Simple ingress support (#48)
Co-authored-by: Faisal Memon <[email protected]>
This commit is contained in:
kfox1111
@@ -98,8 +98,10 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
|||||||
| `ingress.className` | Ingress class name | `""` |
|
| `ingress.className` | Ingress class name | `""` |
|
||||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
||||||
| `ingress.annotations` | Annotations for ingress object | `{}` |
|
| `ingress.annotations` | Annotations for ingress object | `{}` |
|
||||||
| `ingress.hosts` | Host paths for ingress object | `[]` |
|
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `oidc-discovery` |
|
||||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
|
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||||
|
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
| `tests.hostAliases` | List of host aliases for testing | `[]` |
|
||||||
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
| `tests.tls.enabled` | Flag for enabling tls for tests | `false` |
|
||||||
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
| `tests.tls.customCA` | Custom CA value for tests | `""` |
|
||||||
@@ -128,4 +130,3 @@ A Helm chart to install the SPIFFE OIDC discovery provider.
|
|||||||
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tools.kubectl.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
| `tools.kubectl.image.version` | This value is deprecated in favor of tag. (Will be removed in a future release) | `""` |
|
||||||
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
| `tools.kubectl.image.tag` | Overrides the image tag whose default is the chart appVersion | `""` |
|
||||||
|
|
||||||
|
|||||||
@@ -18,5 +18,5 @@ metadata:
|
|||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
+8
-4
@@ -1,4 +1,8 @@
|
|||||||
{{ $values := merge .Values }}
|
{{- $values := merge .Values }}
|
||||||
|
{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.ingress) }}
|
||||||
|
{{- if gt (len .Values.ingress.hosts) 0 }}
|
||||||
|
{{- $host = (index .Values.ingress.hosts 0).host }}
|
||||||
|
{{- end }}
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Pod
|
kind: Pod
|
||||||
metadata:
|
metadata:
|
||||||
@@ -36,9 +40,9 @@ spec:
|
|||||||
command: ['curl']
|
command: ['curl']
|
||||||
{{- if dig "tests" "tls" "enabled" false $values }}
|
{{- if dig "tests" "tls" "enabled" false $values }}
|
||||||
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
||||||
args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
|
args: ['-s', '-f', '--cacert', '/ca/ca.crt', 'https://{{ $host }}/.well-known/openid-configuration']
|
||||||
{{- else }}
|
{{- else }}
|
||||||
args: ['-s', '-f', 'https://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
|
args: ['-s', '-f', 'https://{{ $host }}/.well-known/openid-configuration']
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
{{- if ne (len (dig "tests" "tls" "customCA" "" $values)) 0 }}
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
@@ -46,7 +50,7 @@ spec:
|
|||||||
mountPath: /ca
|
mountPath: /ca
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- else }}
|
{{- else }}
|
||||||
args: ['-s', '-f', 'http://{{ (index .Values.ingress.hosts 0).host }}/.well-known/openid-configuration']
|
args: ['-s', '-f', 'http://{{ $host }}/.well-known/openid-configuration']
|
||||||
{{- end }}
|
{{- end }}
|
||||||
securityContext:
|
securityContext:
|
||||||
{{- toYaml .Values.securityContext | nindent 8 }}
|
{{- toYaml .Values.securityContext | nindent 8 }}
|
||||||
|
|||||||
@@ -250,13 +250,20 @@ ingress:
|
|||||||
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
# nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||||
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
# nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
|
||||||
## @param ingress.hosts [array] Host paths for ingress object
|
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||||
hosts:
|
host: "oidc-discovery"
|
||||||
- host: oidc-discovery.example.org
|
|
||||||
paths:
|
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
- path: /
|
tlsSecret: ""
|
||||||
pathType: Prefix
|
|
||||||
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress
|
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||||
|
hosts: []
|
||||||
|
# - host: oidc-discovery.example.org
|
||||||
|
# paths:
|
||||||
|
# - path: /
|
||||||
|
# pathType: Prefix
|
||||||
|
|
||||||
|
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||||
tls: []
|
tls: []
|
||||||
# - secretName: chart-example-tls
|
# - secretName: chart-example-tls
|
||||||
# hosts:
|
# hosts:
|
||||||
|
|||||||
@@ -152,8 +152,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
| `federation.ingress.className` | Ingress class name for federation | `""` |
|
||||||
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
| `federation.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
||||||
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
| `federation.ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||||
| `federation.ingress.hosts` | Host paths for ingress object | `[]` |
|
| `federation.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server-federation` |
|
||||||
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
| `federation.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
|
| `federation.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||||
|
| `federation.ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
| `ca_subject.country` | Country for Spire server CA | `ARPA` |
|
| `ca_subject.country` | Country for Spire server CA | `ARPA` |
|
||||||
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
|
| `ca_subject.organization` | Organization for Spire server CA | `Example` |
|
||||||
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
|
| `ca_subject.common_name` | Common Name for Spire server CA | `example.org` |
|
||||||
@@ -247,8 +249,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `ingress.className` | Ingress class name | `""` |
|
| `ingress.className` | Ingress class name | `""` |
|
||||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
||||||
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
| `ingress.annotations` | Annotations for the ingress object | `{}` |
|
||||||
| `ingress.hosts` | Host paths for ingress object | `[]` |
|
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `spire-server` |
|
||||||
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress | `[]` |
|
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
|
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||||
|
| `ingress.tls` | Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
| `extraVolumes` | Extra volumes to be mounted | `[]` |
|
||||||
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
| `extraVolumeMounts` | Extra volume mounts | `[]` |
|
||||||
| `extraContainers` | Additional containers to create | `[]` |
|
| `extraContainers` | Additional containers to create | `[]` |
|
||||||
@@ -273,8 +277,10 @@ In order to run Tornjak with simple HTTP Connection only, make sure you don't cr
|
|||||||
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
|
| `tornjak.ingress.className` | Ingress class name for Tornjak backend service | `""` |
|
||||||
| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
| `tornjak.ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
||||||
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
| `tornjak.ingress.annotations` | Annotations for Tornjak backend service | `{}` |
|
||||||
| `tornjak.ingress.hosts` | Host paths for ingress Tornjak backend service | `[]` |
|
| `tornjak.ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-backend` |
|
||||||
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` |
|
| `tornjak.ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
|
| `tornjak.ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||||
|
| `tornjak.ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
| `tornjak.startupProbe.failureThreshold` | Failure threshold count | `3` |
|
||||||
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
| `tornjak.startupProbe.initialDelaySeconds` | Initial delay seconds | `5` |
|
||||||
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
| `tornjak.startupProbe.periodSeconds` | Period seconds | `10` |
|
||||||
|
|||||||
@@ -205,7 +205,10 @@ The code below determines what connection type should be used.
|
|||||||
|
|
||||||
{{- define "spire-server.test.federation-ingress-args" }}
|
{{- define "spire-server.test.federation-ingress-args" }}
|
||||||
{{- $args := list }}
|
{{- $args := list }}
|
||||||
{{- $host := index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }}
|
{{- $host := include "spire-lib.ingress-calculated-name" (dict "Values" .Values "ingress" .Values.federation.ingress) }}
|
||||||
|
{{- if gt (len .Values.federation.ingress.tls) 0 }}
|
||||||
|
{{- $host = index (index (index .Values.federation.ingress.tls 0) "hosts") 0 }}
|
||||||
|
{{- end }}
|
||||||
{{- if dig "tests" "tls" "enabled" false .Values }}
|
{{- if dig "tests" "tls" "enabled" false .Values }}
|
||||||
{{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }}
|
{{- if ne (len (dig "tests" "tls" "customCA" "" .Values)) 0 }}
|
||||||
{{- $args = append $args "--cacert" }}
|
{{- $args = append $args "--cacert" }}
|
||||||
|
|||||||
@@ -20,6 +20,6 @@ metadata:
|
|||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "global" .Values.global) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.federation.ingress "svcName" $svcName "port" .Values.federation.bundleEndpoint.port "Values" .Values) | nindent 2 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -20,5 +20,5 @@ metadata:
|
|||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -23,8 +23,8 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
|
{{- if eq (include "spire-tornjak.connectionType" .) "http" }}
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http") | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-http" "Values" .Values) | nindent 2 }}
|
||||||
{{- else -}}
|
{{- else -}}
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https") | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.tornjak.ingress "svcName" (include "spire-tornjak.servicename" .) "port" "tornjak-srv-https" "Values" .Values) | nindent 2 }}
|
||||||
{{- end -}}
|
{{- end -}}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -211,14 +211,21 @@ federation:
|
|||||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||||
# If Profile Type == https_spiffe:
|
# If Profile Type == https_spiffe:
|
||||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||||
## @param federation.ingress.hosts [array] Host paths for ingress object
|
|
||||||
hosts:
|
|
||||||
- host: spire-server-federation.example.org
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
|
|
||||||
## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress
|
## @param federation.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||||
|
host: "spire-server-federation"
|
||||||
|
|
||||||
|
## @param federation.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
|
tlsSecret: ""
|
||||||
|
|
||||||
|
## @param federation.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||||
|
hosts: []
|
||||||
|
# - host: spire-server-federation.example.org
|
||||||
|
# paths:
|
||||||
|
# - path: /
|
||||||
|
# pathType: Prefix
|
||||||
|
|
||||||
|
## @param federation.ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||||
tls: []
|
tls: []
|
||||||
# - hosts:
|
# - hosts:
|
||||||
# - spire-server-federation.example.org
|
# - spire-server-federation.example.org
|
||||||
@@ -498,13 +505,20 @@ ingress:
|
|||||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
# nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||||
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
# nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||||
|
|
||||||
## @param ingress.hosts [array] Host paths for ingress object
|
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||||
hosts:
|
host: "spire-server"
|
||||||
- host: spire-server.example.org
|
|
||||||
paths:
|
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
- path: /
|
tlsSecret: ""
|
||||||
pathType: Prefix
|
|
||||||
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress
|
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||||
|
hosts: []
|
||||||
|
# - host: spire-server.example.org
|
||||||
|
# paths:
|
||||||
|
# - path: /
|
||||||
|
# pathType: Prefix
|
||||||
|
|
||||||
|
## @param ingress.tls [array] Secrets containining TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||||
tls: []
|
tls: []
|
||||||
# - secretName: spire-server-tls
|
# - secretName: spire-server-tls
|
||||||
# hosts:
|
# hosts:
|
||||||
@@ -570,18 +584,26 @@ tornjak:
|
|||||||
## @param tornjak.ingress.className Ingress class name for Tornjak backend service
|
## @param tornjak.ingress.className Ingress class name for Tornjak backend service
|
||||||
## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
## @param tornjak.ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
||||||
## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service
|
## @param tornjak.ingress.annotations [object] Annotations for Tornjak backend service
|
||||||
## @param tornjak.ingress.hosts [array] Host paths for ingress Tornjak backend service
|
|
||||||
ingress:
|
ingress:
|
||||||
enabled: false
|
enabled: false
|
||||||
className: ""
|
className: ""
|
||||||
controllerType: ""
|
controllerType: ""
|
||||||
annotations: {}
|
annotations: {}
|
||||||
hosts:
|
|
||||||
- host: tornjak-backend.example.org
|
## @param tornjak.ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||||
paths:
|
host: "tornjak-backend"
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
## @param tornjak.ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress
|
tlsSecret: ""
|
||||||
|
|
||||||
|
## @param tornjak.ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||||
|
hosts: []
|
||||||
|
# - host: tornjak-backend.example.org
|
||||||
|
# paths:
|
||||||
|
# - path: /
|
||||||
|
# pathType: Prefix
|
||||||
|
|
||||||
|
## @param tornjak.ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||||
tls: []
|
tls: []
|
||||||
# - secretName: chart-example-tls
|
# - secretName: chart-example-tls
|
||||||
# hosts:
|
# hosts:
|
||||||
|
|||||||
@@ -92,8 +92,10 @@ port forwarding. See the chart NOTES output for more details.
|
|||||||
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
|
| `ingress.className` | Ingress class name for Tornjak frontend service | `""` |
|
||||||
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
| `ingress.controllerType` | Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""]. | `""` |
|
||||||
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
|
| `ingress.annotations` | Annotations for Tornjak frontend service | `{}` |
|
||||||
| `ingress.hosts` | Host paths for ingress Tornjak frontend service | `[]` |
|
| `ingress.host` | Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead. | `tornjak-frontend` |
|
||||||
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress | `[]` |
|
| `ingress.tlsSecret` | Secret that has the certs. If blank will use default certs. Used with host var. | `""` |
|
||||||
|
| `ingress.hosts` | Host paths for ingress object. If emtpy, rules will be built based on the host var. | `[]` |
|
||||||
|
| `ingress.tls` | Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars. | `[]` |
|
||||||
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
| `tests.bash.image.registry` | The OCI registry to pull the image from | `cgr.dev` |
|
||||||
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
| `tests.bash.image.repository` | The repository within the registry | `chainguard/bash` |
|
||||||
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
| `tests.bash.image.pullPolicy` | The image pull policy | `IfNotPresent` |
|
||||||
|
|||||||
@@ -18,5 +18,5 @@ metadata:
|
|||||||
{{- toYaml . | nindent 4 }}
|
{{- toYaml . | nindent 4 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "global" .Values.global) | nindent 2 }}
|
{{ include "spire-lib.ingress-spec" (dict "ingress" .Values.ingress "svcName" $fullName "port" .Values.service.port "Values" .Values) | nindent 2 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@@ -117,18 +117,26 @@ startupProbe:
|
|||||||
## @param ingress.className Ingress class name for Tornjak frontend service
|
## @param ingress.className Ingress class name for Tornjak frontend service
|
||||||
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
## @param ingress.controllerType Specify what type of ingress controller you're using to add the necessary annotations accordingly. If blank, other is assumed. If other, no annotations will be added. Must be one of [ingress-nginx, other, ""].
|
||||||
## @param ingress.annotations [object] Annotations for Tornjak frontend service
|
## @param ingress.annotations [object] Annotations for Tornjak frontend service
|
||||||
## @param ingress.hosts [array] Host paths for ingress Tornjak frontend service
|
|
||||||
ingress:
|
ingress:
|
||||||
enabled: false
|
enabled: false
|
||||||
className: ""
|
className: ""
|
||||||
controllerType: ""
|
controllerType: ""
|
||||||
annotations: {}
|
annotations: {}
|
||||||
hosts:
|
|
||||||
- host: tornjak-frontend.example.org
|
## @param ingress.host Host name for the ingress. If no '.' in host, trustDomain is automatically appended. The rest of the rules will be autogenerated. For more customizability, use hosts[] instead.
|
||||||
paths:
|
host: "tornjak-frontend"
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
## @param ingress.tlsSecret Secret that has the certs. If blank will use default certs. Used with host var.
|
||||||
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress
|
tlsSecret: ""
|
||||||
|
|
||||||
|
## @param ingress.hosts [array] Host paths for ingress object. If emtpy, rules will be built based on the host var.
|
||||||
|
hosts: []
|
||||||
|
# - host: tornjak-frontend.example.org
|
||||||
|
# paths:
|
||||||
|
# - path: /
|
||||||
|
# pathType: Prefix
|
||||||
|
|
||||||
|
## @param ingress.tls [array] Secrets containing TLS certs to enable https on ingress. If emtpy, rules will be built based on the host and tlsSecret vars.
|
||||||
tls: []
|
tls: []
|
||||||
# - secretName: chart-example-tls
|
# - secretName: chart-example-tls
|
||||||
# hosts:
|
# hosts:
|
||||||
|
|||||||
@@ -80,17 +80,50 @@
|
|||||||
{{- $type }}
|
{{- $type }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|
||||||
|
{{/* Takes in a dictionary with keys:
|
||||||
|
* ingress - the standardized ingress object
|
||||||
|
* Values - Chart values
|
||||||
|
*/}}
|
||||||
|
{{ define "spire-lib.ingress-calculated-name" }}
|
||||||
|
{{- $host := .ingress.host }}
|
||||||
|
{{- if not (contains $host ".") }}
|
||||||
|
{{- $host = printf "%s.%s" $host (include "spire-lib.trust-domain" .) }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $host }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
{{/* Takes in a dictionary with keys:
|
{{/* Takes in a dictionary with keys:
|
||||||
* ingress - the standardized ingress object
|
* ingress - the standardized ingress object
|
||||||
* svcName - The service to route to
|
* svcName - The service to route to
|
||||||
* port - which port on the service to use
|
* port - which port on the service to use
|
||||||
|
* Values - Chart values
|
||||||
*/}}
|
*/}}
|
||||||
{{ define "spire-lib.ingress-spec" }}
|
{{ define "spire-lib.ingress-spec" }}
|
||||||
|
{{- $host := include "spire-lib.ingress-calculated-name" . }}
|
||||||
{{- $svcName := .svcName }}
|
{{- $svcName := .svcName }}
|
||||||
{{- $port := .port }}
|
{{- $port := .port }}
|
||||||
{{- with .ingress.className }}
|
{{- with .ingress.className }}
|
||||||
ingressClassName: {{ . | quote }}
|
ingressClassName: {{ . | quote }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if eq (add (len .ingress.tls) (len .ingress.hosts)) 0 }}
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- {{ $host | quote }}
|
||||||
|
{{- with .ingress.tlsSecret }}
|
||||||
|
secretName: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
rules:
|
||||||
|
- host: {{ $host | quote }}
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: "/"
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: {{ $svcName | quote }}
|
||||||
|
port:
|
||||||
|
number: {{ $port }}
|
||||||
|
{{- else }}
|
||||||
{{- if .ingress.tls }}
|
{{- if .ingress.tls }}
|
||||||
tls:
|
tls:
|
||||||
{{- range .ingress.tls }}
|
{{- range .ingress.tls }}
|
||||||
@@ -117,6 +150,7 @@ rules:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
{{- define "spire-lib.kubectl-image" }}
|
{{- define "spire-lib.kubectl-image" }}
|
||||||
{{- $root := deepCopy . }}
|
{{- $root := deepCopy . }}
|
||||||
|
|||||||
@@ -10,36 +10,15 @@ spire-server:
|
|||||||
organization: Production
|
organization: Production
|
||||||
common_name: production.other
|
common_name: production.other
|
||||||
|
|
||||||
ingress:
|
# ingress:
|
||||||
hosts:
|
# host: spire-server
|
||||||
- host: spire-server.production.other
|
# federation:
|
||||||
paths:
|
# ingress:
|
||||||
- path: /
|
# host: spire-server-federation
|
||||||
pathType: Prefix
|
# tlsSecret: tls-cert
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- spire-server.production.other
|
|
||||||
federation:
|
|
||||||
ingress:
|
|
||||||
hosts:
|
|
||||||
- host: spire-server-federation.production.other
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- spire-server-federation.production.other
|
|
||||||
secretName: tls-cert
|
|
||||||
|
|
||||||
spiffe-oidc-discovery-provider:
|
# spiffe-oidc-discovery-provider:
|
||||||
ingress:
|
# ingress:
|
||||||
hosts:
|
# host: oidc-discovery
|
||||||
- host: oidc-discovery.production.other
|
# tlsSecret: tls-cert
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
tls:
|
|
||||||
- secretName: tls-cert
|
|
||||||
hosts:
|
|
||||||
- oidc-discovery.production.other
|
|
||||||
|
|
||||||
|
|||||||
@@ -117,6 +117,7 @@ install_and_test() {
|
|||||||
--values /tmp/dummydns \
|
--values /tmp/dummydns \
|
||||||
--set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
|
--set spiffe-oidc-discovery-provider.tests.tls.customCA=tls-cert,spire-server.tests.tls.customCA=tls-cert \
|
||||||
--set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \
|
--set spire-agent.server.address=spire-server.production.other,spire-agent.server.port=443 \
|
||||||
|
--set spire-server.federation.ingress.tlsSecret=tls-cert,spiffe-oidc-discovery-provider.ingress.tlsSecret=tls-cert \
|
||||||
--values "${SCRIPTPATH}/example-your-values.yaml" \
|
--values "${SCRIPTPATH}/example-your-values.yaml" \
|
||||||
$2 \
|
$2 \
|
||||||
--wait
|
--wait
|
||||||
|
|||||||
@@ -8,12 +8,3 @@ spire-server:
|
|||||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||||
|
|
||||||
# className: nginx
|
# className: nginx
|
||||||
|
|
||||||
hosts:
|
|
||||||
- host: spire-server-federation.example.org
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- spire-server-federation.example.org
|
|
||||||
|
|||||||
@@ -10,12 +10,4 @@ spire-server:
|
|||||||
|
|
||||||
# className: nginx
|
# className: nginx
|
||||||
|
|
||||||
hosts:
|
tlsSecret: spire-server-federation-tls
|
||||||
- host: spire-server-federation.example.org
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- spire-server-federation.example.org
|
|
||||||
secretName: spire-server-federation-tls
|
|
||||||
|
|||||||
+2
-11
@@ -8,14 +8,5 @@ spiffe-oidc-discovery-provider:
|
|||||||
|
|
||||||
# className: nginx
|
# className: nginx
|
||||||
|
|
||||||
# You must override these in your own values file with the appropriate hostname
|
# You must override these in your own values file with the appropriate secret or it wont start.
|
||||||
# and secret or it wont start.
|
tlsSecret: tls-cert
|
||||||
hosts:
|
|
||||||
- host: oidc-discovery.example.org
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
tls:
|
|
||||||
- secretName: tls-cert
|
|
||||||
hosts:
|
|
||||||
- oidc-discovery.example.org
|
|
||||||
|
|||||||
@@ -4,14 +4,3 @@ spire-server:
|
|||||||
controllerType: ingress-nginx
|
controllerType: ingress-nginx
|
||||||
|
|
||||||
# className: nginx
|
# className: nginx
|
||||||
|
|
||||||
# You must override these in your own values file with the appropriate hostname
|
|
||||||
# and secret or it wont start.
|
|
||||||
hosts:
|
|
||||||
- host: spire-server.example.org
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- spire-server.example.org
|
|
||||||
|
|||||||
Reference in New Issue
Block a user