Skip to content

Commit 44b8308

Browse files
kagaya85kagaya85
committed
update cert manifests
Signed-off-by: Kagaya <[email protected]>
1 parent 1944633 commit 44b8308

File tree

8 files changed

+103
-13
lines changed

8 files changed

+103
-13
lines changed

‎versions/kruise-game/next/Chart.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,5 @@ sources:
88
- https://github.com/openkruise/kruise-game
99
annotations:
1010
artifacthub.io/changes: |
11-
- "[Changed]: https://github.com/openkruise/kruise-game/blob/master/CHANGELOG.md"
11+
- "[Changed]: https://github.com/openkruise/kruise-game/blob/master/CHANGELOG.md"
12+
- "[Added]: Support for cert-manager with CA injection"

‎versions/kruise-game/next/templates/cert-manager/okg-tls-certificate.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,19 +2,20 @@
22
apiVersion: cert-manager.io/v1
33
kind: Certificate
44
metadata:
5-
name: {{ .Values.kruiseGame.fullname }}-tls-certificates
5+
name: {{ .Values.kruiseGame.fullname }}-cert
66
namespace: {{ .Values.installation.namespace }}
77
spec:
88
commonName: {{ .Values.kruiseGame.fullname }}
99
dnsNames:
10-
- {{ ..Values.kruiseGame.webhook.serviceName }}.{{ .Values.installation.namespace }}
11-
- {{ ..Values.kruiseGame.webhook.serviceName }}.{{ .Values.installation.namespace }}.svc
12-
- {{ ..Values.kruiseGame.webhook.serviceName }}.{{ .Values.installation.namespace }}.svc.{{ .Values.clusterDomain }}
10+
- {{ .Values.kruiseGame.webhook.serviceName }}.{{ .Values.installation.namespace }}
11+
- {{ .Values.kruiseGame.webhook.serviceName }}.{{ .Values.installation.namespace }}.svc
12+
- {{ .Values.kruiseGame.webhook.serviceName }}.{{ .Values.installation.namespace }}.svc.{{ .Values.clusterDomain }}
1313
secretName: {{ .Values.certificates.secretName }}
1414
usages:
1515
- server auth
1616
- client auth
1717
privateKey:
18+
rotationPolicy: Always
1819
algorithm: RSA
1920
size: 2048
2021
duration: {{ .Values.certificates.certManager.duration }}

‎versions/kruise-game/next/templates/cert-manager/self-ca.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,13 @@ spec:
99
commonName: {{ .Values.kruiseGame.fullname }}
1010
secretName: {{ .Values.certificates.certManager.caSecretName }}
1111
privateKey:
12+
rotationPolicy: Always
1213
algorithm: RSA
1314
size: 2048
1415
duration: 8760h0m0s # 1 year
1516
renewBefore: 720h0m0s # 1 month
1617
issuerRef:
17-
name: {{ .Values.operator.name }}-selfsigned-issuer
18+
name: {{ .Values.kruiseGame.fullname }}-selfsigned-issuer
1819
kind: Issuer
1920
group: cert-manager.io
2021
{{- end }}

‎versions/kruise-game/next/templates/manager.yaml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ spec:
6060
- --api-server-qps={{ .Values.kruiseGame.apiServerQps }}
6161
- --api-server-qps-burst={{ .Values.kruiseGame.apiServerQpsBurst }}
6262
- --scale-server-bind-address=:{{ .Values.scale.service.targetPort }}
63+
{{- if not .Values.certificates.autoGenerated }}
64+
- --enable-cert-generation={{ .Values.certificates.autoGenerated }}
65+
{{- end }}
6366
{{- if .Values.prometheus.enabled }}
6467
- --metrics-bind-address=:{{ .Values.prometheus.monitorService.port }}
6568
{{- end }}
@@ -98,6 +101,8 @@ spec:
98101
volumeMounts:
99102
- mountPath: /etc/kruise-game
100103
name: provider-config
104+
- mountPath: {{ .Values.certificates.mountPath }}
105+
name: certificates
101106
topologySpreadConstraints:
102107
- labelSelector:
103108
matchLabels:
@@ -108,7 +113,7 @@ spec:
108113
{{- end }}
109114
maxSkew: 1
110115
topologyKey: topology.kubernetes.io/zone
111-
whenUnsatisfiable: ScheduleAnyway
116+
whenUnsatisfiable: ScheduleAnyway
112117
serviceAccountName: {{ .Values.kruiseGame.fullname }}
113118
terminationGracePeriodSeconds: 10
114119
volumes:
@@ -119,3 +124,8 @@ spec:
119124
path: config.toml
120125
name: kruise-game-manager-config
121126
name: provider-config
127+
- name: certificates
128+
secret:
129+
defaultMode: 420
130+
secretName: {{ .Values.certificates.secretName}}
131+
optional: {{ and .Values.certificates.autoGenerated ( not .Values.certificates.certManager.enabled ) }}

‎versions/kruise-game/next/templates/webhooks/mutatingconfiguration.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
apiVersion: admissionregistration.k8s.io/v1
2+
kind: MutatingWebhookConfiguration
3+
metadata:
4+
annotations:
5+
{{- if .Values.certificates.certManager.enabled }}
6+
{{- if and (not .Values.certificates.certManager.generateCA) .Values.certificates.certManager.issuer.generate }}
7+
cert-manager.io/inject-ca-from-secret: {{ .Values.installation.namespace }}/{{ .Values.certificates.certManager.caSecretName }}
8+
{{- else }}
9+
cert-manager.io/inject-ca-from: {{ .Values.installation.namespace }}/{{ .Values.kruiseGame.fullname }}-cert
10+
{{- end }}
11+
{{- end }}
12+
labels:
13+
app.kubernetes.io/name: {{ .Values.kruiseGame.fullname }}
14+
name: kruise-game-mutating-webhook
15+
webhooks:
16+
- admissionReviewVersions:
17+
- v1
18+
- v1beta1
19+
clientConfig:
20+
service:
21+
name: {{ .Values.kruiseGame.webhook.serviceName }}
22+
namespace: {{ .Values.installation.namespace }}
23+
path: /mutate-v1-pod
24+
failurePolicy: {{ .Values.kruiseGame.webhook.failurePolicy }}
25+
matchPolicy: Equivalent
26+
name: mgameserverset.kb.io
27+
rules:
28+
- operations:
29+
- CREATE
30+
- UPDATE
31+
- DELETE
32+
apiGroups:
33+
- ""
34+
apiVersions:
35+
- v1
36+
resources:
37+
- pods
38+
objectSelector:
39+
matchExpressions:
40+
- key: game.kruise.io/owner-gss
41+
operator: Exists
42+
sideEffects: None

‎versions/kruise-game/next/templates/webhook_service.yaml‎ renamed to ‎versions/kruise-game/next/templates/webhooks/service.yaml‎

File renamed without changes.

‎versions/kruise-game/next/templates/webhooks/validatingconfiguration.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
apiVersion: admissionregistration.k8s.io/v1
2+
kind: ValidatingWebhookConfiguration
3+
metadata:
4+
annotations:
5+
{{- if .Values.certificates.certManager.enabled }}
6+
{{- if and (not .Values.certificates.certManager.generateCA) .Values.certificates.certManager.issuer.generate }}
7+
cert-manager.io/inject-ca-from-secret: {{ .Values.installation.namespace }}/{{ .Values.certificates.certManager.caSecretName }}
8+
{{- else }}
9+
cert-manager.io/inject-ca-from: {{ .Values.installation.namespace }}/{{ .Values.kruiseGame.fullname }}-cert
10+
{{- end }}
11+
{{- end }}
12+
labels:
13+
app.kubernetes.io/name: {{ .Values.kruiseGame.fullname }}
14+
name: kruise-game-validating-webhook
15+
webhooks:
16+
- admissionReviewVersions:
17+
- v1
18+
- v1beta1
19+
clientConfig:
20+
service:
21+
name: {{ .Values.kruiseGame.webhook.serviceName }}
22+
namespace: {{ .Values.installation.namespace }}
23+
path: /validate-v1alpha1-gss
24+
failurePolicy: {{ .Values.kruiseGame.webhook.failurePolicy }}
25+
matchPolicy: Equivalent
26+
name: vgameserverset.kb.io
27+
namespaceSelector: {}
28+
objectSelector: {}
29+
rules:
30+
- apiGroups:
31+
- game.kruise.io
32+
apiVersions:
33+
- v1alpha1
34+
operations:
35+
- CREATE
36+
- UPDATE
37+
resources:
38+
- gameserversets
39+
sideEffects: None
40+
timeoutSeconds: 10

‎versions/kruise-game/next/values.yaml‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ kruiseGame:
1414
serviceName: kruise-game-webhook-service
1515
port: 443
1616
targetPort: 9876
17+
failurePolicy: Fail
1718
apiServerQps: 5
1819
apiServerQpsBurst: 10
1920

@@ -80,12 +81,6 @@ certificates:
8081
renewBefore: 5840h0m0s # 8 months
8182
generateCA: true
8283
caSecretName: "kruise-game-ca"
83-
secretTemplate: {}
84-
# annotations:
85-
# my-secret-annotation-1: "foo"
86-
# my-secret-annotation-2: "bar"
87-
# labels:
88-
# my-secret-label: foo
8984
# -- Reference to custom Issuer. If issuer.generate is false, then issuer.group, issuer.kind and issuer.name are required
9085
issuer:
9186
generate: true

0 commit comments

Comments
 (0)