generated from cloudoperators/repository-template
-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(alerts): CA cert creation via cert-manager (#637)
* feat(alerts): CA cert creation via cert-manager fixes #546 Helm `genCA` function led to reconciliation loops in Greenhouse. Signed-off-by: Richard Tief <[email protected]> * fix(alerts): correct formatting in values.yaml for caCert comment Signed-off-by: IB Akshay <[email protected]> * chore(alerts): improve description in values.yaml Signed-off-by: Richard Tief <[email protected]> * chore(alerts): disable certManager for helm-lint and helm-test Signed-off-by: Richard Tief <[email protected]> * chore(alerts): move ci folder into charts/ Signed-off-by: Richard Tief <[email protected]> * chore(alerts): increase versions Signed-off-by: Richard Tief <[email protected]> * chore(alerts): name cert-manager resources like the organisation Signed-off-by: Richard Tief <[email protected]> * chore(alerts): add shared prometheus cert For consecutive Prometheus installations. Signed-off-by: Richard Tief <[email protected]> * docs(alerts): adds cert-manager option values and explaination Signed-off-by: Richard Tief <[email protected]> * chore(alerts): add cert-manager options to plugindefinition Signed-off-by: Richard Tief <[email protected]> * docs(alerts): improve wording Co-authored-by: Akshay Iyyadurai Balasundaram <[email protected]> --------- Signed-off-by: Richard Tief <[email protected]> Signed-off-by: IB Akshay <[email protected]> Co-authored-by: IB Akshay <[email protected]>
- Loading branch information
1 parent
39f7000
commit 387cbea
Showing
13 changed files
with
160 additions
and
191 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -6,3 +6,5 @@ alerts: | |
| enabled: true | ||
| hosts: | ||
| - dummy-host | ||
| certManager: | ||
| enabled: false | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,85 @@ | ||
| {{- if .Values.alerts.certManager.enabled -}} | ||
| {{- if not .Values.alerts.certManager.issuerRef -}} | ||
| # Create a selfsigned Issuer in order to create a root CA certificate for the org | ||
| # signing alertmanager serving certificates | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Issuer | ||
| metadata: | ||
| name: {{ .Release.Namespace }}-prometheus-issuer | ||
| labels: | ||
| {{- include "kube-prometheus-stack.labels" . | indent 4 }} | ||
| spec: | ||
| selfSigned: {} | ||
| --- | ||
| # Generate a CA Certificate used to sign certificates for the alertmanager | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Certificate | ||
| metadata: | ||
| name: {{ .Release.Namespace }}-prometheus-root-cert | ||
| labels: | ||
| {{- include "kube-prometheus-stack.labels" . | indent 4 }} | ||
| spec: | ||
| secretName: {{ .Release.Namespace }}-prometheus-root-cert | ||
| duration: {{ .Values.alerts.certManager.rootCert.duration | default "43800h0m0s" | quote }} | ||
| issuerRef: | ||
| name: {{ .Release.Namespace }}-prometheus-issuer | ||
| commonName: "ca.prometheus.greenhouse" | ||
| isCA: true | ||
| --- | ||
| # Create an Issuer that uses the above generated CA certificate to issue certs | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Issuer | ||
| metadata: | ||
| name: {{ .Release.Namespace }}-prometheus-root-issuer | ||
| labels: | ||
| {{- include "kube-prometheus-stack.labels" . | indent 4 }} | ||
| spec: | ||
| ca: | ||
| secretName: {{ .Release.Namespace }}-root-cert | ||
| {{- end }} | ||
| --- | ||
| # generate a server certificate for the alertmanager to use | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Certificate | ||
| metadata: | ||
| name: {{ include "kube-prometheus-stack.fullname" . }}-cert | ||
| labels: | ||
| {{- include "kube-prometheus-stack.labels" . | indent 4 }} | ||
| spec: | ||
| secretName: tls-{{ include "kube-prometheus-stack.fullname" . }}-cert | ||
| duration: {{ .Values.alerts.certManager.admissionCert.duration | default "8760h0m0s" | quote }} | ||
| issuerRef: | ||
| {{- if .Values.alerts.certManager.issuerRef }} | ||
| {{- toYaml .Values.alerts.certManager.issuerRef | nindent 4 }} | ||
| {{- else }} | ||
| name: {{ .Release.Namespace }}-root-issuer | ||
| {{- end }} | ||
| dnsNames: | ||
| - {{ include "kube-prometheus-stack.fullname" . }} | ||
| - {{ include "kube-prometheus-stack.fullname" . }}.{{ .Release.Namespace }} | ||
| - {{ include "kube-prometheus-stack.fullname" . }}.{{ .Release.Namespace }}.svc | ||
| {{- if and .Values.alerts.alertmanager.ingress.enabled .Values.alerts.alertmanager.ingress.hosts }} | ||
| {{ toYaml .Values.alerts.alertmanager.ingress.hosts | indent 2 }} | ||
| {{- end }} | ||
| --- | ||
| # generate a shared client certificate for prometheus to use | ||
| apiVersion: cert-manager.io/v1 | ||
| kind: Certificate | ||
| metadata: | ||
| name: prometheus-{{ .Release.Namespace }}-cert | ||
| labels: | ||
| {{- include "kube-prometheus-stack.labels" . | indent 4 }} | ||
| spec: | ||
| secretName: tls-prometheus-{{ .Release.Namespace }} | ||
| duration: {{ .Values.alerts.certManager.admissionCert.duration | default "8760h0m0s" | quote }} | ||
| issuerRef: | ||
| {{- if .Values.alerts.certManager.issuerRef }} | ||
| {{- toYaml .Values.alerts.certManager.issuerRef | nindent 4 }} | ||
| {{- else }} | ||
| name: {{ .Release.Namespace }}-root-issuer | ||
| {{- end }} | ||
| dnsNames: | ||
| {{- if .Values.global.greenhouse.baseDomain }} | ||
| - {{ printf "*.s%" .Values.global.greenhouse.baseDomain }} | ||
| {{- end }} | ||
| {{- end -}} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| {{- if and .Values.alerts.alertmanager.enabled .Values.alerts.alertmanager.ingress.enabled .Values.global.caCert }} | ||
| {{- $extCABundle := .Values.global.caCert }} | ||
| {{- $intCASecret := (lookup "v1" "Secret" $.Release.Namespace (printf "%s-%s" (include "kube-prometheus-stack.fullname") "-root-cert")).data }} | ||
| {{- $intCABundle := get $intCASecret "ca.crt" | b64dec }} | ||
| apiVersion: v1 | ||
| kind: Secret | ||
| type: Opaque | ||
| metadata: | ||
| name: {{ $.Release.Namespace }}-ca-bundle | ||
| labels: | ||
| {{- include "kube-prometheus-stack.labels" . | indent 4 }} | ||
| annotations: | ||
| "helm.sh/hook": post-install,post-upgrade | ||
| "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded | ||
| ## Ensure this is run before release installation and upgrade | ||
| "helm.sh/hook-weight": "-5" | ||
| data: | ||
| ca.crt: {{ printf "%s%s" $extCABundle $intCABundle | b64enc | quote }} | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.