mirrors/kube-arangodb
1
0
Fork 0
mirror of https://github.com/arangodb/kube-arangodb.git synced 2024-12-14 11:57:37 +00:00
Code Activity

[Feature] CertManager Integration (#1778)

Browse source
This commit is contained in:
Adam Janikowski 2024-12-09 14:04:26 +01:00 committed by GitHub
parent 6f713a85e9
commit c7cce48584
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
27 changed files with 396 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
CHANGELOG.md
View file

@ -31,6 +31,7 @@
- (Feature) (Networking) Pass through Server Header
- (Feature) (Platform) Shutdown migration to CE
- (Feature) (Scheduler) Shutdown Integration
- (Feature) CertManager Integration
## [1.2.43](https://github.com/arangodb/kube-arangodb/tree/1.2.43) (2024-10-14)
- (Feature) ArangoRoute CRD

22
chart/kube-arangodb-arm64/templates/certificates/ca.yaml Normal file
View file

@ -0,0 +1,22 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ template "kube-arangodb.operatorName" . }}-ca
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
secretName: {{ template "kube-arangodb.operatorName" . }}-ca
duration: {{ .Values.certificate.ca.duration }}
issuerRef:
name: {{ template "kube-arangodb.operatorName" . }}-ca
commonName: {{ .Values.certificate.ca.commonName }}
isCA: true
{{- end }}

24
chart/kube-arangodb-arm64/templates/certificates/certificate.yaml Normal file
View file

@ -0,0 +1,24 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ template "kube-arangodb.operatorName" . }}
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
secretName: {{ template "kube-arangodb.operatorName" . }}-cert
duration: {{ .Values.certificate.cert.duration }}
issuerRef:
name: {{ template "kube-arangodb.operatorName" . }}
dnsNames:
- {{ template "kube-arangodb.operatorName" . }}
- {{ template "kube-arangodb.operatorName" . }}.{{ .Release.Namespace }}
- {{ template "kube-arangodb.operatorName" . }}.{{ .Release.Namespace }}.svc
{{- end }}

17
chart/kube-arangodb-arm64/templates/certificates/issuer.ca.yaml Normal file
View file

@ -0,0 +1,17 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ template "kube-arangodb.operatorName" . }}-ca
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
selfSigned: {}
{{- end }}

18
chart/kube-arangodb-arm64/templates/certificates/issuer.yaml Normal file
View file

@ -0,0 +1,18 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ template "kube-arangodb.operatorName" . }}
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
ca:
secretName: {{ template "kube-arangodb.operatorName" . }}-ca
{{- end }}

4
chart/kube-arangodb-arm64/templates/deployment.yaml
View file

@ -93,6 +93,10 @@ spec:
image: {{ .Values.operator.image }}
args:
- --scope={{ .Values.operator.scope }}
{{- if .Values.certificate.enabled }}
- --server.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert
- --api.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert
{{- end -}}
{{- if .Values.operator.features.deployment }}
- --operator.deployment
{{- end -}}

7
chart/kube-arangodb-arm64/values.yaml
View file

@ -44,3 +44,10 @@ rbac:
acs: true
at: true
debug: false
certificate:
enabled: false
ca:
duration: 43800h
commonName: "kube-arangodb.operator.cert"
cert:
duration: 8760h

22
chart/kube-arangodb-enterprise-arm64/templates/certificates/ca.yaml Normal file
View file

@ -0,0 +1,22 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ template "kube-arangodb.operatorName" . }}-ca
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
secretName: {{ template "kube-arangodb.operatorName" . }}-ca
duration: {{ .Values.certificate.ca.duration }}
issuerRef:
name: {{ template "kube-arangodb.operatorName" . }}-ca
commonName: {{ .Values.certificate.ca.commonName }}
isCA: true
{{- end }}

24
chart/kube-arangodb-enterprise-arm64/templates/certificates/certificate.yaml Normal file
View file

@ -0,0 +1,24 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ template "kube-arangodb.operatorName" . }}
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
secretName: {{ template "kube-arangodb.operatorName" . }}-cert
duration: {{ .Values.certificate.cert.duration }}
issuerRef:
name: {{ template "kube-arangodb.operatorName" . }}
dnsNames:
- {{ template "kube-arangodb.operatorName" . }}
- {{ template "kube-arangodb.operatorName" . }}.{{ .Release.Namespace }}
- {{ template "kube-arangodb.operatorName" . }}.{{ .Release.Namespace }}.svc
{{- end }}

17
chart/kube-arangodb-enterprise-arm64/templates/certificates/issuer.ca.yaml Normal file
View file

@ -0,0 +1,17 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ template "kube-arangodb.operatorName" . }}-ca
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
selfSigned: {}
{{- end }}

18
chart/kube-arangodb-enterprise-arm64/templates/certificates/issuer.yaml Normal file
View file

@ -0,0 +1,18 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ template "kube-arangodb.operatorName" . }}
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
ca:
secretName: {{ template "kube-arangodb.operatorName" . }}-ca
{{- end }}

4
chart/kube-arangodb-enterprise-arm64/templates/deployment.yaml
View file

@ -93,6 +93,10 @@ spec:
image: {{ .Values.operator.image }}
args:
- --scope={{ .Values.operator.scope }}
{{- if .Values.certificate.enabled }}
- --server.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert
- --api.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert
{{- end -}}
{{- if .Values.operator.features.deployment }}
- --operator.deployment
{{- end -}}

7
chart/kube-arangodb-enterprise-arm64/values.yaml
View file

@ -44,3 +44,10 @@ rbac:
acs: true
at: true
debug: false
certificate:
enabled: false
ca:
duration: 43800h
commonName: "kube-arangodb.operator.cert"
cert:
duration: 8760h

22
chart/kube-arangodb-enterprise/templates/certificates/ca.yaml Normal file
View file

@ -0,0 +1,22 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ template "kube-arangodb.operatorName" . }}-ca
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
secretName: {{ template "kube-arangodb.operatorName" . }}-ca
duration: {{ .Values.certificate.ca.duration }}
issuerRef:
name: {{ template "kube-arangodb.operatorName" . }}-ca
commonName: {{ .Values.certificate.ca.commonName }}
isCA: true
{{- end }}

24
chart/kube-arangodb-enterprise/templates/certificates/certificate.yaml Normal file
View file

@ -0,0 +1,24 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ template "kube-arangodb.operatorName" . }}
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
secretName: {{ template "kube-arangodb.operatorName" . }}-cert
duration: {{ .Values.certificate.cert.duration }}
issuerRef:
name: {{ template "kube-arangodb.operatorName" . }}
dnsNames:
- {{ template "kube-arangodb.operatorName" . }}
- {{ template "kube-arangodb.operatorName" . }}.{{ .Release.Namespace }}
- {{ template "kube-arangodb.operatorName" . }}.{{ .Release.Namespace }}.svc
{{- end }}

17
chart/kube-arangodb-enterprise/templates/certificates/issuer.ca.yaml Normal file
View file

@ -0,0 +1,17 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ template "kube-arangodb.operatorName" . }}-ca
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
selfSigned: {}
{{- end }}

18
chart/kube-arangodb-enterprise/templates/certificates/issuer.yaml Normal file
View file

@ -0,0 +1,18 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ template "kube-arangodb.operatorName" . }}
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
ca:
secretName: {{ template "kube-arangodb.operatorName" . }}-ca
{{- end }}

4
chart/kube-arangodb-enterprise/templates/deployment.yaml
View file

@ -93,6 +93,10 @@ spec:
image: {{ .Values.operator.image }}
args:
- --scope={{ .Values.operator.scope }}
{{- if .Values.certificate.enabled }}
- --server.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert
- --api.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert
{{- end -}}
{{- if .Values.operator.features.deployment }}
- --operator.deployment
{{- end -}}

7
chart/kube-arangodb-enterprise/values.yaml
View file

@ -44,3 +44,10 @@ rbac:
acs: true
at: true
debug: false
certificate:
enabled: false
ca:
duration: 43800h
commonName: "kube-arangodb.operator.cert"
cert:
duration: 8760h

22
chart/kube-arangodb/templates/certificates/ca.yaml Normal file
View file

@ -0,0 +1,22 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ template "kube-arangodb.operatorName" . }}-ca
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
secretName: {{ template "kube-arangodb.operatorName" . }}-ca
duration: {{ .Values.certificate.ca.duration }}
issuerRef:
name: {{ template "kube-arangodb.operatorName" . }}-ca
commonName: {{ .Values.certificate.ca.commonName }}
isCA: true
{{- end }}

24
chart/kube-arangodb/templates/certificates/certificate.yaml Normal file
View file

@ -0,0 +1,24 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: {{ template "kube-arangodb.operatorName" . }}
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
secretName: {{ template "kube-arangodb.operatorName" . }}-cert
duration: {{ .Values.certificate.cert.duration }}
issuerRef:
name: {{ template "kube-arangodb.operatorName" . }}
dnsNames:
- {{ template "kube-arangodb.operatorName" . }}
- {{ template "kube-arangodb.operatorName" . }}.{{ .Release.Namespace }}
- {{ template "kube-arangodb.operatorName" . }}.{{ .Release.Namespace }}.svc
{{- end }}

17
chart/kube-arangodb/templates/certificates/issuer.ca.yaml Normal file
View file

@ -0,0 +1,17 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ template "kube-arangodb.operatorName" . }}-ca
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
selfSigned: {}
{{- end }}

18
chart/kube-arangodb/templates/certificates/issuer.yaml Normal file
View file

@ -0,0 +1,18 @@
{{ if .Values.certificate.enabled -}}
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: {{ template "kube-arangodb.operatorName" . }}
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ template "kube-arangodb.name" . }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
app.kubernetes.io/instance: {{ .Release.Name }}
release: {{ .Release.Name }}
spec:
ca:
secretName: {{ template "kube-arangodb.operatorName" . }}-ca
{{- end }}

4
chart/kube-arangodb/templates/deployment.yaml
View file

@ -93,6 +93,10 @@ spec:
image: {{ .Values.operator.image }}
args:
- --scope={{ .Values.operator.scope }}
{{- if .Values.certificate.enabled }}
- --server.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert
- --api.tls-secret-name={{ template "kube-arangodb.operatorName" . }}-cert
{{- end -}}
{{- if .Values.operator.features.deployment }}
- --operator.deployment
{{- end -}}

7
chart/kube-arangodb/values.yaml
View file

@ -45,3 +45,10 @@ rbac:
acs: true
at: true
debug: false
certificate:
enabled: false
ca:
duration: 43800h
commonName: "kube-arangodb.operator.cert"
cert:
duration: 8760h

25
docs/helm.md
View file

@ -130,6 +130,31 @@ Define if RBAC should be enabled.
Default: `true`
### `certificate.enabled`
Define if Cert via CertManager should be enabled.
Default: `false`
### `certificate.ca.duration`
CA Duration.
Default: `43800h`
### `certificate.ca.commonName`
CA CommonName.
Default: `kube-arangodb.operator.cert`
### `certificate.cert.duration`
Cert Duration.
Default: `8760h`
## Alternate namespaces
The `kube-arangodb` chart supports deployment into a non-default namespace.

4
pkg/server/server.go
View file

@ -110,7 +110,7 @@ func NewServer(cli typedCore.CoreV1Interface, cfg Config, deps Dependencies) (*S
var cert, key string
if cfg.TLSSecretName != "" && cfg.TLSSecretNamespace != "" {
// Load TLS certificate from secret
serverLogger.Str("addr", cfg.Address).Str("secret", cfg.TLSSecretName).Str("secret-namespace", cfg.TLSSecretNamespace).Info("Using existing TLS Certificate")
s, err := cli.Secrets(cfg.TLSSecretNamespace).Get(context.Background(), cfg.TLSSecretName, meta.GetOptions{})
if err != nil {
return nil, errors.WithStack(err)
@ -126,7 +126,7 @@ func NewServer(cli typedCore.CoreV1Interface, cfg Config, deps Dependencies) (*S
cert = string(certBytes)
key = string(keyBytes)
} else {
// Secret not specified, create our own TLS certificate
serverLogger.Str("addr", cfg.Address).Info("Using SelfSigned TLS Certificate")
options := certificates.CreateCertificateOptions{
CommonName: cfg.PodName,
Hosts: []string{cfg.PodName, cfg.PodIP},