home/charts
2
0
Fork 0
mirror of https://github.com/wahyd4/charts.git synced 2026-08-21 11:06:10 +10:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/redis-cluster] Add support for autogenerated certs (#6530)

Browse Source 
* [bitnami/redis-cluster] Add support for autogenerated certs

* Update README.md and Chart version bump

* Add annotations and validation

* Update README.md
This commit is contained in:
Miguel Ruiz
2021-06-18 09:13:35 +02:00
committed by GitHub
parent f9204ca015
commit da613f5fa4
6 changed files with 86 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitnami/redis-cluster/Chart.yaml
+1 -1
View File
@@ -23,4 +23,4 @@ name: redis-cluster
sources:
- https://github.com/bitnami/bitnami-docker-redis
- http://redis.io/
version: 6.1.5
version: 6.2.0
bitnami/redis-cluster/README.md
+4 -3
View File
@@ -119,7 +119,8 @@ The following table lists the configurable parameters of the Redis<sup>TM</sup>
| `statefulset.rollingUpdatePartition` | Partition update strategy | `nil` |
| `tls.enabled` | Enable TLS support for replication traffic | `false` |
| `tls.authClients` | Require clients to authenticate or not | `true` |
| `tls.certificatesSecret` | Name of the secret that contains the certificates | `nil` |
| `tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` |
| `tls.existingSecret` | The name of the existing secret that contains the TLS certificates | `nil` |
| `tls.certFilename` | Certificate filename | `nil` |
| `tls.certKeyFilename` | Certificate key filename | `nil` |
| `tls.certCAFilename` | CA Certificate filename | `nil` |
@@ -399,7 +400,7 @@ metrics.enabled=true
TLS support can be enabled in the chart by specifying the `tls.` parameters while creating a release. The following parameters should be configured to properly enable the TLS support in the cluster:
- `tls.enabled`: Enable TLS support. Defaults to `false`
- `tls.certificatesSecret`: Name of the secret that contains the certificates. No defaults.
- `tls.existingSecret`: Name of the secret that contains the certificates. No defaults.
- `tls.certFilename`: Certificate filename. No defaults.
- `tls.certKeyFilename`: Certificate key filename. No defaults.
- `tls.certCAFilename`: CA Certificate filename. No defaults.
@@ -416,7 +417,7 @@ Then, use the following parameters:
```console
tls.enabled="true"
tls.certificatesSecret="certificates-tls-secret"
tls.existingSecret="certificates-tls-secret"
tls.certFilename="cert.pem"
tls.certKeyFilename="cert.key"
tls.certCAFilename="ca.pem"
bitnami/redis-cluster/templates/_helpers.tpl
+47 -3
View File
@@ -68,25 +68,58 @@ Return the appropriate apiVersion for PodSecurityPolicy.
{{- end -}}
{{- end -}}
{{/*
Return true if a TLS secret object should be created
*/}}
{{- define "redis-cluster.createTlsSecret" -}}
{{- if and .Values.tls.enabled .Values.tls.autoGenerated (not .Values.tls.existingSecret) (not .Values.tls.certificatesSecret) }}
{{- true -}}
{{- end -}}
{{- end -}}
{{/*
Return the secret containing Redis TLS certificates
*/}}
{{- define "redis-cluster.tlsSecretName" -}}
{{- $secretName := coalesce .Values.tls.existingSecret .Values.tls.certificatesSecret -}}
{{- if $secretName -}}
{{- printf "%s" (tpl $secretName $) -}}
{{- else -}}
{{- printf "%s-crt" (include "common.names.fullname" .) -}}
{{- end -}}
{{- end -}}
{{/*
Return the path to the cert file.
*/}}
{{- define "redis-cluster.tlsCert" -}}
{{- printf "/opt/bitnami/redis/certs/%s" .Values.tls.certFilename -}}
{{- if (include "redis-cluster.createTlsSecret" . ) -}}
{{- printf "/opt/bitnami/redis/certs/%s" "tls.crt" -}}
{{- else -}}
{{- required "Certificate filename is required when TLS in enabled" .Values.tls.certFilename | printf "/opt/bitnami/redis/certs/%s" -}}
{{- end -}}
{{- end -}}
{{/*
Return the path to the cert key file.
*/}}
{{- define "redis-cluster.tlsCertKey" -}}
{{- printf "/opt/bitnami/redis/certs/%s" .Values.tls.certKeyFilename -}}
{{- if (include "redis-cluster.createTlsSecret" . ) -}}
{{- printf "/opt/bitnami/redis/certs/%s" "tls.key" -}}
{{- else -}}
{{- required "Certificate Key filename is required when TLS in enabled" .Values.tls.certKeyFilename | printf "/opt/bitnami/redis/certs/%s" -}}
{{- end -}}
{{- end -}}
{{/*
Return the path to the CA cert file.
*/}}
{{- define "redis-cluster.tlsCACert" -}}
{{- printf "/opt/bitnami/redis/certs/%s" .Values.tls.certCAFilename -}}
{{- if (include "redis-cluster.createTlsSecret" . ) -}}
{{- printf "/opt/bitnami/redis/certs/%s" "ca.crt" -}}
{{- else -}}
{{- required "Certificate CA filename is required when TLS in enabled" .Values.tls.certCAFilename | printf "/opt/bitnami/redis/certs/%s" -}}
{{- end -}}
{{- end -}}
{{/*
@@ -169,6 +202,7 @@ Compile all warnings into a single message, and call fail.
{{- $messages := list -}}
{{- $messages := append $messages (include "redis-cluster.validateValues.updateParameters" .) -}}
{{- $messages := append $messages (include "redis-cluster.validateValues.tlsParameters" .) -}}
{{- $messages := append $messages (include "redis-cluster.validateValues.tls" .) -}}
{{- $messages := without $messages "" -}}
{{- $message := join "\n" $messages -}}
@@ -219,3 +253,13 @@ redis-cluster: TLSSecretMissingCertCA
{{- end -}}
{{- end -}}
{{- end -}}
{{/* Validate values of Redis(TM) - PodSecurityPolicy create */}}
{{- define "redis-cluster.validateValues.tls" -}}
{{- if and .Values.tls.enabled (not .Values.tls.autoGenerated) (not .Values.tls.existingSecret) (not .Values.tls.certificatesSecret) }}
redis-cluster: tls.enabled
In order to enable TLS, you also need to provide
an existing secret containing the TLS certificates or
enable auto-generated certificates.
{{- end -}}
{{- end -}}
bitnami/redis-cluster/templates/redis-statefulset.yaml
+1 -1
View File
@@ -387,7 +387,7 @@ spec:
{{- if .Values.tls.enabled }}
- name: redis-certificates
secret:
secretName: {{ include "common.tplvalues.render" (dict "value" .Values.tls.certificatesSecret "context" $) }}
secretName: {{ include "redis-cluster.tlsSecretName" . }}
defaultMode: 256
{{- end }}
{{- if .Values.persistence.enabled }}
bitnami/redis-cluster/templates/tls-secret.yaml
+26
View File
@@ -0,0 +1,26 @@
{{- if (include "redis-cluster.createTlsSecret" .) }}
{{- $ca := genCA "redis-cluster-ca" 365 }}
{{- $releaseNamespace := .Release.Namespace }}
{{- $clusterDomain := .Values.clusterDomain }}
{{- $fullname := include "common.names.fullname" . }}
{{- $serviceName := include "common.names.fullname" . }}
{{- $headlessServiceName := printf "%s-headless" (include "common.names.fullname" .) }}
{{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) $fullname }}
{{- $crt := genSignedCert $fullname nil $altNames 365 $ca }}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "common.names.fullname" . }}-crt
labels: {{- include "common.labels.standard" . | nindent 4 }}
{{- if .Values.commonLabels }}
{{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
{{- end }}
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
type: kubernetes.io/tls
data:
ca.crt: {{ $ca.Cert | b64enc | quote }}
tls.crt: {{ $crt.Cert | b64enc | quote }}
tls.key: {{ $crt.Key | b64enc | quote }}
{{- end }}
bitnami/redis-cluster/values.yaml
+7 -1
View File
@@ -517,8 +517,14 @@ tls:
#
# Whether to require clients to authenticate or not.
authClients: true
## @param tls.autoGenenerated Enable autogenerated certificates
##
autoGenerated: false
## @param tls.existingSecret Then name of the existing secret that contains the TLS certificates
##
existingSecret:
#
# Name of the Secret that contains the certificates
# DEPRECATED. Use tls.existingSecret instead
certificatesSecret:
#
# Certificate filename