diff --git a/charts/podinfo/templates/_helpers.tpl b/charts/podinfo/templates/_helpers.tpl index 533dcf0..c691994 100644 --- a/charts/podinfo/templates/_helpers.tpl +++ b/charts/podinfo/templates/_helpers.tpl @@ -59,3 +59,11 @@ Create the name of the service account to use {{- default "default" .Values.serviceAccount.name }} {{- end }} {{- end }} + +{{/* +Create the name of the tls secret for secure port +*/}} +{{- define "podinfo.tlsSecretName" -}} +{{- $fullname := include "podinfo.fullname" . -}} +{{- default (printf "%s-tls" $fullname) .Values.tls.secretName }} +{{- end }} \ No newline at end of file diff --git a/charts/podinfo/templates/certificate.yaml b/charts/podinfo/templates/certificate.yaml new file mode 100644 index 0000000..8b23809 --- /dev/null +++ b/charts/podinfo/templates/certificate.yaml @@ -0,0 +1,16 @@ +{{- if .Values.certificate.create -}} +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ template "podinfo.fullname" . }} + labels: + {{- include "podinfo.labels" . | nindent 4 }} +spec: + dnsNames: + {{- range .Values.certificate.dnsNames }} + - {{ . | quote }} + {{- end }} + secretName: {{ template "podinfo.tlsSecretName" . }} + issuerRef: + {{- .Values.certificate.issuerRef | toYaml | trimSuffix "\n" | nindent 4 }} +{{- end }} diff --git a/charts/podinfo/templates/deployment.yaml b/charts/podinfo/templates/deployment.yaml index fcfd073..aa8d0ba 100644 --- a/charts/podinfo/templates/deployment.yaml +++ b/charts/podinfo/templates/deployment.yaml @@ -34,9 +34,24 @@ spec: - name: {{ .Chart.Name }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if (or .Values.service.hostPort .Values.tls.hostPort) }} + securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - ALL + add: + - NET_BIND_SERVICE + {{- end }} command: - ./podinfo - --port={{ .Values.service.httpPort | default 9898 }} + {{- if .Values.tls.enabled }} + - --secure-port={{ .Values.tls.port }} + {{- end }} + {{- if .Values.tls.certPath }} + - --cert-path={{ .Values.tls.certPath }} + {{- end }} {{- if .Values.service.metricsPort }} - --port-metrics={{ .Values.service.metricsPort }} {{- end }} @@ -87,6 +102,17 @@ spec: - name: http containerPort: {{ .Values.service.httpPort | default 9898 }} protocol: TCP + {{- if .Values.service.hostPort }} + hostPort: {{ .Values.service.hostPort }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: https + containerPort: {{ .Values.tls.port | default 98899 }} + protocol: TCP + {{- if .Values.tls.hostPort }} + hostPort: {{ .Values.tls.hostPort }} + {{- end }} + {{- end }} {{- if .Values.service.metricsPort }} - name: http-metrics containerPort: {{ .Values.service.metricsPort }} @@ -118,6 +144,11 @@ spec: volumeMounts: - name: data mountPath: /data + {{- if .Values.tls.enabled }} + - name: tls + mountPath: {{ .Values.tls.certPath | default "/data/cert" }} + readOnly: true + {{- end }} resources: {{ toYaml .Values.resources | indent 12 }} {{- with .Values.nodeSelector }} @@ -135,3 +166,8 @@ spec: volumes: - name: data emptyDir: {} + {{- if .Values.tls.enabled }} + - name: tls + secret: + secretName: {{ template "podinfo.tlsSecretName" . }} + {{- end }} diff --git a/charts/podinfo/templates/service.yaml b/charts/podinfo/templates/service.yaml index c794b43..f7abfee 100644 --- a/charts/podinfo/templates/service.yaml +++ b/charts/podinfo/templates/service.yaml @@ -15,6 +15,12 @@ spec: {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort))) }} nodePort: {{ .Values.service.nodePort }} {{- end }} + {{- if .Values.tls.enabled }} + - port: {{ .Values.tls.port | default 9899 }} + targetPort: https + protocol: TCP + name: https + {{- end }} {{- if .Values.service.grpcPort }} - port: {{ .Values.service.grpcPort }} targetPort: grpc diff --git a/charts/podinfo/templates/tests/tls.yaml b/charts/podinfo/templates/tests/tls.yaml new file mode 100644 index 0000000..5f3842a --- /dev/null +++ b/charts/podinfo/templates/tests/tls.yaml @@ -0,0 +1,27 @@ +{{- if .Values.tls.enabled -}} +apiVersion: v1 +kind: Pod +metadata: + name: {{ template "podinfo.fullname" . }}-tls-test-{{ randAlphaNum 5 | lower }} + labels: + {{- include "podinfo.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test-success + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + sidecar.istio.io/inject: "false" + linkerd.io/inject: disabled + appmesh.k8s.aws/sidecarInjectorWebhook: disabled +spec: + containers: + - name: curl + image: curlimages/curl:7.69.0 + command: + - sh + - -c + - | + curl -sk ${PODINFO_SVC}/api/info | grep version + env: + - name: PODINFO_SVC + value: "https://{{ template "podinfo.fullname" . }}.{{ .Release.Namespace }}:{{ .Values.tls.port }}" + restartPolicy: Never +{{- end }} \ No newline at end of file diff --git a/charts/podinfo/values-secure.yaml b/charts/podinfo/values-secure.yaml new file mode 100644 index 0000000..cdc5f52 --- /dev/null +++ b/charts/podinfo/values-secure.yaml @@ -0,0 +1,127 @@ +# Default values for podinfo. + +replicaCount: 1 +logLevel: info +backend: #http://backend-podinfo:9898/echo +backends: [] + +ui: + color: "#34577c" + message: "" + logo: "" + +faults: + delay: false + error: false + unhealthy: false + unready: false + testFail: false + testTimeout: false + +h2c: + enabled: false + +image: + repository: ghcr.io/stefanprodan/podinfo + tag: 5.0.3 + pullPolicy: IfNotPresent + +service: + enabled: true + type: ClusterIP + metricsPort: 9797 + httpPort: 9898 + externalPort: 9898 + grpcPort: 9999 + grpcService: podinfo + nodePort: 31198 + # the port used to bind the http port to the host + # NOTE: requires privileged container with NET_BIND_SERVICE capability -- this is useful for testing + # in local clusters such as kind without port forwarding + hostPort: + +# enable tls on the podinfo service +tls: + enabled: true + # the name of the secret used to mount the certificate key pair + secretName: + # the path where the certificate key pair will be mounted + certPath: /data/cert + # the port used to host the tls endpoint on the service + port: 9899 + # the port used to bind the tls port to the host + # NOTE: requires privileged container with NET_BIND_SERVICE capability -- this is useful for testing + # in local clusters such as kind without port forwarding + hostPort: + +# create a certificate manager certificate +certificate: + create: true + # the issuer used to issue the certificate + issuerRef: + kind: ClusterIssuer + name: self-signed + # the hostname / subject alternative names for the certificate + dnsNames: + - podinfo + +# metrics-server add-on required +hpa: + enabled: false + maxReplicas: 10 + # average total CPU usage per pod (1-100) + cpu: + # average memory usage per pod (100Mi-1Gi) + memory: + # average http requests per second per pod (k8s-prometheus-adapter) + requests: + +# Redis address in the format : +cache: "" +# Redis deployment +redis: + enabled: false + repository: redis + tag: 6.0.8 + +serviceAccount: + # Specifies whether a service account should be created + enabled: false + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: + +linkerd: + profile: + enabled: false + +serviceMonitor: + enabled: false + interval: 15s + +ingress: + enabled: false + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + path: /* + hosts: [] +# - podinfo.local + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: + limits: + requests: + cpu: 1m + memory: 16Mi + +nodeSelector: {} + +tolerations: [] + +affinity: {} + +podAnnotations: {} diff --git a/charts/podinfo/values.yaml b/charts/podinfo/values.yaml index fe6d4f2..7d69fa5 100644 --- a/charts/podinfo/values.yaml +++ b/charts/podinfo/values.yaml @@ -35,6 +35,35 @@ service: grpcPort: 9999 grpcService: podinfo nodePort: 31198 + # the port used to bind the http port to the host + # NOTE: requires privileged container with NET_BIND_SERVICE capability -- this is useful for testing + # in local clusters such as kind without port forwarding + hostPort: + +# enable tls on the podinfo service +tls: + enabled: false + # the name of the secret used to mount the certificate key pair + secretName: + # the path where the certificate key pair will be mounted + certPath: /data/cert + # the port used to host the tls endpoint on the service + port: 9899 + # the port used to bind the tls port to the host + # NOTE: requires privileged container with NET_BIND_SERVICE capability -- this is useful for testing + # in local clusters such as kind without port forwarding + hostPort: + +# create a certificate manager certificate +certificate: + create: false + # the issuer used to issue the certificate + issuerRef: + kind: ClusterIssuer + name: self-signed + # the hostname / subject alternative names for the certificate + dnsNames: + - podinfo # metrics-server add-on required hpa: