Skip to content

Commit cde7c52

Browse files
chrissetochrisseto
committed
charts/redpanda: fix mTLS
Prior to this commit the chart had a variety of bugs around mTLS. The majority of them were incorrect path construction and handling of `.clientSecretRef`. The primary issue, though, is that the chart incorrectly mints a single client certificate regardless of how many trust chains are in use. This commit moves all name and path references into helper methods onto the `TLSCert` itself and generates client certs per unique trust chain with client auth enabled. K8S-719
1 parent c9dcbfc commit cde7c52

26 files changed

+923
-1151
lines changed

‎.changes/unreleased/charts-redpanda-Changed-20250918-152741.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
project: charts/redpanda
2+
kind: Changed
3+
body: Client certificates are now named `$FULLNAME-$CERT-client-cert`.
4+
time: 2025-09-18T15:27:41.700988-04:00

‎.changes/unreleased/charts-redpanda-Fixed-20250918-152623.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
project: charts/redpanda
2+
kind: Fixed
3+
body: mTLS client certificates are now generated per certificate, as required, instead of using a single and potentially invalid certificate.
4+
time: 2025-09-18T15:26:23.232523-04:00

‎.changes/unreleased/operator-Changed-20250918-152741.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
project: operator
2+
kind: Changed
3+
body: Client certificates are now named `$FULLNAME-$CERT-client-cert`.
4+
time: 2025-09-18T15:27:41.700988-04:00

‎.changes/unreleased/operator-Fixed-20250918-152623.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
project: operator
2+
kind: Fixed
3+
body: mTLS client certificates are now generated per certificate, as required, instead of using a single and potentially invalid certificate.
4+
time: 2025-09-18T15:26:23.232523-04:00

‎charts/redpanda/cert_issuers.go‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,17 @@ func certIssuersAndCAs(state *RenderState) ([]*certmanagerv1.Issuer, []*certmana
3535
var issuers []*certmanagerv1.Issuer
3636
var certs []*certmanagerv1.Certificate
3737

38-
if !TLSEnabled(state) {
39-
return issuers, certs
38+
inUseCerts := map[string]bool{}
39+
for _, name := range state.Values.Listeners.InUseServerCerts(&state.Values.TLS) {
40+
inUseCerts[name] = true
4041
}
42+
for _, name := range state.Values.Listeners.InUseClientCerts(&state.Values.TLS) {
43+
inUseCerts[name] = true
44+
}
45+
46+
for name := range helmette.SortedMap(inUseCerts) {
47+
data := state.Values.TLS.Certs.MustGet(name)
4148

42-
for name, data := range helmette.SortedMap(state.Values.TLS.Certs) {
4349
// If this certificate is disabled (.Enabled), provided directly by the
4450
// end user (.SecretRef), or has an issuer provided (.IssuerRef), we
4551
// don't need to bootstrap an issuer.
@@ -128,7 +134,7 @@ func certIssuersAndCAs(state *RenderState) ([]*certmanagerv1.Issuer, []*certmana
128134
Spec: certmanagerv1.IssuerSpec{
129135
IssuerConfig: certmanagerv1.IssuerConfig{
130136
CA: &certmanagerv1.CAIssuer{
131-
SecretName: fmt.Sprintf(`%s-%s-root-certificate`, Fullname(state), name),
137+
SecretName: data.RootSecretName(state, name),
132138
},
133139
},
134140
},

‎charts/redpanda/certs.go‎

Lines changed: 50 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,6 @@ import (
2323
)
2424

2525
func ClientCerts(state *RenderState) []*certmanagerv1.Certificate {
26-
if !TLSEnabled(state) {
27-
return []*certmanagerv1.Certificate{}
28-
}
29-
3026
fullname := Fullname(state)
3127
service := ServiceName(state)
3228
ns := state.Release.Namespace
@@ -35,8 +31,11 @@ func ClientCerts(state *RenderState) []*certmanagerv1.Certificate {
3531
domain := strings.TrimSuffix(state.Values.ClusterDomain, ".")
3632

3733
var certs []*certmanagerv1.Certificate
38-
for name, data := range helmette.SortedMap(state.Values.TLS.Certs) {
39-
if !helmette.Empty(data.SecretRef) || !ptr.Deref(data.Enabled, true) {
34+
for _, name := range state.Values.Listeners.InUseServerCerts(&state.Values.TLS) {
35+
data := state.Values.TLS.Certs.MustGet(name)
36+
37+
// Don't generate server Certificates if a secret is provided.
38+
if !helmette.Empty(data.SecretRef) {
4039
continue
4140
}
4241

@@ -83,7 +82,7 @@ func ClientCerts(state *RenderState) []*certmanagerv1.Certificate {
8382
Duration: helmette.MustDuration(duration),
8483
IsCA: false,
8584
IssuerRef: issuerRef,
86-
SecretName: fmt.Sprintf("%s-%s-cert", fullname, name),
85+
SecretName: data.ServerSecretName(state, name),
8786
PrivateKey: &certmanagerv1.CertificatePrivateKey{
8887
Algorithm: "ECDSA",
8988
Size: 256,
@@ -92,49 +91,54 @@ func ClientCerts(state *RenderState) []*certmanagerv1.Certificate {
9291
})
9392
}
9493

95-
name := state.Values.Listeners.Kafka.TLS.Cert
94+
for _, name := range state.Values.Listeners.InUseClientCerts(&state.Values.TLS) {
95+
data := state.Values.TLS.Certs.MustGet(name)
9696

97-
data, ok := state.Values.TLS.Certs[name]
98-
if !ok {
99-
panic(fmt.Sprintf("Certificate %q referenced but not defined", name))
100-
}
97+
if data.SecretRef != nil && data.ClientSecretRef == nil {
98+
panic(fmt.Sprintf(".clientSecretRef MUST be set if .secretRef is set and require_client_auth is true: Cert %q", name))
99+
}
101100

102-
if !helmette.Empty(data.SecretRef) || !ClientAuthRequired(state) {
103-
return certs
104-
}
101+
// Don't generate a client Certificate if a client secret is provided.
102+
if data.ClientSecretRef != nil {
103+
continue
104+
}
105105

106-
issuerRef := cmmetav1.ObjectReference{
107-
Group: "cert-manager.io",
108-
Kind: "Issuer",
109-
Name: fmt.Sprintf("%s-%s-root-issuer", fullname, name),
110-
}
106+
issuerRef := cmmetav1.ObjectReference{
107+
Group: "cert-manager.io",
108+
Kind: "Issuer",
109+
Name: fmt.Sprintf("%s-%s-root-issuer", fullname, name),
110+
}
111111

112-
if data.IssuerRef != nil {
113-
issuerRef = *data.IssuerRef
114-
issuerRef.Group = "cert-manager.io"
115-
}
112+
if data.IssuerRef != nil {
113+
issuerRef = *data.IssuerRef
114+
issuerRef.Group = "cert-manager.io"
115+
}
116+
117+
duration := helmette.Default("43800h", data.Duration)
116118

117-
duration := helmette.Default("43800h", data.Duration)
118-
119-
return append(certs, &certmanagerv1.Certificate{
120-
TypeMeta: metav1.TypeMeta{
121-
APIVersion: "cert-manager.io/v1",
122-
Kind: "Certificate",
123-
},
124-
ObjectMeta: metav1.ObjectMeta{
125-
Name: fmt.Sprintf("%s-client", fullname),
126-
Labels: FullLabels(state),
127-
},
128-
Spec: certmanagerv1.CertificateSpec{
129-
CommonName: fmt.Sprintf("%s-client", fullname),
130-
Duration: helmette.MustDuration(duration),
131-
IsCA: false,
132-
SecretName: fmt.Sprintf("%s-client", fullname),
133-
PrivateKey: &certmanagerv1.CertificatePrivateKey{
134-
Algorithm: "ECDSA",
135-
Size: 256,
119+
certs = append(certs, &certmanagerv1.Certificate{
120+
TypeMeta: metav1.TypeMeta{
121+
APIVersion: "cert-manager.io/v1",
122+
Kind: "Certificate",
123+
},
124+
ObjectMeta: metav1.ObjectMeta{
125+
Name: fmt.Sprintf("%s-%s-client", fullname, name),
126+
Namespace: state.Release.Namespace,
127+
Labels: FullLabels(state),
128+
},
129+
Spec: certmanagerv1.CertificateSpec{
130+
CommonName: fmt.Sprintf("%s--%s-client", fullname, name),
131+
Duration: helmette.MustDuration(duration),
132+
IsCA: false,
133+
SecretName: data.ClientSecretName(state, name),
134+
PrivateKey: &certmanagerv1.CertificatePrivateKey{
135+
Algorithm: "ECDSA",
136+
Size: 256,
137+
},
138+
IssuerRef: issuerRef,
136139
},
137-
IssuerRef: issuerRef,
138-
},
139-
})
140+
})
141+
}
142+
143+
return certs
140144
}

‎charts/redpanda/chart/templates/_cert-issuers.go.tpl‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,18 +33,27 @@
3333
{{- $_is_returning := false -}}
3434
{{- $issuers := (coalesce nil) -}}
3535
{{- $certs := (coalesce nil) -}}
36-
{{- if (not (get (fromJson (include "redpanda.TLSEnabled" (dict "a" (list $state)))) "r")) -}}
37-
{{- $_is_returning = true -}}
38-
{{- (dict "r" (list $issuers $certs)) | toJson -}}
36+
{{- $inUseCerts := (dict) -}}
37+
{{- range $_, $name := (get (fromJson (include "redpanda.Listeners.InUseServerCerts" (dict "a" (list $state.Values.listeners $state.Values.tls)))) "r") -}}
38+
{{- $_ := (set $inUseCerts $name true) -}}
39+
{{- end -}}
40+
{{- if $_is_returning -}}
41+
{{- break -}}
42+
{{- end -}}
43+
{{- range $_, $name := (get (fromJson (include "redpanda.Listeners.InUseClientCerts" (dict "a" (list $state.Values.listeners $state.Values.tls)))) "r") -}}
44+
{{- $_ := (set $inUseCerts $name true) -}}
45+
{{- end -}}
46+
{{- if $_is_returning -}}
3947
{{- break -}}
4048
{{- end -}}
41-
{{- range $name, $data := $state.Values.tls.certs -}}
49+
{{- range $name, $_ := $inUseCerts -}}
50+
{{- $data := (get (fromJson (include "redpanda.TLSCertMap.MustGet" (dict "a" (list (deepCopy $state.Values.tls.certs) $name)))) "r") -}}
4251
{{- if (or (or (not (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $data.enabled true)))) "r")) (ne (toJson $data.secretRef) "null")) (ne (toJson $data.issuerRef) "null")) -}}
4352
{{- continue -}}
4453
{{- end -}}
4554
{{- $issuers = (concat (default (list) $issuers) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil)) "spec" (dict) "status" (dict)) (mustMergeOverwrite (dict) (dict "apiVersion" "cert-manager.io/v1" "kind" "Issuer")) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil)) (dict "name" (printf `%s-%s-selfsigned-issuer` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $state)))) "r") $name) "namespace" $state.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $state)))) "r"))) "spec" (mustMergeOverwrite (dict) (mustMergeOverwrite (dict) (dict "selfSigned" (mustMergeOverwrite (dict) (dict)))) (dict)))))) -}}
4655
{{- $certs = (concat (default (list) $certs) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil)) "spec" (dict "secretName" "" "issuerRef" (dict "name" "")) "status" (dict)) (mustMergeOverwrite (dict) (dict "apiVersion" "cert-manager.io/v1" "kind" "Certificate")) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil)) (dict "name" (printf `%s-%s-root-certificate` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $state)))) "r") $name) "namespace" $state.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $state)))) "r"))) "spec" (mustMergeOverwrite (dict "secretName" "" "issuerRef" (dict "name" "")) (dict "duration" (get (fromJson (include "_shims.time_Duration_String" (dict "a" (list (get (fromJson (include "_shims.time_ParseDuration" (dict "a" (list (default "43800h" $data.duration))))) "r"))))) "r") "isCA" true "commonName" (printf `%s-%s-root-certificate` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $state)))) "r") $name) "secretName" (printf `%s-%s-root-certificate` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $state)))) "r") $name) "privateKey" (mustMergeOverwrite (dict) (dict "algorithm" "ECDSA" "size" (256 | int))) "issuerRef" (mustMergeOverwrite (dict "name" "") (dict "name" (printf `%s-%s-selfsigned-issuer` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $state)))) "r") $name) "kind" "Issuer" "group" "cert-manager.io")))))))) -}}
47-
{{- $issuers = (concat (default (list) $issuers) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil)) "spec" (dict) "status" (dict)) (mustMergeOverwrite (dict) (dict "apiVersion" "cert-manager.io/v1" "kind" "Issuer")) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil)) (dict "name" (printf `%s-%s-root-issuer` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $state)))) "r") $name) "namespace" $state.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $state)))) "r"))) "spec" (mustMergeOverwrite (dict) (mustMergeOverwrite (dict) (dict "ca" (mustMergeOverwrite (dict "secretName" "") (dict "secretName" (printf `%s-%s-root-certificate` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $state)))) "r") $name))))) (dict)))))) -}}
56+
{{- $issuers = (concat (default (list) $issuers) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil)) "spec" (dict) "status" (dict)) (mustMergeOverwrite (dict) (dict "apiVersion" "cert-manager.io/v1" "kind" "Issuer")) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil)) (dict "name" (printf `%s-%s-root-issuer` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $state)))) "r") $name) "namespace" $state.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $state)))) "r"))) "spec" (mustMergeOverwrite (dict) (mustMergeOverwrite (dict) (dict "ca" (mustMergeOverwrite (dict "secretName" "") (dict "secretName" (get (fromJson (include "redpanda.TLSCert.RootSecretName" (dict "a" (list $data $state $name)))) "r"))))) (dict)))))) -}}
4857
{{- end -}}
4958
{{- if $_is_returning -}}
5059
{{- break -}}

‎charts/redpanda/chart/templates/_certs.go.tpl‎

Lines changed: 16 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,14 @@
55
{{- $state := (index .a 0) -}}
66
{{- range $_ := (list 1) -}}
77
{{- $_is_returning := false -}}
8-
{{- if (not (get (fromJson (include "redpanda.TLSEnabled" (dict "a" (list $state)))) "r")) -}}
9-
{{- $_is_returning = true -}}
10-
{{- (dict "r" (list)) | toJson -}}
11-
{{- break -}}
12-
{{- end -}}
138
{{- $fullname := (get (fromJson (include "redpanda.Fullname" (dict "a" (list $state)))) "r") -}}
149
{{- $service := (get (fromJson (include "redpanda.ServiceName" (dict "a" (list $state)))) "r") -}}
1510
{{- $ns := $state.Release.Namespace -}}
1611
{{- $domain := (trimSuffix "." $state.Values.clusterDomain) -}}
1712
{{- $certs := (coalesce nil) -}}
18-
{{- range $name, $data := $state.Values.tls.certs -}}
19-
{{- if (or (not (empty $data.secretRef)) (not (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $data.enabled true)))) "r"))) -}}
13+
{{- range $_, $name := (get (fromJson (include "redpanda.Listeners.InUseServerCerts" (dict "a" (list $state.Values.listeners $state.Values.tls)))) "r") -}}
14+
{{- $data := (get (fromJson (include "redpanda.TLSCertMap.MustGet" (dict "a" (list (deepCopy $state.Values.tls.certs) $name)))) "r") -}}
15+
{{- if (not (empty $data.secretRef)) -}}
2016
{{- continue -}}
2117
{{- end -}}
2218
{{- $names := (coalesce nil) -}}
@@ -40,31 +36,32 @@
4036
{{- end -}}
4137
{{- $duration := (default "43800h" $data.duration) -}}
4238
{{- $issuerRef := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $data.issuerRef (mustMergeOverwrite (dict "name" "") (dict "kind" "Issuer" "group" "cert-manager.io" "name" (printf "%s-%s-root-issuer" $fullname $name))))))) "r") -}}
43-
{{- $certs = (concat (default (list) $certs) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil)) "spec" (dict "secretName" "" "issuerRef" (dict "name" "")) "status" (dict)) (mustMergeOverwrite (dict) (dict "apiVersion" "cert-manager.io/v1" "kind" "Certificate")) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil)) (dict "name" (printf "%s-%s-cert" $fullname $name) "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $state)))) "r") "namespace" $state.Release.Namespace)) "spec" (mustMergeOverwrite (dict "secretName" "" "issuerRef" (dict "name" "")) (dict "dnsNames" $names "duration" (get (fromJson (include "_shims.time_Duration_String" (dict "a" (list (get (fromJson (include "_shims.time_ParseDuration" (dict "a" (list $duration)))) "r"))))) "r") "isCA" false "issuerRef" $issuerRef "secretName" (printf "%s-%s-cert" $fullname $name) "privateKey" (mustMergeOverwrite (dict) (dict "algorithm" "ECDSA" "size" (256 | int))))))))) -}}
39+
{{- $certs = (concat (default (list) $certs) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil)) "spec" (dict "secretName" "" "issuerRef" (dict "name" "")) "status" (dict)) (mustMergeOverwrite (dict) (dict "apiVersion" "cert-manager.io/v1" "kind" "Certificate")) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil)) (dict "name" (printf "%s-%s-cert" $fullname $name) "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $state)))) "r") "namespace" $state.Release.Namespace)) "spec" (mustMergeOverwrite (dict "secretName" "" "issuerRef" (dict "name" "")) (dict "dnsNames" $names "duration" (get (fromJson (include "_shims.time_Duration_String" (dict "a" (list (get (fromJson (include "_shims.time_ParseDuration" (dict "a" (list $duration)))) "r"))))) "r") "isCA" false "issuerRef" $issuerRef "secretName" (get (fromJson (include "redpanda.TLSCert.ServerSecretName" (dict "a" (list $data $state $name)))) "r") "privateKey" (mustMergeOverwrite (dict) (dict "algorithm" "ECDSA" "size" (256 | int))))))))) -}}
4440
{{- end -}}
4541
{{- if $_is_returning -}}
4642
{{- break -}}
4743
{{- end -}}
48-
{{- $name := $state.Values.listeners.kafka.tls.cert -}}
49-
{{- $_97_data_ok := (get (fromJson (include "_shims.dicttest" (dict "a" (list $state.Values.tls.certs $name (dict "enabled" (coalesce nil) "caEnabled" false "applyInternalDNSNames" (coalesce nil) "duration" "" "issuerRef" (coalesce nil) "secretRef" (coalesce nil) "clientSecretRef" (coalesce nil)))))) "r") -}}
50-
{{- $data := (index $_97_data_ok 0) -}}
51-
{{- $ok := (index $_97_data_ok 1) -}}
52-
{{- if (not $ok) -}}
53-
{{- $_ := (fail (printf "Certificate %q referenced but not defined" $name)) -}}
44+
{{- range $_, $name := (get (fromJson (include "redpanda.Listeners.InUseClientCerts" (dict "a" (list $state.Values.listeners $state.Values.tls)))) "r") -}}
45+
{{- $data := (get (fromJson (include "redpanda.TLSCertMap.MustGet" (dict "a" (list (deepCopy $state.Values.tls.certs) $name)))) "r") -}}
46+
{{- if (and (ne (toJson $data.secretRef) "null") (eq (toJson $data.clientSecretRef) "null")) -}}
47+
{{- $_ := (fail (printf ".clientSecretRef MUST be set if .secretRef is set and require_client_auth is true: Cert %q" $name)) -}}
5448
{{- end -}}
55-
{{- if (or (not (empty $data.secretRef)) (not (get (fromJson (include "redpanda.ClientAuthRequired" (dict "a" (list $state)))) "r"))) -}}
56-
{{- $_is_returning = true -}}
57-
{{- (dict "r" $certs) | toJson -}}
58-
{{- break -}}
49+
{{- if (ne (toJson $data.clientSecretRef) "null") -}}
50+
{{- continue -}}
5951
{{- end -}}
6052
{{- $issuerRef := (mustMergeOverwrite (dict "name" "") (dict "group" "cert-manager.io" "kind" "Issuer" "name" (printf "%s-%s-root-issuer" $fullname $name))) -}}
6153
{{- if (ne (toJson $data.issuerRef) "null") -}}
6254
{{- $issuerRef = $data.issuerRef -}}
6355
{{- $_ := (set $issuerRef "group" "cert-manager.io") -}}
6456
{{- end -}}
6557
{{- $duration := (default "43800h" $data.duration) -}}
58+
{{- $certs = (concat (default (list) $certs) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil)) "spec" (dict "secretName" "" "issuerRef" (dict "name" "")) "status" (dict)) (mustMergeOverwrite (dict) (dict "apiVersion" "cert-manager.io/v1" "kind" "Certificate")) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil)) (dict "name" (printf "%s-%s-client" $fullname $name) "namespace" $state.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $state)))) "r"))) "spec" (mustMergeOverwrite (dict "secretName" "" "issuerRef" (dict "name" "")) (dict "commonName" (printf "%s--%s-client" $fullname $name) "duration" (get (fromJson (include "_shims.time_Duration_String" (dict "a" (list (get (fromJson (include "_shims.time_ParseDuration" (dict "a" (list $duration)))) "r"))))) "r") "isCA" false "secretName" (get (fromJson (include "redpanda.TLSCert.ClientSecretName" (dict "a" (list $data $state $name)))) "r") "privateKey" (mustMergeOverwrite (dict) (dict "algorithm" "ECDSA" "size" (256 | int))) "issuerRef" $issuerRef)))))) -}}
59+
{{- end -}}
60+
{{- if $_is_returning -}}
61+
{{- break -}}
62+
{{- end -}}
6663
{{- $_is_returning = true -}}
67-
{{- (dict "r" (concat (default (list) $certs) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil)) "spec" (dict "secretName" "" "issuerRef" (dict "name" "")) "status" (dict)) (mustMergeOverwrite (dict) (dict "apiVersion" "cert-manager.io/v1" "kind" "Certificate")) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil)) (dict "name" (printf "%s-client" $fullname) "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $state)))) "r"))) "spec" (mustMergeOverwrite (dict "secretName" "" "issuerRef" (dict "name" "")) (dict "commonName" (printf "%s-client" $fullname) "duration" (get (fromJson (include "_shims.time_Duration_String" (dict "a" (list (get (fromJson (include "_shims.time_ParseDuration" (dict "a" (list $duration)))) "r"))))) "r") "isCA" false "secretName" (printf "%s-client" $fullname) "privateKey" (mustMergeOverwrite (dict) (dict "algorithm" "ECDSA" "size" (256 | int))) "issuerRef" $issuerRef))))))) | toJson -}}
64+
{{- (dict "r" $certs) | toJson -}}
6865
{{- break -}}
6966
{{- end -}}
7067
{{- end -}}

0 commit comments

Comments
 (0)