From 522066e9f95cf5eb8394c9cfc86a1f0217d8c867 Mon Sep 17 00:00:00 2001 From: Marco Franssen Date: Wed, 19 Jul 2023 18:13:50 +0200 Subject: [PATCH] Align tornjak clientCA naming convention (#393) --- charts/spire/README.md | 4 ++-- charts/spire/charts/spire-server/README.md | 6 +++--- charts/spire/charts/spire-server/README.md.gotmpl | 2 +- charts/spire/charts/spire-server/templates/_helpers.tpl | 4 ++-- .../spire/charts/spire-server/templates/statefulset.yaml | 8 ++++---- charts/spire/charts/spire-server/values.yaml | 6 +++--- 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/charts/spire/README.md b/charts/spire/README.md index 191f61d..ae7b0f6 100644 --- a/charts/spire/README.md +++ b/charts/spire/README.md @@ -398,10 +398,10 @@ Now you can interact with the Spire agent socket from your own application. The | spire-server.tools.kubectl.image.tag | string | `""` | Overrides the image tag | | spire-server.tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | spire-server.topologySpreadConstraints | list | `[]` | | +| spire-server.tornjak.config.clientCA.name | string | `"tornjak-client-ca"` | | +| spire-server.tornjak.config.clientCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | | spire-server.tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information | | spire-server.tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | -| spire-server.tornjak.config.userCA.name | string | `"tornjak-user-ca"` | | -| spire-server.tornjak.config.userCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | | spire-server.tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) | | spire-server.tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy | | spire-server.tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from | diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index f139ec2..3bd7f57 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -68,7 +68,7 @@ Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/ Here is an example using a *Secret* in `spire-server` namespace: ```console -kubectl -n spire-server create secret generic tornjak-user-ca --from-file=ca.crt="CA/rootCA.crt" +kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt" ``` Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost): @@ -198,10 +198,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | tools.kubectl.image.tag | string | `""` | Overrides the image tag | | tools.kubectl.image.version | string | `""` | This value is deprecated in favor of tag. (Will be removed in a future release) | | topologySpreadConstraints | list | `[]` | | +| tornjak.config.clientCA.name | string | `"tornjak-client-ca"` | | +| tornjak.config.clientCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | | tornjak.config.dataStore | object | `{"driver":"sqlite3","file":"/run/spire/data/tornjak.sqlite3"}` | Persistent DB for storing Tornjak specific information | | tornjak.config.tlsSecret | string | `"tornjak-tls-secret"` | Name of the secret containing server side key and certificate for TLS verification (required for `tls` or `mtls` connectionType) | -| tornjak.config.userCA.name | string | `"tornjak-user-ca"` | | -| tornjak.config.userCA.type | string | `"Secret"` | Type of delivery for the user CA for mTLS client verification options are `Secret` or `ConfigMap` (required for `mtls` connectionType) | | tornjak.enabled | bool | `false` | Deploys Tornjak API (backend) (Not for production) | | tornjak.image.pullPolicy | string | `"IfNotPresent"` | The Tornjak image pull policy | | tornjak.image.registry | string | `"ghcr.io"` | The OCI registry to pull the Tornjak image from | diff --git a/charts/spire/charts/spire-server/README.md.gotmpl b/charts/spire/charts/spire-server/README.md.gotmpl index 0004288..c66ec6f 100644 --- a/charts/spire/charts/spire-server/README.md.gotmpl +++ b/charts/spire/charts/spire-server/README.md.gotmpl @@ -63,7 +63,7 @@ Follow the steps to [create user CA for mTLS](https://github.com/spiffe/tornjak/ Here is an example using a *Secret* in `spire-server` namespace: ```console -kubectl -n spire-server create secret generic tornjak-user-ca --from-file=ca.crt="CA/rootCA.crt" +kubectl -n spire-server create secret generic tornjak-client-ca --from-file=ca.crt="CA/rootCA.crt" ``` Once the charts are deployed, you can test the mTLS connection with the following command (assuming localhost): diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index 1c11bb2..2e2e7a1 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -180,8 +180,8 @@ The code below determines what connection type should be used. {{- if (lookup "v1" "Secret" (include "spire-server.namespace" .) .Values.tornjak.config.tlsSecret) -}} -{{- $caType := default "INVALID" .Values.tornjak.config.userCA.type }} -{{- if (lookup "v1" $caType (include "spire-server.namespace" .) .Values.tornjak.config.userCA.name) -}} +{{- $caType := default "INVALID" .Values.tornjak.config.clientCA.type }} +{{- if (lookup "v1" $caType (include "spire-server.namespace" .) .Values.tornjak.config.clientCA.name) -}} {{- printf "mtls" -}} {{- else }} {{- printf "tls" -}} diff --git a/charts/spire/charts/spire-server/templates/statefulset.yaml b/charts/spire/charts/spire-server/templates/statefulset.yaml index 1587c32..4a5e148 100644 --- a/charts/spire/charts/spire-server/templates/statefulset.yaml +++ b/charts/spire/charts/spire-server/templates/statefulset.yaml @@ -253,15 +253,15 @@ spec: secretName: {{ .Values.tornjak.config.tlsSecret }} {{- end }} {{- if eq (include "spire-tornjak.connectionType" .) "mtls" }} - {{- if eq .Values.tornjak.config.userCA.type "Secret" }} + {{- if eq .Values.tornjak.config.clientCA.type "Secret" }} - name: user-cert secret: defaultMode: 256 - secretName: {{ .Values.tornjak.config.userCA.name }} - {{- else if eq .Values.tornjak.config.userCA.type "ConfigMap" }} + secretName: {{ .Values.tornjak.config.clientCA.name }} + {{- else if eq .Values.tornjak.config.clientCA.type "ConfigMap" }} - name: user-cert configMap: - name: {{ .Values.tornjak.config.userCA.name }} + name: {{ .Values.tornjak.config.clientCA.name }} {{- end }} {{- end }} {{- if eq (.Values.upstreamAuthority.disk.enabled | toString) "true" }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index f95b2d3..d54d21c 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -384,18 +384,18 @@ tornjak: # Tornjak supports 3 connection types: `http`, `tls`, and `mtls`. # The connections are determined based on provided configuration # When `tlsSecret` is created in this chart namespace, the TLS connection is started - # When `tlsSecret` and `userCa.tornjak-user-ca` are created in this chart namespace, the mTLS connection is started + # When `tlsSecret` and `clientCA.tornjak-client-ca` are created in this chart namespace, the mTLS connection is started # When none of them are created, Tornjak starts with HTTP connection only # -- Name of the secret containing server side key and certificate for TLS verification # (required for `tls` or `mtls` connectionType) tlsSecret: tornjak-tls-secret - userCA: + clientCA: # -- Type of delivery for the user CA for mTLS client verification # options are `Secret` or `ConfigMap` # (required for `mtls` connectionType) type: Secret - name: tornjak-user-ca + name: tornjak-client-ca resources: {} # We usually recommend not to specify default resources and to leave this as a conscious