From df6d30357aecd66dcf8f35a37e6df0db34c18521 Mon Sep 17 00:00:00 2001 From: cccs-jc Date: Sat, 7 Dec 2019 17:21:32 -0500 Subject: [PATCH] Fix boolean logic with regards to spark secure connections Also added a tls entry for the ingress template --- bitnami/spark/templates/ingress.yaml | 4 +++ .../spark/templates/statefulset-master.yaml | 34 ++++++++---------- .../spark/templates/statefulset-worker.yaml | 35 ++++++++----------- bitnami/spark/values-production.yaml | 14 +++++--- bitnami/spark/values.yaml | 14 +++++--- 5 files changed, 52 insertions(+), 49 deletions(-) diff --git a/bitnami/spark/templates/ingress.yaml b/bitnami/spark/templates/ingress.yaml index 548d4dd23..05e21ba3b 100644 --- a/bitnami/spark/templates/ingress.yaml +++ b/bitnami/spark/templates/ingress.yaml @@ -23,4 +23,8 @@ spec: serviceName: {{ include "spark.fullname" $ }}-master-svc servicePort: http {{- end }} + {{- if .Values.ingress.tls }} + tls: +{{ toYaml .Values.ingress.tls | indent 4 }} + {{- end }} {{- end }} diff --git a/bitnami/spark/templates/statefulset-master.yaml b/bitnami/spark/templates/statefulset-master.yaml index a919fa7bb..d4c66e3ef 100644 --- a/bitnami/spark/templates/statefulset-master.yaml +++ b/bitnami/spark/templates/statefulset-master.yaml @@ -71,49 +71,45 @@ spec: - name: SPARK_MASTER_OPTS value: {{ .Values.master.configOptions | quote }} {{- end }} - {{- if eq ( .Values.security.rpc.authenticationEnabled | quote ) "yes" }} + {{- if .Values.security.rpc.authenticationEnabled }} - name: SPARK_RPC_AUTHENTICATION_ENABLED value: {{ .Values.security.rpc.authenticationEnabled | quote }} - name: SPARK_RPC_AUTHENTICATION_SECRET valueFrom: secretKeyRef: - {{- if .Values.security.passwordsSecretName }} name: {{ .Values.security.passwordsSecretName }} - {{- else }} - name: {{ include "spark.fullname" . }}-secret - {{- end }} key: rpc-authentication-secret {{- end }} - {{- if eq ( .Values.security.encryptionEnabled | quote ) "yes" }} + {{- if .Values.security.rpc.encryptionEnabled }} - name: SPARK_RPC_ENCRYPTION_ENABLED value: {{ .Values.security.rpc.encryptionEnabled | quote }} {{- end }} - {{- if eq ( .Values.security.storageEncriptionEnabled | quote ) "yes" }} + {{- if .Values.security.storageEncryptionEnabled }} - name: SPARK_LOCAL_STORAGE_ENCRYPTION_ENABLED value: {{ .Values.security.storageEncryptionEnabled | quote }} {{- end }} - {{- if eq ( .Values.security.ssl.enabled | quote ) "yes" }} + {{- if .Values.security.ssl.enabled }} - name: SPARK_SSL_ENABLED value: {{ .Values.security.ssl.enabled | quote }} - name: SPARK_SSL_KEY_PASSWORD valueFrom: secretKeyRef: - name: {{ template "spark.get.passwordSecretName" }} + name: {{ .Values.security.passwordsSecretName }} key: ssl-key-password - name: SPARK_SSL_KEYSTORE_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "spark.get.passwordSecretName" }} - key: ssl-keystore-password + valueFrom: + secretKeyRef: + name: {{ .Values.security.passwordsSecretName }} + key: ssl-keystore-password - name: SPARK_SSL_TRUSTSTORE_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "spark.get.passwordSecretName" }} - key: ssl-truststore-password + valueFrom: + secretKeyRef: + name: {{ .Values.security.passwordsSecretName }} + key: ssl-truststore-password - name: SPARK_SSL_NEED_CLIENT_AUTH - value: {{ .Values.security.ssl.needClientAuth }} + value: {{ .Values.security.ssl.needClientAuth | quote }} - name: SPARK_SSL_PROTOCOL - value: {{ .Values.security.ssl.protocol }} + value: {{ .Values.security.ssl.protocol | quote }} {{- end }} {{- if .Values.master.extraEnvVars }} {{- toYaml .Values.master.extraEnvVars | nindent 10 }} diff --git a/bitnami/spark/templates/statefulset-worker.yaml b/bitnami/spark/templates/statefulset-worker.yaml index 2215f0528..ea20f4e3a 100644 --- a/bitnami/spark/templates/statefulset-worker.yaml +++ b/bitnami/spark/templates/statefulset-worker.yaml @@ -89,50 +89,45 @@ spec: # If you use a custom properties file, it must be loaded using a ConfigMap - name: SPARK_WORKER_OPTS value: {{ .Values.worker.configOptions }} - {{- if eq ( .Values.security.rpc.authenticationEnabled | quote ) "yes" }} + {{- if .Values.security.rpc.authenticationEnabled }} - name: SPARK_RPC_AUTHENTICATION_ENABLED value: {{ .Values.security.rpc.authenticationEnabled | quote }} - name: SPARK_RPC_AUTHENTICATION_SECRET valueFrom: secretKeyRef: - {{- if .Values.security.passwordsSecretName }} name: {{ .Values.security.passwordsSecretName }} key: rpc-authentication-secret - {{- else }} - name: {{ include "spark.fullname" . }}-secret - key: rpc-authentication-secret - {{- end }} {{- end }} - {{- if eq ( .Values.security.encryptionEnabled | quote ) "yes" }} + {{- if .Values.security.rpc.encryptionEnabled }} - name: SPARK_RPC_ENCRYPTION_ENABLED value: {{ .Values.security.rpc.encryptionEnabled | quote }} {{- end }} - {{- if eq ( .Values.security.storageEncriptionEnabled | quote ) "yes" }} + {{- if .Values.security.storageEncryptionEnabled }} - name: SPARK_LOCAL_STORAGE_ENCRYPTION_ENABLED value: {{ .Values.security.storageEncryptionEnabled | quote }} {{- end }} - {{- if eq ( .Values.security.ssl.enabled | quote ) "yes" }} + {{- if .Values.security.ssl.enabled }} - name: SPARK_SSL_ENABLED value: {{ .Values.security.ssl.enabled | quote }} - name: SPARK_SSL_KEY_PASSWORD valueFrom: secretKeyRef: - name: {{ template "spark.get.passwordSecretName" }} + name: {{ .Values.security.passwordsSecretName }} key: ssl-key-password - name: SPARK_SSL_KEYSTORE_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "spark.get.passwordSecretName" }} - key: ssl-keystore-password + valueFrom: + secretKeyRef: + name: {{ .Values.security.passwordsSecretName }} + key: ssl-keystore-password - name: SPARK_SSL_TRUSTSTORE_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "spark.get.passwordSecretName" }} - key: ssl-truststore-password + valueFrom: + secretKeyRef: + name: {{ .Values.security.passwordsSecretName }} + key: ssl-truststore-password - name: SPARK_SSL_NEED_CLIENT_AUTH - value: {{ .Values.security.ssl.needClientAuth }} + value: {{ .Values.security.ssl.needClientAuth | quote }} - name: SPARK_SSL_PROTOCOL - value: {{ .Values.security.ssl.protocol }} + value: {{ .Values.security.ssl.protocol | quote }} {{- end }} {{- if .Values.master.extraEnvVars }} {{- toYaml .Values.master.extraEnvVars | nindent 12 }} diff --git a/bitnami/spark/values-production.yaml b/bitnami/spark/values-production.yaml index ddf62ca73..8e851d44d 100644 --- a/bitnami/spark/values-production.yaml +++ b/bitnami/spark/values-production.yaml @@ -243,18 +243,18 @@ security: ## RPC configuration ## rpc: - authenticationEnabled: "yes" - encryptionEnabled: "yes" + authenticationEnabled: true + encryptionEnabled: true ## Enables local storage encryption ## - storageEncryptionEnabled: "yes" + storageEncryptionEnabled: true ## SSL configuration ## ssl: - enabled: "yes" - needClientAuth: "yes" + enabled: true + needClientAuth: true protocol: TLSv1.2 ## Name of the secret that contains the certificates @@ -316,3 +316,7 @@ ingress: hosts: - name: spark.local path: / + tls: + - hosts: + - spark.domain.com + secretName: spark.local-tls diff --git a/bitnami/spark/values.yaml b/bitnami/spark/values.yaml index 9c5edbc12..6b0473539 100644 --- a/bitnami/spark/values.yaml +++ b/bitnami/spark/values.yaml @@ -243,12 +243,12 @@ security: ## RPC configuration ## rpc: - authenticationEnabled: "no" - encryptionEnabled: "no" + authenticationEnabled: false + encryptionEnabled: false ## Enables local storage encryption ## - storageEncryptionEnabled: "no" + storageEncryptionEnabled: false ## Name of the secret that contains the certificates ## It should contains two keys called "spark-keystore.jks" and "spark-truststore.jks" with the files in JKS format. @@ -258,8 +258,8 @@ security: ## SSL configuration ## ssl: - enabled: "no" - needClientAuth: "no" + enabled: false + needClientAuth: false protocol: TLSv1.2 ## Service parameters @@ -316,3 +316,7 @@ ingress: hosts: - name: spark.local path: / + tls: + - hosts: + - spark.domain.com + secretName: spark.local-tls