From 94fd9d054de059c7bd2ea9e14956fa5e5a2a9cd6 Mon Sep 17 00:00:00 2001 From: Joseph Ball Date: Wed, 17 Jun 2020 16:23:56 +0100 Subject: [PATCH] [bitnami/redmine] Inject Root CA into image (#2774) * [bitnami/redmine] Inject Root CA into image Add a certificate authority into the redmine image. Required for ldaps authentication. Signed-off-by: Joseph Ball * [bitnami/redmine] Add custom certificate into pod Insert a custom certificate into the pod, allowing for a trusted connection using a loadbalancer, or between the ingress and the pod. Signed-off-by: Joseph Ball * [bitnami/redmine] Update certificate image to use bitnami schema Change image from alpine to minideb. Init container will test to see if apk package manager is available for user to change source image. Signed-off-by: Joseph Ball * [bitnami/redmine] Update components versions Signed-off-by: Bitnami Containers Co-authored-by: Bitnami Containers --- bitnami/redmine/Chart.yaml | 2 +- bitnami/redmine/README.md | 34 ++++++ bitnami/redmine/templates/_certificates.tpl | 126 ++++++++++++++++++++ bitnami/redmine/templates/deployment.yaml | 4 + bitnami/redmine/values.yaml | 33 ++++- 5 files changed, 196 insertions(+), 3 deletions(-) create mode 100644 bitnami/redmine/templates/_certificates.tpl diff --git a/bitnami/redmine/Chart.yaml b/bitnami/redmine/Chart.yaml index 8c4bc7cca..e9f3f4f15 100644 --- a/bitnami/redmine/Chart.yaml +++ b/bitnami/redmine/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: redmine -version: 14.1.21 +version: 14.2.0 appVersion: 4.1.1 description: A flexible project management web application. keywords: diff --git a/bitnami/redmine/README.md b/bitnami/redmine/README.md index dff4e7c84..42fc2a877 100644 --- a/bitnami/redmine/README.md +++ b/bitnami/redmine/README.md @@ -169,6 +169,20 @@ The following table lists the configurable parameters of the Redmine chart and t | `mailReceiver.priority` | Defines a new task priority | `""` | | `mailReceiver.assignedTo` | Defines a new task priority | `""` | | `mailReceiver.allowOverride` | Defines if email content is allowed to set attributes values. Values is a comma separated list of attributes or `all` to alllow all attributes | `""` | +| `certificates.customCertificate.certificateSecret` | Secret containing the certificate and key to add | `""` | +| `certificates.customCertificate.chainSecret.name` | Name of the secret containing the certificate chain | `""` | +| `certificates.customCertificate.chainSecret.key` | Key of the certificate chain file inside the secret | `""` | +| `certificates.customCertificate.certificateLocation` | Location in the container to store the certificate | `/etc/ssl/certs/ssl-cert-snakeoil.pem` | +| `certificates.customCertificate.keyLocation` | Location in the container to store the private key | `/etc/ssl/private/ssl-cert-snakeoil.key` | +| `certificates.customCertificate.chainLocation` | Location in the container to store the certificate chain | `/etc/ssl/certs/chain.pem` | +| `certificates.customCA` | Defines a list of secrets to import into the container trust store | `[]` | +| `certificates.image.registry` | Container sidecar registry | `docker.io` | +| `certificates.image.repository` | Container sidecar image | `bitnami/minideb` | +| `certificates.image.tag` | Container sidecar image tag | `buster` | +| `certificates.image.pullPolicy` | Container sidecar image pull policy | `IfNotPresent` | +| `certificates.image.pullSecrets` | Container sidecar image pull secrets | `image.pullSecrets` | +| `certificates.extraEnvVars` | Container sidecar extra environment variables (eg proxy) | `[]` | + The above parameters map to the env variables defined in [bitnami/redmine](http://github.com/bitnami/bitnami-docker-redmine). For more information please refer to the [bitnami/redmine](http://github.com/bitnami/bitnami-docker-redmine) image documentation. @@ -223,6 +237,26 @@ The following example includes two PVCs, one for Redmine and another for MariaDB $ helm install test --set persistence.existingClaim=PVC_REDMINE,mariadb.persistence.existingClaim=PVC_MARIADB bitnami/redmine ``` +## CA Certificates + +Custom CA certificates not included in the base docker image can be added with +the following configuration. The secret must exist in the same namespace as the +deployment. Will load all certificates files it finds in the secret. + +```yaml +certificates: + customCAs: + - secret: my-ca-1 + - secret: my-ca-2 +``` + +###Secret +Secret can be created with: + +```bash +kubectl create secret generic my-ca-1 --from-file my-ca-1.crt +``` + ## Upgrading ### 14.0.0 diff --git a/bitnami/redmine/templates/_certificates.tpl b/bitnami/redmine/templates/_certificates.tpl new file mode 100644 index 000000000..aed154a36 --- /dev/null +++ b/bitnami/redmine/templates/_certificates.tpl @@ -0,0 +1,126 @@ +{{/* Templates for certificates injection */}} + +{{/* +Return the proper Redmine image name +*/}} +{{- define "certificates.image" -}} +{{- $registryName := default .Values.certificates.image.registry .Values.image.registry -}} +{{- $repositoryName := .Values.certificates.image.repository -}} +{{- $tag := .Values.certificates.image.tag | toString -}} +{{/* +Helm 2.11 supports the assignment of a value to a variable defined in a different scope, +but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. +Also, we can't use a single if because lazy evaluation is not an option +*/}} +{{- if .Values.global }} + {{- if .Values.global.imageRegistry }} + {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} + {{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} + {{- end -}} +{{- else -}} + {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{- define "certificates.initContainer" -}} +{{- if .Values.certificates.customCAs }} +- name: certificates + image: {{ template "certificates.image" . }} + imagePullPolicy: {{ default .Values.image.pullPolicy .Values.certificates.image.pullPolicy }} + imagePullSecrets: + {{- range (default .Values.image.pullSecrets .Values.certificates.image.pullSecrets) }} + - name: {{ . }} + {{- end }} + command: + {{- if .Values.certificates.customCertificate.certificateSecret }} + - sh + - -c + - if command -v apk >/dev/null; then apk add --no-cache ca-certificates openssl && update-ca-certificates; + else apt-get update && apt-get install -y ca-certificates openssl; fi + {{- else }} + - sh + - -c + - if command -v apk >/dev/null; then apk add --no-cache ca-certificates openssl && update-ca-certificates; + else apt-get update && apt-get install -y ca-certificates openssl; fi + && openssl req -new -x509 -days 3650 -nodes -sha256 + -subj "/CN=$(hostname)" -addext "subjectAltName = DNS:$(hostname)" + -out /etc/ssl/certs/ssl-cert-snakeoil.pem + -keyout /etc/ssl/private/ssl-cert-snakeoil.key -extensions v3_req + {{- end }} + {{- if .Values.certificates.extraEnvVars }} + env: + {{- tpl (toYaml .Values.certificates.extraEnvVars) $ | nindent 2 }} + {{- end }} + volumeMounts: + - name: etc-ssl-certs + mountPath: /etc/ssl/certs + readOnly: false + - name: etc-ssl-private + mountPath: /etc/ssl/private + readOnly: false + - name: custom-ca-certificates + mountPath: /usr/local/share/ca-certificates + readOnly: true +{{- end }} +{{- end }} + +{{- define "certificates.volumes" -}} +{{- if .Values.certificates.customCAs }} +- name: etc-ssl-certs + emptyDir: + medium: "Memory" +- name: etc-ssl-private + emptyDir: + medium: "Memory" +- name: custom-ca-certificates + projected: + defaultMode: 0400 + sources: + {{- range $index, $customCA := .Values.certificates.customCAs }} + - secret: + name: {{ $customCA.secret }} + # items not specified, will mount all keys + {{- end }} +{{- end -}} +{{- if .Values.certificates.customCertificate.certificateSecret }} +- name: custom-certificate + secret: + secretName: {{ .Values.certificates.customCertificate.certificateSecret }} +{{- if .Values.certificates.customCertificate.chainSecret }} +- name: custom-certificate-chain + secret: + secretName: {{ .Values.certificates.customCertificate.chainSecret.name }} +{{- end -}} +{{- end -}} +{{- end -}} + +{{- define "certificates.volumeMount" -}} +{{- if .Values.certificates.customCAs }} +- name: etc-ssl-certs + mountPath: /etc/ssl/certs/ + readOnly: false +- name: etc-ssl-private + mountPath: /etc/ssl/private/ + readOnly: false +- name: custom-ca-certificates + mountPath: /usr/local/share/ca-certificates + readOnly: true +{{- end -}} +{{- if .Values.certificates.customCertificate.certificateSecret }} +- name: custom-certificate + mountPath: {{ .Values.certificates.customCertificate.certificateLocation }} + subPath: tls.crt + readOnly: true +- name: custom-certificate + mountPath: {{ .Values.certificates.customCertificate.keyLocation }} + subPath: tls.key + readOnly: true +{{- if .Values.certificates.customCertificate.chainSecret }} +- name: custom-certificate-chain + mountPath: {{ .Values.certificates.customCertificate.chainLocation }} + subPath: {{ .Values.certificates.customCertificate.chainSecret.key }} + readOnly: true +{{- end }} +{{- end -}} +{{- end -}} diff --git a/bitnami/redmine/templates/deployment.yaml b/bitnami/redmine/templates/deployment.yaml index 94630e614..e8b6f2a26 100644 --- a/bitnami/redmine/templates/deployment.yaml +++ b/bitnami/redmine/templates/deployment.yaml @@ -28,6 +28,8 @@ spec: {{- with .Values.securityContext }} securityContext: {{- toYaml . | nindent 8 }} {{- end }} + initContainers: + {{- include "certificates.initContainer" . | indent 8 }} containers: - name: {{ template "redmine.fullname" . }} image: {{ template "redmine.image" . }} @@ -145,9 +147,11 @@ spec: failureThreshold: {{ .Values.readinessProbe.failureThreshold }} {{- end }} volumeMounts: + {{- include "certificates.volumeMount" . | indent 12 }} - name: redmine-data mountPath: /bitnami/redmine volumes: + {{- include "certificates.volumes" . | indent 8 }} - name: redmine-data {{- if .Values.persistence.enabled }} persistentVolumeClaim: diff --git a/bitnami/redmine/values.yaml b/bitnami/redmine/values.yaml index c3aef5522..9ea187358 100644 --- a/bitnami/redmine/values.yaml +++ b/bitnami/redmine/values.yaml @@ -14,7 +14,7 @@ image: registry: docker.io repository: bitnami/redmine - tag: 4.1.1-debian-10-r60 + tag: 4.1.1-debian-10-r64 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -388,7 +388,7 @@ mailReceiver: image: registry: docker.io repository: bitnami/redmine - tag: 4.1.1-debian-10-r59 + tag: 4.1.1-debian-10-r62 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -470,3 +470,32 @@ mailReceiver: ## Defines a list of attributes which can be overrided by received email body ## "all" means that all attributes can be overrided allowOverride: "" + +# Add custom certificates and certificate authorities to redmine container +certificates: + customCertificate: + certificateSecret: "" + chainSecret: {} + # name: secret-name + # key: secret-key + certificateLocation: /etc/ssl/certs/ssl-cert-snakeoil.pem + keyLocation: /etc/ssl/private/ssl-cert-snakeoil.key + chainLocation: /etc/ssl/certs/mychain.pem + customCA: [] + # - secret: custom-CA + # - secret: more-custom-CAs + image: + registry: docker.io + repository: bitnami/minideb + tag: buster + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + # pullPolicy: + # pullSecrets + # - myRegistryKeySecretName + extraEnvVars: [] + # - name: myvar + # value: myval