Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

set template for ca issuer name and secret name + geo-replication installation example #565

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

set template for ca issuer name and secret name + geo-replication installation example #565

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
51fc3f2
set template for ca issuer name and secret name + geo-replication ins…
Jan 22, 2025
d0ce192
remove geo-replication from this PR
Feb 24, 2025
36794e9
use certs template to define ca name and secret name
Feb 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 1 addition & 6 deletions charts/pulsar/templates/_autorecovery.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,12 +74,7 @@ Define autorecovery tls certs volumes
path: tls.key
- name: ca
secret:
{{- if eq .Values.certs.internal_issuer.type "selfsigning" }}
secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
{{- end }}
{{- if eq .Values.certs.internal_issuer.type "ca" }}
secretName: "{{ .Values.certs.issuers.ca.secretName }}"
{{- end }}
secretName: "{{ template "pulsar.certs.issuers.ca.secretName" . }}"
items:
- key: ca.crt
path: ca.crt
Expand Down
7 changes: 1 addition & 6 deletions charts/pulsar/templates/_bookkeeper.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,12 +75,7 @@ Define bookie tls certs volumes
path: tls.key
- name: ca
secret:
{{- if eq .Values.certs.internal_issuer.type "selfsigning" }}
secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
{{- end }}
{{- if eq .Values.certs.internal_issuer.type "ca" }}
secretName: "{{ .Values.certs.issuers.ca.secretName }}"
{{- end }}
secretName: "{{ template "pulsar.certs.issuers.ca.secretName" . }}"
items:
- key: ca.crt
path: ca.crt
Expand Down
7 changes: 1 addition & 6 deletions charts/pulsar/templates/_broker.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,12 +81,7 @@ Define broker tls certs volumes
path: tls.key
- name: ca
secret:
{{- if eq .Values.certs.internal_issuer.type "selfsigning" }}
secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
{{- end }}
{{- if eq .Values.certs.internal_issuer.type "ca" }}
secretName: "{{ .Values.certs.issuers.ca.secretName }}"
{{- end }}
secretName: "{{ template "pulsar.certs.issuers.ca.secretName" . }}"
items:
- key: ca.crt
path: ca.crt
Expand Down
40 changes: 40 additions & 0 deletions charts/pulsar/templates/_certs.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
{{/*
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
*/}}

{{/*
Define the pulsar certs ca issuer name
*/}}
{{- define "pulsar.certs.issuers.ca.name" -}}
{{- if .Values.certs.issuers.ca.name -}}
{{- .Values.certs.issuers.ca.name -}}
{{- else -}}
{{ template "pulsar.fullname" . }}-{{ .Values.certs.internal_issuer.component }}-ca-issuer
{{- end -}}
{{- end -}}

{{/*
Define the pulsar certs ca issuer secret name
*/}}
{{- define "pulsar.certs.issuers.ca.secretName" -}}
{{- if .Values.certs.issuers.ca.secretName -}}
{{- .Values.certs.issuers.ca.secretName -}}
{{- else -}}
{{ printf "%s-%s" .Release.Name .Values.tls.ca_suffix }}
{{- end -}}
{{- end -}}
Comment on lines +20 to +40
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a great improvement.
One additional request would be to handle both .Values.certs.internal_issuer.type cases in these templates, for both "selfsigning" and "ca". That would make this PR more consistent. (#561 recently added/improved "ca" handling).

7 changes: 1 addition & 6 deletions charts/pulsar/templates/_toolset.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,12 +74,7 @@ Define toolset tls certs volumes
path: tls.key
- name: ca
secret:
{{- if eq .Values.certs.internal_issuer.type "selfsigning" }}
secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
{{- end }}
{{- if eq .Values.certs.internal_issuer.type "ca" }}
secretName: "{{ .Values.certs.issuers.ca.secretName }}"
{{- end }}
secretName: "{{ template "pulsar.certs.issuers.ca.secretName" . }}"
items:
- key: ca.crt
path: ca.crt
Expand Down
2 changes: 1 addition & 1 deletion charts/pulsar/templates/proxy-statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,7 +297,7 @@ spec:
- name: ca
secret:
{{- if eq .Values.certs.internal_issuer.type "selfsigning" }}
secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
secretName: "{{ template "pulsar.certs.issuers.ca.secretName" . }}"
{{- end }}
{{- if eq .Values.certs.internal_issuer.type "ca" }}
secretName: "{{ .Values.certs.issuers.ca.secretName }}"
Expand Down
16 changes: 3 additions & 13 deletions charts/pulsar/templates/tls-cert-internal-issuer.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ metadata:
name: "{{ template "pulsar.fullname" . }}-ca"
namespace: {{ template "pulsar.namespace" . }}
spec:
secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
secretName: "{{ template "pulsar.certs.issuers.ca.secretName" . }}"
commonName: "{{ template "pulsar.namespace" . }}.svc.{{ .Values.clusterDomain }}"
duration: "{{ .Values.certs.internal_issuer.duration }}"
renewBefore: "{{ .Values.certs.internal_issuer.renewBefore }}"
Expand All @@ -50,23 +50,13 @@ spec:
# if you are using an external issuer, change this to that issuer group.
group: cert-manager.io
---
apiVersion: "{{ .Values.certs.internal_issuer.apiVersion }}"
kind: Issuer
metadata:
name: "{{ template "pulsar.fullname" . }}-{{ .Values.certs.internal_issuer.component }}-ca-issuer"
namespace: {{ template "pulsar.namespace" . }}
spec:
ca:
secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
{{- end }}
{{- if eq .Values.certs.internal_issuer.type "ca" }}
apiVersion: "{{ .Values.certs.internal_issuer.apiVersion }}"
kind: Issuer
metadata:
name: "{{ template "pulsar.fullname" . }}-{{ .Values.certs.internal_issuer.component }}-ca-issuer"
name: "{{ template "pulsar.certs.issuers.ca.name" . }}"
namespace: {{ template "pulsar.namespace" . }}
spec:
ca:
secretName: "{{ .Values.certs.issuers.ca.secretName }}"
{{- end }}
secretName: "{{ template "pulsar.certs.issuers.ca.secretName" . }}"
{{- end }}
14 changes: 6 additions & 8 deletions charts/pulsar/templates/tls-certs-internal.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@
#

{{- if .Values.tls.enabled }}
{{- if .Values.certs.internal_issuer.enabled }}

{{- if .Values.tls.proxy.enabled }}
{{- if .Values.tls.proxy.createCert }}
Expand Down Expand Up @@ -66,7 +65,7 @@ spec:
- "{{ template "pulsar.fullname" . }}-{{ .Values.proxy.component }}"
# Issuer references are always required.
issuerRef:
name: "{{ template "pulsar.fullname" . }}-{{ .Values.certs.internal_issuer.component }}-ca-issuer"
name: "{{ template "pulsar.certs.issuers.ca.name" . }}"
# We can reference ClusterIssuers by changing the kind here.
# The default value is Issuer (i.e. a locally namespaced Issuer)
kind: Issuer
Expand Down Expand Up @@ -122,7 +121,7 @@ spec:
- "{{ template "pulsar.fullname" . }}-{{ .Values.broker.component }}"
# Issuer references are always required.
issuerRef:
name: "{{ template "pulsar.fullname" . }}-{{ .Values.certs.internal_issuer.component }}-ca-issuer"
name: "{{ template "pulsar.certs.issuers.ca.name" . }}"
# We can reference ClusterIssuers by changing the kind here.
# The default value is Issuer (i.e. a locally namespaced Issuer)
kind: Issuer
Expand Down Expand Up @@ -176,7 +175,7 @@ spec:
- "{{ template "pulsar.fullname" . }}-{{ .Values.bookkeeper.component }}"
# Issuer references are always required.
issuerRef:
name: "{{ template "pulsar.fullname" . }}-{{ .Values.certs.internal_issuer.component }}-ca-issuer"
name: "{{ template "pulsar.certs.issuers.ca.name" . }}"
# We can reference ClusterIssuers by changing the kind here.
# The default value is Issuer (i.e. a locally namespaced Issuer)
kind: Issuer
Expand Down Expand Up @@ -230,7 +229,7 @@ spec:
- "{{ template "pulsar.fullname" . }}-{{ .Values.autorecovery.component }}"
# Issuer references are always required.
issuerRef:
name: "{{ template "pulsar.fullname" . }}-{{ .Values.certs.internal_issuer.component }}-ca-issuer"
name: "{{ template "pulsar.certs.issuers.ca.name" . }}"
# We can reference ClusterIssuers by changing the kind here.
# The default value is Issuer (i.e. a locally namespaced Issuer)
kind: Issuer
Expand Down Expand Up @@ -281,7 +280,7 @@ spec:
- "{{ template "pulsar.fullname" . }}-{{ .Values.toolset.component }}"
# Issuer references are always required.
issuerRef:
name: "{{ template "pulsar.fullname" . }}-{{ .Values.certs.internal_issuer.component }}-ca-issuer"
name: "{{ template "pulsar.certs.issuers.ca.name" . }}"
# We can reference ClusterIssuers by changing the kind here.
# The default value is Issuer (i.e. a locally namespaced Issuer)
kind: Issuer
Expand Down Expand Up @@ -332,7 +331,7 @@ spec:
- "{{ template "pulsar.fullname" . }}-{{ .Values.zookeeper.component }}"
# Issuer references are always required.
issuerRef:
name: "{{ template "pulsar.fullname" . }}-{{ .Values.certs.internal_issuer.component }}-ca-issuer"
name: "{{ template "pulsar.certs.issuers.ca.name" . }}"
# We can reference ClusterIssuers by changing the kind here.
# The default value is Issuer (i.e. a locally namespaced Issuer)
kind: Issuer
Expand All @@ -342,4 +341,3 @@ spec:
{{- end }}

{{- end }}
{{- end }}
2 changes: 1 addition & 1 deletion charts/pulsar/templates/toolset-statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,7 @@ spec:
- name: proxy-ca
secret:
{{- if eq .Values.certs.internal_issuer.type "selfsigning" }}
secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
secretName: "{{ template "pulsar.certs.issuers.ca.secretName" . }}"
{{- end }}
{{- if eq .Values.certs.internal_issuer.type "ca" }}
secretName: "{{ .Values.certs.issuers.ca.secretName }}"
Expand Down
2 changes: 1 addition & 1 deletion charts/pulsar/templates/zookeeper-statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -253,7 +253,7 @@ spec:
- name: ca
secret:
{{- if eq .Values.certs.internal_issuer.type "selfsigning" }}
secretName: "{{ .Release.Name }}-{{ .Values.tls.ca_suffix }}"
secretName: "{{ template "pulsar.certs.issuers.ca.secretName" . }}"
{{- end }}
{{- if eq .Values.certs.internal_issuer.type "ca" }}
secretName: "{{ .Values.certs.issuers.ca.secretName }}"
Expand Down
7 changes: 4 additions & 3 deletions charts/pulsar/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,7 +295,7 @@ auth:
######################################################################

## cert-manager
## templates/tls-cert-issuer.yaml
## templates/tls-cert-internal-issuer.yaml
##
## Cert manager is used for automatically provisioning TLS certificates
## for components within a Pulsar cluster
Expand All @@ -311,10 +311,11 @@ certs:
# 15d
renewBefore: 360h
issuers:
# Used for certs.type as selfsigning, the selfsigned issuer has no dependency on any other resource.
# Used for certs.internal_issuer.type as selfsigning, the selfsigned issuer has no dependency on any other resource.
selfsigning:
# used for certs.type as ca, the CA issuer needs to reference a Secret which contains your CA certificate and signing private key.
# used for certs.internal_issuer.type as ca, the CA issuer needs to reference a Secret which contains your CA certificate and signing private key.
ca:
name:
secretName:

######################################################################
Expand Down