From 5a8a8ae77a1f21a4f78ca432987a1686f52dbd75 Mon Sep 17 00:00:00 2001 From: Dario Tranchitella Date: Fri, 22 Jul 2022 10:46:53 +0200 Subject: [PATCH] feat(helm): support for cert-manager and externally managed tls secret --- charts/capsule/Makefile | 9 +++++ charts/capsule/README.md | 33 ++++++++++++++++++- charts/capsule/README.md.gotmpl | 28 ++++++++++++++++ charts/capsule/templates/_helpers.tpl | 2 +- charts/capsule/templates/certs.yaml | 2 ++ .../templates/configuration-default.yaml | 2 +- .../mutatingwebhookconfiguration.yaml | 5 ++- .../capsule/templates/post-install-job.yaml | 4 ++- charts/capsule/templates/pre-delete-job.yaml | 2 +- .../validatingwebhookconfiguration.yaml | 5 ++- charts/capsule/values.yaml | 9 +++++ 11 files changed, 94 insertions(+), 7 deletions(-) create mode 100644 charts/capsule/Makefile diff --git a/charts/capsule/Makefile b/charts/capsule/Makefile new file mode 100644 index 00000000..a191fe4c --- /dev/null +++ b/charts/capsule/Makefile @@ -0,0 +1,9 @@ +docs: HELMDOCS_VERSION := v1.8.1 +docs: docker + @docker run --rm -v "$$(pwd):/helm-docs" -u $$(id -u) jnorwood/helm-docs:$(HELMDOCS_VERSION) + +docker: + @hash docker 2>/dev/null || {\ + echo "You need docker" &&\ + exit 1;\ + } diff --git a/charts/capsule/README.md b/charts/capsule/README.md index 086d1841..c6a909ae 100644 --- a/charts/capsule/README.md +++ b/charts/capsule/README.md @@ -78,6 +78,9 @@ Here the values you can override: | serviceAccount.annotations | object | `{}` | Annotations to add to the service account. | | serviceAccount.create | bool | `true` | Specifies whether a service account should be created. | | serviceAccount.name | string | `"capsule"` | The name of the service account to use. If not set and `serviceAccount.create=true`, a name is generated using the fullname template | +| tls.create | bool | `true` | When cert-manager is disabled, Capsule will generate the TLS certificate for webhook and CRDs conversion. | +| tls.enableController | bool | `true` | Start the Capsule controller that injects the CA into mutating and validating webhooks, and CRD as well. | +| tls.name | string | `""` | Override name of the Capsule TLS Secret name when externally managed. | | tolerations | list | `[]` | Set list of tolerations for the Capsule pod | | validatingWebhooksTimeoutSeconds | int | `30` | Timeout in seconds for validating webhooks | @@ -85,7 +88,7 @@ Here the values you can override: | Key | Type | Default | Description | |-----|------|---------|-------------| -| manager.hostNetwork | bool | `false` | Specifies if the container should be started in hostNetwork mode. Required for use in some managed kubernetes clusters (such as AWS EKS) with custom CNI (such as calico), because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working | +| manager.hostNetwork | bool | `false` | Specifies if the container should be started in hostNetwork mode. Required for use in some managed kubernetes clusters (such as AWS EKS) with custom CNI (such as calico), because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working | | manager.image.pullPolicy | string | `"IfNotPresent"` | Set the image pull policy. | | manager.image.repository | string | `"clastix/capsule"` | Set the image repository of the capsule. | | manager.image.tag | string | `""` | Overrides the image tag whose default is the chart appVersion. | @@ -175,6 +178,34 @@ And optionally, depending on the values set: Capsule, as many other add-ons, defines its own set of Custom Resource Definitions (CRDs). Helm3 removed the old CRDs installation method for a more simple methodology. In the Helm Chart, there is now a special directory called `crds` to hold the CRDs. These CRDs are not templated, but will be installed by default when running a `helm install` for the chart. If the CRDs already exist (for example, you already executed `helm install`), it will be skipped with a warning. When you wish to skip the CRDs installation, and do not see the warning, you can pass the `--skip-crds` flag to the `helm install` command. +## Cert-Manager integration + +You can enable the generation of certificates using `cert-manager` as follows. + +``` +helm upgrade --install capsule clastix/capsule --namespace capsule-system --create-namespace \ + --set "certManager.generateCertificates=true" \ + --set "tls.create=false" \ + --set "tls.enableController=false" +``` + +With the usage of `tls.enableController=false` value, you're delegating the injection of the Validating and Mutating Webhooks' CA to `cert-manager`. +Since Helm3 doesn't allow to template _CRDs_, you have to patch manually the Custom Resource Definition `tenants.capsule.clastix.io` adding the proper annotation (YMMV). + +```yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + cert-manager.io/inject-ca-from: capsule-system/capsule-webhook-cert + creationTimestamp: "2022-07-22T08:32:51Z" + generation: 45 + name: tenants.capsule.clastix.io + resourceVersion: "9832" + uid: 61e287df-319b-476d-88d5-bdb8dc14d4a6 +``` + ## More See Capsule [tutorial](https://github.com/clastix/capsule/blob/master/docs/content/general/tutorial.md) for more information about how to use Capsule. diff --git a/charts/capsule/README.md.gotmpl b/charts/capsule/README.md.gotmpl index 0f6ff3e1..415a3f00 100644 --- a/charts/capsule/README.md.gotmpl +++ b/charts/capsule/README.md.gotmpl @@ -127,6 +127,34 @@ And optionally, depending on the values set: Capsule, as many other add-ons, defines its own set of Custom Resource Definitions (CRDs). Helm3 removed the old CRDs installation method for a more simple methodology. In the Helm Chart, there is now a special directory called `crds` to hold the CRDs. These CRDs are not templated, but will be installed by default when running a `helm install` for the chart. If the CRDs already exist (for example, you already executed `helm install`), it will be skipped with a warning. When you wish to skip the CRDs installation, and do not see the warning, you can pass the `--skip-crds` flag to the `helm install` command. +## Cert-Manager integration + +You can enable the generation of certificates using `cert-manager` as follows. + +``` +helm upgrade --install capsule clastix/capsule --namespace capsule-system --create-namespace \ + --set "certManager.generateCertificates=true" \ + --set "tls.create=false" \ + --set "tls.enableController=false" +``` + +With the usage of `tls.enableController=false` value, you're delegating the injection of the Validating and Mutating Webhooks' CA to `cert-manager`. +Since Helm3 doesn't allow to template _CRDs_, you have to patch manually the Custom Resource Definition `tenants.capsule.clastix.io` adding the proper annotation (YMMV). + +```yaml +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.5.0 + cert-manager.io/inject-ca-from: capsule-system/capsule-webhook-cert + creationTimestamp: "2022-07-22T08:32:51Z" + generation: 45 + name: tenants.capsule.clastix.io + resourceVersion: "9832" + uid: 61e287df-319b-476d-88d5-bdb8dc14d4a6 +``` + ## More See Capsule [tutorial](https://github.com/clastix/capsule/blob/master/docs/content/general/tutorial.md) for more information about how to use Capsule. diff --git a/charts/capsule/templates/_helpers.tpl b/charts/capsule/templates/_helpers.tpl index 7060e82f..80d8a2e6 100644 --- a/charts/capsule/templates/_helpers.tpl +++ b/charts/capsule/templates/_helpers.tpl @@ -123,5 +123,5 @@ Create the Capsule controller name to use Create the Capsule TLS Secret name to use */}} {{- define "capsule.secretTlsName" -}} -{{- printf "%s-tls" (include "capsule.fullname" .) -}} +{{ default ( printf "%s-tls" ( include "capsule.fullname" . ) ) .Values.tls.name }} {{- end }} diff --git a/charts/capsule/templates/certs.yaml b/charts/capsule/templates/certs.yaml index 97baa368..4488bbfd 100644 --- a/charts/capsule/templates/certs.yaml +++ b/charts/capsule/templates/certs.yaml @@ -1,3 +1,4 @@ +{{- if or (not .Values.certManager.generateCertificates) (.Values.tls.create) }} apiVersion: v1 kind: Secret metadata: @@ -8,3 +9,4 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} name: {{ include "capsule.secretTlsName" . }} +{{- end }} diff --git a/charts/capsule/templates/configuration-default.yaml b/charts/capsule/templates/configuration-default.yaml index 6f393951..3cb897a1 100644 --- a/charts/capsule/templates/configuration-default.yaml +++ b/charts/capsule/templates/configuration-default.yaml @@ -8,7 +8,7 @@ metadata: capsule.clastix.io/mutating-webhook-configuration-name: {{ include "capsule.fullname" . }}-mutating-webhook-configuration capsule.clastix.io/tls-secret-name: {{ include "capsule.secretTlsName" . }} capsule.clastix.io/validating-webhook-configuration-name: {{ include "capsule.fullname" . }}-validating-webhook-configuration - capsule.clastix.io/generate-certificates: "{{ .Values.manager.options.generateCertificates }}" + capsule.clastix.io/enable-tls-configuration: "{{ .Values.tls.enableController }}" {{- with .Values.customAnnotations }} {{- toYaml . | nindent 4 }} {{- end }} diff --git a/charts/capsule/templates/mutatingwebhookconfiguration.yaml b/charts/capsule/templates/mutatingwebhookconfiguration.yaml index 86bde7af..9997e702 100644 --- a/charts/capsule/templates/mutatingwebhookconfiguration.yaml +++ b/charts/capsule/templates/mutatingwebhookconfiguration.yaml @@ -4,8 +4,11 @@ metadata: name: {{ include "capsule.fullname" . }}-mutating-webhook-configuration labels: {{- include "capsule.labels" . | nindent 4 }} - {{- with .Values.customAnnotations }} annotations: + {{- if .Values.certManager.generateCertificates }} + cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "capsule.fullname" . }}-webhook-cert + {{- end }} + {{- with .Values.customAnnotations }} {{- toYaml . | nindent 4 }} {{- end }} webhooks: diff --git a/charts/capsule/templates/post-install-job.yaml b/charts/capsule/templates/post-install-job.yaml index 6a9ee7ad..1e043a8e 100644 --- a/charts/capsule/templates/post-install-job.yaml +++ b/charts/capsule/templates/post-install-job.yaml @@ -1,3 +1,4 @@ +{{- if .Values.tls.create }} {{- $cmd := printf "while [ -z $$(kubectl -n $NAMESPACE get secret %s -o jsonpath='{.data.tls\\\\.crt}') ];" (include "capsule.secretTlsName" .) -}} {{- $cmd = printf "%s do echo 'waiting Capsule to be up and running...' && sleep 5;" $cmd -}} {{- $cmd = printf "%s done" $cmd -}} @@ -44,4 +45,5 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - serviceAccountName: {{ include "capsule.serviceAccountName" . }} \ No newline at end of file + serviceAccountName: {{ include "capsule.serviceAccountName" . }} +{{- end }} diff --git a/charts/capsule/templates/pre-delete-job.yaml b/charts/capsule/templates/pre-delete-job.yaml index b7b9c5a4..0897bb1a 100644 --- a/charts/capsule/templates/pre-delete-job.yaml +++ b/charts/capsule/templates/pre-delete-job.yaml @@ -1,5 +1,5 @@ {{- $cmd := ""}} -{{- if not .Values.certManager.generateCertificates }} +{{- if or (.Values.tls.create) (.Values.certManager.generateCertificates) }} {{- $cmd = printf "%s kubectl delete secret -n $NAMESPACE %s --ignore-not-found &&" $cmd (include "capsule.secretTlsName" .) -}} {{- end }} {{- $cmd = printf "%s kubectl delete clusterroles.rbac.authorization.k8s.io capsule-namespace-deleter capsule-namespace-provisioner --ignore-not-found &&" $cmd -}} diff --git a/charts/capsule/templates/validatingwebhookconfiguration.yaml b/charts/capsule/templates/validatingwebhookconfiguration.yaml index 56fdcb6d..e20ae09c 100644 --- a/charts/capsule/templates/validatingwebhookconfiguration.yaml +++ b/charts/capsule/templates/validatingwebhookconfiguration.yaml @@ -4,8 +4,11 @@ metadata: name: {{ include "capsule.fullname" . }}-validating-webhook-configuration labels: {{- include "capsule.labels" . | nindent 4 }} - {{- with .Values.customAnnotations }} annotations: + {{- if .Values.certManager.generateCertificates }} + cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "capsule.fullname" . }}-webhook-cert + {{- end }} + {{- with .Values.customAnnotations }} {{- toYaml . | nindent 4 }} {{- end }} webhooks: diff --git a/charts/capsule/values.yaml b/charts/capsule/values.yaml index ffc9c12e..7c84c636 100644 --- a/charts/capsule/values.yaml +++ b/charts/capsule/values.yaml @@ -2,6 +2,15 @@ # This is a YAML-formatted file. # Declare variables to be passed into your templates. +# Secret Options +tls: + # -- Start the Capsule controller that injects the CA into mutating and validating webhooks, and CRD as well. + enableController: true + # -- When cert-manager is disabled, Capsule will generate the TLS certificate for webhook and CRDs conversion. + create: true + # -- Override name of the Capsule TLS Secret name when externally managed. + name: "" + # Manager Options manager: