piraeus-operator/operator-https-secret.yaml at main · jwcfree/piraeus-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
{{- $fullName := include "operator.fullname" . -}}
{{- $cn := printf "%s-cs" $fullName -}}
{{- $altName1 := printf "%s.%s" $cn .Release.Namespace }}
{{- $altName2 := printf "%s.%s.svc" $cn .Release.Namespace }}
{{- if (eq .Values.linstorHttpsMethod "helm") }}
{{- $ca := genCA (printf "%s-ca" $fullName) 3650 -}}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "controller.httpsSecretName" . }}
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/resource-policy": "keep"
    "helm.sh/hook": "pre-install"
    "helm.sh/hook-delete-policy": "before-hook-creation"
type: kubernetes.io/tls
data:
  {{- with genSignedCert $cn (list "::1" "127.0.0.1") (list $cn $altName1 $altName2 "localhost") 3650 $ca }}
  tls.crt: {{ b64enc .Cert }}
  tls.key: {{ b64enc .Key }}
  ca.crt: {{ b64enc $ca.Cert }}
  {{- end }}
---
apiVersion: v1
kind: Secret
metadata:
  name: {{ template "client.httpsSecretName" . }}
  namespace: {{ .Release.Namespace }}
  annotations:
    "helm.sh/resource-policy": "keep"
    "helm.sh/hook": "pre-install"
    "helm.sh/hook-delete-policy": "before-hook-creation"
type: kubernetes.io/tls
data:
  {{- with genSignedCert (printf "%s-client" $fullName) nil nil 3650 $ca }}
  tls.crt: {{ b64enc .Cert }}
  tls.key: {{ b64enc .Key }}
  ca.crt: {{ b64enc $ca.Cert }}
  {{- end }}
{{- else if (eq .Values.linstorHttpsMethod "cert-manager") }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ template "controller.httpsSecretName" . }}
  namespace: {{ .Release.Namespace }}
spec:
  secretName: {{ template "controller.httpsSecretName" . }}
  commonName: {{ $cn }}
  ipAddresses:
  - "::1"
  - "127.0.0.1"
  dnsNames:
  - {{ $cn }}
  - {{ $altName1 }}
  - {{ $altName2 }}
  - localhost
  duration: 87600h # 3650d
  usages:
  - "signing"
  - "key encipherment"
  - "server auth"
  issuerRef:
    name: {{ $fullName }}-ca-issuer
    kind: Issuer
    group: cert-manager.io
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: {{ template "client.httpsSecretName" . }}
  namespace: {{ .Release.Namespace }}
spec:
  secretName: {{ template "client.httpsSecretName" . }}
  commonName: {{ $cn }}-client
  duration: 87600h # 3650d
  usages:
  - "signing"
  - "key encipherment"
  - "client auth"
  issuerRef:
    name: {{ $fullName }}-ca-issuer
    kind: Issuer
    group: cert-manager.io
{{- else if (not (eq (.Values.linstorHttpsMethod | default "manual") "manual"))  }}
{{- fail ".Values.linstorHttpsMethod is not set to <manual|helm|cert-manager>" }}
{{- end }}