Skip to content

Commit 503e5a4

Browse files
kota2and3kankota2and3kan
authored
[scalardb-cluster] Support cert-manager in ScalarDB Cluster chart (#263)
1 parent 5382b70 commit 503e5a4

File tree

5 files changed

+212
-38
lines changed

5 files changed

+212
-38
lines changed

‎charts/scalardb-cluster/README.md

+14-3
Original file line numberDiff line numberDiff line change
@@ -65,9 +65,20 @@ Current chart version is `2.0.0-SNAPSHOT`
6565
| scalardbCluster.strategy.rollingUpdate.maxSurge | string | `"25%"` | The number of pods that can be created above the desired amount of pods during an update |
6666
| scalardbCluster.strategy.rollingUpdate.maxUnavailable | string | `"25%"` | The number of pods that can be unavailable during the update process |
6767
| scalardbCluster.strategy.type | string | `"RollingUpdate"` | New pods are added gradually, and old pods are terminated gradually, e.g: Recreate or RollingUpdate |
68-
| scalardbCluster.tls.caRootCertSecret | string | `""` | Name of the Secret containing the custom CA root certificate for TLS communication. |
69-
| scalardbCluster.tls.certChainSecret | string | `""` | Name of the Secret containing the certificate chain file used for TLS communication. |
68+
| scalardbCluster.tls.caRootCertSecret | string | `""` | Name of the Secret containing the custom CA root certificate for TLS communication. |
69+
| scalardbCluster.tls.certChainSecret | string | `""` | Name of the Secret containing the certificate chain file used for TLS communication. |
70+
| scalardbCluster.tls.certManager.dnsNames | list | `["localhost"]` | Subject Alternative Name (SAN) of a certificate. |
71+
| scalardbCluster.tls.certManager.duration | string | `"8760h0m0s"` | Duration of a certificate. |
72+
| scalardbCluster.tls.certManager.enabled | bool | `false` | Use cert-manager to manage private key and certificate files. |
73+
| scalardbCluster.tls.certManager.issuerRef | object | `{}` | Issuer references of cert-manager. |
74+
| scalardbCluster.tls.certManager.privateKey | object | `{"algorithm":"ECDSA","encoding":"PKCS1","size":256}` | Configuration of a private key. |
75+
| scalardbCluster.tls.certManager.renewBefore | string | `"360h0m0s"` | How long before expiry a certificate should be renewed. |
76+
| scalardbCluster.tls.certManager.selfSigned | object | `{"caRootCert":{"duration":"8760h0m0s","renewBefore":"360h0m0s"},"enabled":false}` | Configuration of a certificate for self-signed CA. |
77+
| scalardbCluster.tls.certManager.selfSigned.caRootCert.duration | string | `"8760h0m0s"` | Duration of a self-signed CA certificate. |
78+
| scalardbCluster.tls.certManager.selfSigned.caRootCert.renewBefore | string | `"360h0m0s"` | How long before expiry a self-signed CA certificate should be renewed. |
79+
| scalardbCluster.tls.certManager.selfSigned.enabled | bool | `false` | Use self-signed CA. |
80+
| scalardbCluster.tls.certManager.usages | list | `["server auth","key encipherment","signing"]` | List of key usages. |
7081
| scalardbCluster.tls.enabled | bool | `false` | Enable TLS. You need to enable TLS when you use wire encryption feature of ScalarDB Cluster. |
7182
| scalardbCluster.tls.overrideAuthority | string | `""` | The custom authority for TLS communication. This doesn't change what host is actually connected. This is intended for testing, but may safely be used outside of tests as an alternative to DNS overrides. For example, you can specify the hostname presented in the certificate chain file that you set by using `scalardbCluster.tls.certChainSecret`. This chart uses this value for startupProbe and livenessProbe. |
72-
| scalardbCluster.tls.privateKeySecret | string | `""` | Name of the Secret containing the private key file used for TLS communication. |
83+
| scalardbCluster.tls.privateKeySecret | string | `""` | Name of the Secret containing the private key file used for TLS communication. |
7384
| scalardbCluster.tolerations | list | `[]` | Tolerations are applied to pods, and allow (but do not require) the pods to schedule onto nodes with matching taints. |

‎charts/scalardb-cluster/templates/scalardb-cluster/certmanager.yaml

+84
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{{- if .Values.scalardbCluster.tls.certManager.enabled }}
2+
{{- if .Values.scalardbCluster.tls.certManager.selfSigned.enabled }}
3+
# Self-signed root CA
4+
apiVersion: cert-manager.io/v1
5+
kind: Issuer
6+
metadata:
7+
name: {{ include "scalardb-cluster.fullname" . }}-self-signed-issuer
8+
namespace: {{ .Release.Namespace }}
9+
labels:
10+
{{- include "scalardb-cluster.labels" . | nindent 4 }}
11+
spec:
12+
selfSigned: {}
13+
---
14+
# Generate a CA Certificate used to sign certificates for the ScalarDB Cluster
15+
apiVersion: cert-manager.io/v1
16+
kind: Certificate
17+
metadata:
18+
name: {{ include "scalardb-cluster.fullname" . }}-root-ca-cert
19+
namespace: {{ .Release.Namespace }}
20+
labels:
21+
{{- include "scalardb-cluster.labels" . | nindent 4 }}
22+
spec:
23+
isCA: true
24+
secretName: {{ include "scalardb-cluster.fullname" . }}-root-ca-cert
25+
secretTemplate:
26+
labels:
27+
{{- include "scalardb-cluster.labels" . | nindent 6 }}
28+
commonName: self-signed-ca
29+
duration: {{ .Values.scalardbCluster.tls.certManager.selfSigned.caRootCert.duration | quote }}
30+
renewBefore: {{ .Values.scalardbCluster.tls.certManager.selfSigned.caRootCert.renewBefore | quote }}
31+
privateKey:
32+
algorithm: ECDSA
33+
size: 256
34+
issuerRef:
35+
name: {{ include "scalardb-cluster.fullname" . }}-self-signed-issuer
36+
kind: Issuer
37+
group: cert-manager.io
38+
---
39+
# Create an Issuer that uses the above generated CA certificate to issue certs
40+
apiVersion: cert-manager.io/v1
41+
kind: Issuer
42+
metadata:
43+
name: {{ include "scalardb-cluster.fullname" . }}-ca-issuer
44+
namespace: {{ .Release.Namespace }}
45+
labels:
46+
{{- include "scalardb-cluster.labels" . | nindent 4 }}
47+
spec:
48+
ca:
49+
secretName: {{ include "scalardb-cluster.fullname" . }}-root-ca-cert
50+
{{- end }}
51+
---
52+
# Generate a server certificate for the ScalarDB Cluster
53+
apiVersion: cert-manager.io/v1
54+
kind: Certificate
55+
metadata:
56+
name: {{ include "scalardb-cluster.fullname" . }}-tls-cert
57+
namespace: {{ .Release.Namespace }}
58+
labels:
59+
{{- include "scalardb-cluster.labels" . | nindent 4 }}
60+
spec:
61+
secretName: {{ include "scalardb-cluster.fullname" . }}-tls-cert
62+
secretTemplate:
63+
labels:
64+
{{- include "scalardb-cluster.labels" . | nindent 6 }}
65+
duration: {{ .Values.scalardbCluster.tls.certManager.duration | quote }}
66+
renewBefore: {{ .Values.scalardbCluster.tls.certManager.renewBefore | quote }}
67+
privateKey:
68+
{{- toYaml .Values.scalardbCluster.tls.certManager.privateKey | nindent 4 }}
69+
usages:
70+
{{- range .Values.scalardbCluster.tls.certManager.usages }}
71+
- {{ . | quote }}
72+
{{- end }}
73+
dnsNames:
74+
{{- range .Values.scalardbCluster.tls.certManager.dnsNames }}
75+
- {{ . | quote }}
76+
{{- end }}
77+
issuerRef:
78+
# If and only if you set `scalardbCluster.tls.certManager.selfSigned.enabled=true`, this chart automatically generates a self-signed CA and uses it.
79+
{{- if .Values.scalardbCluster.tls.certManager.selfSigned.enabled }}
80+
name: {{ include "scalardb-cluster.fullname" . }}-ca-issuer
81+
{{- else }}
82+
{{- toYaml .Values.scalardbCluster.tls.certManager.issuerRef | nindent 4 }}
83+
{{- end }}
84+
{{- end }}

‎charts/scalardb-cluster/templates/scalardb-cluster/deployment.yaml

+18-32
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,7 @@ spec:
6666
- -addr=localhost:60053
6767
{{- if .Values.scalardbCluster.tls.enabled }}
6868
- -tls
69-
{{- if .Values.scalardbCluster.tls.caRootCertSecret }}
70-
- -tls-ca-cert=/tls/certs/ca-root-cert.pem
71-
{{- end }}
69+
- -tls-ca-cert=/tls/scalardb-cluster/certs/ca.crt
7270
{{- if .Values.scalardbCluster.tls.overrideAuthority }}
7371
- -tls-server-name={{ .Values.scalardbCluster.tls.overrideAuthority }}
7472
{{- end }}
@@ -82,9 +80,7 @@ spec:
8280
- -addr=localhost:60053
8381
{{- if .Values.scalardbCluster.tls.enabled }}
8482
- -tls
85-
{{- if .Values.scalardbCluster.tls.caRootCertSecret }}
86-
- -tls-ca-cert=/tls/certs/ca-root-cert.pem
87-
{{- end }}
83+
- -tls-ca-cert=/tls/scalardb-cluster/certs/ca.crt
8884
{{- if .Values.scalardbCluster.tls.overrideAuthority }}
8985
- -tls-server-name={{ .Values.scalardbCluster.tls.overrideAuthority }}
9086
{{- end }}
@@ -97,20 +93,9 @@ spec:
9793
- name: scalardb-cluster-database-properties-volume
9894
mountPath: /scalardb-cluster/node/scalardb-cluster-node.properties
9995
subPath: scalardb-cluster-node.properties
100-
{{- if .Values.scalardbCluster.tls.caRootCertSecret }}
101-
- name: scalardb-cluster-tls-ca-root-volume
102-
mountPath: /tls/certs/ca-root-cert.pem
103-
subPath: ca-root-cert
104-
{{- end }}
105-
{{- if .Values.scalardbCluster.tls.certChainSecret }}
106-
- name: scalardb-cluster-tls-cert-chain-volume
107-
mountPath: /tls/certs/cert-chain.pem
108-
subPath: cert-chain
109-
{{- end }}
110-
{{- if .Values.scalardbCluster.tls.privateKeySecret }}
111-
- name: scalardb-cluster-tls-private-key-volume
112-
mountPath: /tls/certs/private-key.pem
113-
subPath: private-key
96+
{{- if .Values.scalardbCluster.tls.enabled }}
97+
- name: scalardb-cluster-tls-volume
98+
mountPath: /tls/scalardb-cluster/certs
11499
{{- end }}
115100
{{- with .Values.scalardbCluster.extraVolumeMounts }}
116101
{{- toYaml . | nindent 12 }}
@@ -119,20 +104,21 @@ spec:
119104
- name: scalardb-cluster-database-properties-volume
120105
configMap:
121106
name: {{ include "scalardb-cluster.fullname" . }}-node-properties
122-
{{- if .Values.scalardbCluster.tls.caRootCertSecret }}
123-
- name: scalardb-cluster-tls-ca-root-volume
107+
{{- if and .Values.scalardbCluster.tls.enabled .Values.scalardbCluster.tls.certManager.enabled }}
108+
- name: scalardb-cluster-tls-volume
124109
secret:
125-
secretName: {{ .Values.scalardbCluster.tls.caRootCertSecret }}
110+
secretName: {{ include "scalardb-cluster.fullname" . }}-tls-cert
126111
{{- end }}
127-
{{- if .Values.scalardbCluster.tls.certChainSecret }}
128-
- name: scalardb-cluster-tls-cert-chain-volume
129-
secret:
130-
secretName: {{ .Values.scalardbCluster.tls.certChainSecret }}
131-
{{- end }}
132-
{{- if .Values.scalardbCluster.tls.privateKeySecret }}
133-
- name: scalardb-cluster-tls-private-key-volume
134-
secret:
135-
secretName: {{ .Values.scalardbCluster.tls.privateKeySecret }}
112+
{{- if and (.Values.scalardbCluster.tls.enabled) (not .Values.scalardbCluster.tls.certManager.enabled) }}
113+
- name: scalardb-cluster-tls-volume
114+
projected:
115+
sources:
116+
- secret:
117+
name: {{ .Values.scalardbCluster.tls.caRootCertSecret }}
118+
- secret:
119+
name: {{ .Values.scalardbCluster.tls.certChainSecret }}
120+
- secret:
121+
name: {{ .Values.scalardbCluster.tls.privateKeySecret }}
136122
{{- end }}
137123
{{- with .Values.scalardbCluster.extraVolumes }}
138124
{{- toYaml . | nindent 8 }}

‎charts/scalardb-cluster/values.schema.json

+62
Original file line numberDiff line numberDiff line change
@@ -298,6 +298,68 @@
298298
"certChainSecret": {
299299
"type": "string"
300300
},
301+
"certManager": {
302+
"type": "object",
303+
"properties": {
304+
"dnsNames": {
305+
"type": "array",
306+
"items": {
307+
"type": "string"
308+
}
309+
},
310+
"duration": {
311+
"type": "string"
312+
},
313+
"enabled": {
314+
"type": "boolean"
315+
},
316+
"issuerRef": {
317+
"type": "object"
318+
},
319+
"privateKey": {
320+
"type": "object",
321+
"properties": {
322+
"algorithm": {
323+
"type": "string"
324+
},
325+
"encoding": {
326+
"type": "string"
327+
},
328+
"size": {
329+
"type": "integer"
330+
}
331+
}
332+
},
333+
"renewBefore": {
334+
"type": "string"
335+
},
336+
"selfSigned": {
337+
"type": "object",
338+
"properties": {
339+
"caRootCert": {
340+
"type": "object",
341+
"properties": {
342+
"duration": {
343+
"type": "string"
344+
},
345+
"renewBefore": {
346+
"type": "string"
347+
}
348+
}
349+
},
350+
"enabled": {
351+
"type": "boolean"
352+
}
353+
}
354+
},
355+
"usages": {
356+
"type": "array",
357+
"items": {
358+
"type": "string"
359+
}
360+
}
361+
}
362+
},
301363
"enabled": {
302364
"type": "boolean"
303365
},

‎charts/scalardb-cluster/values.yaml

+34-3
Original file line numberDiff line numberDiff line change
@@ -278,9 +278,40 @@ scalardbCluster:
278278
enabled: false
279279
# -- The custom authority for TLS communication. This doesn't change what host is actually connected. This is intended for testing, but may safely be used outside of tests as an alternative to DNS overrides. For example, you can specify the hostname presented in the certificate chain file that you set by using `scalardbCluster.tls.certChainSecret`. This chart uses this value for startupProbe and livenessProbe.
280280
overrideAuthority: ""
281-
# -- Name of the Secret containing the custom CA root certificate for TLS communication.
281+
# -- Name of the Secret containing the custom CA root certificate for TLS communication.
282282
caRootCertSecret: ""
283-
# -- Name of the Secret containing the certificate chain file used for TLS communication.
283+
# -- Name of the Secret containing the certificate chain file used for TLS communication.
284284
certChainSecret: ""
285-
# -- Name of the Secret containing the private key file used for TLS communication.
285+
# -- Name of the Secret containing the private key file used for TLS communication.
286286
privateKeySecret: ""
287+
certManager:
288+
# -- Use cert-manager to manage private key and certificate files.
289+
enabled: false
290+
# -- Configuration of a certificate for self-signed CA.
291+
selfSigned:
292+
# -- Use self-signed CA.
293+
enabled: false
294+
caRootCert:
295+
# -- Duration of a self-signed CA certificate.
296+
duration: "8760h0m0s"
297+
# -- How long before expiry a self-signed CA certificate should be renewed.
298+
renewBefore: "360h0m0s"
299+
# -- Duration of a certificate.
300+
duration: "8760h0m0s"
301+
# -- How long before expiry a certificate should be renewed.
302+
renewBefore: "360h0m0s"
303+
# -- Configuration of a private key.
304+
privateKey:
305+
algorithm: ECDSA
306+
encoding: PKCS1
307+
size: 256
308+
# -- List of key usages.
309+
usages:
310+
- server auth
311+
- key encipherment
312+
- signing
313+
# -- Subject Alternative Name (SAN) of a certificate.
314+
dnsNames:
315+
- localhost
316+
# -- Issuer references of cert-manager.
317+
issuerRef: {}

0 commit comments

Comments
 (0)