From ed23d8b71440bebbef528e4a9f85e0cded9c3981 Mon Sep 17 00:00:00 2001 From: kfox1111 Date: Mon, 30 Oct 2023 15:16:17 -0700 Subject: [PATCH] Simple ingress support (#48) Co-authored-by: Faisal Memon --- .../spiffe-oidc-discovery-provider/README.md | 7 +- .../templates/ingress.yaml | 2 +- .../templates/tests/test-connection.yaml | 12 ++-- .../values.yaml | 21 ++++-- charts/spire/charts/spire-server/README.md | 18 ++++-- .../spire-server/templates/_helpers.tpl | 5 +- .../templates/federation-ingress.yaml | 2 +- .../spire-server/templates/ingress.yaml | 2 +- .../templates/tornjak-ingress.yaml | 4 +- charts/spire/charts/spire-server/values.yaml | 64 +++++++++++++------ .../spire/charts/tornjak-frontend/README.md | 6 +- .../tornjak-frontend/templates/ingress.yaml | 2 +- .../spire/charts/tornjak-frontend/values.yaml | 22 +++++-- charts/spire/templates/_spire-lib.tpl | 34 ++++++++++ examples/production/example-your-values.yaml | 41 +++--------- examples/production/run-tests.sh | 1 + ...federation-https-spiffe-ingress-nginx.yaml | 9 --- ...rt-federation-https-web-ingress-nginx.yaml | 10 +-- ...oidc-discovery-provider-ingress-nginx.yaml | 13 +--- ...ues-export-spire-server-ingress-nginx.yaml | 11 ---- 20 files changed, 158 insertions(+), 128 deletions(-) diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md index fb76684..796597e 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/README.md +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/README.md @@ -98,8 +98,10 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `ingress.className` | Ingress class name | `""` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `ingress.annotations` | Annotations for ingress object | `{}` | -| `ingress.hosts` | Host paths for ingress object | `[]` | -| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `tests.hostAliases` | List of host aliases for testing | `[]` | | `tests.tls.enabled` | Flag for enabling tls for tests | `false` | | `tests.tls.customCA` | Custom CA value for tests | `""` | @@ -128,4 +130,3 @@ A Helm chart to install the SPIFFE OIDC discovery provider. | `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` | | `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` | | `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` | - diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml index aad0f5d..9cbd7c2 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/ingress.yaml @@ -18,5 +18,5 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml index af9063e..73a8b35 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/templates/tests/test-connection.yaml @@ -1,4 +1,8 @@ -{{ $values := merge .Values }} +{{- $values := merge .Values }} +{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }} +{{- if gt (len .Values.ingress.hosts) 0 }} +{{- $host = (index .Values.ingress.hosts 0).host }} +{{- end }} apiVersion: v1 kind: Pod metadata: @@ -36,9 +40,9 @@ spec: command: ['curl'] {{- if dig "tests" "tls" "enabled" false $values }} {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} - args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ $host }}/.well-known/openid-configuration'] {{- else }} - args: ['-s', '-f', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + args: ['-s', '-f', 'https://{{ $host }}/.well-known/openid-configuration'] {{- end }} {{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }} volumeMounts: @@ -46,7 +50,7 @@ spec: mountPath: /ca {{- end }} {{- else }} - args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration'] + args: ['-s', '-f', 'http://{{ $host }}/.well-known/openid-configuration'] {{- end }} securityContext: {{- toYaml .Values.securityContext | nindent 8 }} diff --git a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml index 8cc1007..8b11f46 100644 --- a/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml +++ b/charts/spire/charts/spiffe-oidc-discovery-provider/values.yaml @@ -250,13 +250,20 @@ ingress: # nginx.ingress.kubernetes.io/ssl-redirect: "true" # nginx.ingress.kubernetes.io/force-ssl-redirect: "true" - ## @param ingress.hosts [array] Host paths for ingress object - hosts: - - host: oidc-discovery.example.org - paths: - - path: / - pathType: Prefix - ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "oidc-discovery" + + ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: oidc-discovery.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: chart-example-tls # hosts: diff --git a/charts/spire/charts/spire-server/README.md b/charts/spire/charts/spire-server/README.md index e27e8a3..bd2ff79 100644 --- a/charts/spire/charts/spire-server/README.md +++ b/charts/spire/charts/spire-server/README.md @@ -152,8 +152,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `federation.ingress.className` | Ingress class name for federation | `""` | | `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `federation.ingress.annotations` | Annotations for the ingress object | `{}` | -| `federation.ingress.hosts` | Host paths for ingress object | `[]` | -| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` | +| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `federation.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `ca_subject.country` | Country for Spire server CA | `ARPA` | | `ca_subject.organization` | Organization for Spire server CA | `Example` | | `ca_subject.common_name` | Common Name for Spire server CA | `example.org` | @@ -247,8 +249,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `ingress.className` | Ingress class name | `""` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `ingress.annotations` | Annotations for the ingress object | `{}` | -| `ingress.hosts` | Host paths for ingress object | `[]` | -| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `extraVolumes` | Extra volumes to be mounted | `[]` | | `extraVolumeMounts` | Extra volume mounts | `[]` | | `extraContainers` | Additional containers to create | `[]` | @@ -273,8 +277,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr | `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` | | `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` | -| `tornjak.ingress.hosts` | Host paths for ingress Tornjak backend service | `[]` | -| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` | +| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` | +| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` | | `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` | | `tornjak.startupProbe.periodSeconds` | Period seconds | `10` | diff --git a/charts/spire/charts/spire-server/templates/_helpers.tpl b/charts/spire/charts/spire-server/templates/_helpers.tpl index d4d503e..0f0521b 100644 --- a/charts/spire/charts/spire-server/templates/_helpers.tpl +++ b/charts/spire/charts/spire-server/templates/_helpers.tpl @@ -205,7 +205,10 @@ The code below determines what connection type should be used. {{- define "spire-server.test.federation-ingress-args" }} {{- $args := list }} -{{- $host := index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }} +{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.federation.ingress) }} +{{- if gt (len .Values.federation.ingress.tls) 0 }} +{{- $host = index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }} +{{- end }} {{- if dig "tests" "tls" "enabled" false .Values }} {{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }} {{- $args = append $args "--cacert" }} diff --git a/charts/spire/charts/spire-server/templates/federation-ingress.yaml b/charts/spire/charts/spire-server/templates/federation-ingress.yaml index b4735e1..e09d096 100644 --- a/charts/spire/charts/spire-server/templates/federation-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/federation-ingress.yaml @@ -20,6 +20,6 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "Values" .Values) | nindent 2 }} {{- end }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/ingress.yaml b/charts/spire/charts/spire-server/templates/ingress.yaml index 15346d5..dbcdb39 100644 --- a/charts/spire/charts/spire-server/templates/ingress.yaml +++ b/charts/spire/charts/spire-server/templates/ingress.yaml @@ -20,5 +20,5 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml index 435e9b7..8d10558 100644 --- a/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml +++ b/charts/spire/charts/spire-server/templates/tornjak-ingress.yaml @@ -23,8 +23,8 @@ metadata: {{- end }} spec: {{- if eq (include "spire-tornjak.connectionType" .) "http" }} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http") | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http" "Values" .Values) | nindent 2 }} {{- else -}} - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https") | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https" "Values" .Values) | nindent 2 }} {{- end -}} {{- end }} diff --git a/charts/spire/charts/spire-server/values.yaml b/charts/spire/charts/spire-server/values.yaml index 844c52c..3342e70 100644 --- a/charts/spire/charts/spire-server/values.yaml +++ b/charts/spire/charts/spire-server/values.yaml @@ -211,14 +211,21 @@ federation: # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # If Profile Type == https_spiffe: # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - ## @param federation.ingress.hosts [array] Host paths for ingress object - hosts: - - host: spire-server-federation.example.org - paths: - - path: / - pathType: Prefix - ## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress + ## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "spire-server-federation" + + ## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param federation.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: spire-server-federation.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - hosts: # - spire-server-federation.example.org @@ -498,13 +505,20 @@ ingress: # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - ## @param ingress.hosts [array] Host paths for ingress object - hosts: - - host: spire-server.example.org - paths: - - path: / - pathType: Prefix - ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "spire-server" + + ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: spire-server.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: spire-server-tls # hosts: @@ -570,18 +584,26 @@ tornjak: ## @param tornjak.ingress.className Ingress class name for Tornjak backend service ## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. ## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service - ## @param tornjak.ingress.hosts [array] Host paths for ingress Tornjak backend service ingress: enabled: false className: "" controllerType: "" annotations: {} - hosts: - - host: tornjak-backend.example.org - paths: - - path: / - pathType: Prefix - ## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress + + ## @param tornjak.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "tornjak-backend" + + ## @param tornjak.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param tornjak.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: tornjak-backend.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: chart-example-tls # hosts: diff --git a/charts/spire/charts/tornjak-frontend/README.md b/charts/spire/charts/tornjak-frontend/README.md index 5c6272b..4c6710d 100644 --- a/charts/spire/charts/tornjak-frontend/README.md +++ b/charts/spire/charts/tornjak-frontend/README.md @@ -92,8 +92,10 @@ port forwarding. See the chart NOTES output for more details. | `ingress.className` | Ingress class name for Tornjak frontend service | `""` | | `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` | | `ingress.annotations` | Annotations for Tornjak frontend service | `{}` | -| `ingress.hosts` | Host paths for ingress Tornjak frontend service | `[]` | -| `ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` | +| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` | +| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` | +| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` | +| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` | | `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` | | `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` | | `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` | diff --git a/charts/spire/charts/tornjak-frontend/templates/ingress.yaml b/charts/spire/charts/tornjak-frontend/templates/ingress.yaml index 6a9a3af..142c28e 100644 --- a/charts/spire/charts/tornjak-frontend/templates/ingress.yaml +++ b/charts/spire/charts/tornjak-frontend/templates/ingress.yaml @@ -18,5 +18,5 @@ metadata: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }} + {{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }} {{- end }} diff --git a/charts/spire/charts/tornjak-frontend/values.yaml b/charts/spire/charts/tornjak-frontend/values.yaml index 7b259eb..2965f06 100644 --- a/charts/spire/charts/tornjak-frontend/values.yaml +++ b/charts/spire/charts/tornjak-frontend/values.yaml @@ -117,18 +117,26 @@ startupProbe: ## @param ingress.className Ingress class name for Tornjak frontend service ## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. ## @param ingress.annotations [object] Annotations for Tornjak frontend service -## @param ingress.hosts [array] Host paths for ingress Tornjak frontend service ingress: enabled: false className: "" controllerType: "" annotations: {} - hosts: - - host: tornjak-frontend.example.org - paths: - - path: / - pathType: Prefix - ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress + + ## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. + host: "tornjak-frontend" + + ## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var. + tlsSecret: "" + + ## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var. + hosts: [] + # - host: tornjak-frontend.example.org + # paths: + # - path: / + # pathType: Prefix + + ## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. tls: [] # - secretName: chart-example-tls # hosts: diff --git a/charts/spire/templates/_spire-lib.tpl b/charts/spire/templates/_spire-lib.tpl index 05ed708..f703258 100644 --- a/charts/spire/templates/_spire-lib.tpl +++ b/charts/spire/templates/_spire-lib.tpl @@ -80,17 +80,50 @@ {{- $type }} {{- end }} +{{/* Takes in a dictionary with keys: + * ingress - the standardized ingress object + * Values - Chart values +*/}} +{{ define "spire-lib.ingress-calculated-name" }} +{{- $host := .ingress.host }} +{{- if not (contains $host ".") }} +{{- $host = printf "%s.%s" $host (include "spire-lib.trust-domain" .) }} +{{- end }} +{{- $host }} +{{- end }} + {{/* Takes in a dictionary with keys: * ingress - the standardized ingress object * svcName - The service to route to * port - which port on the service to use + * Values - Chart values */}} {{ define "spire-lib.ingress-spec" }} +{{- $host := include "spire-lib.ingress-calculated-name" . }} {{- $svcName := .svcName }} {{- $port := .port }} {{- with .ingress.className }} ingressClassName: {{ . | quote }} {{- end }} +{{- if eq (add (len .ingress.tls) (len .ingress.hosts)) 0 }} +tls: + - hosts: + - {{ $host | quote }} +{{- with .ingress.tlsSecret }} + secretName: {{ . | quote }} +{{- end }} +rules: + - host: {{ $host | quote }} + http: + paths: + - path: "/" + pathType: Prefix + backend: + service: + name: {{ $svcName | quote }} + port: + number: {{ $port }} +{{- else }} {{- if .ingress.tls }} tls: {{- range .ingress.tls }} @@ -117,6 +150,7 @@ rules: {{- end }} {{- end }} {{- end }} +{{- end }} {{- define "spire-lib.kubectl-image" }} {{- $root := deepCopy . }} diff --git a/examples/production/example-your-values.yaml b/examples/production/example-your-values.yaml index be5efa3..68b7b63 100644 --- a/examples/production/example-your-values.yaml +++ b/examples/production/example-your-values.yaml @@ -10,36 +10,15 @@ spire-server: organization: Production common_name: production.other - ingress: - hosts: - - host: spire-server.production.other - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server.production.other - federation: - ingress: - hosts: - - host: spire-server-federation.production.other - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server-federation.production.other - secretName: tls-cert +# ingress: +# host: spire-server +# federation: +# ingress: +# host: spire-server-federation +# tlsSecret: tls-cert -spiffe-oidc-discovery-provider: - ingress: - hosts: - - host: oidc-discovery.production.other - paths: - - path: / - pathType: Prefix - tls: - - secretName: tls-cert - hosts: - - oidc-discovery.production.other +# spiffe-oidc-discovery-provider: +# ingress: +# host: oidc-discovery +# tlsSecret: tls-cert diff --git a/examples/production/run-tests.sh b/examples/production/run-tests.sh index 185e93d..e48a127 100755 --- a/examples/production/run-tests.sh +++ b/examples/production/run-tests.sh @@ -117,6 +117,7 @@ install_and_test() { --values /tmp/dummydns \ --set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \ --set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \ + --set spire-server.federation.ingress.tlsSecret=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \ --values "${SCRIPTPATH}/example-your-values.yaml" \ $2 \ --wait diff --git a/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml b/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml index c50044e..2a95d89 100644 --- a/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml +++ b/examples/production/values-export-federation-https-spiffe-ingress-nginx.yaml @@ -8,12 +8,3 @@ spire-server: nginx.ingress.kubernetes.io/ssl-passthrough: "true" # className: nginx - - hosts: - - host: spire-server-federation.example.org - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server-federation.example.org diff --git a/examples/production/values-export-federation-https-web-ingress-nginx.yaml b/examples/production/values-export-federation-https-web-ingress-nginx.yaml index 49aeaf1..c2c3879 100644 --- a/examples/production/values-export-federation-https-web-ingress-nginx.yaml +++ b/examples/production/values-export-federation-https-web-ingress-nginx.yaml @@ -10,12 +10,4 @@ spire-server: # className: nginx - hosts: - - host: spire-server-federation.example.org - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server-federation.example.org - secretName: spire-server-federation-tls + tlsSecret: spire-server-federation-tls diff --git a/examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml b/examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml index f292414..51e3887 100644 --- a/examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml +++ b/examples/production/values-export-spiffe-oidc-discovery-provider-ingress-nginx.yaml @@ -8,14 +8,5 @@ spiffe-oidc-discovery-provider: # className: nginx - # You must override these in your own values file with the appropriate hostname - # and secret or it wont start. - hosts: - - host: oidc-discovery.example.org - paths: - - path: / - pathType: Prefix - tls: - - secretName: tls-cert - hosts: - - oidc-discovery.example.org + # You must override these in your own values file with the appropriate secret or it wont start. + tlsSecret: tls-cert diff --git a/examples/production/values-export-spire-server-ingress-nginx.yaml b/examples/production/values-export-spire-server-ingress-nginx.yaml index 3fb0b5d..b951f6e 100644 --- a/examples/production/values-export-spire-server-ingress-nginx.yaml +++ b/examples/production/values-export-spire-server-ingress-nginx.yaml @@ -4,14 +4,3 @@ spire-server: controllerType: ingress-nginx # className: nginx - - # You must override these in your own values file with the appropriate hostname - # and secret or it wont start. - hosts: - - host: spire-server.example.org - paths: - - path: / - pathType: Prefix - tls: - - hosts: - - spire-server.example.org