From fc869801c050cac7551deb49ada910f1e63eb65b Mon Sep 17 00:00:00 2001 From: Emmanuel CARRE <1766710+emmanuelCarre@users.noreply.github.com> Date: Thu, 14 Mar 2019 01:36:36 +0100 Subject: [PATCH] [stable/traefik] Add acme dns resolvers configuration (#11112) * [stable/traefik] Add acme.dnsChallenge.resolvers `resolvers` configuration is not available into Helm deployment but it could be necessary for Letsencrypt DSN challange. Signed-off-by: Emmanuel CARRE * [stable/traefik] Bumped chart version Signed-off-by: Emmanuel CARRE --- stable/traefik/Chart.yaml | 2 +- stable/traefik/README.md | 1 + stable/traefik/templates/_helpers.tpl | 12 ++++++++++++ stable/traefik/templates/configmap.yaml | 3 +++ stable/traefik/values.yaml | 3 +++ 5 files changed, 20 insertions(+), 1 deletion(-) diff --git a/stable/traefik/Chart.yaml b/stable/traefik/Chart.yaml index 9aa2945eb8..6292765133 100644 --- a/stable/traefik/Chart.yaml +++ b/stable/traefik/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: traefik -version: 1.63.1 +version: 1.64.0 appVersion: 1.7.9 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support keywords: diff --git a/stable/traefik/README.md b/stable/traefik/README.md index 0772afadc9..fe17bd476a 100644 --- a/stable/traefik/README.md +++ b/stable/traefik/README.md @@ -143,6 +143,7 @@ The following table lists the configurable parameters of the Traefik chart and t | `acme.domains.domainsList` | List of domains & (optional) subject names | `[]` | | `acme.domains.domainsList.main` | Main domain name of the generated certificate | *.example.com | | `acme.domains.domainsList.sans` | optional list of alternative subject names to give to the certificate | `[]` | +| `acme.resolvers` | DNS servers list to use for DNS challenge | `[]` | | `acme.persistence.enabled` | Create a volume to store ACME certs (if ACME is enabled) | `true` | | `acme.persistence.annotations` | PVC annotations | `{}` | | `acme.persistence.storageClass` | Type of `StorageClass` to request, will be cluster-specific | `nil` (uses alpha storage class annotation) | diff --git a/stable/traefik/templates/_helpers.tpl b/stable/traefik/templates/_helpers.tpl index 804d9539f1..4f10d4e40c 100644 --- a/stable/traefik/templates/_helpers.tpl +++ b/stable/traefik/templates/_helpers.tpl @@ -82,6 +82,18 @@ Create the block for acme.domains. {{- end -}} {{- end -}} +{{/* +Create the block for acme.resolvers. +*/}} +{{- define "traefik.acme.dnsResolvers" -}} + resolvers = [ + {{- range $idx, $ips := .Values.acme.resolvers }} + {{- if $idx }},{{ end }} + {{- $ips | quote }} + {{- end -}} + ] +{{- end -}} + {{/* Create custom cipherSuites block */}} diff --git a/stable/traefik/templates/configmap.yaml b/stable/traefik/templates/configmap.yaml index 4a8d03bf25..c90374093f 100644 --- a/stable/traefik/templates/configmap.yaml +++ b/stable/traefik/templates/configmap.yaml @@ -252,6 +252,9 @@ data: {{- if eq .Values.acme.challengeType "dns-01" }} [acme.dnsChallenge] provider = {{ .Values.acme.dnsProvider.name | quote }} + {{- if .Values.acme.resolvers }} + {{ template "traefik.acme.dnsResolvers" . }} + {{- end }} {{- if .Values.acme.delayBeforeCheck }} delayBeforeCheck = {{ .Values.acme.delayBeforeCheck }} {{- end }} diff --git a/stable/traefik/values.yaml b/stable/traefik/values.yaml index a95f7a5521..93cf945081 100644 --- a/stable/traefik/values.yaml +++ b/stable/traefik/values.yaml @@ -191,6 +191,9 @@ acme: ## Configure dnsProvider to perform domain verification using dns challenge ## Applicable only if using the dns-01 challenge type delayBeforeCheck: 0 + resolvers: [] + # - 1.1.1.1:53 + # - 8.8.8.8:53 dnsProvider: name: nil auroradns: