diff --git a/stable/wordpress/Chart.yaml b/stable/wordpress/Chart.yaml index 6e4f7f786c..e83c3dd5cf 100644 --- a/stable/wordpress/Chart.yaml +++ b/stable/wordpress/Chart.yaml @@ -1,5 +1,5 @@ name: wordpress -version: 0.6.13 +version: 0.7.0 appVersion: 4.8.2 description: Web publishing platform for building blogs and websites. icon: https://bitnami.com/assets/stacks/wordpress/img/wordpress-stack-220x234.png diff --git a/stable/wordpress/README.md b/stable/wordpress/README.md index 1c416f7ea1..b233659229 100644 --- a/stable/wordpress/README.md +++ b/stable/wordpress/README.md @@ -69,8 +69,13 @@ The following tables lists the configurable parameters of the WordPress chart an | `serviceType` | Kubernetes Service type | `LoadBalancer` | | `healthcheckHttps` | Use https for liveliness and readiness | `false` | | `ingress.enabled` | Enable ingress controller resource | `false` | -| `ingress.hostname` | URL to address your WordPress installation | `wordpress.local` | -| `ingress.tls` | Ingress TLS configuration | `[]` | +| `ingress.hosts[0].name` | Hostname to your WordPress installation | `wordpress.local` | +| `ingress.hosts[0].tls` | Utilize TLS backend in ingress | `false` | +| `ingress.hosts[0].tlsSecret` | TLS Secret (certificates) | `wordpress.local-tls-secret` | +| `ingress.hosts[0].annotations` | Annotations for this host's ingress record | `[]` | +| `ingress.secrets[0].name` | TLS Secret Name | `nil` | +| `ingress.secrets[0].certificate` | TLS Secret Certificate | `nil` | +| `ingress.secrets[0].key` | TLS Secret Key | `nil` | | `persistence.enabled` | Enable persistence using PVC | `true` | | `persistence.storageClass` | PVC Storage Class | `nil` (uses alpha storage class annotation) | | `persistence.accessMode` | PVC Access Mode | `ReadWriteOnce` | @@ -106,4 +111,74 @@ See the [Configuration](#configuration) section to configure the PVC or to disab ## Ingress -This chart provides support for Ingress resource. If you have available an Ingress Controller such as Nginx or Traefik you maybe want to set up `ingress.enabled` to true and choose a `ingress.hostname` for the URL. Then, you should be able to access the installation using that address. +This chart provides support for ingress resources. If you have an +ingress controller installed on your cluster, such as [nginx-ingress](https://kubeapps.com/charts/stable/nginx-ingress) +or [traefik](https://kubeapps.com/charts/stable/traefik) you can utilize +the ingress controller to service your WordPress application. + +To enable ingress integration, please set `ingress.enabled` to `true` + +### Hosts +Most likely you will only want to have one hostname that maps to this +WordPress installation, however it is possible to have more than one +host. To facilitate this, the `ingress.hosts` object is an array. + +For each item, please indicate a `name`, `tls`, `tlsSecret`, and any +`annotations` that you may want the ingress controller to know about. + +Indicating TLS will cause WordPress to generate HTTPS urls, and +WordPress will be connected to at port 443. The actual secret that +`tlsSecret` references does not have to be generated by this chart. +However, please note that if TLS is enabled, the ingress record will not +work until this secret exists. + +For annotations, please see [this document](https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md). +Not all annotations are supported by all ingress controllers, but this +document does a good job of indicating which annotation is supported by +many popular ingress controllers. + +### TLS Secrets +This chart will facilitate the creation of TLS secrets for use with the +ingress controller, however this is not required. There are three +common use cases: + +* helm generates / manages certificate secrets +* user generates / manages certificates separately +* an additional tool (like [kube-lego](https://kubeapps.com/charts/stable/kube-lego)) +manages the secrets for the application + +In the first two cases, one will need a certificate and a key. We would +expect them to look like this: + +* certificate files should look like (and there can be more than one +certificate if there is a certificate chain) + +``` +-----BEGIN CERTIFICATE----- +MIID6TCCAtGgAwIBAgIJAIaCwivkeB5EMA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNV +... +jScrvkiBO65F46KioCL9h5tDvomdU1aqpI/CBzhvZn1c0ZTf87tGQR8NK7v7 +-----END CERTIFICATE----- +``` +* keys should look like: +``` +-----BEGIN RSA PRIVATE KEY----- +MIIEogIBAAKCAQEAvLYcyu8f3skuRyUgeeNpeDvYBCDcgq+LsWap6zbX5f8oLqp4 +... +wrj2wDbCDCFmfqnSJ+dKI3vFLlEz44sAV8jX/kd4Y6ZTQhlLbYc= +-----END RSA PRIVATE KEY----- +```` + +If you are going to use helm to manage the certificates, please copy +these values into the `certificate` and `key` values for a given +`ingress.secrets` entry. + +If you are going are going to manage TLS secrets outside of helm, please +know that you can create a TLS secret by doing the following: + +``` +kubectl create secret tls wordpress.local-tls --key /path/to/key.key --cert /path/to/cert.crt +``` + +Please see [this example](https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx/examples/tls) +for more information. \ No newline at end of file diff --git a/stable/wordpress/templates/ingress.yaml b/stable/wordpress/templates/ingress.yaml index ebd91c03e9..78e2c571f1 100644 --- a/stable/wordpress/templates/ingress.yaml +++ b/stable/wordpress/templates/ingress.yaml @@ -1,28 +1,36 @@ -{{- if .Values.ingress.enabled -}} +{{- if .Values.ingress.enabled }} +{{- range .Values.ingress.hosts }} apiVersion: extensions/v1beta1 kind: Ingress metadata: - name: {{ template "fullname" . }} - labels: - app: {{ template "fullname" . }} - chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" - annotations: - {{- range $key, $value := .Values.ingress.annotations }} - {{ $key }}: {{ $value | quote }} - {{- end }} + name: "{{- printf "%s-%s" .name $.Release.Name | trunc 63 | trimSuffix "-" -}}" + labels: + app: {{ template "fullname" $ }} + chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}" + release: "{{ $.Release.Name }}" + heritage: "{{ $.Release.Service }}" + annotations: + {{- if .tls }} + ingress.kubernetes.io/secure-backends: "true" + {{- end }} + {{- range $key, $value := .annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} spec: rules: - - host: {{ .Values.ingress.hostname }} - http: - paths: - - path: / - backend: - serviceName: {{ template "fullname" . }} - servicePort: 80 -{{- if .Values.ingress.tls }} + - host: {{ .name }} + http: + paths: + - path: / + backend: + serviceName: {{ template "fullname" $ }} + servicePort: {{ if .tls }}443{{ else }}80{{end}} +{{- if .tls }} tls: -{{ toYaml .Values.ingress.tls | indent 4 }} -{{- end -}} -{{- end -}} + - hosts: + - {{ .name }} + secretName: {{ .tlsSecret }} +{{- end }} +--- +{{- end }} +{{- end }} \ No newline at end of file diff --git a/stable/wordpress/templates/tls-secrets.yaml b/stable/wordpress/templates/tls-secrets.yaml new file mode 100644 index 0000000000..ca75d33ef2 --- /dev/null +++ b/stable/wordpress/templates/tls-secrets.yaml @@ -0,0 +1,18 @@ +{{- if .Values.ingress.enabled }} +{{- range .Values.ingress.secrets }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ .name }} + labels: + app: {{ template "fullname" $ }} + chart: "{{ $.Chart.Name }}-{{ $.Chart.Version }}" + release: "{{ $.Release.Name }}" + heritage: "{{ $.Release.Service }}" +type: kubernetes.io/tls +data: + tls.crt: {{ .certificate | b64enc }} + tls.key: {{ .key | b64enc }} +--- +{{- end }} +{{- end }} \ No newline at end of file diff --git a/stable/wordpress/values.yaml b/stable/wordpress/values.yaml index 665e7198e6..d02e6c049d 100644 --- a/stable/wordpress/values.yaml +++ b/stable/wordpress/values.yaml @@ -106,21 +106,46 @@ healthcheckHttps: false ## ref: http://kubernetes.io/docs/user-guide/ingress/ ## ingress: - enabled: false - hostname: wordpress.local + ## Set to true to enable ingress record generation + enabled: false - ## Ingress annotations - ## - # annotations: - # kubernetes.io/ingress.class: nginx + ## The list of hostnames to be covered with this ingress record. + ## Most likely this will be just one host, but in the event more hosts are needed, this is an array + hosts: + - name: wordpress.local - ## Ingress TLS configuration - ## Secrets must be manually created in the namespace + ## Set this to true in order to enable TLS on the ingress record + ## A side effect of this will be that the backend wordpress service will be connected at port 443 + tls: false + + ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS + tlsSecret: wordpress.local-tls + + ## Ingress annotations done as key:value pairs + ## If you're using kube-lego, you will want to add: + ## kubernetes.io/tls-acme: true ## - # tls: - # - secretName: wordpress.local-tls - # hosts: - # - wordpress.local + ## For a full list of possible ingress annotations, please see + ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md + ## + ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set + annotations: + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: true + + secrets: + ## If you're providing your own certificates, please use this to add the certificates as secrets + ## key and certificate should start with -----BEGIN CERTIFICATE----- or + ## -----BEGIN RSA PRIVATE KEY----- + ## + ## name should line up with a tlsSecret set further up + ## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set + ## + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + # - name: wordpress.local-tls + # key: + # certificate: ## Enable persistence using Persistent Volume Claims ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/