diff --git a/incubator/jaeger/Chart.yaml b/incubator/jaeger/Chart.yaml index a88450dafe..ab3a91d250 100644 --- a/incubator/jaeger/Chart.yaml +++ b/incubator/jaeger/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v1 appVersion: 1.15.1 description: A Jaeger Helm chart for Kubernetes name: jaeger -version: 0.16.0 +version: 0.17.0 keywords: - jaeger - opentracing diff --git a/incubator/jaeger/README.md b/incubator/jaeger/README.md index 30cb9ee03d..de5428996f 100644 --- a/incubator/jaeger/README.md +++ b/incubator/jaeger/README.md @@ -94,6 +94,61 @@ helm install incubator/jaeger --name myrel --set provisionDataStore.cassandra=fa > **Tip**: It is highly encouraged to run the Cassandra cluster with storage persistence. +## Installing the Chart using an Existing Cassandra Cluster with TLS + +If you already have an existing running Cassandra cluster with TLS, you can configure the chart as follows to use it as your backing store: + +Content of the `values.yaml` file: + +```YAML +storage: + type: cassandra + cassandra: + host: + port: + user: + password: + tls: + enabled: true + secretName: cassandra-tls-secret + +provisionDataStore: + cassandra: false +``` + +Content of the `jaeger-tls-cassandra-secret.yaml` file: + +```YAML +apiVersion: v1 +kind: Secret +metadata: + name: cassandra-tls-secret +data: + commonName: + ca-cert.pem: | + -----BEGIN CERTIFICATE----- + + -----END CERTIFICATE----- + client-cert.pem: | + -----BEGIN CERTIFICATE----- + + -----END CERTIFICATE----- + client-key.pem: | + -----BEGIN RSA PRIVATE KEY----- + -----END RSA PRIVATE KEY----- + cqlshrc: | + [ssl] + certfile = ~/.cassandra/ca-cert.pem + userkey = ~/.cassandra/client-key.pem + usercert = ~/.cassandra/client-cert.pem + +``` + +```bash +kubectl apply -f jaeger-tls-cassandra-secret.yaml +helm install incubator/jaeger --name myrel --values values.yaml +``` + ## Installing the Chart using a New ElasticSearch Cluster To install the chart with the release name `myrel` using a new ElasticSearch cluster instead of Cassandra (default), run the following command: @@ -252,6 +307,7 @@ The following table lists the configurable parameters of the Jaeger chart and th | `query.basePath` | Base path of Query UI, used for ingress as well (if it is enabled) | `/` | | `query.extraConfigmapMounts` | Additional query configMap mounts | `[]` | | `schema.annotations` | Annotations for the schema job | `nil` | +| `schema.extraConfigmapMounts` | Additional cassandra schema job configMap mounts | `[]` | | `schema.image` | Image to setup cassandra schema | `jaegertracing/jaeger-cassandra-schema` | | `schema.mode` | Schema mode (prod or test) | `prod` | | `schema.pullPolicy` | Schema image pullPolicy | `IfNotPresent` | @@ -282,6 +338,8 @@ The following table lists the configurable parameters of the Jaeger chart and th | `storage.cassandra.host` | Provisioned cassandra host | `cassandra` | | `storage.cassandra.password` | Provisioned cassandra password (ignored if storage.cassandra.existingSecret set) | `password` | | `storage.cassandra.port` | Provisioned cassandra port | `9042` | +| `storage.cassandra.tls.enabled` | Provisioned cassandra TLS connection enabled | `false` | +| `storage.cassandra.tls.secretName` | Provisioned cassandra TLS connection existing secret name (possible keys in secret: `ca-cert.pem`, `client-key.pem`, `client-cert.pem`, `cqlshrc`, `commonName`) | `` | | `storage.cassandra.usePassword` | Use password | `true` | | `storage.cassandra.user` | Provisioned cassandra username | `user` | | `storage.elasticsearch.existingSecret` | Name of existing password secret object (for password authentication) | `nil` | diff --git a/incubator/jaeger/templates/cassandra-schema-job.yaml b/incubator/jaeger/templates/cassandra-schema-job.yaml index b145c93ad0..4eb0f5b0f1 100644 --- a/incubator/jaeger/templates/cassandra-schema-job.yaml +++ b/incubator/jaeger/templates/cassandra-schema-job.yaml @@ -32,6 +32,10 @@ spec: env: - name: CQLSH_HOST value: {{ template "cassandra.host" . }} + {{ if .Values.storage.cassandra.tls.enabled }} + - name: CQLSH_SSL + value: "--ssl" + {{- end }} - name: MODE value: {{ .Values.schema.mode | quote }} - name: DATACENTER @@ -55,6 +59,37 @@ spec: {{- end }} resources: {{ toYaml .Values.schema.resources | indent 10 }} + volumeMounts: + {{- range .Values.schema.extraConfigmapMounts }} + - name: {{ .name }} + mountPath: {{ .mountPath }} + subPath: {{ .subPath }} + readOnly: {{ .readOnly }} + {{- end }} + {{- if .Values.storage.cassandra.tls.enabled }} + - name: {{ .Values.storage.cassandra.tls.secretName }} + mountPath: "/root/.cassandra/ca-cert.pem" + subPath: "ca-cert.pem" + readOnly: true + - name: {{ .Values.storage.cassandra.tls.secretName }} + mountPath: "/root/.cassandra/client-cert.pem" + subPath: "client-cert.pem" + readOnly: true + - name: {{ .Values.storage.cassandra.tls.secretName }} + mountPath: "/root/.cassandra/client-key.pem" + subPath: "client-key.pem" + readOnly: true + - name: {{ .Values.storage.cassandra.tls.secretName }} + mountPath: "/root/.cassandra/cqlshrc" + subPath: "cqlshrc" + readOnly: true + {{- end }} restartPolicy: OnFailure + volumes: + {{- range .Values.schema.extraConfigmapMounts }} + - name: {{ .name }} + configMap: + name: {{ .configMap }} + {{- end }} {{- end -}} {{- end -}} diff --git a/incubator/jaeger/templates/collector-deploy.yaml b/incubator/jaeger/templates/collector-deploy.yaml index e0da50bb98..7beba52154 100644 --- a/incubator/jaeger/templates/collector-deploy.yaml +++ b/incubator/jaeger/templates/collector-deploy.yaml @@ -62,6 +62,21 @@ spec: value: {{ template "cassandra.host" . }} - name: CASSANDRA_PORT value: {{ .Values.storage.cassandra.port | quote }} + {{ if .Values.storage.cassandra.tls.enabled }} + - name: CASSANDRA_TLS + value: {{ .Values.storage.cassandra.tls.enabled }} + - name: CASSANDRA_TLS_SERVER_NAME + valueFrom: + secretKeyRef: + name: {{ .Values.storage.cassandra.tls.secretName }} + key: commonName + - name: CASSANDRA_TLS_KEY + value: "/cassandra-tls/client-key.pem" + - name: CASSANDRA_TLS_CERT + value: "/cassandra-tls/client-cert.pem" + - name: CASSANDRA_TLS_CA + value: "/cassandra-tls/ca-cert.pem" + {{- end }} - name: CASSANDRA_KEYSPACE value: {{ printf "%s_%s" "jaeger_v1" .Values.cassandra.config.dc_name | quote }} - name: CASSANDRA_USERNAME @@ -122,6 +137,20 @@ spec: subPath: {{ .subPath }} readOnly: {{ .readOnly }} {{- end }} + {{- if .Values.storage.cassandra.tls.enabled }} + - name: {{ .Values.storage.cassandra.tls.secretName }} + mountPath: "/cassandra-tls/ca-cert.pem" + subPath: "ca-cert.pem" + readOnly: true + - name: {{ .Values.storage.cassandra.tls.secretName }} + mountPath: "/cassandra-tls/client-cert.pem" + subPath: "client-cert.pem" + readOnly: true + - name: {{ .Values.storage.cassandra.tls.secretName }} + mountPath: "/cassandra-tls/client-key.pem" + subPath: "client-key.pem" + readOnly: true + {{- end }} {{- if .Values.collector.samplingConfig}} - name: strategies mountPath: /etc/conf/ diff --git a/incubator/jaeger/templates/query-deploy.yaml b/incubator/jaeger/templates/query-deploy.yaml index 386a17f269..41c1a29027 100644 --- a/incubator/jaeger/templates/query-deploy.yaml +++ b/incubator/jaeger/templates/query-deploy.yaml @@ -59,6 +59,21 @@ spec: value: {{ template "cassandra.host" . }} - name: CASSANDRA_PORT value: {{ .Values.storage.cassandra.port | quote }} + {{ if .Values.storage.cassandra.tls.enabled }} + - name: CASSANDRA_TLS + value: {{ .Values.storage.cassandra.tls.enabled }} + - name: CASSANDRA_TLS_SERVER_NAME + valueFrom: + secretKeyRef: + name: {{ .Values.storage.cassandra.tls.secretName }} + key: commonName + - name: CASSANDRA_TLS_KEY + value: "/cassandra-tls/client-key.pem" + - name: CASSANDRA_TLS_CERT + value: "/cassandra-tls/client-cert.pem" + - name: CASSANDRA_TLS_CA + value: "/cassandra-tls/ca-cert.pem" + {{- end }} - name: CASSANDRA_KEYSPACE value: {{ printf "%s_%s" "jaeger_v1" .Values.cassandra.config.dc_name | quote }} - name: CASSANDRA_USERNAME @@ -100,6 +115,20 @@ spec: subPath: {{ .subPath }} readOnly: {{ .readOnly }} {{- end }} + {{- if .Values.storage.cassandra.tls.enabled }} + - name: {{ .Values.storage.cassandra.tls.secretName }} + mountPath: "/cassandra-tls/ca-cert.pem" + subPath: "ca-cert.pem" + readOnly: true + - name: {{ .Values.storage.cassandra.tls.secretName }} + mountPath: "/cassandra-tls/client-cert.pem" + subPath: "client-cert.pem" + readOnly: true + - name: {{ .Values.storage.cassandra.tls.secretName }} + mountPath: "/cassandra-tls/client-key.pem" + subPath: "client-key.pem" + readOnly: true + {{- end }} livenessProbe: httpGet: path: / diff --git a/incubator/jaeger/values.yaml b/incubator/jaeger/values.yaml index 5ba3a80fb6..a1bcd7f45e 100644 --- a/incubator/jaeger/values.yaml +++ b/incubator/jaeger/values.yaml @@ -37,6 +37,9 @@ storage: cassandra: host: cassandra port: 9042 + tls: + enabled: false + secretName: cassandra-tls-secret user: user usePassword: true password: password