Skip to content

Commit a36a7dc

Browse files
jiparisjiparis
authored
feat(verification): support multiple CAs in helm chart (#1823)
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
1 parent 561e456 commit a36a7dc

8 files changed

Lines changed: 179 additions & 94 deletions

File tree

‎deployment/chainloop/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ description: Chainloop is an open source software supply chain control plane, a
77

88
type: application
99
# Bump the patch (not minor, not major) version on each change in the Chart Source code
10-
version: 1.182.0
10+
version: 1.182.1
1111
# Do not update appVersion, this is handled automatically by the release process
1212
appVersion: v0.164.0
1313

‎deployment/chainloop/README.md‎

Lines changed: 63 additions & 60 deletions
Large diffs are not rendered by default.

‎deployment/chainloop/templates/controlplane/deployment.yaml‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -149,13 +149,21 @@ spec:
149149
- name: jwt-cas-private-key
150150
mountPath: /secrets
151151
{{- if and .Values.controlplane.keylessSigning.enabled (eq "fileCA" .Values.controlplane.keylessSigning.backend) }}
152+
# deprecated
152153
- name: file-ca-cert
153154
mountPath: /ca_secrets
154155
{{- end }}
155156
{{- if and .Values.controlplane.keylessSigning.enabled (eq "ejbcaCA" .Values.controlplane.keylessSigning.backend) }}
157+
# deprecated
156158
- name: ejbca-ca-client
157159
mountPath: /ca_secrets
158160
{{- end }}
161+
{{- if .Values.controlplane.keylessSigning.enabled }}
162+
{{- range $index, $backend := .Values.controlplane.keylessSigning.backends }}
163+
- name: sign-backend-{{$backend.type}}-{{$index}}
164+
mountPath: /sign_secrets_{{$backend.type}}_{{$index}}
165+
{{- end }}
166+
{{- end }}
159167
{{- if include "controlplane.tls-secret-name" . }}
160168
- name: server-certs
161169
mountPath: /data/server-certs
@@ -198,6 +206,18 @@ spec:
198206
- name: jwt-cas-private-key
199207
secret:
200208
secretName: {{ include "chainloop.controlplane.fullname" . }}-jwt-cas
209+
{{- if and .Values.controlplane.keylessSigning.enabled (eq "fileCA" .Values.controlplane.keylessSigning.backend) }}
210+
# deprecated
211+
- name: file-ca-cert
212+
secret:
213+
secretName: {{ include "chainloop.controlplane.fullname" . }}-keyless-file-ca
214+
{{- end }}
215+
{{- if and .Values.controlplane.keylessSigning.enabled (eq "ejbcaCA" .Values.controlplane.keylessSigning.backend) }}
216+
# deprecated
217+
- name: ejbca-ca-client
218+
secret:
219+
secretName: {{ include "chainloop.controlplane.fullname" . }}-keyless-ejbca-ca
220+
{{- end }}
201221
{{- if include "controlplane.tls-secret-name" . }}
202222
- name: server-certs
203223
secret:
@@ -208,15 +228,12 @@ spec:
208228
secret:
209229
secretName: {{ include "chainloop.controlplane.fullname" . }}-gcp-secretmanager-serviceaccountkey
210230
{{- end }}
211-
{{- if and .Values.controlplane.keylessSigning.enabled (eq "fileCA" .Values.controlplane.keylessSigning.backend) }}
212-
- name: file-ca-cert
213-
secret:
214-
secretName: {{ include "chainloop.controlplane.fullname" . }}-keyless-file-ca
231+
{{- if and .Values.controlplane.keylessSigning.enabled }}
232+
{{- range $index, $backend := .Values.controlplane.keylessSigning.backends }}
233+
- name: sign-backend-{{$backend.type}}-{{$index}}
234+
secrets:
235+
secretName: {{ include "chainloop.controlplane.fullname" $ }}-keyless-{{$backend.type}}-{{$index}}
215236
{{- end }}
216-
{{- if and .Values.controlplane.keylessSigning.enabled (eq "ejbcaCA" .Values.controlplane.keylessSigning.backend) }}
217-
- name: ejbca-ca-client
218-
secret:
219-
secretName: {{ include "chainloop.controlplane.fullname" . }}-keyless-ejbca-ca
220237
{{- end }}
221238
{{- if .Values.controlplane.extraVolumes }}
222239
{{- include "common.tplvalues.render" (dict "value" .Values.controlplane.extraVolumes "context" $) | nindent 8 }}

‎deployment/chainloop/templates/controlplane/secret-config.yaml‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ stringData:
2727
{{- include "chainloop.sentry" .Values.controlplane.sentry | nindent 4 }}
2828
{{- end }}
2929
{{- if and .Values.controlplane.keylessSigning.enabled (eq "fileCA" .Values.controlplane.keylessSigning.backend) }}
30+
# deprecated
3031
fileca.secret.yaml: |
3132
{{- with .Values.controlplane.keylessSigning.fileCA }}
3233
certificate_authorities:
@@ -38,6 +39,7 @@ stringData:
3839
{{- end }}
3940
{{- end }}
4041
{{- if and .Values.controlplane.keylessSigning.enabled (eq "ejbcaCA" .Values.controlplane.keylessSigning.backend) }}
42+
# deprecated
4143
ejbca.secret.yaml: |
4244
{{- with .Values.controlplane.keylessSigning.ejbcaCA }}
4345
certificate_authorities:
@@ -50,7 +52,34 @@ stringData:
5052
end_entity_profile_name: "{{- required "EJBCA end entity profile name is mandatory" .endEntityProfileName }}"
5153
certificate_authority_name: "{{- required "EJBCA certificate authority name is mandatory" .caName }}"
5254
{{- end }}
53-
{{- end }}
55+
{{- end }}
56+
{{- if and .Values.controlplane.keylessSigning.enabled .Values.controlplane.keylessSigning.backends }}
57+
signing.secrets.yaml: |
58+
certificate_authorities:
59+
{{- range $index, $backend := .Values.controlplane.keylessSigning.backends }}
60+
{{- if eq "fileCA" $backend.type }}
61+
{{- with $backend.fileCA }}
62+
- issuer: {{default false $backend.issuer }}
63+
file_ca:
64+
cert_path: "/sign_secrets_{{$backend.type}}_{{$index}}/file_ca.cert"
65+
key_path: "/sign_secrets_{{$backend.type}}_{{$index}}/file_ca.key"
66+
key_pass: "{{- required "FileCA keyPass is mandatory" .keyPass }}"
67+
{{- end }}
68+
{{- else if eq "ejbcaCA" $backend.type }}
69+
{{- with $backend.ejbcaCA }}
70+
- issuer: {{default false $backend.issuer}}
71+
ejbca_ca:
72+
cert_path: "/sign_secrets_{{$backend.type}}_{{$index}}/ejbca_client.cert"
73+
key_path: "/sign_secrets_{{$backend.type}}_{{$index}}/ejbca_client.key"
74+
root_ca_path: "/sign_secrets_{{$backend.type}}_{{$index}}/ejbca_ca.cert"
75+
server_url: "{{- required "EJBCA server URL is mandatory" .serverURL }}"
76+
certificate_profile_name: "{{- required "EJBCA certificate profile name is mandatory" .certProfileName }}"
77+
end_entity_profile_name: "{{- required "EJBCA end entity profile name is mandatory" .endEntityProfileName }}"
78+
certificate_authority_name: "{{- required "EJBCA certificate authority name is mandatory" .caName }}"
79+
{{- end }}
80+
{{- end }}
81+
{{- end }}
82+
{{- end }}
5483
config.secret.yaml: |
5584
data:
5685
database:

‎deployment/chainloop/templates/controlplane/secret-ejbca-ca.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ SPDX-License-Identifier: APACHE-2.0
44
*/}}
55

66
{{- if and .Values.controlplane.keylessSigning.enabled (eq "ejbcaCA" .Values.controlplane.keylessSigning.backend) }}
7+
# deprecated
78
apiVersion: v1
89
kind: Secret
910
metadata:
@@ -14,4 +15,4 @@ type: Opaque
1415
data:
1516
ejbca_client.cert: {{ .Values.controlplane.keylessSigning.ejbcaCA.clientCert | b64enc | quote }}
1617
ejbca_client.key: {{ .Values.controlplane.keylessSigning.ejbcaCA.clientKey | b64enc | quote }}
17-
{{- end }}
18+
{{- end }}

‎deployment/chainloop/templates/controlplane/secret-file-ca.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ SPDX-License-Identifier: APACHE-2.0
44
*/}}
55

66
{{- if and .Values.controlplane.keylessSigning.enabled (eq "fileCA" .Values.controlplane.keylessSigning.backend) }}
7+
# deprecated
78
apiVersion: v1
89
kind: Secret
910
metadata:
@@ -14,4 +15,4 @@ type: Opaque
1415
data:
1516
file_ca.cert: {{ .Values.controlplane.keylessSigning.fileCA.cert | b64enc | quote }}
1617
file_ca.key: {{ .Values.controlplane.keylessSigning.fileCA.key | b64enc | quote }}
17-
{{- end }}
18+
{{- end }}

‎deployment/chainloop/templates/controlplane/secrets-signer-ca.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{{- /*
2+
Copyright Chainloop, Inc. All Rights Reserved.
3+
SPDX-License-Identifier: APACHE-2.0
4+
*/}}
5+
6+
7+
{{- if .Values.controlplane.keylessSigning.enabled }}
8+
{{- range $index, $backend := .Values.controlplane.keylessSigning.backends }}
9+
---
10+
apiVersion: v1
11+
kind: Secret
12+
metadata:
13+
name: {{ include "chainloop.controlplane.fullname" $ }}-keyless-{{$backend.type}}-{{$index}}
14+
labels:
15+
{{- include "chainloop.controlplane.labels" $ | nindent 4 }}
16+
type: Opaque
17+
data:
18+
{{- if eq "fileCA" $backend.type }}
19+
file_ca.cert: {{ $backend.fileCA.cert | b64enc | quote }}
20+
file_ca.key: {{ $backend.fileCA.key | b64enc | quote }}
21+
{{- else if eq "ejbcaCA" $backend.type }}
22+
ejbca_client.cert: {{ $backend.ejbcaCA.clientCert | b64enc | quote }}
23+
ejbca_client.key: {{ $backend.ejbcaCA.clientKey | b64enc | quote }}
24+
ejbca_ca.cert: {{ $backend.ejbcaCA.caCert | b64enc | quote }}
25+
{{- end }}
26+
{{- end }}
27+
{{- end }}

‎deployment/chainloop/values.yaml‎

Lines changed: 29 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -658,36 +658,43 @@ controlplane:
658658

659659
## Configuration for keyless signing using one of the supported providers
660660
## @param controlplane.keylessSigning.enabled Activates or deactivates the feature
661-
## @param controlplane.keylessSigning.backend The backend to use. Currently only "fileCA" and "ejbcaCA" are supported
662-
## @param controlplane.keylessSigning.fileCA.cert The PEM-encoded certificate of the file based CA
661+
## @param controlplane.keylessSigning.backends[0].issuer Whether this backend should be used to issue new certificates. Only one can be set at a time.
662+
## @param controlplane.keylessSigning.backends[0].type backend type. Only "fileCA" and "ejbcaCA" are supported
663+
## @param controlplane.keylessSigning.backends[0].fileCA.cert The PEM-encoded certificate of the file based CA
663664
## -----BEGIN CERTIFICATE-----
664665
## ...
665666
## -----END CERTIFICATE-----
666-
## @param controlplane.keylessSigning.fileCA.key The PEM-encoded private key of the file based CA
667+
## @param controlplane.keylessSigning.backends[0].fileCA.key The PEM-encoded private key of the file based CA
667668
## -----BEGIN RSA PRIVATE KEY-----
668669
## ...
669670
## -----END RSA PRIVATE KEY-----
670-
## @param controlplane.keylessSigning.fileCA.keyPass The secret key pass
671-
## @param controlplane.keylessSigning.ejbcaCA.serverURL The url of the EJBCA service ("https://host/ejbca")
672-
## @param controlplane.keylessSigning.ejbcaCA.clientKey PEM-encoded the private key for EJBCA cert authentication
673-
## @param controlplane.keylessSigning.ejbcaCA.clientCert PEM-encoded certificate for EJBCA cert authentication
674-
## @param controlplane.keylessSigning.ejbcaCA.certProfileName Name of the certificate profile to use in EJBCA
675-
## @param controlplane.keylessSigning.ejbcaCA.endEntityProfileName Name of the Entity Profile to use in EJBCA
676-
## @param controlplane.keylessSigning.ejbcaCA.caName Name of the CA issuer to use in EJBCA
671+
## @param controlplane.keylessSigning.backends[0].fileCA.keyPass The secret key pass
672+
## @param controlplane.keylessSigning.backends[1].type backend type. Only "fileCA" and "ejbcaCA" are supported
673+
## @param controlplane.keylessSigning.backends[1].ejbcaCA.serverURL The url of the EJBCA service ("https://host/ejbca")
674+
## @param controlplane.keylessSigning.backends[1].ejbcaCA.clientKey PEM-encoded the private key for EJBCA cert authentication
675+
## @param controlplane.keylessSigning.backends[1].ejbcaCA.clientCert PEM-encoded certificate for EJBCA cert authentication
676+
## @param controlplane.keylessSigning.backends[1].ejbcaCA.caCert PEM-encoded certificate of the root CA
677+
## @param controlplane.keylessSigning.backends[1].ejbcaCA.certProfileName Name of the certificate profile to use in EJBCA
678+
## @param controlplane.keylessSigning.backends[1].ejbcaCA.endEntityProfileName Name of the Entity Profile to use in EJBCA
679+
## @param controlplane.keylessSigning.backends[1].ejbcaCA.caName Name of the CA issuer to use in EJBCA
677680
keylessSigning:
678681
enabled: false
679-
backend: fileCA
680-
fileCA:
681-
cert: ""
682-
key: ""
683-
keyPass: ""
684-
ejbcaCA:
685-
serverURL: ""
686-
clientKey: ""
687-
clientCert: ""
688-
certProfileName: ""
689-
endEntityProfileName: ""
690-
caName: ""
682+
backends:
683+
- type: fileCA
684+
fileCA:
685+
cert: ""
686+
key: ""
687+
keyPass: "foo"
688+
issuer: true
689+
- type: ejbcaCA
690+
ejbcaCA:
691+
serverURL: ""
692+
clientKey: ""
693+
clientCert: ""
694+
caCert: ""
695+
certProfileName: ""
696+
endEntityProfileName: ""
697+
caName: ""
691698

692699
## Inject custom CA certificates to the controlplane container
693700
## @param controlplane.customCAs List of custom CA certificates content

0 commit comments

Comments
 (0)