From 56e076ac4fa126e022e3468bc84739fec8c10468 Mon Sep 17 00:00:00 2001 From: MichaelBjeski Date: Tue, 13 Jun 2023 15:49:06 +0200 Subject: [PATCH 1/6] feat: use multiple existing tls certificates Signed-off-by: MichaelBjeski --- charts/common/Chart.yaml | 2 +- charts/common/README.md | 4 +- charts/common/templates/_ingress-ingress.yaml | 3 +- charts/common/values.schema.json | 799 +++++++++--------- charts/common/values.yaml | 2 +- 5 files changed, 413 insertions(+), 397 deletions(-) diff --git a/charts/common/Chart.yaml b/charts/common/Chart.yaml index 82def37..cb77fbc 100644 --- a/charts/common/Chart.yaml +++ b/charts/common/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: common description: "Bedag's common Helm chart to use for creating other Helm charts" -version: 10.2.0 +version: 10.2.1 # A chart can be either an 'application' or a 'library' chart. # # Application charts are a collection of templates that can be packaged into versioned archives diff --git a/charts/common/README.md b/charts/common/README.md index 88a7bf2..b694dfa 100644 --- a/charts/common/README.md +++ b/charts/common/README.md @@ -1,6 +1,6 @@ # common -![Version: 10.2.0](https://img.shields.io/badge/Version-10.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) +![Version: 10.2.1](https://img.shields.io/badge/Version-10.2.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) Bedag's common Helm chart to use for creating other Helm charts @@ -41,7 +41,7 @@ Major Changes to functions are documented with the version affected. **Before up | ingress.rules[0].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) | | ingress.rules[0].http.paths[0].path | string | `"/"` | path which ingress is listening | | ingress.rules[0].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") | -| ingress.tls.existing.secret | string | `""` | name of an existing secret with tls.crt & tls.key content | +| ingress.tls.existing[0] | object | `{"secret":""}` | name of an existing secret with tls.crt & tls.key content | | ingress.tls.provided.cert | string | `""` | If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key Has to be base64 encoded and should be encrypted in the ejson vault Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails. | | ingress.tls.provided.key | string | `""` | The key must not have a passphrase | | ingress.tls.self | object | `{"alternativeDnsNames":[],"commonName":"*.cluster.local","ipAddresses":[],"validityDuration":365}` | depending on the type you have further configuration options: | diff --git a/charts/common/templates/_ingress-ingress.yaml b/charts/common/templates/_ingress-ingress.yaml index 1834e5b..91840ed 100644 --- a/charts/common/templates/_ingress-ingress.yaml +++ b/charts/common/templates/_ingress-ingress.yaml @@ -45,7 +45,8 @@ spec: {{- if or (eq $ingress.tls.type "self") (eq $ingress.tls.type "provided") }} secretName: {{ template "library.name" . }}-ingress-tls {{- else if eq $ingress.tls.type "existing" }} - secretName: {{ $ingress.tls.existing.secret }} + {{- range $ingress.tls.existing }} + secretName: {{ .secret }} {{- end }} {{- end }} {{- end }} diff --git a/charts/common/values.schema.json b/charts/common/values.schema.json index b682867..560caa0 100644 --- a/charts/common/values.schema.json +++ b/charts/common/values.schema.json @@ -82,7 +82,10 @@ } }, "env": { - "type": ["array", "object"] + "type": [ + "array", + "object" + ] }, "envSecret": { "type": "object" @@ -509,463 +512,477 @@ "type": "string", "default": "none" }, + "existing": { - "type": "object", - "required": [ - "secret" - ], - "properties": { - "secret": { - "type": "string" - } - } - }, - "provided": { - "type": "object", - "required": [ - "cert", - "key" - ], - "properties": { - "cert": { - "type": "string" - }, - "key": { - "type": "string" - } - } - }, - "self": { - "type": "object", - "required": [ - "commonName", - "validityDuration" - ], - "properties": { - "commonName": { - "type": "string" - }, - "ipAddresses": { - "type": "array" + "type": "array", + "items": { + "type": "string", + "required": [ + "secret" + ], + + "existing": { + "type": "object", + "required": [ + "secret" + ], + "properties": { + "secret": { + "type": "string" + } + } }, - "alternativeDnsNames": { - "type": "array" + "provided": { + "type": "object", + "required": [ + "cert", + "key" + ], + "properties": { + "cert": { + "type": "string" + }, + "key": { + "type": "string" + } + } }, - "validityDuration": { - "type": "integer" + "self": { + "type": "object", + "required": [ + "commonName", + "validityDuration" + ], + "properties": { + "commonName": { + "type": "string" + }, + "ipAddresses": { + "type": "array" + }, + "alternativeDnsNames": { + "type": "array" + }, + "validityDuration": { + "type": "integer" + } + } } } } } - } - } - }, - "servicemonitor": { - "type": "object", - "required": [ - "deploy" - ], - "if": { - "properties": { - "deploy": { - "const": true - } - } - }, - "then": { - "required": [ - "basicAuth", - "endpoints" - ] - }, - "properties": { - "deploy": { - "type": "boolean", - "default": false }, - "basicAuth": { + "servicemonitor": { "type": "object", "required": [ - "enabled" + "deploy" ], "if": { "properties": { - "enabled": { + "deploy": { "const": true } } }, "then": { "required": [ - "existingSecret", - "newSecret", - "userKey", - "passwordKey" + "basicAuth", + "endpoints" ] }, "properties": { - "enabled": { + "deploy": { "type": "boolean", "default": false }, - "existingSecret": { - "type": "string" - }, - "newSecret": { - "type": "object" - }, - "userKey": { - "type": "string" + "basicAuth": { + "type": "object", + "required": [ + "enabled" + ], + "if": { + "properties": { + "enabled": { + "const": true + } + } + }, + "then": { + "required": [ + "existingSecret", + "newSecret", + "userKey", + "passwordKey" + ] + }, + "properties": { + "enabled": { + "type": "boolean", + "default": false + }, + "existingSecret": { + "type": "string" + }, + "newSecret": { + "type": "object" + }, + "userKey": { + "type": "string" + }, + "passwordKey": { + "type": "string" + } + } }, - "passwordKey": { - "type": "string" + "endpoints": { + "type": "object", + "patternProperties": { + "^.*$": { + "$ref": "#/$defs/servicemonitorEndpoint" + } + } } } }, - "endpoints": { - "type": "object", - "patternProperties": { - "^.*$": { - "$ref": "#/$defs/servicemonitorEndpoint" - } - } - } - } - }, - "pvcs": { - "type": [ - "array", - "null" - ], - "items": { - "type": "object", - "properties": { - "name": { - "type": "string", - "examples": [ - "name-of-pvc" - ] - }, - "size": { - "type": "string", - "default": "1Gi" - }, - "accessModes": { - "type": "array", - "items": {} - }, - "storageClassName": { - "type": "string", - "examples": [ - "nfs-data" + "pvcs": { + "type": [ + "array", + "null" + ], + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "examples": [ + "name-of-pvc" + ] + }, + "size": { + "type": "string", + "default": "1Gi" + }, + "accessModes": { + "type": "array", + "items": {} + }, + "storageClassName": { + "type": "string", + "examples": [ + "nfs-data" + ] + } + }, + "required": [ + "name" ] } }, - "required": [ - "name" - ] - } - }, - "components": { - "type": "object", - "patternProperties": { - "^.*$": { + "components": { "type": "object", - "required": [ - "services", - "controller" - ], - "properties": { - "services": { + "patternProperties": { + "^.*$": { "type": "object", - "patternProperties": { - "^.*$": { + "required": [ + "services", + "controller" + ], + "properties": { + "services": { + "type": "object", + "patternProperties": { + "^.*$": { + "type": "object", + "required": [ + "deploy" + ], + "properties": { + "deploy": { + "type": "boolean", + "default": false + } + } + } + } + }, + "networkpolicies": { + "type": "object", + "patternProperties": { + "^.*$": { + "type": "object", + "properties": { + "policyTypes": { + "type": "array", + "items": { + "type": "string", + "enum": [ + "Ingress", + "Egress" + ] + } + }, + "ingress": { + "$ref": "#/$defs/networkpolicyType" + }, + "egress": { + "$ref": "#/$defs/networkpolicyType" + } + } + } + } + }, + "controller": { "type": "object", "required": [ - "deploy" + "deploy", + "type" ], "properties": { "deploy": { "type": "boolean", "default": false - } - } - } - } - }, - "networkpolicies": { - "type": "object", - "patternProperties": { - "^.*$": { - "type": "object", - "properties": { - "policyTypes": { - "type": "array", - "items": { - "type": "string", - "enum": ["Ingress", "Egress"] - } }, - "ingress": { - "$ref": "#/$defs/networkpolicyType" + "type": { + "type": "string", + "enum": [ + "Deployment", + "StatefulSet", + "Job", + "CronJob" + ] }, - "egress": { - "$ref": "#/$defs/networkpolicyType" - } - } - } - } - }, - "controller": { - "type": "object", - "required": [ - "deploy", - "type" - ], - "properties": { - "deploy": { - "type": "boolean", - "default": false - }, - "type": { - "type": "string", - "enum": [ - "Deployment", - "StatefulSet", - "Job", - "CronJob" - ] - }, - "gatherMetrics": { - "type": "boolean", - "default": false - }, - "extraAnnotations": { - "type": "object" - }, - "extraLabels": { - "type": "object" - }, - "replicas": { - "type": "integer", - "default": 1 - }, - "revisionHistoryLimit": { - "type": "integer", - "default": 3 - }, - "forceRedeploy": { - "type": "boolean", - "default": false - }, - "updateStrategy": { - "type": "string", - "default": "RollingUpdate" - }, - "extraVolumeClaimTemplates": { - "type": "array", - "items": { - "type": "object", - "properties": { - "metadata": { - "type": "object", - "required": [ - "name" - ] - }, - "spec": { + "gatherMetrics": { + "type": "boolean", + "default": false + }, + "extraAnnotations": { + "type": "object" + }, + "extraLabels": { + "type": "object" + }, + "replicas": { + "type": "integer", + "default": 1 + }, + "revisionHistoryLimit": { + "type": "integer", + "default": 3 + }, + "forceRedeploy": { + "type": "boolean", + "default": false + }, + "updateStrategy": { + "type": "string", + "default": "RollingUpdate" + }, + "extraVolumeClaimTemplates": { + "type": "array", + "items": { "type": "object", "properties": { - "accessModes": { - "type": "array", - "items": { - "type": "string" - } - }, - "storageClassName": { - "type": "string" + "metadata": { + "type": "object", + "required": [ + "name" + ] }, - "resources": { - "type": "object" + "spec": { + "type": "object", + "properties": { + "accessModes": { + "type": "array", + "items": { + "type": "string" + } + }, + "storageClassName": { + "type": "string" + }, + "resources": { + "type": "object" + } + }, + "required": [ + "accessModes", + "storageClassName", + "resources" + ] } }, "required": [ - "accessModes", - "storageClassName", - "resources" + "metadata", + "spec" ] } }, - "required": [ - "metadata", - "spec" - ] - } - }, - "strategy": { - "type": "object", - "properties": { - "type": { + "strategy": { + "type": "object", + "properties": { + "type": { + "type": "string", + "default": "Recreate" + }, + "maxSurge": { + "type": "string", + "default": "1" + }, + "maxUnavailable": { + "type": "string", + "default": "1" + } + } + }, + "completions": { + "type": "integer" + }, + "completionMode": { "type": "string", - "default": "Recreate" + "enum": [ + "NonIndexed", + "Indexed" + ] + }, + "backoffLimit": { + "type": "integer" + }, + "activeDeadlineSeconds": { + "type": "integer" + }, + "ttlSecondsAfterFinished": { + "type": "integer" + }, + "suspend": { + "type": "boolean", + "default": false }, - "maxSurge": { + "parallelism": { + "type": "integer" + }, + "schedule": { "type": "string", - "default": "1" + "default": "* * * * *" }, - "maxUnavailable": { + "concurrencyPolicy": { "type": "string", - "default": "1" - } - } - }, - "completions": { - "type": "integer" - }, - "completionMode": { - "type": "string", - "enum": [ - "NonIndexed", - "Indexed" - ] - }, - "backoffLimit": { - "type": "integer" - }, - "activeDeadlineSeconds": { - "type": "integer" - }, - "ttlSecondsAfterFinished": { - "type": "integer" - }, - "suspend": { - "type": "boolean", - "default": false - }, - "parallelism": { - "type": "integer" - }, - "schedule": { - "type": "string", - "default": "* * * * *" - }, - "concurrencyPolicy": { - "type": "string", - "enum": [ - "Allow", - "Forbid", - "Replace" - ] - }, - "failedJobsHistoryLimit": { - "type": "integer" - }, - "startingDeadlineSeconds": { - "type": "integer" - }, - "successfulJobsHistoryLimit": { - "type": "integer" - }, - "disableChecksumAnnotations": { - "type": "boolean", - "default": false - }, - "extraChecksumAnnotations": { - "type": "array", - "items": { - "type": "object", - "properties": { - "key": { - "type": "string", - "minLength": 3, - "maxLength": 253 - }, - "checksumFrom": { - "type": "string" - } + "enum": [ + "Allow", + "Forbid", + "Replace" + ] }, - "required": [ - "key", - "checksumFrom" - ] - } - }, - "serviceAccountName": { - "type": "string" - }, - "automountServiceAccountToken": { - "type": "boolean", - "default": false - }, - "priorityClassName": { - "type": "string" - }, - "restartPolicy": { - "type": "string", - "enum": [ - "Always", - "Never", - "OnFailure" - ] - }, - "podSecurityContext": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean" + "failedJobsHistoryLimit": { + "type": "integer" }, - "fsGroup": { + "startingDeadlineSeconds": { "type": "integer" }, - "runAsGroup": { + "successfulJobsHistoryLimit": { "type": "integer" }, - "runAsNonRoot": { - "type": "boolean" + "disableChecksumAnnotations": { + "type": "boolean", + "default": false }, - "runAsUser": { - "type": "integer" + "extraChecksumAnnotations": { + "type": "array", + "items": { + "type": "object", + "properties": { + "key": { + "type": "string", + "minLength": 3, + "maxLength": 253 + }, + "checksumFrom": { + "type": "string" + } + }, + "required": [ + "key", + "checksumFrom" + ] + } + }, + "serviceAccountName": { + "type": "string" + }, + "automountServiceAccountToken": { + "type": "boolean", + "default": false + }, + "priorityClassName": { + "type": "string" + }, + "restartPolicy": { + "type": "string", + "enum": [ + "Always", + "Never", + "OnFailure" + ] + }, + "podSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "fsGroup": { + "type": "integer" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + }, + "supplementalGroups": { + "type": "array", + "items": { + "type": "integer" + } + } + } }, - "supplementalGroups": { + "nodeSelector": { + "type": "object" + }, + "tolerations": { + "type": "array" + }, + "affinity": { + "type": "object" + }, + "volumes": { "type": "array", "items": { - "type": "integer" + "type": "object", + "required": [ + "name", + "type" + ] + } + }, + "containers": { + "type": "object", + "patternProperties": { + "^.*$": { + "$ref": "#/$defs/container" + } + } + }, + "initContainers": { + "type": "object", + "patternProperties": { + "^.*$": { + "$ref": "#/$defs/container" + } } - } - } - }, - "nodeSelector": { - "type": "object" - }, - "tolerations": { - "type": "array" - }, - "affinity": { - "type": "object" - }, - "volumes": { - "type": "array", - "items": { - "type": "object", - "required": [ - "name", - "type" - ] - } - }, - "containers": { - "type": "object", - "patternProperties": { - "^.*$": { - "$ref": "#/$defs/container" - } - } - }, - "initContainers": { - "type": "object", - "patternProperties": { - "^.*$": { - "$ref": "#/$defs/container" } } } @@ -975,5 +992,3 @@ } } } - } -} diff --git a/charts/common/values.yaml b/charts/common/values.yaml index eda4944..77a21f4 100644 --- a/charts/common/values.yaml +++ b/charts/common/values.yaml @@ -84,7 +84,7 @@ ingress: validityDuration: 365 existing: # -- name of an existing secret with tls.crt & tls.key content - secret: "" + - secret: "" provided: # -- If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key # Has to be base64 encoded and should be encrypted in the ejson vault From 3017dbe456e9f7a29e1d5d1a948ae9b7692bf6b3 Mon Sep 17 00:00:00 2001 From: MichaelBjeski Date: Wed, 14 Jun 2023 08:18:58 +0200 Subject: [PATCH 2/6] fix: version bump to 10.3.0 fix: set host for each certificate directly Signed-off-by: MichaelBjeski --- charts/common/Chart.yaml | 2 +- charts/common/README.md | 8 +- charts/common/templates/_ingress-ingress.yaml | 7 +- charts/common/values.schema.json | 796 +++++++++--------- charts/common/values.yaml | 19 +- 5 files changed, 410 insertions(+), 422 deletions(-) diff --git a/charts/common/Chart.yaml b/charts/common/Chart.yaml index cb77fbc..6e8a896 100644 --- a/charts/common/Chart.yaml +++ b/charts/common/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: common description: "Bedag's common Helm chart to use for creating other Helm charts" -version: 10.2.1 +version: 10.3.0 # A chart can be either an 'application' or a 'library' chart. # # Application charts are a collection of templates that can be packaged into versioned archives diff --git a/charts/common/README.md b/charts/common/README.md index b694dfa..fa28612 100644 --- a/charts/common/README.md +++ b/charts/common/README.md @@ -1,6 +1,6 @@ # common -![Version: 10.2.1](https://img.shields.io/badge/Version-10.2.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) +![Version: 10.3.0](https://img.shields.io/badge/Version-10.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) Bedag's common Helm chart to use for creating other Helm charts @@ -41,14 +41,8 @@ Major Changes to functions are documented with the version affected. **Before up | ingress.rules[0].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) | | ingress.rules[0].http.paths[0].path | string | `"/"` | path which ingress is listening | | ingress.rules[0].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") | -| ingress.tls.existing[0] | object | `{"secret":""}` | name of an existing secret with tls.crt & tls.key content | | ingress.tls.provided.cert | string | `""` | If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key Has to be base64 encoded and should be encrypted in the ejson vault Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails. | | ingress.tls.provided.key | string | `""` | The key must not have a passphrase | -| ingress.tls.self | object | `{"alternativeDnsNames":[],"commonName":"*.cluster.local","ipAddresses":[],"validityDuration":365}` | depending on the type you have further configuration options: | -| ingress.tls.self.alternativeDnsNames | list | `[]` | alternativeDnsNames is an optional list of DNS names to add in the Subject Alternative Names (SAN) sectiom | -| ingress.tls.self.commonName | string | `"*.cluster.local"` | commonName of the certificate (mandatory) | -| ingress.tls.self.ipAddresses | list | `[]` | ipAddresses is an optional list of IP addresses to add in the Subject Alternative Names (SAN) section | -| ingress.tls.self.validityDuration | int | `365` | validityDuration defines how long the certificate is valid (in days) | ## ServiceMonitor diff --git a/charts/common/templates/_ingress-ingress.yaml b/charts/common/templates/_ingress-ingress.yaml index 91840ed..0928418 100644 --- a/charts/common/templates/_ingress-ingress.yaml +++ b/charts/common/templates/_ingress-ingress.yaml @@ -45,8 +45,13 @@ spec: {{- if or (eq $ingress.tls.type "self") (eq $ingress.tls.type "provided") }} secretName: {{ template "library.name" . }}-ingress-tls {{- else if eq $ingress.tls.type "existing" }} + {{- range $ingress.tls.existing }} - secretName: {{ .secret }} + {{- if has $.host .host }} + secretName: {{ $.host.secret }} + {{- end }} + {{- end }} + {{- end }} {{- end }} {{- end }} diff --git a/charts/common/values.schema.json b/charts/common/values.schema.json index 560caa0..b424eaf 100644 --- a/charts/common/values.schema.json +++ b/charts/common/values.schema.json @@ -512,479 +512,477 @@ "type": "string", "default": "none" }, - "existing": { "type": "array", "items": { - "type": "string", + "type": "object", "required": [ - "secret" + "host" ], - - "existing": { - "type": "object", - "required": [ - "secret" - ], - "properties": { - "secret": { - "type": "string" - } + "properties": { + "host": { + "type": "string", + "examples": [ + "myapp.cluster.local" + ] + }, + "secret": { + "type": "string" } + } + } + }, + "provided": { + "type": "object", + "required": [ + "cert", + "key" + ], + "properties": { + "cert": { + "type": "string" }, - "provided": { - "type": "object", - "required": [ - "cert", - "key" - ], - "properties": { - "cert": { - "type": "string" - }, - "key": { - "type": "string" - } - } + "key": { + "type": "string" + } + } + }, + "self": { + "type": "object", + "required": [ + "commonName", + "validityDuration" + ], + "properties": { + "commonName": { + "type": "string" }, - "self": { - "type": "object", - "required": [ - "commonName", - "validityDuration" - ], - "properties": { - "commonName": { - "type": "string" - }, - "ipAddresses": { - "type": "array" - }, - "alternativeDnsNames": { - "type": "array" - }, - "validityDuration": { - "type": "integer" - } - } + "ipAddresses": { + "type": "array" + }, + "alternativeDnsNames": { + "type": "array" + }, + "validityDuration": { + "type": "integer" } } } } + } + } + }, + "servicemonitor": { + "type": "object", + "required": [ + "deploy" + ], + "if": { + "properties": { + "deploy": { + "const": true + } + } + }, + "then": { + "required": [ + "basicAuth", + "endpoints" + ] + }, + "properties": { + "deploy": { + "type": "boolean", + "default": false }, - "servicemonitor": { + "basicAuth": { "type": "object", "required": [ - "deploy" + "enabled" ], "if": { "properties": { - "deploy": { + "enabled": { "const": true } } }, "then": { "required": [ - "basicAuth", - "endpoints" + "existingSecret", + "newSecret", + "userKey", + "passwordKey" ] }, "properties": { - "deploy": { + "enabled": { "type": "boolean", "default": false }, - "basicAuth": { - "type": "object", - "required": [ - "enabled" - ], - "if": { - "properties": { - "enabled": { - "const": true - } - } - }, - "then": { - "required": [ - "existingSecret", - "newSecret", - "userKey", - "passwordKey" - ] - }, - "properties": { - "enabled": { - "type": "boolean", - "default": false - }, - "existingSecret": { - "type": "string" - }, - "newSecret": { - "type": "object" - }, - "userKey": { - "type": "string" - }, - "passwordKey": { - "type": "string" - } - } + "existingSecret": { + "type": "string" }, - "endpoints": { - "type": "object", - "patternProperties": { - "^.*$": { - "$ref": "#/$defs/servicemonitorEndpoint" - } - } + "newSecret": { + "type": "object" + }, + "userKey": { + "type": "string" + }, + "passwordKey": { + "type": "string" } } }, - "pvcs": { - "type": [ - "array", - "null" - ], - "items": { - "type": "object", - "properties": { - "name": { - "type": "string", - "examples": [ - "name-of-pvc" - ] - }, - "size": { - "type": "string", - "default": "1Gi" - }, - "accessModes": { - "type": "array", - "items": {} - }, - "storageClassName": { - "type": "string", - "examples": [ - "nfs-data" - ] - } - }, - "required": [ - "name" + "endpoints": { + "type": "object", + "patternProperties": { + "^.*$": { + "$ref": "#/$defs/servicemonitorEndpoint" + } + } + } + } + }, + "pvcs": { + "type": [ + "array", + "null" + ], + "items": { + "type": "object", + "properties": { + "name": { + "type": "string", + "examples": [ + "name-of-pvc" + ] + }, + "size": { + "type": "string", + "default": "1Gi" + }, + "accessModes": { + "type": "array", + "items": {} + }, + "storageClassName": { + "type": "string", + "examples": [ + "nfs-data" ] } }, - "components": { + "required": [ + "name" + ] + } + }, + "components": { + "type": "object", + "patternProperties": { + "^.*$": { "type": "object", - "patternProperties": { - "^.*$": { + "required": [ + "services", + "controller" + ], + "properties": { + "services": { "type": "object", - "required": [ - "services", - "controller" - ], - "properties": { - "services": { - "type": "object", - "patternProperties": { - "^.*$": { - "type": "object", - "required": [ - "deploy" - ], - "properties": { - "deploy": { - "type": "boolean", - "default": false - } - } - } - } - }, - "networkpolicies": { - "type": "object", - "patternProperties": { - "^.*$": { - "type": "object", - "properties": { - "policyTypes": { - "type": "array", - "items": { - "type": "string", - "enum": [ - "Ingress", - "Egress" - ] - } - }, - "ingress": { - "$ref": "#/$defs/networkpolicyType" - }, - "egress": { - "$ref": "#/$defs/networkpolicyType" - } - } - } - } - }, - "controller": { + "patternProperties": { + "^.*$": { "type": "object", "required": [ - "deploy", - "type" + "deploy" ], "properties": { "deploy": { "type": "boolean", "default": false - }, - "type": { - "type": "string", - "enum": [ - "Deployment", - "StatefulSet", - "Job", - "CronJob" - ] - }, - "gatherMetrics": { - "type": "boolean", - "default": false - }, - "extraAnnotations": { - "type": "object" - }, - "extraLabels": { - "type": "object" - }, - "replicas": { - "type": "integer", - "default": 1 - }, - "revisionHistoryLimit": { - "type": "integer", - "default": 3 - }, - "forceRedeploy": { - "type": "boolean", - "default": false - }, - "updateStrategy": { - "type": "string", - "default": "RollingUpdate" - }, - "extraVolumeClaimTemplates": { + } + } + } + } + }, + "networkpolicies": { + "type": "object", + "patternProperties": { + "^.*$": { + "type": "object", + "properties": { + "policyTypes": { "type": "array", "items": { - "type": "object", - "properties": { - "metadata": { - "type": "object", - "required": [ - "name" - ] - }, - "spec": { - "type": "object", - "properties": { - "accessModes": { - "type": "array", - "items": { - "type": "string" - } - }, - "storageClassName": { - "type": "string" - }, - "resources": { - "type": "object" - } - }, - "required": [ - "accessModes", - "storageClassName", - "resources" - ] - } - }, - "required": [ - "metadata", - "spec" + "type": "string", + "enum": [ + "Ingress", + "Egress" ] } }, - "strategy": { - "type": "object", - "properties": { - "type": { - "type": "string", - "default": "Recreate" - }, - "maxSurge": { - "type": "string", - "default": "1" - }, - "maxUnavailable": { - "type": "string", - "default": "1" - } - } - }, - "completions": { - "type": "integer" + "ingress": { + "$ref": "#/$defs/networkpolicyType" }, - "completionMode": { - "type": "string", - "enum": [ - "NonIndexed", - "Indexed" - ] - }, - "backoffLimit": { - "type": "integer" - }, - "activeDeadlineSeconds": { - "type": "integer" - }, - "ttlSecondsAfterFinished": { - "type": "integer" - }, - "suspend": { - "type": "boolean", - "default": false - }, - "parallelism": { - "type": "integer" - }, - "schedule": { - "type": "string", - "default": "* * * * *" - }, - "concurrencyPolicy": { - "type": "string", - "enum": [ - "Allow", - "Forbid", - "Replace" - ] - }, - "failedJobsHistoryLimit": { - "type": "integer" - }, - "startingDeadlineSeconds": { - "type": "integer" - }, - "successfulJobsHistoryLimit": { - "type": "integer" - }, - "disableChecksumAnnotations": { - "type": "boolean", - "default": false - }, - "extraChecksumAnnotations": { - "type": "array", - "items": { + "egress": { + "$ref": "#/$defs/networkpolicyType" + } + } + } + } + }, + "controller": { + "type": "object", + "required": [ + "deploy", + "type" + ], + "properties": { + "deploy": { + "type": "boolean", + "default": false + }, + "type": { + "type": "string", + "enum": [ + "Deployment", + "StatefulSet", + "Job", + "CronJob" + ] + }, + "gatherMetrics": { + "type": "boolean", + "default": false + }, + "extraAnnotations": { + "type": "object" + }, + "extraLabels": { + "type": "object" + }, + "replicas": { + "type": "integer", + "default": 1 + }, + "revisionHistoryLimit": { + "type": "integer", + "default": 3 + }, + "forceRedeploy": { + "type": "boolean", + "default": false + }, + "updateStrategy": { + "type": "string", + "default": "RollingUpdate" + }, + "extraVolumeClaimTemplates": { + "type": "array", + "items": { + "type": "object", + "properties": { + "metadata": { + "type": "object", + "required": [ + "name" + ] + }, + "spec": { "type": "object", "properties": { - "key": { - "type": "string", - "minLength": 3, - "maxLength": 253 + "accessModes": { + "type": "array", + "items": { + "type": "string" + } }, - "checksumFrom": { + "storageClassName": { "type": "string" + }, + "resources": { + "type": "object" } }, "required": [ - "key", - "checksumFrom" + "accessModes", + "storageClassName", + "resources" ] } }, - "serviceAccountName": { - "type": "string" - }, - "automountServiceAccountToken": { - "type": "boolean", - "default": false - }, - "priorityClassName": { - "type": "string" + "required": [ + "metadata", + "spec" + ] + } + }, + "strategy": { + "type": "object", + "properties": { + "type": { + "type": "string", + "default": "Recreate" }, - "restartPolicy": { + "maxSurge": { "type": "string", - "enum": [ - "Always", - "Never", - "OnFailure" - ] + "default": "1" }, - "podSecurityContext": { - "type": "object", - "properties": { - "enabled": { - "type": "boolean" - }, - "fsGroup": { - "type": "integer" - }, - "runAsGroup": { - "type": "integer" - }, - "runAsNonRoot": { - "type": "boolean" - }, - "runAsUser": { - "type": "integer" - }, - "supplementalGroups": { - "type": "array", - "items": { - "type": "integer" - } - } + "maxUnavailable": { + "type": "string", + "default": "1" + } + } + }, + "completions": { + "type": "integer" + }, + "completionMode": { + "type": "string", + "enum": [ + "NonIndexed", + "Indexed" + ] + }, + "backoffLimit": { + "type": "integer" + }, + "activeDeadlineSeconds": { + "type": "integer" + }, + "ttlSecondsAfterFinished": { + "type": "integer" + }, + "suspend": { + "type": "boolean", + "default": false + }, + "parallelism": { + "type": "integer" + }, + "schedule": { + "type": "string", + "default": "* * * * *" + }, + "concurrencyPolicy": { + "type": "string", + "enum": [ + "Allow", + "Forbid", + "Replace" + ] + }, + "failedJobsHistoryLimit": { + "type": "integer" + }, + "startingDeadlineSeconds": { + "type": "integer" + }, + "successfulJobsHistoryLimit": { + "type": "integer" + }, + "disableChecksumAnnotations": { + "type": "boolean", + "default": false + }, + "extraChecksumAnnotations": { + "type": "array", + "items": { + "type": "object", + "properties": { + "key": { + "type": "string", + "minLength": 3, + "maxLength": 253 + }, + "checksumFrom": { + "type": "string" } }, - "nodeSelector": { - "type": "object" + "required": [ + "key", + "checksumFrom" + ] + } + }, + "serviceAccountName": { + "type": "string" + }, + "automountServiceAccountToken": { + "type": "boolean", + "default": false + }, + "priorityClassName": { + "type": "string" + }, + "restartPolicy": { + "type": "string", + "enum": [ + "Always", + "Never", + "OnFailure" + ] + }, + "podSecurityContext": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" }, - "tolerations": { - "type": "array" + "fsGroup": { + "type": "integer" }, - "affinity": { - "type": "object" + "runAsGroup": { + "type": "integer" }, - "volumes": { - "type": "array", - "items": { - "type": "object", - "required": [ - "name", - "type" - ] - } + "runAsNonRoot": { + "type": "boolean" }, - "containers": { - "type": "object", - "patternProperties": { - "^.*$": { - "$ref": "#/$defs/container" - } - } + "runAsUser": { + "type": "integer" }, - "initContainers": { - "type": "object", - "patternProperties": { - "^.*$": { - "$ref": "#/$defs/container" - } + "supplementalGroups": { + "type": "array", + "items": { + "type": "integer" } } } + }, + "nodeSelector": { + "type": "object" + }, + "tolerations": { + "type": "array" + }, + "affinity": { + "type": "object" + }, + "volumes": { + "type": "array", + "items": { + "type": "object", + "required": [ + "name", + "type" + ] + } + }, + "containers": { + "type": "object", + "patternProperties": { + "^.*$": { + "$ref": "#/$defs/container" + } + } + }, + "initContainers": { + "type": "object", + "patternProperties": { + "^.*$": { + "$ref": "#/$defs/container" + } + } } } } @@ -992,3 +990,5 @@ } } } + } +} diff --git a/charts/common/values.yaml b/charts/common/values.yaml index 77a21f4..20138b8 100644 --- a/charts/common/values.yaml +++ b/charts/common/values.yaml @@ -63,28 +63,17 @@ ingress: nginx.ingress.kubernetes.io/ssl-redirect: "true" # tls configuration tls: - # define your type of tls certificate, it can be one of: - # none: tls will be disabled - # existing: use an existing secret already present in the namespace. Requires secret name to be specified - # provided: use an officially generated certificate/key - # k8s: use the default k8s-ingress tls. no further configuration needed - # self: generate a self signed certificate, which is stored as secret. Needs commonName and validityDuration at least type: "none" - # -- depending on the type you have further configuration options: self: - # -- commonName of the certificate (mandatory) commonName: "*.cluster.local" - # -- ipAddresses is an optional list of IP addresses to add in the Subject Alternative Names (SAN) section ipAddresses: [] - # - "10.0.0.1" - # -- alternativeDnsNames is an optional list of DNS names to add in the Subject Alternative Names (SAN) sectiom alternativeDnsNames: [] - # - "foo.com" - # -- validityDuration defines how long the certificate is valid (in days) validityDuration: 365 + existing: - # -- name of an existing secret with tls.crt & tls.key content - - secret: "" + - host: myapp.cluster.local + secret: "" + provided: # -- If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key # Has to be base64 encoded and should be encrypted in the ejson vault From 4cbe7bf3d1ac72518a19ecee94ddf8ff75de6b35 Mon Sep 17 00:00:00 2001 From: MichaelBjeski Date: Wed, 14 Jun 2023 08:22:42 +0200 Subject: [PATCH 3/6] fix: add comments in tls part back in Signed-off-by: MichaelBjeski --- charts/common/values.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/charts/common/values.yaml b/charts/common/values.yaml index 20138b8..4a7e1aa 100644 --- a/charts/common/values.yaml +++ b/charts/common/values.yaml @@ -63,11 +63,24 @@ ingress: nginx.ingress.kubernetes.io/ssl-redirect: "true" # tls configuration tls: + # define your type of tls certificate, it can be one of: + # none: tls will be disabled + # existing: use an existing secret already present in the namespace. Requires secret name to be specified + # provided: use an officially generated certificate/key + # k8s: use the default k8s-ingress tls. no further configuration needed + # self: generate a self signed certificate, which is stored as secret. Needs commonName and validityDuration at least type: "none" + # -- depending on the type you have further configuration options: self: + # -- commonName of the certificate (mandatory) commonName: "*.cluster.local" + # -- ipAddresses is an optional list of IP addresses to add in the Subject Alternative Names (SAN) section ipAddresses: [] + # - "10.0.0.1" + # -- alternativeDnsNames is an optional list of DNS names to add in the Subject Alternative Names (SAN) sectiom alternativeDnsNames: [] + # - "foo.com" + # -- validityDuration defines how long the certificate is valid (in days) validityDuration: 365 existing: From 2bc78f860e8c9814be3ff1f34b69c74392689249 Mon Sep 17 00:00:00 2001 From: MichaelBjeski Date: Wed, 14 Jun 2023 10:30:11 +0200 Subject: [PATCH 4/6] fix: correct helm-docs make Signed-off-by: MichaelBjeski --- charts/common/README.md | 6 ++++++ charts/common/values.yaml | 1 + 2 files changed, 7 insertions(+) diff --git a/charts/common/README.md b/charts/common/README.md index fa28612..1b82ecc 100644 --- a/charts/common/README.md +++ b/charts/common/README.md @@ -41,8 +41,14 @@ Major Changes to functions are documented with the version affected. **Before up | ingress.rules[0].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) | | ingress.rules[0].http.paths[0].path | string | `"/"` | path which ingress is listening | | ingress.rules[0].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") | +| ingress.tls.existing[0] | object | `{"host":"myapp.cluster.local","secret":""}` | name of an existing secret with tls.crt & tls.key content | | ingress.tls.provided.cert | string | `""` | If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key Has to be base64 encoded and should be encrypted in the ejson vault Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails. | | ingress.tls.provided.key | string | `""` | The key must not have a passphrase | +| ingress.tls.self | object | `{"alternativeDnsNames":[],"commonName":"*.cluster.local","ipAddresses":[],"validityDuration":365}` | depending on the type you have further configuration options: | +| ingress.tls.self.alternativeDnsNames | list | `[]` | alternativeDnsNames is an optional list of DNS names to add in the Subject Alternative Names (SAN) sectiom | +| ingress.tls.self.commonName | string | `"*.cluster.local"` | commonName of the certificate (mandatory) | +| ingress.tls.self.ipAddresses | list | `[]` | ipAddresses is an optional list of IP addresses to add in the Subject Alternative Names (SAN) section | +| ingress.tls.self.validityDuration | int | `365` | validityDuration defines how long the certificate is valid (in days) | ## ServiceMonitor diff --git a/charts/common/values.yaml b/charts/common/values.yaml index 4a7e1aa..a5b378d 100644 --- a/charts/common/values.yaml +++ b/charts/common/values.yaml @@ -84,6 +84,7 @@ ingress: validityDuration: 365 existing: + # -- name of an existing secret with tls.crt & tls.key content - host: myapp.cluster.local secret: "" From 2a72a08a9bffd27778bf4226f5c7661d4acb1a2c Mon Sep 17 00:00:00 2001 From: MichaelBjeski Date: Thu, 15 Jun 2023 10:19:33 +0200 Subject: [PATCH 5/6] fix: updating helm template Signed-off-by: MichaelBjeski --- charts/common/README.md | 11 +++++-- charts/common/templates/_ingress-ingress.yaml | 31 +++++++++++++------ charts/common/values.yaml | 30 ++++++++++++------ 3 files changed, 51 insertions(+), 21 deletions(-) diff --git a/charts/common/README.md b/charts/common/README.md index 1b82ecc..2bfc97a 100644 --- a/charts/common/README.md +++ b/charts/common/README.md @@ -33,7 +33,7 @@ Major Changes to functions are documented with the version affected. **Before up | ingress.annotations | object | `{"nginx.ingress.kubernetes.io/ssl-redirect":"true"}` | annotations is a dictionary for defining ingress controller specific annotations | | ingress.deploy | bool | `false` | deploy has to be set to true for rendering to be applied | | ingress.ingressClassName | string | `""` | ingressClassName, defines the class of the ingress controller. | -| ingress.rules[0] | object | `{"host":"myapp.cluster.local","http":{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}}` | host is the URL which ingress is listening | +| ingress.rules[0] | object | `{"host":"myapp.cluster.local_1","http":{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}}` | host is the URL which ingress is listening | | ingress.rules[0].http | object | `{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}` | http is a list of http selectors pointing to backends | | ingress.rules[0].http.paths | list | `[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]` | paths is a list of paths that map requests to backends | | ingress.rules[0].http.paths[0] | object | `{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}` | backend defines the referenced service endpoint to which the traffic will be forwarded to | @@ -41,7 +41,14 @@ Major Changes to functions are documented with the version affected. **Before up | ingress.rules[0].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) | | ingress.rules[0].http.paths[0].path | string | `"/"` | path which ingress is listening | | ingress.rules[0].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") | -| ingress.tls.existing[0] | object | `{"host":"myapp.cluster.local","secret":""}` | name of an existing secret with tls.crt & tls.key content | +| ingress.rules[1].http | object | `{"paths":[{"backend":{"serviceNameSuffix":"component-2","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}` | http is a list of http selectors pointing to backends | +| ingress.rules[1].http.paths | list | `[{"backend":{"serviceNameSuffix":"component-2","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]` | paths is a list of paths that map requests to backends | +| ingress.rules[1].http.paths[0] | object | `{"backend":{"serviceNameSuffix":"component-2","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}` | backend defines the referenced service endpoint to which the traffic will be forwarded to | +| ingress.rules[1].http.paths[0].backend.serviceNameSuffix | string | `"component-2"` | serviceNameSuffix describes the suffix of the serviceName | +| ingress.rules[1].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) | +| ingress.rules[1].http.paths[0].path | string | `"/"` | path which ingress is listening | +| ingress.rules[1].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") | +| ingress.tls.existing[0] | object | `{"host":"exmaple_host","secret":"exapmle-certificate-tls"}` | name of an existing secret for a specific host, with tls.crt & tls.key content | | ingress.tls.provided.cert | string | `""` | If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key Has to be base64 encoded and should be encrypted in the ejson vault Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails. | | ingress.tls.provided.key | string | `""` | The key must not have a passphrase | | ingress.tls.self | object | `{"alternativeDnsNames":[],"commonName":"*.cluster.local","ipAddresses":[],"validityDuration":365}` | depending on the type you have further configuration options: | diff --git a/charts/common/templates/_ingress-ingress.yaml b/charts/common/templates/_ingress-ingress.yaml index 0928418..083129e 100644 --- a/charts/common/templates/_ingress-ingress.yaml +++ b/charts/common/templates/_ingress-ingress.yaml @@ -37,22 +37,33 @@ spec: {{- end }} {{- if $ingress.tls }} {{- if and (ne $ingress.tls.type "none") (ne $ingress.tls.type "") }} + tls: - hosts: - {{- range $ingress.rules }} - - {{ .host }} - {{- end }} - {{- if or (eq $ingress.tls.type "self") (eq $ingress.tls.type "provided") }} + {{- range $outer :=$ingress.rules }} + {{- $exists := false }} + {{- range $element2 := $ingress.tls.existing }} + {{- if eq $outer.host $element2.host }} + {{- $exists = true }} + {{- end }} + {{- end }} + {{- if not $exists }} + - {{ .host }} + {{- end }} + {{- end }} secretName: {{ template "library.name" . }}-ingress-tls - {{- else if eq $ingress.tls.type "existing" }} - {{- range $ingress.tls.existing }} - {{- if has $.host .host }} - secretName: {{ $.host.secret }} - {{- end }} - {{- end }} + {{- if or (eq $ingress.tls.type "existing")}} + {{- range $outer := $ingress.tls.existing }} + - hosts: + - {{ $outer.host }} + {{- if eq $ingress.tls.type "existing" }} + secretName: {{ $outer.secret }} + {{- end }} {{- end }} + {{- end }} + {{- end }} {{- end }} {{- end }} diff --git a/charts/common/values.yaml b/charts/common/values.yaml index a5b378d..8778c34 100644 --- a/charts/common/values.yaml +++ b/charts/common/values.yaml @@ -39,7 +39,7 @@ ingress: # rules is a list of host rules used to configure the Ingress rules: # -- host is the URL which ingress is listening - - host: myapp.cluster.local + - host: myapp.cluster.local_1 # -- http is a list of http selectors pointing to backends http: # -- paths is a list of paths that map requests to backends @@ -54,6 +54,21 @@ ingress: path: "/" # -- pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") pathType: "ImplementationSpecific" + - host: myapp.cluster.local_2 + # -- http is a list of http selectors pointing to backends + http: + # -- paths is a list of paths that map requests to backends + paths: + # -- backend defines the referenced service endpoint to which the traffic will be forwarded to + - backend: + # -- serviceNameSuffix describes the suffix of the serviceName + serviceNameSuffix: component-2 + # -- servicePort describes the port where the service is listening at (can be either a string or a number) + servicePort: http + # -- path which ingress is listening + path: "/" + # -- pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") + pathType: "ImplementationSpecific" # -- annotations is a dictionary for defining ingress controller specific annotations annotations: @@ -69,7 +84,7 @@ ingress: # provided: use an officially generated certificate/key # k8s: use the default k8s-ingress tls. no further configuration needed # self: generate a self signed certificate, which is stored as secret. Needs commonName and validityDuration at least - type: "none" + type: "k8s" # -- depending on the type you have further configuration options: self: # -- commonName of the certificate (mandatory) @@ -82,12 +97,10 @@ ingress: # - "foo.com" # -- validityDuration defines how long the certificate is valid (in days) validityDuration: 365 - existing: - # -- name of an existing secret with tls.crt & tls.key content - - host: myapp.cluster.local - secret: "" - + # -- name of an existing secret for a specific host, with tls.crt & tls.key content + - host: "exmaple_host" + secret: "exapmle-certificate-tls" provided: # -- If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key # Has to be base64 encoded and should be encrypted in the ejson vault @@ -123,8 +136,7 @@ servicemonitor: # endpoints is a dictionary of one or more endpoints to configure endpoints: {} # komponente is a sample endpoint - # komponente: - # componentSelector is used for selecting specific pods +tls: # componentSelector is used for selecting specific pods # componentSelector: # key is the name of the label # key: app.kubernetes.io/component From 7c480092c1fce979bfeb43c41a50029f522a4d05 Mon Sep 17 00:00:00 2001 From: MichaelBjeski Date: Wed, 21 Jun 2023 04:44:46 +0200 Subject: [PATCH 6/6] feat: having multiple hosts for a certificate Signed-off-by: MichaelBjeski --- charts/common/README.md | 10 +++++----- charts/common/templates/_ingress-ingress.yaml | 17 ++++------------- charts/common/values.schema.json | 13 +++++++++---- charts/common/values.yaml | 9 ++++++--- 4 files changed, 24 insertions(+), 25 deletions(-) diff --git a/charts/common/README.md b/charts/common/README.md index 2bfc97a..a3244e0 100644 --- a/charts/common/README.md +++ b/charts/common/README.md @@ -41,14 +41,14 @@ Major Changes to functions are documented with the version affected. **Before up | ingress.rules[0].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) | | ingress.rules[0].http.paths[0].path | string | `"/"` | path which ingress is listening | | ingress.rules[0].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") | -| ingress.rules[1].http | object | `{"paths":[{"backend":{"serviceNameSuffix":"component-2","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}` | http is a list of http selectors pointing to backends | -| ingress.rules[1].http.paths | list | `[{"backend":{"serviceNameSuffix":"component-2","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]` | paths is a list of paths that map requests to backends | -| ingress.rules[1].http.paths[0] | object | `{"backend":{"serviceNameSuffix":"component-2","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}` | backend defines the referenced service endpoint to which the traffic will be forwarded to | -| ingress.rules[1].http.paths[0].backend.serviceNameSuffix | string | `"component-2"` | serviceNameSuffix describes the suffix of the serviceName | +| ingress.rules[1].http | object | `{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}` | http is a list of http selectors pointing to backends | +| ingress.rules[1].http.paths | list | `[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]` | paths is a list of paths that map requests to backends | +| ingress.rules[1].http.paths[0] | object | `{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}` | backend defines the referenced service endpoint to which the traffic will be forwarded to | +| ingress.rules[1].http.paths[0].backend.serviceNameSuffix | string | `"component-1"` | serviceNameSuffix describes the suffix of the serviceName | | ingress.rules[1].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) | | ingress.rules[1].http.paths[0].path | string | `"/"` | path which ingress is listening | | ingress.rules[1].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") | -| ingress.tls.existing[0] | object | `{"host":"exmaple_host","secret":"exapmle-certificate-tls"}` | name of an existing secret for a specific host, with tls.crt & tls.key content | +| ingress.tls.existing[0] | object | `{"host":["myapp.cluster.local_tls_1","myapp.cluster.local_tls_2"],"secret":"exapmle-certificate-tls"}` | name of an existing secret for a specific host, with tls.crt & tls.key content | | ingress.tls.provided.cert | string | `""` | If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key Has to be base64 encoded and should be encrypted in the ejson vault Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails. | | ingress.tls.provided.key | string | `""` | The key must not have a passphrase | | ingress.tls.self | object | `{"alternativeDnsNames":[],"commonName":"*.cluster.local","ipAddresses":[],"validityDuration":365}` | depending on the type you have further configuration options: | diff --git a/charts/common/templates/_ingress-ingress.yaml b/charts/common/templates/_ingress-ingress.yaml index 083129e..d8c137f 100644 --- a/charts/common/templates/_ingress-ingress.yaml +++ b/charts/common/templates/_ingress-ingress.yaml @@ -41,26 +41,17 @@ spec: tls: - hosts: {{- range $outer :=$ingress.rules }} - {{- $exists := false }} - {{- range $element2 := $ingress.tls.existing }} - {{- if eq $outer.host $element2.host }} - {{- $exists = true }} - {{- end }} - {{- end }} - {{- if not $exists }} - {{ .host }} {{- end }} - {{- end }} secretName: {{ template "library.name" . }}-ingress-tls - {{- if or (eq $ingress.tls.type "existing")}} + {{- if eq $ingress.tls.type "existing"}} {{- range $outer := $ingress.tls.existing }} - hosts: - - {{ $outer.host }} - - {{- if eq $ingress.tls.type "existing" }} + {{- range $outer_2 := $outer.host }} + - {{ . }} + {{- end }} secretName: {{ $outer.secret }} - {{- end }} {{- end }} {{- end }} diff --git a/charts/common/values.schema.json b/charts/common/values.schema.json index b424eaf..27991bc 100644 --- a/charts/common/values.schema.json +++ b/charts/common/values.schema.json @@ -512,6 +512,8 @@ "type": "string", "default": "none" }, + + "existing": { "type": "array", "items": { @@ -521,10 +523,10 @@ ], "properties": { "host": { - "type": "string", - "examples": [ - "myapp.cluster.local" - ] + "type": "array", + "items": { + "type": "string" + } }, "secret": { "type": "string" @@ -532,6 +534,9 @@ } } }, + + + "provided": { "type": "object", "required": [ diff --git a/charts/common/values.yaml b/charts/common/values.yaml index 8778c34..0cf0db0 100644 --- a/charts/common/values.yaml +++ b/charts/common/values.yaml @@ -62,7 +62,7 @@ ingress: # -- backend defines the referenced service endpoint to which the traffic will be forwarded to - backend: # -- serviceNameSuffix describes the suffix of the serviceName - serviceNameSuffix: component-2 + serviceNameSuffix: component-1 # -- servicePort describes the port where the service is listening at (can be either a string or a number) servicePort: http # -- path which ingress is listening @@ -84,7 +84,7 @@ ingress: # provided: use an officially generated certificate/key # k8s: use the default k8s-ingress tls. no further configuration needed # self: generate a self signed certificate, which is stored as secret. Needs commonName and validityDuration at least - type: "k8s" + type: "none" # -- depending on the type you have further configuration options: self: # -- commonName of the certificate (mandatory) @@ -99,8 +99,11 @@ ingress: validityDuration: 365 existing: # -- name of an existing secret for a specific host, with tls.crt & tls.key content - - host: "exmaple_host" + - host: + - "myapp.cluster.local_tls_1" + - "myapp.cluster.local_tls_2" secret: "exapmle-certificate-tls" + provided: # -- If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key # Has to be base64 encoded and should be encrypted in the ejson vault