From 85a650c96765fdcf779b73ddd52fc01ff8b95c22 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20=C5=A0irok=C3=BD?= Date: Thu, 18 Aug 2022 08:49:38 +0200 Subject: [PATCH] [bitnami/elasticsearch] Fix alt names in generated TLS certs (#11632) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * [bitnami/elasticsearch] Fix secret name in README Signed-off-by: Petr Široký * [bitnami/elasticsearch] Fix alt names in generated certs Signed-off-by: Petr Široký Signed-off-by: Petr Široký --- bitnami/elasticsearch/README.md | 2 +- bitnami/elasticsearch/templates/tls-secret.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/bitnami/elasticsearch/README.md b/bitnami/elasticsearch/README.md index e2defbe31..2de52f9ca 100644 --- a/bitnami/elasticsearch/README.md +++ b/bitnami/elasticsearch/README.md @@ -701,7 +701,7 @@ kibana: # Instruct kibana to connect to elastic over https enabled: true # Bit of a catch 22, as you will need to know the name upfront of your release - existingSecret: RELEASENAME-elasticsearch-coordinating-only-crt + existingSecret: RELEASENAME-elasticsearch-coordinating-crt # or just 'elasticsearch-coordinating-crt' if the release name happens to be 'elasticsearch' # As the certs are auto-generated, they are pemCerts so set to true usePemCerts: true ``` diff --git a/bitnami/elasticsearch/templates/tls-secret.yaml b/bitnami/elasticsearch/templates/tls-secret.yaml index bcc051e5f..f691d53f1 100644 --- a/bitnami/elasticsearch/templates/tls-secret.yaml +++ b/bitnami/elasticsearch/templates/tls-secret.yaml @@ -9,7 +9,7 @@ {{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname "127.0.0.1" "localhost" }} {{- if not (include "elasticsearch.coordinating.enabled" .) }} {{- $altNames = append $altNames (include "elasticsearch.service.name" .) }} -{{- $altNames = append $altNames (printf "%s.%s.svc.%s" (include "elasticsearch.service.name" .)) }} +{{- $altNames = append $altNames (printf "%s.%s.svc.%s" (include "elasticsearch.service.name" .) $releaseNamespace $clusterDomain) }} {{- end }} {{- $crt := genSignedCert $fullname nil $altNames 365 $ca }} apiVersion: v1 @@ -59,7 +59,7 @@ data: {{- if and (include "elasticsearch.coordinating.enabled" .) (not .Values.security.tls.coordinating.existingSecret) }} {{- $fullname := include "elasticsearch.coordinating.fullname" . }} {{- $serviceName := printf "%s-hl" (include "elasticsearch.coordinating.fullname" .) | trunc 63 | trimSuffix "-" }} -{{- $altNames := list (include "elasticsearch.service.name" .) (printf "%s.%s.svc.%s" (include "elasticsearch.service.name" .)) (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname "127.0.0.1" "localhost" }} +{{- $altNames := list (include "elasticsearch.service.name" .) (printf "%s.%s.svc.%s" (include "elasticsearch.service.name" .) $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname "127.0.0.1" "localhost" }} {{- $crt := genSignedCert $fullname nil $altNames 365 $ca }} --- apiVersion: v1 @@ -87,7 +87,7 @@ data: {{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) $fullname "127.0.0.1" "localhost" }} {{- if .Values.ingest.service.enabled }} {{- $altNames = append $altNames (include "elasticsearch.ingest.fullname" .) }} -{{- $altNames = append $altNames (printf "%s.%s.svc.%s" (include "elasticsearch.ingest.fullname" .)) }} +{{- $altNames = append $altNames (printf "%s.%s.svc.%s" (include "elasticsearch.ingest.fullname" .) $releaseNamespace $clusterDomain) }} {{- end }} {{- $crt := genSignedCert $fullname nil $altNames 365 $ca }} ---