diff --git a/bitnami/redis-cluster/Chart.yaml b/bitnami/redis-cluster/Chart.yaml index 4e91c1970..825a50ed7 100644 --- a/bitnami/redis-cluster/Chart.yaml +++ b/bitnami/redis-cluster/Chart.yaml @@ -23,4 +23,4 @@ name: redis-cluster sources: - https://github.com/bitnami/bitnami-docker-redis - http://redis.io/ -version: 6.1.5 +version: 6.2.0 diff --git a/bitnami/redis-cluster/README.md b/bitnami/redis-cluster/README.md index 11a38f7cc..726389999 100644 --- a/bitnami/redis-cluster/README.md +++ b/bitnami/redis-cluster/README.md @@ -119,7 +119,8 @@ The following table lists the configurable parameters of the RedisTM | `statefulset.rollingUpdatePartition` | Partition update strategy | `nil` | | `tls.enabled` | Enable TLS support for replication traffic | `false` | | `tls.authClients` | Require clients to authenticate or not | `true` | -| `tls.certificatesSecret` | Name of the secret that contains the certificates | `nil` | +| `tls.autoGenerated` | Generate automatically self-signed TLS certificates | `false` | +| `tls.existingSecret` | The name of the existing secret that contains the TLS certificates | `nil` | | `tls.certFilename` | Certificate filename | `nil` | | `tls.certKeyFilename` | Certificate key filename | `nil` | | `tls.certCAFilename` | CA Certificate filename | `nil` | @@ -399,7 +400,7 @@ metrics.enabled=true TLS support can be enabled in the chart by specifying the `tls.` parameters while creating a release. The following parameters should be configured to properly enable the TLS support in the cluster: - `tls.enabled`: Enable TLS support. Defaults to `false` -- `tls.certificatesSecret`: Name of the secret that contains the certificates. No defaults. +- `tls.existingSecret`: Name of the secret that contains the certificates. No defaults. - `tls.certFilename`: Certificate filename. No defaults. - `tls.certKeyFilename`: Certificate key filename. No defaults. - `tls.certCAFilename`: CA Certificate filename. No defaults. @@ -416,7 +417,7 @@ Then, use the following parameters: ```console tls.enabled="true" -tls.certificatesSecret="certificates-tls-secret" +tls.existingSecret="certificates-tls-secret" tls.certFilename="cert.pem" tls.certKeyFilename="cert.key" tls.certCAFilename="ca.pem" diff --git a/bitnami/redis-cluster/templates/_helpers.tpl b/bitnami/redis-cluster/templates/_helpers.tpl index 660b3b90d..90e58a44f 100644 --- a/bitnami/redis-cluster/templates/_helpers.tpl +++ b/bitnami/redis-cluster/templates/_helpers.tpl @@ -68,25 +68,58 @@ Return the appropriate apiVersion for PodSecurityPolicy. {{- end -}} {{- end -}} +{{/* +Return true if a TLS secret object should be created +*/}} +{{- define "redis-cluster.createTlsSecret" -}} +{{- if and .Values.tls.enabled .Values.tls.autoGenerated (not .Values.tls.existingSecret) (not .Values.tls.certificatesSecret) }} + {{- true -}} +{{- end -}} +{{- end -}} + +{{/* +Return the secret containing Redis TLS certificates +*/}} +{{- define "redis-cluster.tlsSecretName" -}} +{{- $secretName := coalesce .Values.tls.existingSecret .Values.tls.certificatesSecret -}} +{{- if $secretName -}} + {{- printf "%s" (tpl $secretName $) -}} +{{- else -}} + {{- printf "%s-crt" (include "common.names.fullname" .) -}} +{{- end -}} +{{- end -}} + {{/* Return the path to the cert file. */}} {{- define "redis-cluster.tlsCert" -}} -{{- printf "/opt/bitnami/redis/certs/%s" .Values.tls.certFilename -}} +{{- if (include "redis-cluster.createTlsSecret" . ) -}} + {{- printf "/opt/bitnami/redis/certs/%s" "tls.crt" -}} +{{- else -}} + {{- required "Certificate filename is required when TLS in enabled" .Values.tls.certFilename | printf "/opt/bitnami/redis/certs/%s" -}} +{{- end -}} {{- end -}} {{/* Return the path to the cert key file. */}} {{- define "redis-cluster.tlsCertKey" -}} -{{- printf "/opt/bitnami/redis/certs/%s" .Values.tls.certKeyFilename -}} +{{- if (include "redis-cluster.createTlsSecret" . ) -}} + {{- printf "/opt/bitnami/redis/certs/%s" "tls.key" -}} +{{- else -}} + {{- required "Certificate Key filename is required when TLS in enabled" .Values.tls.certKeyFilename | printf "/opt/bitnami/redis/certs/%s" -}} +{{- end -}} {{- end -}} {{/* Return the path to the CA cert file. */}} {{- define "redis-cluster.tlsCACert" -}} -{{- printf "/opt/bitnami/redis/certs/%s" .Values.tls.certCAFilename -}} +{{- if (include "redis-cluster.createTlsSecret" . ) -}} + {{- printf "/opt/bitnami/redis/certs/%s" "ca.crt" -}} +{{- else -}} + {{- required "Certificate CA filename is required when TLS in enabled" .Values.tls.certCAFilename | printf "/opt/bitnami/redis/certs/%s" -}} +{{- end -}} {{- end -}} {{/* @@ -169,6 +202,7 @@ Compile all warnings into a single message, and call fail. {{- $messages := list -}} {{- $messages := append $messages (include "redis-cluster.validateValues.updateParameters" .) -}} {{- $messages := append $messages (include "redis-cluster.validateValues.tlsParameters" .) -}} +{{- $messages := append $messages (include "redis-cluster.validateValues.tls" .) -}} {{- $messages := without $messages "" -}} {{- $message := join "\n" $messages -}} @@ -219,3 +253,13 @@ redis-cluster: TLSSecretMissingCertCA {{- end -}} {{- end -}} {{- end -}} + +{{/* Validate values of Redis(TM) - PodSecurityPolicy create */}} +{{- define "redis-cluster.validateValues.tls" -}} +{{- if and .Values.tls.enabled (not .Values.tls.autoGenerated) (not .Values.tls.existingSecret) (not .Values.tls.certificatesSecret) }} +redis-cluster: tls.enabled + In order to enable TLS, you also need to provide + an existing secret containing the TLS certificates or + enable auto-generated certificates. +{{- end -}} +{{- end -}} diff --git a/bitnami/redis-cluster/templates/redis-statefulset.yaml b/bitnami/redis-cluster/templates/redis-statefulset.yaml index 8c686f8b8..f1afa2d12 100644 --- a/bitnami/redis-cluster/templates/redis-statefulset.yaml +++ b/bitnami/redis-cluster/templates/redis-statefulset.yaml @@ -387,7 +387,7 @@ spec: {{- if .Values.tls.enabled }} - name: redis-certificates secret: - secretName: {{ include "common.tplvalues.render" (dict "value" .Values.tls.certificatesSecret "context" $) }} + secretName: {{ include "redis-cluster.tlsSecretName" . }} defaultMode: 256 {{- end }} {{- if .Values.persistence.enabled }} diff --git a/bitnami/redis-cluster/templates/tls-secret.yaml b/bitnami/redis-cluster/templates/tls-secret.yaml new file mode 100644 index 000000000..a9833e9e1 --- /dev/null +++ b/bitnami/redis-cluster/templates/tls-secret.yaml @@ -0,0 +1,26 @@ +{{- if (include "redis-cluster.createTlsSecret" .) }} +{{- $ca := genCA "redis-cluster-ca" 365 }} +{{- $releaseNamespace := .Release.Namespace }} +{{- $clusterDomain := .Values.clusterDomain }} +{{- $fullname := include "common.names.fullname" . }} +{{- $serviceName := include "common.names.fullname" . }} +{{- $headlessServiceName := printf "%s-headless" (include "common.names.fullname" .) }} +{{- $altNames := list (printf "*.%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $serviceName $releaseNamespace $clusterDomain) (printf "*.%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) (printf "%s.%s.svc.%s" $headlessServiceName $releaseNamespace $clusterDomain) $fullname }} +{{- $crt := genSignedCert $fullname nil $altNames 365 $ca }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }}-crt + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: kubernetes.io/tls +data: + ca.crt: {{ $ca.Cert | b64enc | quote }} + tls.crt: {{ $crt.Cert | b64enc | quote }} + tls.key: {{ $crt.Key | b64enc | quote }} +{{- end }} diff --git a/bitnami/redis-cluster/values.yaml b/bitnami/redis-cluster/values.yaml index afee758e4..2cbef8c8d 100644 --- a/bitnami/redis-cluster/values.yaml +++ b/bitnami/redis-cluster/values.yaml @@ -517,8 +517,14 @@ tls: # # Whether to require clients to authenticate or not. authClients: true + ## @param tls.autoGenenerated Enable autogenerated certificates + ## + autoGenerated: false + ## @param tls.existingSecret Then name of the existing secret that contains the TLS certificates + ## + existingSecret: # - # Name of the Secret that contains the certificates + # DEPRECATED. Use tls.existingSecret instead certificatesSecret: # # Certificate filename