Skip to content

Commit a316e53

Browse files
ixxeL2097Frederic Spiers
ixxeL2097
and
Frederic Spiers
authored
feat(helm): prepare certificate refactor (#87)
* feat(helm): prepare certificate refactor * feat(helm): prepare certificate refactor --------- Co-authored-by: Frederic Spiers <[email protected]>
1 parent 934e594 commit a316e53

File tree

17 files changed

+87
-24
lines changed

17 files changed

+87
-24
lines changed

‎helm/ggbridge/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,6 +227,11 @@ A Helm chart for installing ggbridge
227227
| terminationGracePeriodSeconds | int | `300` | |
228228
| tls.autoGenerated | bool | `false` | Generate automatically self-signed TLS certificates |
229229
| tls.caCrt | string | `""` | CA certificate in PEM format |
230+
| tls.certManager.certificate | object | `{"algorithm":"RSA","duration":"17520h","renewBefore":"360h","size":4096}` | certificate configuration |
231+
| tls.certManager.certificate.algorithm | string | `"RSA"` | certificate algorithm for private key |
232+
| tls.certManager.certificate.duration | string | `"17520h"` | certificate total duration time |
233+
| tls.certManager.certificate.renewBefore | string | `"360h"` | certificate renewal time |
234+
| tls.certManager.certificate.size | int | `4096` | certificate size for private key |
230235
| tls.certManager.enabled | bool | `false` | Manage certifcates with cert-manager |
231236
| tls.certManager.issuer.kind | string | `"Issuer"` | Issuer kind ("Issuer" or "ClusterIssuer") |
232237
| tls.certManager.issuer.name | string | `""` | Set Issuer to use |

‎helm/ggbridge/templates/_helpers.tpl‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -566,9 +566,17 @@ Returns cert-manager issuer spec for TLS config
566566
{{- $fullname := include "ggbridge.fullname" . -}}
567567
{{- $spec := dict -}}
568568
{{- if hasKey .Values.tls.certManager.issuer.spec "vault" -}}
569-
{{- $spec = dict "vault" (dict "auth" (dict "kubernetes" (dict "secretRef" (dict "name" (printf "%s-issuer-token" $fullname) "key" "token")))) -}}
569+
{{- $userKubernetesAuth := dig "vault" "auth" "kubernetes" dict .Values.tls.certManager.issuer.spec -}}
570+
{{- $kubernetesAuth := dict -}}
571+
572+
{{/* Only add secretRef if user hasn't provided secretRef OR serviceAccountRef */}}
573+
{{- if and (not (hasKey $userKubernetesAuth "secretRef")) (not (hasKey $userKubernetesAuth "serviceAccountRef")) -}}
574+
{{- $_ := set $kubernetesAuth "secretRef" (dict "name" (printf "%s-issuer-token" $fullname) "key" "token") -}}
575+
{{- end -}}
576+
577+
{{- $spec = dict "vault" (dict "auth" (dict "kubernetes" $kubernetesAuth)) -}}
570578
{{- end -}}
571-
{{- $spec = include "ggbridge.tplvalues.merge" ( dict "values" ( list .Values.tls.certManager.issuer.spec $spec ) "context" . ) | fromYaml -}}
579+
{{- $spec = include "ggbridge.tplvalues.merge" ( dict "values" ( list $spec .Values.tls.certManager.issuer.spec ) "context" . ) | fromYaml -}}
572580
{{ include "ggbridge.tplvalues.render" ( dict "value" $spec "context" .) }}
573581
{{- end -}}
574582

‎helm/ggbridge/templates/cert-manager.yaml‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
{{- if .Values.tls.certManager.enabled -}}
2-
{{- $fullname := include "ggbridge.fullname" . -}}
3-
{{- $namespace := ternary (default .Release.Namespace .Values.server.istio.gateway.namespace) .Release.Namespace .Values.server.istio.enabled -}}
1+
{{- $fullname := include "ggbridge.fullname" . -}}
2+
{{- $namespace := ternary (default .Release.Namespace .Values.server.istio.gateway.namespace) .Release.Namespace .Values.server.istio.enabled -}}
3+
{{- if and .Values.tls.certManager.enabled (not (hasKey .Values.tls.certManager.issuer.spec "vault")) -}}
44
{{- if .Values.tls.certManager.issuer.spec }}
55
{{- if hasKey .Values.tls.certManager.issuer.spec "selfSigned" -}}
66
---
@@ -69,3 +69,18 @@ spec:
6969
{{- end }}
7070
{{- end }}
7171
{{- end }}
72+
{{- if hasKey .Values.tls.certManager.issuer.spec "vault" }}
73+
---
74+
apiVersion: cert-manager.io/v1
75+
kind: Issuer
76+
metadata:
77+
name: {{ printf "%s-issuer" $fullname }}
78+
namespace: {{ $namespace }}
79+
labels:
80+
{{- include "ggbridge.labels" $ | nindent 4 }}
81+
{{- if .Values.commonAnnotations }}
82+
annotations: {{- include "ggbridge.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" . ) | nindent 4 }}
83+
{{- end }}
84+
spec:
85+
{{- include "ggbridge.certManager.issuer.spec" . | nindent 2 }}
86+
{{- end }}

‎helm/ggbridge/templates/client/cert-manager.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if .Values.tls.certManager.enabled -}}
1+
{{- if and .Values.tls.certManager.enabled (and (not (empty .Values.tls.certManager.issuer.spec)) (not (hasKey .Values.tls.certManager.issuer.spec "vault"))) -}}
22
{{- $fullname := include "ggbridge.fullname" . -}}
33
{{- $namespace := ternary (default .Release.Namespace .Values.server.istio.gateway.namespace) .Release.Namespace .Values.server.istio.enabled -}}
44
{{- $clientFullname := include "ggbridge.client.fullname" $ -}}
@@ -16,10 +16,11 @@ metadata:
1616
{{- end }}
1717
spec:
1818
secretName: {{ printf "%s-crt" $clientFullname }}
19-
duration: 17520h # 2 years
19+
duration: {{ .Values.tls.certManager.certificate.duration }}
20+
renewBefore: {{ .Values.tls.certManager.certificate.renewBefore }}
2021
privateKey:
21-
algorithm: RSA
22-
size: 4096
22+
algorithm: {{ .Values.tls.certManager.certificate.algorithm }}
23+
size: {{ .Values.tls.certManager.certificate.size }}
2324
commonName: {{ include "ggbridge.hostname" . }}
2425
usages:
2526
- client auth

‎helm/ggbridge/templates/proxy/networkpolicy.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
{{- if and (eq .Values.mode "server") .Values.proxy.networkPolicy.enabled -}}
1+
{{- $deploymentCount := int (default 0 .Values.deploymentCount) -}}
2+
{{- if and (eq .Values.mode "server") .Values.proxy.networkPolicy.enabled (gt $deploymentCount 0) -}}
23
{{- $fullname := include "ggbridge.proxy.fullname" . }}
34
apiVersion: networking.k8s.io/v1
45
kind: NetworkPolicy

‎helm/ggbridge/templates/proxy/service.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
{{- if (eq (include "ggbridge.proxy.enabled" .) "true") -}}
1+
{{- $deploymentCount := int (default 0 .Values.deploymentCount) -}}
2+
{{- if and (eq (include "ggbridge.proxy.enabled" .) "true") (gt $deploymentCount 0) -}}
23
{{- $proxyFullname := include "ggbridge.proxy.fullname" . }}
34
{{- $ports := include "ggbridge.proxy.service.ports" . | fromYaml -}}
45
{{- if $ports -}}

‎helm/ggbridge/templates/rbac.yaml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,21 @@ metadata:
4545
annotations:
4646
kubernetes.io/service-account.name: {{ printf "%s-issuer" $fullname }}
4747
type: kubernetes.io/service-account-token
48+
---
49+
apiVersion: rbac.authorization.k8s.io/v1
50+
kind: ClusterRoleBinding
51+
metadata:
52+
name: {{ printf "%s-issuer" $fullname }}-token-reviewer
53+
roleRef:
54+
apiGroup: rbac.authorization.k8s.io
55+
kind: ClusterRole
56+
name: system:auth-delegator
57+
subjects:
58+
- kind: ServiceAccount
59+
name: {{ printf "%s-issuer" $fullname }}
60+
namespace: {{ .Release.Namespace }}
4861
{{- end }}
62+
{{- if .Values.tls.certManager.rbac.subjects }}
4963
---
5064
apiVersion: rbac.authorization.k8s.io/v1
5165
kind: Role
@@ -79,7 +93,6 @@ rules:
7993
- 'list'
8094
- 'watch'
8195
- 'create'
82-
{{- if .Values.tls.certManager.rbac.subjects }}
8396
---
8497
apiVersion: rbac.authorization.k8s.io/v1
8598
kind: RoleBinding

‎helm/ggbridge/templates/server/cert-manager.yaml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
{{- if and (eq .Values.mode "server") .Values.tls.certManager.enabled -}}
1+
{{- $deploymentCount := int (default 0 .Values.deploymentCount) -}}
2+
{{- if and (eq .Values.mode "server") .Values.tls.certManager.enabled (gt $deploymentCount 0) -}}
23
{{- $fullname := include "ggbridge.fullname" . -}}
34
{{- $serverFullname := include "ggbridge.server.fullname" . }}
45
{{- $namespace := ternary (default .Release.Namespace .Values.server.istio.gateway.namespace) .Release.Namespace .Values.server.istio.enabled -}}
@@ -16,10 +17,11 @@ metadata:
1617
{{- end }}
1718
spec:
1819
secretName: {{ printf "%s-crt" $serverFullname }}
19-
duration: 17520h # 2 years
20+
duration: {{ .Values.tls.certManager.certificate.duration }}
21+
renewBefore: {{ .Values.tls.certManager.certificate.renewBefore }}
2022
privateKey:
21-
algorithm: RSA
22-
size: 4096
23+
algorithm: {{ .Values.tls.certManager.certificate.algorithm }}
24+
size: {{ .Values.tls.certManager.certificate.size }}
2325
commonName: {{ include "ggbridge.hostname" . }}
2426
dnsNames:
2527
- {{ include "ggbridge.hostname" . }}

‎helm/ggbridge/templates/server/configmap.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
{{- if (eq .Values.mode "server") -}}
1+
{{- $deploymentCount := int (default 0 .Values.deploymentCount) -}}
2+
{{- if and (eq .Values.mode "server") (gt $deploymentCount 0) -}}
23
{{- $serverFullname := include "ggbridge.server.fullname" . }}
34
---
45
apiVersion: v1

‎helm/ggbridge/templates/server/gateway.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
{{- if and (eq .Values.mode "server") .Values.server.gateway.enabled }}
1+
{{- $deploymentCount := int (default 0 .Values.deploymentCount) -}}
2+
{{- if and (eq .Values.mode "server") .Values.server.gateway.enabled (gt $deploymentCount 0) }}
23
{{- $serverFullname := include "ggbridge.server.fullname" . }}
34
{{- if .Values.server.gateway.gateway.create }}
45
---

0 commit comments

Comments
 (0)