Skip to content

Commit 5fa768d

Browse files
knative-prow-robotdavidhadas
knative-prow-robot
and
davidhadas
authored
[release-0.3] Tls script (#126)
* TLS scripts * TLS scripts * TLS scripts * TLS scripts * TLS scripts Co-authored-by: David Hadas <david.hadas@gmail.com>
1 parent 802ae98 commit 5fa768d

File tree

5 files changed

+168
-1
lines changed

5 files changed

+168
-1
lines changed

‎config/deploy/queue-proxy.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,3 @@ metadata:
2323
data:
2424
# This overrides the configmap produced by knative serving
2525
queue-sidecar-image: ko://knative.dev/security-guard/cmd/queue
26-
queue-sidecar-tokens: guard-service

‎hack/installUsingOperatorWithTLS.sh‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2022 The Knative Authors
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
18+
# Set the ROOT_CA and token audiences
19+
20+
echo "Copy the certificate to file"
21+
ROOTCA="$(mktemp)"
22+
FILENAME=`basename $ROOTCA`
23+
kubectl get secret -n knative-serving knative-serving-certs -o json| jq -r '.data."ca-cert.pem"' | base64 -d > $ROOTCA
24+
25+
echo "Create a temporary config-deployment configmap with the certificate"
26+
CERT=`kubectl create cm config-deployment --from-file $ROOTCA -o json --dry-run=client |jq .data.\"$FILENAME\"`
27+
28+
echo "cleanup"
29+
rm $ROOTCA
30+
31+
kubectl apply --filename - <<EOF
32+
apiVersion: v1
33+
kind: Namespace
34+
metadata:
35+
name: knative-serving
36+
---
37+
apiVersion: operator.knative.dev/v1beta1
38+
kind: KnativeServing
39+
metadata:
40+
name: knative-serving
41+
namespace: knative-serving
42+
spec:
43+
deployments:
44+
- name: guard-service
45+
env:
46+
- container: guard-service
47+
envVars:
48+
- name: GUARD_SERVICE_TLS
49+
value: "true"
50+
- name: GUARD_SERVICE_AUTH
51+
value: "true"
52+
security:
53+
securityGuard:
54+
enabled: true
55+
ingress:
56+
kourier:
57+
enabled: true
58+
config:
59+
network:
60+
ingress.class: "kourier.ingress.networking.knative.dev"
61+
deployment:
62+
queue-sidecar-rootca: ${CERT}
63+
queue-sidecar-token-audiences: guard-service
64+
EOF
65+
66+
kubectl get KnativeServing -n knative-serving -o yaml

‎hack/installUsingOperatorWithoutTLS.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
kubectl apply --filename - <<EOF
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: knative-serving
6+
---
7+
apiVersion: operator.knative.dev/v1beta1
8+
kind: KnativeServing
9+
metadata:
10+
name: knative-serving
11+
namespace: knative-serving
12+
spec:
13+
security:
14+
securityGuard:
15+
enabled: true
16+
ingress:
17+
kourier:
18+
enabled: true
19+
config:
20+
network:
21+
ingress.class: "kourier.ingress.networking.knative.dev"
22+
EOF
23+
24+
kubectl get KnativeServing -n knative-serving -o yaml

‎hack/setTLS.sh‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2022 The Knative Authors
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
18+
# Set the ROOT_CA and token audiences
19+
20+
echo "Copy the certificate to file"
21+
ROOTCA="$(mktemp)"
22+
FILENAME=`basename $ROOTCA`
23+
kubectl get secret -n knative-serving knative-serving-certs -o json| jq -r '.data."ca-cert.pem"' | base64 -d > $ROOTCA
24+
25+
echo "Create a temporary config-deployment configmap with the certificate"
26+
CERT=`kubectl create cm config-deployment --from-file $ROOTCA -o json --dry-run=client |jq .data.\"$FILENAME\"`
27+
28+
echo "Get the current config-deployment configmap"
29+
CURRENT="$(mktemp)"
30+
kubectl get cm config-deployment -n knative-serving -o json | jq 'del(.data, .binaryData | ."queue-sidecar-token-audiences", ."queue-sidecar-rootca" )' > $CURRENT
31+
32+
echo "Add queue-sidecar-token-audiences"
33+
AUDIENCES="$(mktemp)"
34+
jq '.data |= . + { "queue-sidecar-token-audiences": "guard-service"}' $CURRENT > $AUDIENCES
35+
36+
echo "Join the two config-deployment configmaps into one"
37+
MERGED="$(mktemp)"
38+
jq --arg cert "${CERT}" '.data |= . + { "queue-sidecar-rootca": $cert}' $AUDIENCES > $MERGED
39+
40+
echo "Apply the joined config-deployment configmap"
41+
kubectl apply -f $MERGED -n knative-serving
42+
43+
echo "cleanup"
44+
rm $MERGED $AUDIENCES $ROOTCA $CURRENT
45+
46+
echo "Results:"
47+
kubectl get cm config-deployment -n knative-serving -o json|jq '.data'

‎hack/unsetTLS.sh‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2022 The Knative Authors
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
18+
# Unset the ROOT_CA and token audiences
19+
20+
echo "Get the current config-deployment configmap"
21+
CURRENT="$(mktemp)"
22+
kubectl get cm config-deployment -n knative-serving -o json | jq 'del(.data, .binaryData | ."queue-sidecar-token-audiences", ."queue-sidecar-rootca" )' > $CURRENT
23+
24+
echo "Apply the joined config-deployment configmap"
25+
kubectl apply -f $CURRENT -n knative-serving
26+
27+
echo "cleanup"
28+
rm $CURRENT
29+
30+
echo "Results:"
31+
kubectl get cm config-deployment -n knative-serving -o json|jq '.data'

0 commit comments

Comments
 (0)