7cb3ef69ae
This patch set: - allows options in the bootstrap job to load the proper TLS secret into the proper envvar so the openstack client can connect properly to perform bootstrap; - adds in certificates to make rally work properly with TLS endpoints; - adds methods to handle TLS secret volume and volumeMount; - updates ingress to handle secure backends. Change-Id: I322cda393f18bfeed0b9f8b1827d101f60d6bdeb Signed-off-by: Tin Lam <tin@irrational.io>
105 lines
4.2 KiB
Smarty
105 lines
4.2 KiB
Smarty
{{/*
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/}}
|
|
|
|
{{/*
|
|
abstract: |
|
|
Creates a certificate using jetstack
|
|
examples:
|
|
- values: |
|
|
endpoints:
|
|
dashboard:
|
|
host_fqdn_override:
|
|
default:
|
|
host: null
|
|
tls:
|
|
secretName: keystone-tls-api
|
|
issuerRef:
|
|
name: ca-issuer
|
|
duration: 2160h
|
|
organization:
|
|
- ACME
|
|
commonName: keystone-api.openstack.svc.cluster.local
|
|
keySize: 2048
|
|
usages:
|
|
- server auth
|
|
- client auth
|
|
dnsNames:
|
|
- cluster.local
|
|
issuerRef:
|
|
name: ca-issuer
|
|
usage: |
|
|
{{- $opts := dict "envAll" . "service" "dashboard" "type" "internal" -}}
|
|
{{ $opts | include "helm-toolkit.manifests.certificates" }}
|
|
return: |
|
|
---
|
|
apiVersion: cert-manager.io/v1alpha3
|
|
kind: Certificate
|
|
metadata:
|
|
name: keystone-tls-api
|
|
namespace: NAMESPACE
|
|
spec:
|
|
commonName: keystone-api.openstack.svc.cluster.local
|
|
dnsNames:
|
|
- cluster.local
|
|
duration: 2160h
|
|
issuerRef:
|
|
name: ca-issuer
|
|
keySize: 2048
|
|
organization:
|
|
- ACME
|
|
secretName: keystone-tls-api
|
|
usages:
|
|
- server auth
|
|
- client auth
|
|
*/}}
|
|
|
|
{{- define "helm-toolkit.manifests.certificates" -}}
|
|
{{- $envAll := index . "envAll" -}}
|
|
{{- $service := index . "service" -}}
|
|
{{- $type := index . "type" | default "" -}}
|
|
{{- $slice := index $envAll.Values.endpoints $service "host_fqdn_override" "default" "tls" -}}
|
|
{{/* Put in some sensible default value if one is not provided by values.yaml */}}
|
|
{{/* If a dnsNames list is not in the values.yaml, it can be overridden by a passed-in parameter.
|
|
This allows user to use other HTK method to determine the URI and pass that into this method.*/}}
|
|
{{- if not (hasKey $slice "dnsNames") -}}
|
|
{{- $hostName := tuple $service $type $envAll | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" -}}
|
|
{{- $dnsNames := list $hostName (printf "%s.%s" $hostName $envAll.Release.Namespace) (printf "%s.%s.svc.%s" $hostName $envAll.Release.Namespace $envAll.Values.endpoints.cluster_domain_suffix) -}}
|
|
{{- $_ := $dnsNames | set (index $envAll.Values.endpoints $service "host_fqdn_override" "default" "tls") "dnsNames" -}}
|
|
{{- end -}}
|
|
{{/* Default keySize to 4096. This can be overridden. */}}
|
|
{{- if not (hasKey $slice "keySize") -}}
|
|
{{- $_ := ( printf "%d" 4096 | atoi ) | set (index $envAll.Values.endpoints $service "host_fqdn_override" "default" "tls") "keySize" -}}
|
|
{{- end -}}
|
|
{{/* Default keySize to 3 months. Note the min is 720h. This can be overridden. */}}
|
|
{{- if not (hasKey $slice "duration") -}}
|
|
{{- $_ := printf "%s" "2190h" | set (index $envAll.Values.endpoints $service "host_fqdn_override" "default" "tls") "duration" -}}
|
|
{{- end -}}
|
|
{{/* Default renewBefore to 15 days. This can be overridden. */}}
|
|
{{- if not (hasKey $slice "renewBefore") -}}
|
|
{{- $_ := printf "%s" "360h" | set (index $envAll.Values.endpoints $service "host_fqdn_override" "default" "tls") "renewBefore" -}}
|
|
{{- end -}}
|
|
{{/* Default the usage to server auth and client auth. This can be overridden. */}}
|
|
{{- if not (hasKey $slice "usages") -}}
|
|
{{- $_ := (list "server auth" "client auth") | set (index $envAll.Values.endpoints $service "host_fqdn_override" "default" "tls") "usages" -}}
|
|
{{- end -}}
|
|
---
|
|
apiVersion: cert-manager.io/v1alpha3
|
|
kind: Certificate
|
|
metadata:
|
|
name: {{ index $envAll.Values.endpoints $service "host_fqdn_override" "default" "tls" "secretName" }}
|
|
namespace: {{ $envAll.Release.Namespace }}
|
|
spec:
|
|
{{ $slice | toYaml | indent 2 }}
|
|
{{- end -}}
|