_service(client.clone(), owner_reference.clone(), kbs_port).await {
         Ok(_) => info!("Generate the KBS service"),
         Err(e) => error!("Failed to create the KBS service: {e}"),

register-server/src/main.rs

@@ -90,8 +90,8 @@ async fn get_public_trustee_addr(client: Client) -> anyhow::Result<String> {
     }
     let cocl = list.items.pop().unwrap();
     let name = cocl.metadata.name.as_deref().unwrap_or("<no name>");
-    cocl.spec.trustee_addr.context(format!(
-        "ConfidentialCluster {name} did not specify a Trustee address. \
+    cocl.spec.public_trustee_addr.context(format!(
+        "ConfidentialCluster {name} did not specify a public Trustee address. \
          Add an address and re-register the node."
     ))
 }