Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

search-api: custom CA certificates support #478

Merged
merged 3 commits into from
Aug 26, 2024
Merged

search-api: custom CA certificates support #478

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1b2d6ab
add custom CA support
zhukov-d-man Aug 5, 2024
1b34721
add new line to values.yaml and update README.md
zhukov-d-man Aug 5, 2024
12474fd
fix of the missing nginx container issue
zhukov-d-man Aug 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions charts/search-api/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,13 @@ See the [documentation](https://docs.2gis.com/en/on-premise/search) to learn abo
| `nginx.resources.limits.cpu` | A CPU limit, e.g., `100m` | |
| `nginx.resources.limits.memory` | A memory limit, e.g., `128Mi` | |

### customCAs **Custom Certificate Authority**

| Name | Description | Value |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------- | ----- |
| `customCAs.bundle` | Custom CA [text representation of the X.509 PEM public-key certificate](https://www.rfc-editor.org/rfc/rfc7468#section-5.1) | `""` |
| `customCAs.certsPath` | Custom CA bundle mount directory in the container. | `""` |


## Maintainers

Expand Down
22 changes: 22 additions & 0 deletions charts/search-api/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,28 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- printf "{\"auths\": {\"%s\": {\"auth\": \"%s\"}}}" .registry (printf "%s:%s" .username .password | b64enc) | b64enc }}
{{- end }}

{{- define "search_api.env.custom.ca.path" -}}
- name: SSL_CERT_FILE
value: {{ include "search_api.custom.ca.mountPath" . }}/custom-ca.crt
{{- end }}

{{- define "search_api.custom.ca.mountPath" -}}
{{ .Values.customCAs.certsPath | default "/usr/local/share/ca-certificates" }}
{{- end -}}

{{- define "search_api.custom.ca.volumeMounts" -}}
- name: custom-ca
mountPath: {{ include "search_api.custom.ca.mountPath" . }}/custom-ca.crt
subPath: custom-ca.crt
readOnly: true
{{- end -}}

{{- define "search_api.custom.ca.deploys.volumes" -}}
- name: custom-ca
configMap:
name: {{ include "search_api.fullname" . }}
{{- end -}}

{{/*
Return the target Kubernetes version
*/}}
Expand Down
4 changes: 4 additions & 0 deletions charts/search-api/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,3 +74,7 @@ data:
}
}
}
{{- if .Values.customCAs.bundle }}
custom-ca.crt: |-
{{- .Values.customCAs.bundle | nindent 4 }}
{{- end }}
32 changes: 30 additions & 2 deletions charts/search-api/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,14 @@ apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "search_api.fullname" . }}
{{- if .Values.annotations }}
{{- if or .Values.annotations .Values.customCAs.bundle }}
annotations:
{{- toYaml .Values.annotations | nindent 4 }}
{{- if .Values.customCAs.bundle }}
checksum/config: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum }}
{{- end }}
{{- with .Values.annotations }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
labels:
{{- include "search_api.labels" . | nindent 4 }}
Expand Down Expand Up @@ -53,6 +58,9 @@ spec:
secretKeyRef:
name: {{ include "search_api.fullname" . }}
key: s3SecretKey
{{- if .Values.customCAs.bundle }}
{{- include "search_api.env.custom.ca.path" . | nindent 10 }}
{{- end }}
command:
- importer
- --endpoint={{ required "Valid .Values.dgctlStorage.host required!" .Values.dgctlStorage.host }}
Expand All @@ -72,6 +80,9 @@ spec:
mountPath: /etc/2gis
- name: search-api-data
mountPath: {{ .Values.api.dataDir }}
{{- if .Values.customCAs.bundle }}
{{- include "search_api.custom.ca.volumeMounts" . | nindent 12 }}
{{- end }}
containers:
- name: api
image: {{ required "A valid .Values.dgctlDockerRegistry entry required" .Values.dgctlDockerRegistry }}/{{ .Values.api.image.repository }}:{{ .Values.api.image.tag }}
Expand All @@ -88,9 +99,16 @@ spec:
mountPath: /etc/2gis
- name: search-api-data
mountPath: {{ .Values.api.dataDir }}
{{- if .Values.customCAs.bundle }}
{{- include "search_api.custom.ca.volumeMounts" . | nindent 12 }}
{{- end }}
env:
- name: REDEPLOY_LABEL
value: "{{ .Values.redeployLabel }}"
{{- if .Values.customCAs.bundle }}
{{- include "search_api.env.custom.ca.path" . | nindent 12 }}
{{- end }}

- name: nginx
image: {{ required "A valid .Values.dgctlDockerRegistry entry required" .Values.dgctlDockerRegistry }}/{{ .Values.nginx.image.repository }}:{{ .Values.nginx.image.tag }}
imagePullPolicy: {{ .Values.nginx.image.pullPolicy }}
Expand Down Expand Up @@ -122,6 +140,13 @@ spec:
volumeMounts:
- name: {{ include "search_api.name" $ }}-configmap
mountPath: /etc/2gis
{{- if .Values.customCAs.bundle }}
{{- include "search_api.custom.ca.volumeMounts" . | nindent 12 }}
{{- end }}
env:
{{- if .Values.customCAs.bundle }}
{{- include "search_api.env.custom.ca.path" . | nindent 12 }}
{{- end }}
volumes:
- name: {{ include "search_api.name" . }}-configmap
configMap:
Expand All @@ -133,6 +158,9 @@ spec:
path: nginx.conf
- name: search-api-data
emptyDir: {}
{{- if .Values.customCAs.bundle }}
{{- include "search_api.custom.ca.deploys.volumes" . | nindent 8 }}
{{- end }}
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
Expand Down
13 changes: 13 additions & 0 deletions charts/search-api/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,3 +189,16 @@ ingress:
# @extra nginx.resources.requests.memory A memory request, e.g., `128Mi`
# @extra nginx.resources.limits.cpu A CPU limit, e.g., `100m`
# @extra nginx.resources.limits.memory A memory limit, e.g., `128Mi`

# @section customCAs **Custom Certificate Authority**

# @param customCAs.bundle Custom CA [text representation of the X.509 PEM public-key certificate](https://www.rfc-editor.org/rfc/rfc7468#section-5.1)
# @param customCAs.certsPath Custom CA bundle mount directory in the container.
Copy link
Contributor

@v-a-v v-a-v Aug 26, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zhukov-d-man а давай добавим отдельным ПР с описанием что есть дефолт.

# @param customCAs.certsPath Custom CA bundle mount directory in the container. If empty, default: "/usr/local/share/ca-certificates"

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/2gis/on-premise-helm-charts/pull/485/files


customCAs:
endryhold marked this conversation as resolved.
Show resolved Hide resolved
bundle: ''
# bundle: |
# -----BEGIN CERTIFICATE-----
# ...
# -----END CERTIFICATE-----
certsPath: ''
Loading