From ebe24f6cc8612880acc4fa89cbee08212c78c140 Mon Sep 17 00:00:00 2001 From: Jeff Billimek Date: Sun, 15 Jul 2018 12:28:55 -0400 Subject: [PATCH] [stable/traefik] adding support for traefik wildcard certificates (#6015) * adding support for traefik wildcard certificates * adding support for multiple sets of domains * making values sans example more readable * bumping version of Chart * commenting domain examples from values.yml --- stable/traefik/Chart.yaml | 2 +- stable/traefik/README.md | 26 +++++++++++++++++++++++++ stable/traefik/templates/_helpers.tpl | 20 +++++++++++++++++++ stable/traefik/templates/configmap.yaml | 3 +++ stable/traefik/values.yaml | 14 +++++++++++++ 5 files changed, 64 insertions(+), 1 deletion(-) diff --git a/stable/traefik/Chart.yaml b/stable/traefik/Chart.yaml index 30e8a5239e..a93afe2486 100755 --- a/stable/traefik/Chart.yaml +++ b/stable/traefik/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: traefik -version: 1.34.0 +version: 1.35.0 appVersion: 1.6.2 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support keywords: diff --git a/stable/traefik/README.md b/stable/traefik/README.md index 8a5b347f73..561f68d3a6 100644 --- a/stable/traefik/README.md +++ b/stable/traefik/README.md @@ -121,6 +121,10 @@ The following table lists the configurable parameters of the Traefik chart and t | `acme.email` | Email address to be used in certificates obtained from Let's Encrypt | `admin@example.com` | | `acme.staging` | Whether to get certs from Let's Encrypt's staging environment | `true` | | `acme.logging` | Display debug log messages from the ACME client library | `false` | +| `acme.domains.enabled` | Enable certificate creation by default for specific domain | `false` | +| `acme.domains.domainList` | List of domains & (optional) subject names | `[]` | +| `acme.domains.domainList.main` | Main domain name of the generated certificate | *.example.com | +| `acme.domains.domainList.sans` | optional list of alternative subject names to give to the certificate | `[]` | | `acme.persistence.enabled` | Create a volume to store ACME certs (if ACME is enabled) | `true` | | `acme.persistence.annotations` | PVC annotations | `{}` | | `acme.persistence.storageClass` | Type of `StorageClass` to request-- will be cluster-specific | `nil` (uses alpha storage class annotation) | @@ -222,6 +226,28 @@ acme: # variables that the specific dns provider requires ``` +### Let's Encrypt wildcard certificate + +To obtain an ACME (Let's Encrypt) wildcard certificate you must use a DNS challenge as explained above. +Then you need to specify the wildcard domain name in the `acme.domains` section like this : + +```yaml +acme: + enabled: true + challengeType: "dns-01" + dnsProvider: + name: # name of the dns provider to use + $name: # the configuration of the dns provider. See the following section for an example + # variables that the specific dns provider requires + domains: + enabled: true + domainsList: + - main: "*.example.com" # name of the wildcard domain name for the certificate + - sans: + - "example.com" # OPTIONAL: Alternative name(s) for the certificate, if you want the same certificate for the root of the domain name for example + - main: "*.example2.com" # name of the wildcard domain name for the certificate +``` + #### Example: AWS Route 53 Route 53 requires the [following configuration variables to be set](values.yaml#L98-L101): diff --git a/stable/traefik/templates/_helpers.tpl b/stable/traefik/templates/_helpers.tpl index 4ca658d99a..ee111949aa 100644 --- a/stable/traefik/templates/_helpers.tpl +++ b/stable/traefik/templates/_helpers.tpl @@ -49,3 +49,23 @@ Create the block for whiteListSourceRange. {{- end -}} ] {{- end -}} + +{{/* +Create the block for acme.domains. +*/}} +{{- define "traefik.acme.domains" -}} +{{- range $idx, $value := .Values.acme.domains.domainsList }} + {{- if $value.main }} + [[acme.domains]] + main = {{- range $mainIdx, $mainValue := $value }} {{ $mainValue | quote }}{{- end -}} + {{- end -}} +{{- if $value.sans }} + sans = [ + {{- range $sansIdx, $domains := $value.sans }} + {{- if $sansIdx }}, {{ end }} + {{- $domains | quote }} + {{- end -}} + ] + {{- end -}} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/stable/traefik/templates/configmap.yaml b/stable/traefik/templates/configmap.yaml index d2bb0d0043..a40e2beb83 100644 --- a/stable/traefik/templates/configmap.yaml +++ b/stable/traefik/templates/configmap.yaml @@ -111,6 +111,9 @@ data: [acme.httpChallenge] entryPoint = "http" {{- end }} + {{- if .Values.acme.domains.enabled }} + {{- if .Values.acme.domains.domainsList }}{{ template "traefik.acme.domains" . }}{{- end }} + {{- end }} {{- end }} {{- if or .Values.dashboard.enabled .Values.metrics.prometheus.enabled .Values.metrics.statsd.enabled .Values.metrics.datadog.enabled }} [web] diff --git a/stable/traefik/values.yaml b/stable/traefik/values.yaml index f5cfa259e9..0eeb7691be 100644 --- a/stable/traefik/values.yaml +++ b/stable/traefik/values.yaml @@ -59,6 +59,20 @@ acme: email: admin@example.com staging: true logging: false + # Configure a Let's Encrypt certificate to be managed by default. + # This is the only way to request wildcard certificates (works only with dns challenge). + domains: + enabled: false + # List of sets of main and (optional) SANs to generate for + # for wildcard certificates see https://docs.traefik.io/configuration/acme/#wildcard-domains + domainsList: + # - main: "*.example.com" + # - sans: + # - "example.com" + # - main: "*.example2.com" + # - sans: + # - "test1.example2.com" + # - "test2.example2.com" ## ACME challenge type: "tls-sni-01", "http-01" or "dns-01" ## Note the chart's default of tls-sni-01 has been DEPRECATED and (except in ## certain circumstances) DISABLED by Let's Encrypt. It remains as a default