mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Traefik mtls (#13347)
* Adds MTLS support to Traefik chart. Work previously done by @somcsel and picked up here after abndoned. Signed-off-by: Thomas Miller <thomas@tlm.id.au> * Removed base64 ca cert requirement Signed-off-by: Thomas Miller <thomas@tlm.id.au> * Comment out MTLS by default - PR feedback to comment out values MTLS settings by default Signed-off-by: Thomas Miller <thomas@tlm.id.au> * PR feedback, removing typos from values Signed-off-by: Thomas Miller <thomas@tlm.id.au> * Add missing comment blocks Signed-off-by: Thomas Miller <thomas@tlm.id.au> * Bumped chart version to 1.70.0 Signed-off-by: Thomas Miller <thomas@tlm.id.au> * Bumped chart version to 1.74.0 Signed-off-by: Thomas Miller <thomas@tlm.id.au>
This commit is contained in:
Thomas Miller
committed by
Kubernetes Prow Robot
Kubernetes Prow Robot
parent
28a19e7b04
commit
1aea5456c5
@@ -1,6 +1,6 @@
|
||||
apiVersion: v1
|
||||
name: traefik
|
||||
version: 1.73.1
|
||||
version: 1.74.0
|
||||
appVersion: 1.7.12
|
||||
description: A Traefik based Kubernetes ingress controller with Let's Encrypt support
|
||||
keywords:
|
||||
|
||||
@@ -134,6 +134,9 @@ The following table lists the configurable parameters of the Traefik chart and t
|
||||
| `ssl.defaultCert` | Base64 encoded default certificate | A self-signed certificate |
|
||||
| `ssl.defaultKey` | Base64 encoded private key for the certificate above | The private key for the certificate above |
|
||||
| `ssl.auth.basic` | Basic auth for all SSL endpoints, see Authentication section | unset by default; this means basic auth is disabled |
|
||||
| `ssl.mtls.enabled` | Whether to enable mutual TLS. See [here](https://docs.traefik.io/configuration/entrypoints/#tls-mutual-authentication). | false |
|
||||
| `ssl.mtls.optional` | When ssl.mtls.enabled is set, whether to accept client certificates not signed by one of the CAs specified in ssl.mtls.clientCaCerts. | false |
|
||||
| `ssl.mtls.clientCaCerts` | When ssl.mtls.enabled is set, an array of client CA certificates, each in PEM format. | [] |
|
||||
| `acme.enabled` | Whether to use Let's Encrypt to obtain certificates | `false` |
|
||||
| `acme.keyType` | KeyType used for generating certificate private key. Allow value 'EC256', 'EC384', 'RSA2048', 'RSA4096', 'RSA8192'. | `RSA4096` |
|
||||
| `acme.challengeType` | Type of ACME challenge to perform domain validation. `tls-sni-01` (deprecated), `tls-alpn-01` (recommended), `http-01` or `dns-01` | `tls-sni-01` |
|
||||
|
||||
@@ -125,6 +125,18 @@ Create the block for RootCAs.
|
||||
]
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the block for mTLS ClientCAs.
|
||||
*/}}
|
||||
{{- define "traefik.ssl.mtls.clientCAs" -}}
|
||||
files = [
|
||||
{{- range $idx, $_ := .Values.ssl.mtls.clientCaCerts }}
|
||||
{{- if $idx }}, {{ end }}
|
||||
{{- printf "/mtls/clientCaCert-%d.crt" $idx | quote }}
|
||||
{{- end -}}
|
||||
]
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Helper for containerPort (http)
|
||||
*/}}
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if and .Values.ssl.enabled .Values.ssl.mtls }}
|
||||
{{- if .Values.ssl.mtls.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "traefik.fullname" . }}-client-ca-certs
|
||||
labels:
|
||||
app: {{ template "traefik.name" . }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
release: {{ .Release.Name | quote }}
|
||||
heritage: {{ .Release.Service | quote }}
|
||||
type: Opaque
|
||||
data:
|
||||
{{- range $idx, $caCert := .Values.ssl.mtls.clientCaCerts }}
|
||||
clientCaCert-{{ $idx }}.crt: {{ $caCert | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -92,6 +92,13 @@ data:
|
||||
{{- if .Values.ssl.sniStrict }}
|
||||
sniStrict = true
|
||||
{{- end }}
|
||||
{{- if .Values.ssl.mtls }}
|
||||
{{- if .Values.ssl.mtls.enabled }}
|
||||
[entryPoints.https.tls.ClientCA]
|
||||
{{ template "traefik.ssl.mtls.clientCAs" . }}
|
||||
optional = {{ .Values.ssl.mtls.optional }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
[[entryPoints.https.tls.certificates]]
|
||||
CertFile = "/ssl/tls.crt"
|
||||
KeyFile = "/ssl/tls.key"
|
||||
|
||||
@@ -122,10 +122,18 @@ spec:
|
||||
{{- if .Values.extraVolumeMounts }}{{ toYaml .Values.extraVolumeMounts | trim | nindent 8 }}{{ end }}
|
||||
- mountPath: /config
|
||||
name: config
|
||||
{{- if and .Values.ssl.enabled (not .Values.ssl.upstream) }}
|
||||
{{- if .Values.ssl.enabled }}
|
||||
{{- if not .Values.ssl.upstream }}
|
||||
- mountPath: /ssl
|
||||
name: ssl
|
||||
{{- end }}
|
||||
{{- if .Values.ssl.mtls }}
|
||||
{{- if .Values.ssl.mtls.enabled }}
|
||||
- mountPath: /mtls
|
||||
name: mtls
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.acme.enabled }}
|
||||
- mountPath: /acme
|
||||
name: acme
|
||||
@@ -173,11 +181,20 @@ spec:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ template "traefik.fullname" . }}
|
||||
{{- if and .Values.ssl.enabled (not .Values.ssl.upstream) }}
|
||||
{{- if .Values.ssl.enabled }}
|
||||
{{- if not .Values.ssl.upstream }}
|
||||
- name: ssl
|
||||
secret:
|
||||
secretName: {{ template "traefik.fullname" . }}-default-cert
|
||||
{{- end }}
|
||||
{{- if .Values.ssl.mtls }}
|
||||
{{- if .Values.ssl.mtls.enabled }}
|
||||
- name: mtls
|
||||
configMap:
|
||||
name: {{ template "traefik.fullname" . }}-client-ca-certs
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.acme.enabled }}
|
||||
- name: acme
|
||||
{{- if .Values.acme.persistence.enabled }}
|
||||
|
||||
@@ -141,6 +141,14 @@ ssl:
|
||||
# basic:
|
||||
# testuser: $apr1$JXRA7j2s$LpVns9vsme8FHN0r.aSt11
|
||||
|
||||
# mtls:
|
||||
# enabled: true
|
||||
# optional: false
|
||||
# clientCaCerts: []
|
||||
# # When mTLS is enabled, the set of CA certificates used to validate client TLS certificates.
|
||||
# # https://docs.traefik.io/configuration/entrypoints/#tls-mutual-authentication
|
||||
# # CA certificates should be in PEM format.
|
||||
|
||||
kvprovider:
|
||||
## If you want to run Traefik in HA mode, you will need to setup a KV Provider. Therefore you can choose one of
|
||||
## * etcd
|
||||
|
||||
Reference in New Issue
Block a user