mirror of
https://github.com/helm/charts.git
synced 2026-08-23 22:37:45 +00:00
Adjusting ingress record to better support TLS (#2484)
* Adjusting ingress record to better support TLS * Adjusting indentation per linting * Adjusting indentation per linting - including stuff not part of original PR * Adjusting indentation per linting - including stuff not part of original PR * Bumping to 0.7.0 because ingress change _is_ added functionality but backward compatible * Documenting option in README.md * Refactored ingress section, chart is compatible with older chart's ingress section * Updating values.yaml per linting * correcting hostnames -> hosts * $ is available everywhere * Fixing indentation, allowing certificates to be b64 encoded * Fixing english * Updating documentation to give more information about ingress, TLS and TLS secrets * Fixing typos * Fixing typos / wording * fixing capitalizations
This commit is contained in:
Michael Venezia
committed by
Adnan Abdulhussein
Adnan Abdulhussein
parent
7fa06cdef6
commit
46f37b7f43
@@ -1,5 +1,5 @@
|
||||
name: wordpress
|
||||
version: 0.6.13
|
||||
version: 0.7.0
|
||||
appVersion: 4.8.2
|
||||
description: Web publishing platform for building blogs and websites.
|
||||
icon: https://bitnami.com/assets/stacks/wordpress/img/wordpress-stack-220x234.png
|
||||
|
||||
@@ -69,8 +69,13 @@ The following tables lists the configurable parameters of the WordPress chart an
|
||||
| `serviceType` | Kubernetes Service type | `LoadBalancer` |
|
||||
| `healthcheckHttps` | Use https for liveliness and readiness | `false` |
|
||||
| `ingress.enabled` | Enable ingress controller resource | `false` |
|
||||
| `ingress.hostname` | URL to address your WordPress installation | `wordpress.local` |
|
||||
| `ingress.tls` | Ingress TLS configuration | `[]` |
|
||||
| `ingress.hosts[0].name` | Hostname to your WordPress installation | `wordpress.local` |
|
||||
| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` |
|
||||
| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `wordpress.local-tls-secret` |
|
||||
| `ingress.hosts[0].annotations` | Annotations for this host's ingress record | `[]` |
|
||||
| `ingress.secrets[0].name` | TLS Secret Name | `nil` |
|
||||
| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` |
|
||||
| `ingress.secrets[0].key` | TLS Secret Key | `nil` |
|
||||
| `persistence.enabled` | Enable persistence using PVC | `true` |
|
||||
| `persistence.storageClass` | PVC Storage Class | `nil` (uses alpha storage class annotation) |
|
||||
| `persistence.accessMode` | PVC Access Mode | `ReadWriteOnce` |
|
||||
@@ -106,4 +111,74 @@ See the [Configuration](#configuration) section to configure the PVC or to disab
|
||||
|
||||
## Ingress
|
||||
|
||||
This chart provides support for Ingress resource. If you have available an Ingress Controller such as Nginx or Traefik you maybe want to set up `ingress.enabled` to true and choose a `ingress.hostname` for the URL. Then, you should be able to access the installation using that address.
|
||||
This chart provides support for ingress resources. If you have an
|
||||
ingress controller installed on your cluster, such as [nginx-ingress](https://kubeapps.com/charts/stable/nginx-ingress)
|
||||
or [traefik](https://kubeapps.com/charts/stable/traefik) you can utilize
|
||||
the ingress controller to service your WordPress application.
|
||||
|
||||
To enable ingress integration, please set `ingress.enabled` to `true`
|
||||
|
||||
### Hosts
|
||||
Most likely you will only want to have one hostname that maps to this
|
||||
WordPress installation, however it is possible to have more than one
|
||||
host. To facilitate this, the `ingress.hosts` object is an array.
|
||||
|
||||
For each item, please indicate a `name`, `tls`, `tlsSecret`, and any
|
||||
`annotations` that you may want the ingress controller to know about.
|
||||
|
||||
Indicating TLS will cause WordPress to generate HTTPS urls, and
|
||||
WordPress will be connected to at port 443. The actual secret that
|
||||
`tlsSecret` references does not have to be generated by this chart.
|
||||
However, please note that if TLS is enabled, the ingress record will not
|
||||
work until this secret exists.
|
||||
|
||||
For annotations, please see [this document](https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md).
|
||||
Not all annotations are supported by all ingress controllers, but this
|
||||
document does a good job of indicating which annotation is supported by
|
||||
many popular ingress controllers.
|
||||
|
||||
### TLS Secrets
|
||||
This chart will facilitate the creation of TLS secrets for use with the
|
||||
ingress controller, however this is not required. There are three
|
||||
common use cases:
|
||||
|
||||
* helm generates / manages certificate secrets
|
||||
* user generates / manages certificates separately
|
||||
* an additional tool (like [kube-lego](https://kubeapps.com/charts/stable/kube-lego))
|
||||
manages the secrets for the application
|
||||
|
||||
In the first two cases, one will need a certificate and a key. We would
|
||||
expect them to look like this:
|
||||
|
||||
* certificate files should look like (and there can be more than one
|
||||
certificate if there is a certificate chain)
|
||||
|
||||
```
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIID6TCCAtGgAwIBAgIJAIaCwivkeB5EMA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNV
|
||||
...
|
||||
jScrvkiBO65F46KioCL9h5tDvomdU1aqpI/CBzhvZn1c0ZTf87tGQR8NK7v7
|
||||
-----END CERTIFICATE-----
|
||||
```
|
||||
* keys should look like:
|
||||
```
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEogIBAAKCAQEAvLYcyu8f3skuRyUgeeNpeDvYBCDcgq+LsWap6zbX5f8oLqp4
|
||||
...
|
||||
wrj2wDbCDCFmfqnSJ+dKI3vFLlEz44sAV8jX/kd4Y6ZTQhlLbYc=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
````
|
||||
|
||||
If you are going to use helm to manage the certificates, please copy
|
||||
these values into the `certificate` and `key` values for a given
|
||||
`ingress.secrets` entry.
|
||||
|
||||
If you are going are going to manage TLS secrets outside of helm, please
|
||||
know that you can create a TLS secret by doing the following:
|
||||
|
||||
```
|
||||
kubectl create secret tls wordpress.local-tls --key /path/to/key.key --cert /path/to/cert.crt
|
||||
```
|
||||
|
||||
Please see [this example](https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx/examples/tls)
|
||||
for more information.
|
||||
@@ -1,28 +1,36 @@
|
||||
{{- if .Values.ingress.enabled -}}
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range .Values.ingress.hosts }}
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}
|
||||
labels:
|
||||
app: {{ template "fullname" . }}
|
||||
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
|
||||
release: "{{ .Release.Name }}"
|
||||
heritage: "{{ .Release.Service }}"
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.ingress.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
name: "{{- printf "%s-%s" .name $.Release.Name | trunc 63 | trimSuffix "-" -}}"
|
||||
labels:
|
||||
app: {{ template "fullname" $ }}
|
||||
chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}"
|
||||
release: "{{ $.Release.Name }}"
|
||||
heritage: "{{ $.Release.Service }}"
|
||||
annotations:
|
||||
{{- if .tls }}
|
||||
ingress.kubernetes.io/secure-backends: "true"
|
||||
{{- end }}
|
||||
{{- range $key, $value := .annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
rules:
|
||||
- host: {{ .Values.ingress.hostname }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
backend:
|
||||
serviceName: {{ template "fullname" . }}
|
||||
servicePort: 80
|
||||
{{- if .Values.ingress.tls }}
|
||||
- host: {{ .name }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
backend:
|
||||
serviceName: {{ template "fullname" $ }}
|
||||
servicePort: {{ if .tls }}443{{ else }}80{{end}}
|
||||
{{- if .tls }}
|
||||
tls:
|
||||
{{ toYaml .Values.ingress.tls | indent 4 }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
- hosts:
|
||||
- {{ .name }}
|
||||
secretName: {{ .tlsSecret }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if .Values.ingress.enabled }}
|
||||
{{- range .Values.ingress.secrets }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ .name }}
|
||||
labels:
|
||||
app: {{ template "fullname" $ }}
|
||||
chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}"
|
||||
release: "{{ $.Release.Name }}"
|
||||
heritage: "{{ $.Release.Service }}"
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ .certificate | b64enc }}
|
||||
tls.key: {{ .key | b64enc }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -106,21 +106,46 @@ healthcheckHttps: false
|
||||
## ref: http://kubernetes.io/docs/user-guide/ingress/
|
||||
##
|
||||
ingress:
|
||||
enabled: false
|
||||
hostname: wordpress.local
|
||||
## Set to true to enable ingress record generation
|
||||
enabled: false
|
||||
|
||||
## Ingress annotations
|
||||
##
|
||||
# annotations:
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
## The list of hostnames to be covered with this ingress record.
|
||||
## Most likely this will be just one host, but in the event more hosts are needed, this is an array
|
||||
hosts:
|
||||
- name: wordpress.local
|
||||
|
||||
## Ingress TLS configuration
|
||||
## Secrets must be manually created in the namespace
|
||||
## Set this to true in order to enable TLS on the ingress record
|
||||
## A side effect of this will be that the backend wordpress service will be connected at port 443
|
||||
tls: false
|
||||
|
||||
## If TLS is set to true, you must declare what secret will store the key/certificate for TLS
|
||||
tlsSecret: wordpress.local-tls
|
||||
|
||||
## Ingress annotations done as key:value pairs
|
||||
## If you're using kube-lego, you will want to add:
|
||||
## kubernetes.io/tls-acme: true
|
||||
##
|
||||
# tls:
|
||||
# - secretName: wordpress.local-tls
|
||||
# hosts:
|
||||
# - wordpress.local
|
||||
## For a full list of possible ingress annotations, please see
|
||||
## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md
|
||||
##
|
||||
## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set
|
||||
annotations:
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# kubernetes.io/tls-acme: true
|
||||
|
||||
secrets:
|
||||
## If you're providing your own certificates, please use this to add the certificates as secrets
|
||||
## key and certificate should start with -----BEGIN CERTIFICATE----- or
|
||||
## -----BEGIN RSA PRIVATE KEY-----
|
||||
##
|
||||
## name should line up with a tlsSecret set further up
|
||||
## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set
|
||||
##
|
||||
## It is also possible to create and manage the certificates outside of this helm chart
|
||||
## Please see README.md for more information
|
||||
# - name: wordpress.local-tls
|
||||
# key:
|
||||
# certificate:
|
||||
|
||||
## Enable persistence using Persistent Volume Claims
|
||||
## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
|
||||
|
||||
Reference in New Issue
Block a user