mirror of
https://github.com/wahyd4/charts.git
synced 2026-08-23 12:06:20 +10:00
[bitnami/redmine] Inject Root CA into image (#2774)
* [bitnami/redmine] Inject Root CA into image Add a certificate authority into the redmine image. Required for ldaps authentication. Signed-off-by: Joseph Ball <joseph.ball@packetsolutions.io> * [bitnami/redmine] Add custom certificate into pod Insert a custom certificate into the pod, allowing for a trusted connection using a loadbalancer, or between the ingress and the pod. Signed-off-by: Joseph Ball <joseph.ball@packetsolutions.io> * [bitnami/redmine] Update certificate image to use bitnami schema Change image from alpine to minideb. Init container will test to see if apk package manager is available for user to change source image. Signed-off-by: Joseph Ball <joseph.ball@packetsolutions.io> * [bitnami/redmine] Update components versions Signed-off-by: Bitnami Containers <containers@bitnami.com> Co-authored-by: Bitnami Containers <containers@bitnami.com>
This commit is contained in:
Joseph Ball
co-authored by
Bitnami Containers
Bitnami Containers
parent
ab23fc07c2
commit
94fd9d054d
@@ -1,6 +1,6 @@
|
||||
apiVersion: v1
|
||||
name: redmine
|
||||
version: 14.1.21
|
||||
version: 14.2.0
|
||||
appVersion: 4.1.1
|
||||
description: A flexible project management web application.
|
||||
keywords:
|
||||
|
||||
@@ -169,6 +169,20 @@ The following table lists the configurable parameters of the Redmine chart and t
|
||||
| `mailReceiver.priority` | Defines a new task priority | `""` |
|
||||
| `mailReceiver.assignedTo` | Defines a new task priority | `""` |
|
||||
| `mailReceiver.allowOverride` | Defines if email content is allowed to set attributes values. Values is a comma separated list of attributes or `all` to alllow all attributes | `""` |
|
||||
| `certificates.customCertificate.certificateSecret` | Secret containing the certificate and key to add | `""` |
|
||||
| `certificates.customCertificate.chainSecret.name` | Name of the secret containing the certificate chain | `""` |
|
||||
| `certificates.customCertificate.chainSecret.key` | Key of the certificate chain file inside the secret | `""` |
|
||||
| `certificates.customCertificate.certificateLocation` | Location in the container to store the certificate | `/etc/ssl/certs/ssl-cert-snakeoil.pem` |
|
||||
| `certificates.customCertificate.keyLocation` | Location in the container to store the private key | `/etc/ssl/private/ssl-cert-snakeoil.key` |
|
||||
| `certificates.customCertificate.chainLocation` | Location in the container to store the certificate chain | `/etc/ssl/certs/chain.pem` |
|
||||
| `certificates.customCA` | Defines a list of secrets to import into the container trust store | `[]` |
|
||||
| `certificates.image.registry` | Container sidecar registry | `docker.io` |
|
||||
| `certificates.image.repository` | Container sidecar image | `bitnami/minideb` |
|
||||
| `certificates.image.tag` | Container sidecar image tag | `buster` |
|
||||
| `certificates.image.pullPolicy` | Container sidecar image pull policy | `IfNotPresent` |
|
||||
| `certificates.image.pullSecrets` | Container sidecar image pull secrets | `image.pullSecrets` |
|
||||
| `certificates.extraEnvVars` | Container sidecar extra environment variables (eg proxy) | `[]` |
|
||||
|
||||
|
||||
The above parameters map to the env variables defined in [bitnami/redmine](http://github.com/bitnami/bitnami-docker-redmine). For more information please refer to the [bitnami/redmine](http://github.com/bitnami/bitnami-docker-redmine) image documentation.
|
||||
|
||||
@@ -223,6 +237,26 @@ The following example includes two PVCs, one for Redmine and another for MariaDB
|
||||
$ helm install test --set persistence.existingClaim=PVC_REDMINE,mariadb.persistence.existingClaim=PVC_MARIADB bitnami/redmine
|
||||
```
|
||||
|
||||
## CA Certificates
|
||||
|
||||
Custom CA certificates not included in the base docker image can be added with
|
||||
the following configuration. The secret must exist in the same namespace as the
|
||||
deployment. Will load all certificates files it finds in the secret.
|
||||
|
||||
```yaml
|
||||
certificates:
|
||||
customCAs:
|
||||
- secret: my-ca-1
|
||||
- secret: my-ca-2
|
||||
```
|
||||
|
||||
###Secret
|
||||
Secret can be created with:
|
||||
|
||||
```bash
|
||||
kubectl create secret generic my-ca-1 --from-file my-ca-1.crt
|
||||
```
|
||||
|
||||
## Upgrading
|
||||
|
||||
### 14.0.0
|
||||
|
||||
@@ -0,0 +1,126 @@
|
||||
{{/* Templates for certificates injection */}}
|
||||
|
||||
{{/*
|
||||
Return the proper Redmine image name
|
||||
*/}}
|
||||
{{- define "certificates.image" -}}
|
||||
{{- $registryName := default .Values.certificates.image.registry .Values.image.registry -}}
|
||||
{{- $repositoryName := .Values.certificates.image.repository -}}
|
||||
{{- $tag := .Values.certificates.image.tag | toString -}}
|
||||
{{/*
|
||||
Helm 2.11 supports the assignment of a value to a variable defined in a different scope,
|
||||
but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic.
|
||||
Also, we can't use a single if because lazy evaluation is not an option
|
||||
*/}}
|
||||
{{- if .Values.global }}
|
||||
{{- if .Values.global.imageRegistry }}
|
||||
{{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "certificates.initContainer" -}}
|
||||
{{- if .Values.certificates.customCAs }}
|
||||
- name: certificates
|
||||
image: {{ template "certificates.image" . }}
|
||||
imagePullPolicy: {{ default .Values.image.pullPolicy .Values.certificates.image.pullPolicy }}
|
||||
imagePullSecrets:
|
||||
{{- range (default .Values.image.pullSecrets .Values.certificates.image.pullSecrets) }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
command:
|
||||
{{- if .Values.certificates.customCertificate.certificateSecret }}
|
||||
- sh
|
||||
- -c
|
||||
- if command -v apk >/dev/null; then apk add --no-cache ca-certificates openssl && update-ca-certificates;
|
||||
else apt-get update && apt-get install -y ca-certificates openssl; fi
|
||||
{{- else }}
|
||||
- sh
|
||||
- -c
|
||||
- if command -v apk >/dev/null; then apk add --no-cache ca-certificates openssl && update-ca-certificates;
|
||||
else apt-get update && apt-get install -y ca-certificates openssl; fi
|
||||
&& openssl req -new -x509 -days 3650 -nodes -sha256
|
||||
-subj "/CN=$(hostname)" -addext "subjectAltName = DNS:$(hostname)"
|
||||
-out /etc/ssl/certs/ssl-cert-snakeoil.pem
|
||||
-keyout /etc/ssl/private/ssl-cert-snakeoil.key -extensions v3_req
|
||||
{{- end }}
|
||||
{{- if .Values.certificates.extraEnvVars }}
|
||||
env:
|
||||
{{- tpl (toYaml .Values.certificates.extraEnvVars) $ | nindent 2 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: etc-ssl-certs
|
||||
mountPath: /etc/ssl/certs
|
||||
readOnly: false
|
||||
- name: etc-ssl-private
|
||||
mountPath: /etc/ssl/private
|
||||
readOnly: false
|
||||
- name: custom-ca-certificates
|
||||
mountPath: /usr/local/share/ca-certificates
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- define "certificates.volumes" -}}
|
||||
{{- if .Values.certificates.customCAs }}
|
||||
- name: etc-ssl-certs
|
||||
emptyDir:
|
||||
medium: "Memory"
|
||||
- name: etc-ssl-private
|
||||
emptyDir:
|
||||
medium: "Memory"
|
||||
- name: custom-ca-certificates
|
||||
projected:
|
||||
defaultMode: 0400
|
||||
sources:
|
||||
{{- range $index, $customCA := .Values.certificates.customCAs }}
|
||||
- secret:
|
||||
name: {{ $customCA.secret }}
|
||||
# items not specified, will mount all keys
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- if .Values.certificates.customCertificate.certificateSecret }}
|
||||
- name: custom-certificate
|
||||
secret:
|
||||
secretName: {{ .Values.certificates.customCertificate.certificateSecret }}
|
||||
{{- if .Values.certificates.customCertificate.chainSecret }}
|
||||
- name: custom-certificate-chain
|
||||
secret:
|
||||
secretName: {{ .Values.certificates.customCertificate.chainSecret.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "certificates.volumeMount" -}}
|
||||
{{- if .Values.certificates.customCAs }}
|
||||
- name: etc-ssl-certs
|
||||
mountPath: /etc/ssl/certs/
|
||||
readOnly: false
|
||||
- name: etc-ssl-private
|
||||
mountPath: /etc/ssl/private/
|
||||
readOnly: false
|
||||
- name: custom-ca-certificates
|
||||
mountPath: /usr/local/share/ca-certificates
|
||||
readOnly: true
|
||||
{{- end -}}
|
||||
{{- if .Values.certificates.customCertificate.certificateSecret }}
|
||||
- name: custom-certificate
|
||||
mountPath: {{ .Values.certificates.customCertificate.certificateLocation }}
|
||||
subPath: tls.crt
|
||||
readOnly: true
|
||||
- name: custom-certificate
|
||||
mountPath: {{ .Values.certificates.customCertificate.keyLocation }}
|
||||
subPath: tls.key
|
||||
readOnly: true
|
||||
{{- if .Values.certificates.customCertificate.chainSecret }}
|
||||
- name: custom-certificate-chain
|
||||
mountPath: {{ .Values.certificates.customCertificate.chainLocation }}
|
||||
subPath: {{ .Values.certificates.customCertificate.chainSecret.key }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -28,6 +28,8 @@ spec:
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext: {{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- include "certificates.initContainer" . | indent 8 }}
|
||||
containers:
|
||||
- name: {{ template "redmine.fullname" . }}
|
||||
image: {{ template "redmine.image" . }}
|
||||
@@ -145,9 +147,11 @@ spec:
|
||||
failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- include "certificates.volumeMount" . | indent 12 }}
|
||||
- name: redmine-data
|
||||
mountPath: /bitnami/redmine
|
||||
volumes:
|
||||
{{- include "certificates.volumes" . | indent 8 }}
|
||||
- name: redmine-data
|
||||
{{- if .Values.persistence.enabled }}
|
||||
persistentVolumeClaim:
|
||||
|
||||
@@ -14,7 +14,7 @@
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/redmine
|
||||
tag: 4.1.1-debian-10-r60
|
||||
tag: 4.1.1-debian-10-r64
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
@@ -388,7 +388,7 @@ mailReceiver:
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/redmine
|
||||
tag: 4.1.1-debian-10-r59
|
||||
tag: 4.1.1-debian-10-r62
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
@@ -470,3 +470,32 @@ mailReceiver:
|
||||
## Defines a list of attributes which can be overrided by received email body
|
||||
## "all" means that all attributes can be overrided
|
||||
allowOverride: ""
|
||||
|
||||
# Add custom certificates and certificate authorities to redmine container
|
||||
certificates:
|
||||
customCertificate:
|
||||
certificateSecret: ""
|
||||
chainSecret: {}
|
||||
# name: secret-name
|
||||
# key: secret-key
|
||||
certificateLocation: /etc/ssl/certs/ssl-cert-snakeoil.pem
|
||||
keyLocation: /etc/ssl/private/ssl-cert-snakeoil.key
|
||||
chainLocation: /etc/ssl/certs/mychain.pem
|
||||
customCA: []
|
||||
# - secret: custom-CA
|
||||
# - secret: more-custom-CAs
|
||||
image:
|
||||
registry: docker.io
|
||||
repository: bitnami/minideb
|
||||
tag: buster
|
||||
## Specify a imagePullPolicy
|
||||
## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
|
||||
## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
|
||||
##
|
||||
pullPolicy: IfNotPresent
|
||||
# pullPolicy:
|
||||
# pullSecrets
|
||||
# - myRegistryKeySecretName
|
||||
extraEnvVars: []
|
||||
# - name: myvar
|
||||
# value: myval
|
||||
|
||||
Reference in New Issue
Block a user