Skip to content

Commit 1e75bda

Browse files
anirudhprasad-sapanirudhprasad-sap
authored
[Misc] webhook & server certificate helm configuration (SAP#96)
1 parent 5110b59 commit 1e75bda

File tree

11 files changed

+454
-53
lines changed

11 files changed

+454
-53
lines changed

‎api/v1alpha1/capoperator_types.go‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,16 @@ type CAPOperatorSpec struct {
4949
Controller Controller `json:"controller,omitempty"`
5050
// Monitoring specification
5151
Monitoring Monitoring `json:"monitoring,omitempty"`
52+
// Webhook specification
53+
Webhook Webhook `json:"webhook,omitempty"`
54+
}
55+
56+
type Webhook struct {
57+
// Certificate manager which can be either `Default` or `CertManager`
58+
// +kubebuilder:validation:Enum=Default;CertManager
59+
CertificateManager CertificateManager `json:"certificateManager,omitempty"`
60+
// Certificate configuration
61+
CertificateConfig *CertificateConfig `json:"certificateConfig,omitempty"`
5262
}
5363

5464
type Monitoring struct {
@@ -58,6 +68,11 @@ type Monitoring struct {
5868

5969
type SubscriptionServer struct {
6070
Subdomain string `json:"subDomain"`
71+
// Certificate manager which can be either `Gardener` or `CertManager`
72+
// +kubebuilder:validation:Enum=Gardener;CertManager
73+
CertificateManager CertificateManager `json:"certificateManager,omitempty"`
74+
// Certificate configuration
75+
CertificateConfig *CertificateConfig `json:"certificateConfig,omitempty"`
6176
}
6277

6378
type Controller struct {
@@ -80,6 +95,33 @@ type VersionMonitoring struct {
8095
PromClientAcquireRetryDelay Duration `json:"promClientAcquireRetryDelay,omitempty"`
8196
}
8297

98+
type CertificateConfig struct {
99+
// Gardener configuration
100+
Gardener Gardener `json:"gardener,omitempty"`
101+
// CertManager configuration
102+
CertManager CertManager `json:"certManager,omitempty"`
103+
}
104+
105+
type Gardener struct {
106+
// Issuer name
107+
IssuerName string `json:"issuerName,omitempty"`
108+
// Issuer namespace
109+
IssuerNamespace string `json:"issuerNamespace,omitempty"`
110+
}
111+
112+
type CertManager struct {
113+
// Issuer name
114+
IssuerName string `json:"issuerName,omitempty"`
115+
// Issuer kind
116+
IssuerKind string `json:"issuerKind,omitempty"`
117+
// Issuer group
118+
IssuerGroup string `json:"issuerGroup,omitempty"`
119+
}
120+
121+
// Supported values are Gardener, CertManager, or Default
122+
// For the subscription server, it can be either Gardener or CertManager, while for the webhook, it can be either Default or CertManager
123+
type CertificateManager string
124+
83125
// Duration is a valid time duration that can be parsed by Prometheus
84126
// Supported units: y, w, d, h, m, s, ms
85127
// Examples: `30s`, `1m`, `1h20m15s`, `15d`

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 74 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎chart/README.md‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,15 @@ Helm chart to deploy CAP Operator https://sap.github.io/cap-operator/
7171
| subscriptionServer.ingressGatewayLabels | object | `{"app":"istio-ingressgateway","istio":"ingressgateway"}` | Labels used to identify the istio ingress-gateway component |
7272
| subscriptionServer.dnsTarget | string | `"public-ingress.clusters.cs.services.sap"` | The dns target mentioned on the public ingress gateway service used in the cluster |
7373
| subscriptionServer.domain | string | `"cap-operator.clusters.cs.services.sap"` | The domain under which the cap operator subscription server would be available |
74+
| subscriptionServer.certificateManager | string | `"Gardener"` | Certificate manager which can be either `Gardener` or `CertManager` |
75+
| subscriptionServer.certificateConfig | object | `{"certManager":{"issuerGroup":"","issuerKind":"","issuerName":""},"gardener":{"issuerName":"","issuerNamespace":""}}` | Certificate configuration |
76+
| subscriptionServer.certificateConfig.certManager | object | `{"issuerGroup":"","issuerKind":"","issuerName":""}` | Cert Manager configuration |
77+
| subscriptionServer.certificateConfig.certManager.issuerGroup | string | `""` | Issuer group |
78+
| subscriptionServer.certificateConfig.certManager.issuerKind | string | `""` | Issuer kind |
79+
| subscriptionServer.certificateConfig.certManager.issuerName | string | `""` | Issuer name |
80+
| subscriptionServer.certificateConfig.gardener | object | `{"issuerName":"","issuerNamespace":""}` | Optionally specify the corresponding certificate configuration |
81+
| subscriptionServer.certificateConfig.gardener.issuerName | string | `""` | Issuer name |
82+
| subscriptionServer.certificateConfig.gardener.issuerNamespace | string | `""` | Issuer namespace |
7483
| webhook.sidecar | bool | `false` | Side car to mount admission review |
7584
| webhook.replicas | int | `1` | Replicas |
7685
| webhook.image.repository | string | `"ghcr.io/sap/cap-operator/web-hooks"` | Image repository |
@@ -94,4 +103,8 @@ Helm chart to deploy CAP Operator https://sap.github.io/cap-operator/
94103
| webhook.service.type | string | `"ClusterIP"` | Service type |
95104
| webhook.service.port | int | `443` | Service port |
96105
| webhook.service.targetPort | int | `1443` | Target port |
97-
106+
| webhook.certificateManager | string | `"Default"` | Certificate manager which can be either `Default` or `CertManager` |
107+
| webhook.certificateConfig | object | `{"certManager":{"issuerGroup":"","issuerKind":"","issuerName":""}}` | Optionally specify the corresponding certificate configuration |
108+
| webhook.certificateConfig.certManager.issuerGroup | string | `""` | Issuer group |
109+
| webhook.certificateConfig.certManager.issuerKind | string | `""` | Issuer kind |
110+
| webhook.certificateConfig.certManager.issuerName | string | `""` | Issuer name |

‎chart/templates/server-deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ metadata:
88
operator.sme.sap.com/category: controller
99
operator.sme.sap.com/release: {{.Release.Name}}
1010
spec:
11-
replicas: {{.Values.subscriptionServer.replicas}}
11+
replicas: {{.Values.subscriptionServer.replicas}}
1212
selector:
1313
matchLabels:
1414
operator.sme.sap.com/app: subscription-server

‎chart/templates/server-networking.yaml‎

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,40 @@
1-
{{- if .Capabilities.APIVersions.Has "cert.gardener.cloud/v1alpha1" }}
1+
{{- if and (.Capabilities.APIVersions.Has "cert-manager.io/v1") (eq .Values.subscriptionServer.certificateManager "CertManager") }}
22
---
3-
apiVersion: cert.gardener.cloud/v1alpha1
3+
apiVersion: cert-manager.io/v1
44
kind: Certificate
55
metadata:
66
name: {{.Release.Name}}-subscription-server
77
namespace: {{.Values.subscriptionServer.istioSystemNamespace}}
88
spec:
99
commonName: {{.Values.subscriptionServer.domain}}
10-
secretName: {{.Release.Name}}-subscription-server
11-
{{- else if .Capabilities.APIVersions.Has "cert-manager.io/v1" }}
10+
secretName: {{.Release.Name}}-subscription-server-cert-manager
11+
issuerRef:
12+
{{- with .Values.subscriptionServer.certificateConfig.certManager.issuerGroup }}
13+
group: {{ . }}
14+
{{- end }}
15+
{{- with .Values.subscriptionServer.certificateConfig.certManager.issuerKind }}
16+
kind: {{ . }}
17+
{{- end }}
18+
{{- with .Values.subscriptionServer.certificateConfig.certManager.issuerName }}
19+
name: {{ . }}
20+
{{- end }}
21+
{{- else if and (.Capabilities.APIVersions.Has "cert.gardener.cloud/v1alpha1") (eq .Values.subscriptionServer.certificateManager "Gardener") }}
1222
---
13-
apiVersion: cert-manager.io/v1
23+
apiVersion: cert.gardener.cloud/v1alpha1
1424
kind: Certificate
1525
metadata:
1626
name: {{.Release.Name}}-subscription-server
1727
namespace: {{.Values.subscriptionServer.istioSystemNamespace}}
1828
spec:
1929
commonName: {{.Values.subscriptionServer.domain}}
20-
secretName: {{.Release.Name}}-subscription-server
30+
secretName: {{.Release.Name}}-subscription-server-gardener
31+
{{- if .Values.subscriptionServer.certificateConfig.gardener.issuerName }}
2132
issuerRef:
22-
kind: ClusterIssuer
23-
name: cluster-ca
33+
name: {{.Values.subscriptionServer.certificateConfig.gardener.issuerName}}
34+
{{- if .Values.subscriptionServer.certificateConfig.gardener.issuerNamespace }}
35+
namespace: {{.Values.subscriptionServer.certificateConfig.gardener.issuerNamespace}}
36+
{{- end }}
37+
{{- end }}
2438
{{- end }}
2539
{{- if .Capabilities.APIVersions.Has "dns.gardener.cloud/v1alpha1" }}
2640
---
@@ -55,7 +69,11 @@ spec:
5569
number: 443
5670
protocol: HTTPS
5771
tls:
58-
credentialName: {{.Release.Name}}-subscription-server
72+
{{- if and (.Capabilities.APIVersions.Has "cert-manager.io/v1") (eq .Values.subscriptionServer.certificateManager "CertManager") }}
73+
credentialName: {{.Release.Name}}-subscription-server-cert-manager
74+
{{- else if and (.Capabilities.APIVersions.Has "cert.gardener.cloud/v1alpha1") (eq .Values.subscriptionServer.certificateManager "Gardener") }}
75+
credentialName: {{.Release.Name}}-subscription-server-gardener
76+
{{- end }}
5977
mode: SIMPLE
6078
---
6179
apiVersion: networking.istio.io/v1beta1

‎chart/templates/webhook-config.yaml‎

Lines changed: 57 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,34 @@
11
{{- if gt (int .Values.webhook.replicas) 0 }}
2+
{{- $caCert := "" }}
3+
---
4+
{{- if and (.Capabilities.APIVersions.Has "cert-manager.io/v1") (eq .Values.webhook.certificateManager "CertManager") }}
5+
---
6+
apiVersion: cert-manager.io/v1
7+
kind: Certificate
8+
metadata:
9+
name: {{.Release.Name}}-webhook-cert
10+
labels:
11+
operator.sme.sap.com/app: webhook
12+
operator.sme.sap.com/category: controller
13+
operator.sme.sap.com/release: {{.Release.Name}}
14+
spec:
15+
dnsNames:
16+
- {{.Release.Name}}-webhook
17+
- {{.Release.Name}}-webhook.{{ .Release.Namespace }}
18+
- {{.Release.Name}}-webhook.{{ .Release.Namespace }}.svc
19+
- {{.Release.Name}}-webhook.{{ .Release.Namespace }}.svc.cluster.local
20+
issuerRef:
21+
{{- with .Values.webhook.certificateConfig.certManager.issuerGroup }}
22+
group: {{ . }}
23+
{{- end }}
24+
{{- with .Values.webhook.certificateConfig.certManager.issuerKind }}
25+
kind: {{ . }}
26+
{{- end }}
27+
{{- with .Values.webhook.certificateConfig.certManager.issuerName }}
28+
name: {{ . }}
29+
{{- end }}
30+
secretName: {{.Release.Name}}-webhook-tls-managed
31+
{{- else }}
232
---
333
apiVersion: v1
434
kind: Secret
@@ -10,20 +40,31 @@ metadata:
1040
operator.sme.sap.com/release: {{.Release.Name}}
1141
type: Opaque
1242
data:
43+
{{- $cn := printf "%s-webhook.%s.svc" .Release.Name .Release.Namespace }}
1344
{{- $data := (lookup "v1" "Secret" .Release.Namespace (printf "%s-webhook-tls" .Release.Name )).data }}
14-
{{- $caCert := "" }}
1545
{{- if $data }}
16-
{{ $data | toYaml | nindent 2 }}
17-
{{- $caCert = index $data "ca.crt" }}
46+
{{- $caCert = index $data "ca.crt" }}
47+
{{- if (hasKey $data "ca.key") }}
48+
{{- $caKey := index $data "ca.key" }}
49+
ca.crt: {{ $caCert }}
50+
ca.key: {{ $caKey }}
51+
{{- $customCa := buildCustomCert $caCert $caKey }}
52+
{{- $customCaCert := genSignedCert $cn (list "127.0.0.1") (list $cn "localhost") 1000 $customCa }}
53+
tls.crt: {{ $customCaCert.Cert | b64enc }}
54+
tls.key: {{ $customCaCert.Key | b64enc }}
55+
{{- else }}
56+
{{ $data | toYaml | nindent 2 }}
57+
{{- end }}
1858
{{- else }}
19-
{{- $cn := printf "%s-webhook.%s.svc" .Release.Name .Release.Namespace }}
20-
{{- $ca := genCA (printf "%s-webhook-ca" .Release.Name ) 36500 }}
21-
{{- $cert := genSignedCert $cn (list "127.0.0.1") (list $cn "localhost") 36500 $ca }}
22-
ca.crt: {{ $ca.Cert | b64enc }}
23-
tls.crt: {{ $cert.Cert | b64enc }}
24-
tls.key: {{ $cert.Key | b64enc }}
25-
{{- $caCert = $ca.Cert | b64enc }}
59+
{{- $ca := genCA (printf "%s-webhook-ca" .Release.Name ) 3650 }}
60+
{{- $cert := genSignedCert $cn (list "127.0.0.1") (list $cn "localhost") 1000 $ca }}
61+
ca.crt: {{ $ca.Cert | b64enc }}
62+
ca.key: {{ $ca.Key | b64enc }}
63+
tls.crt: {{ $cert.Cert | b64enc }}
64+
tls.key: {{ $cert.Key | b64enc }}
65+
{{- $caCert = $ca.Cert | b64enc }}
2666
{{- end }}
67+
{{- end }}
2768
---
2869
apiVersion: admissionregistration.k8s.io/v1
2970
kind: ValidatingWebhookConfiguration
@@ -33,12 +74,18 @@ metadata:
3374
operator.sme.sap.com/app: webhook
3475
operator.sme.sap.com/category: controller
3576
operator.sme.sap.com/release: {{.Release.Name}}
77+
{{- if and (.Capabilities.APIVersions.Has "cert-manager.io/v1") (eq .Values.webhook.certificateManager "CertManager") }}
78+
annotations:
79+
cert-manager.io/inject-ca-from: {{.Release.Namespace}}/{{.Release.Name}}-webhook-cert
80+
{{- end }}
3681
webhooks:
3782
- name: cap-operator.sme.sap.com
3883
admissionReviewVersions:
3984
- v1
4085
clientConfig:
86+
{{- if not (and (.Capabilities.APIVersions.Has "cert-manager.io/v1") (eq .Values.webhook.certificateManager "CertManager")) }}
4187
caBundle: {{ $caCert }}
88+
{{- end }}
4289
service:
4390
name: {{.Release.Name}}-webhook
4491
namespace: {{ .Release.Namespace }}

0 commit comments

Comments
 (0)