[common]: use multiple existing tls certificates

charts/common/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: common
 description: "Bedag's common Helm chart to use for creating other Helm charts"
-version: 10.2.0
+version: 10.3.0
 # A chart can be either an 'application' or a 'library' chart.
 #
 # Application charts are a collection of templates that can be packaged into versioned archives

charts/common/README.md

@@ -1,6 +1,6 @@
 # common
 
-![Version: 10.2.0](https://img.shields.io/badge/Version-10.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
+![Version: 10.3.0](https://img.shields.io/badge/Version-10.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 Bedag's common Helm chart to use for creating other Helm charts
 
@@ -33,15 +33,22 @@ Major Changes to functions are documented with the version affected. **Before up
 | ingress.annotations | object | `{"nginx.ingress.kubernetes.io/ssl-redirect":"true"}` | annotations is a dictionary for defining ingress controller specific annotations |
 | ingress.deploy | bool | `false` | deploy has to be set to true for rendering to be applied |
 | ingress.ingressClassName | string | `""` | ingressClassName, defines the class of the ingress controller. |
-| ingress.rules[0] | object | `{"host":"myapp.cluster.local","http":{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}}` | host is the URL which ingress is listening |
+| ingress.rules[0] | object | `{"host":"myapp.cluster.local_1","http":{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}}` | host is the URL which ingress is listening |
 | ingress.rules[0].http | object | `{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}` | http is a list of http selectors pointing to backends |
 | ingress.rules[0].http.paths | list | `[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]` | paths is a list of paths that map requests to backends |
 | ingress.rules[0].http.paths[0] | object | `{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}` | backend defines the referenced service endpoint to which the traffic will be forwarded to |
 | ingress.rules[0].http.paths[0].backend.serviceNameSuffix | string | `"component-1"` | serviceNameSuffix describes the suffix of the serviceName |
 | ingress.rules[0].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) |
 | ingress.rules[0].http.paths[0].path | string | `"/"` | path which ingress is listening |
 | ingress.rules[0].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") |
-| ingress.tls.existing.secret | string | `""` | name of an existing secret with tls.crt & tls.key content |
+| ingress.rules[1].http | object | `{"paths":[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]}` | http is a list of http selectors pointing to backends |
+| ingress.rules[1].http.paths | list | `[{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}]` | paths is a list of paths that map requests to backends |
+| ingress.rules[1].http.paths[0] | object | `{"backend":{"serviceNameSuffix":"component-1","servicePort":"http"},"path":"/","pathType":"ImplementationSpecific"}` | backend defines the referenced service endpoint to which the traffic will be forwarded to |
+| ingress.rules[1].http.paths[0].backend.serviceNameSuffix | string | `"component-1"` | serviceNameSuffix describes the suffix of the serviceName |
+| ingress.rules[1].http.paths[0].backend.servicePort | string | `"http"` | servicePort describes the port where the service is listening at (can be either a string or a number) |
+| ingress.rules[1].http.paths[0].path | string | `"/"` | path which ingress is listening |
+| ingress.rules[1].http.paths[0].pathType | string | `"ImplementationSpecific"` | pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific") |
+| ingress.tls.existing[0] | object | `{"host":["myapp.cluster.local_tls_1","myapp.cluster.local_tls_2"],"secret":"exapmle-certificate-tls"}` | name of an existing secret for a specific host, with tls.crt & tls.key content |
 | ingress.tls.provided.cert | string | `""` | If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key Has to be base64 encoded and should be encrypted in the ejson vault Add Variable to your CI/CD Settings "SKIP_DECRYPT" with value "" that it doesnt decrypt the cert and fails. |
 | ingress.tls.provided.key | string | `""` | The key must not have a passphrase |
 | ingress.tls.self | object | `{"alternativeDnsNames":[],"commonName":"*.cluster.local","ipAddresses":[],"validityDuration":365}` | depending on the type you have further configuration options: |

charts/common/templates/_ingress-ingress.yaml

@@ -37,16 +37,24 @@ spec:
     {{- end }}
   {{- if $ingress.tls }}
   {{- if and (ne $ingress.tls.type "none") (ne $ingress.tls.type "") }}
+
   tls:
     - hosts:
-      {{- range $ingress.rules }}
-        - {{ .host }}
-      {{- end }}
-      {{- if or (eq $ingress.tls.type "self") (eq $ingress.tls.type "provided") }}
+      {{- range $outer :=$ingress.rules }}
+      - {{ .host }}
+        {{- end }}
       secretName: {{ template "library.name" . }}-ingress-tls
-      {{- else if eq $ingress.tls.type "existing" }}
-      secretName: {{ $ingress.tls.existing.secret }}
+
+    {{- if eq $ingress.tls.type "existing"}}
+    {{- range $outer := $ingress.tls.existing }}
+    - hosts:
+      {{- range $outer_2 := $outer.host }}
+      - {{ . }}
       {{- end }}
+      secretName: {{ $outer.secret }}
+      {{- end }}
+    {{- end }}
+
   {{- end }}
   {{- end }}
 {{- end }}

charts/common/values.schema.json

@@ -82,7 +82,10 @@
           }
         },
         "env": {
-          "type": ["array", "object"]
+          "type": [
+            "array",
+            "object"
+          ]
         },
         "envSecret": {
           "type": "object"
@@ -509,17 +512,31 @@
               "type": "string",
               "default": "none"
             },
+
+
             "existing": {
-              "type": "object",
-              "required": [
-                "secret"
-              ],
-              "properties": {
-                "secret": {
-                  "type": "string"
+              "type": "array",
+              "items": {
+                "type": "object",
+                "required": [
+                  "host"
+                ],
+                "properties": {
+                  "host": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "secret": {
+                    "type": "string"
+                  }
                 }
               }
             },
+
+
+
             "provided": {
               "type": "object",
               "required": [
@@ -703,7 +720,10 @@
                       "type": "array",
                       "items": {
                         "type": "string",
-                        "enum": ["Ingress", "Egress"]
+                        "enum": [
+                          "Ingress",
+                          "Egress"
+                        ]
                       }
                     },
                     "ingress": {

charts/common/values.yaml

@@ -39,7 +39,22 @@ ingress:
   # rules is a list of host rules used to configure the Ingress
   rules:
     # -- host is the URL which ingress is listening
-    - host: myapp.cluster.local
+    - host: myapp.cluster.local_1
+      # -- http is a list of http selectors pointing to backends
+      http:
+        # -- paths is a list of paths that map requests to backends
+        paths:
+          # -- backend defines the referenced service endpoint to which the traffic will be forwarded to
+          - backend:
+              # -- serviceNameSuffix describes the suffix of the serviceName
+              serviceNameSuffix: component-1
+              # -- servicePort describes the port where the service is listening at (can be either a string or a number)
+              servicePort: http
+            # -- path which ingress is listening
+            path: "/"
+            # -- pathType Each path in an Ingress is required to have a corresponding path type. Comment out for using default ("ImplementationSpecific")
+            pathType: "ImplementationSpecific"
+    - host: myapp.cluster.local_2
       # -- http is a list of http selectors pointing to backends
       http:
         # -- paths is a list of paths that map requests to backends
@@ -83,8 +98,12 @@ ingress:
       # -- validityDuration defines how long the certificate is valid (in days)
       validityDuration: 365
     existing:
-      # -- name of an existing secret with tls.crt & tls.key content
-      secret: ""
+      # -- name of an existing secret for a specific host, with tls.crt & tls.key content
+      - host:
+        - "myapp.cluster.local_tls_1"
+        - "myapp.cluster.local_tls_2"
+        secret: "exapmle-certificate-tls"
+
     provided:
       # -- If SSL is terminated on ingress and you have a generated (preferrably CERT-001) certificate/key
       # Has to be base64 encoded and should be encrypted in the ejson vault
@@ -120,8 +139,7 @@ servicemonitor:
   # endpoints is a dictionary of one or more endpoints to configure
   endpoints: {}
     # komponente is a sample endpoint
-    # komponente:
-      # componentSelector is used for selecting specific pods
+tls:      # componentSelector is used for selecting specific pods
       # componentSelector:
         # key is the name of the label
         # key: app.kubernetes.io/component