Skip to content

Commit a6d8e04

Browse files
francesco-furlanfrancesco-furlan
committed
feat(shield): add support to cert-manager on cluster-shield
1 parent 5457803 commit a6d8e04

File tree

5 files changed

+244
-0
lines changed

5 files changed

+244
-0
lines changed

‎charts/shield/templates/cluster/_tls.tpl‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111
{{- define "cluster.tls_certificates.secret_name" -}}
1212
{{- if .Values.cluster.tls_certificates.create -}}
1313
{{- include "cluster.fullname" . }}-tls-certificates
14+
{{- else if (include "cluster.tls_certificates.use_cert_manager" .) -}}
15+
{{- include "cluster.tls_certificates.cm_certificate_name" . -}}
1416
{{- else if .Values.cluster.tls_certificates.secret_name -}}
1517
{{- .Values.cluster.tls_certificates.secret_name -}}
1618
{{- else -}}
@@ -47,3 +49,112 @@
4749
{{- end -}}
4850
{{- $dnsNames | toYaml -}}
4951
{{- end }}
52+
53+
{{- define "cluster.tls_certificates.check_conflicts" -}}
54+
{{- if and .Values.cluster.tls_certificates.create .Values.cluster.tls_certificates.cert_manager.enabled -}}
55+
{{- fail "Cannot specify both tls_certificates.create and tls_certificates.cert_manager.enabled" -}}
56+
{{- end -}}
57+
{{- if and (not (quote .Values.cluster.tls_certificates.secret_name | empty)) .Values.cluster.tls_certificates.cert_manager.enabled -}}
58+
{{- fail "Cannot specify both tls_certificates.cert_manager.enabled and tls_certificates.secret_name" -}}
59+
{{- end -}}
60+
{{- end }}
61+
62+
{{- define "cluster.tls_certificates.use_cert_manager" -}}
63+
{{- if and .Values.cluster.tls_certificates.cert_manager .Values.cluster.tls_certificates.cert_manager.enabled -}}
64+
{{- if and (not .Values.cluster.tls_certificates.cert_manager.ca.generate) (not .Values.cluster.tls_certificates.cert_manager.ca.secret_name) -}}
65+
{{- fail "cert_manager.ca.secret_name must be specified when CA generation is disabled" -}}
66+
{{- end -}}
67+
{{- if and (not .Values.cluster.tls_certificates.cert_manager.issuer.generate) (not .Values.cluster.tls_certificates.cert_manager.issuer.name) -}}
68+
{{- fail "cert_manager.issuer.name must be specified when Issuer generation is disabled" -}}
69+
{{- end -}}
70+
{{- true -}}
71+
{{- end -}}
72+
{{- end }}
73+
74+
{{- define "cluster.tls_certificates.cm_certificate_name" -}}
75+
{{- printf "%s-cm-tls" ((include "cluster.fullname" .) | trimSuffix "-" | trunc 57) -}}
76+
{{- end }}
77+
78+
{{- define "cluster.tls_certificates.cm_ca_secret_name" -}}
79+
{{- if .Values.cluster.tls_certificates.cert_manager.ca.generate -}}
80+
{{- printf "%s-cm-ca" ((include "cluster.fullname" .) | trimSuffix "-" | trunc 58) -}}
81+
{{- else -}}
82+
{{- .Values.cluster.tls_certificates.cert_manager.ca.secret_name -}}
83+
{{- end -}}
84+
{{- end }}
85+
86+
{{- define "cluster.tls_certificates.cm_generate_ca" -}}
87+
{{- if and (include "cluster.tls_certificates.use_cert_manager" .) (.Values.cluster.tls_certificates.cert_manager.ca.generate) -}}
88+
{{- true -}}
89+
{{- end -}}
90+
{{- end }}
91+
92+
{{- define "cluster.tls_certificates.cm_generate_issuer" -}}
93+
{{- if and (include "cluster.tls_certificates.use_cert_manager" .) (.Values.cluster.tls_certificates.cert_manager.issuer.generate) -}}
94+
{{- true -}}
95+
{{- end -}}
96+
{{- end }}
97+
98+
{{- define "cluster.tls_certificates.cm_issuer_name" -}}
99+
{{- if .Values.cluster.tls_certificates.cert_manager.issuer.generate -}}
100+
{{- printf "%s-cm-self-issuer" ((include "cluster.fullname" .) | trimSuffix "-" | trunc 49) -}}
101+
{{- else -}}
102+
{{- .Values.cluster.tls_certificates.cert_manager.issuer.name -}}
103+
{{- end -}}
104+
{{- end }}
105+
106+
{{- define "cluster.tls_certificates.cm_issuer_namespace" -}}
107+
{{- if .Values.cluster.tls_certificates.cert_manager.issuer.generate -}}
108+
{{- if and (not .Values.cluster.tls_certificates.cert_manager.ca.generate) (not (empty .Values.cluster.tls_certificates.cert_manager.ca.secret_namespace)) -}}
109+
{{- .Values.cluster.tls_certificates.cert_manager.ca.secret_namespace -}}
110+
{{- else -}}
111+
{{- .Release.Namespace -}}
112+
{{- end -}}
113+
{{- else -}}
114+
{{- .Release.Namespace -}}
115+
{{- end -}}
116+
{{- end }}
117+
118+
{{- define "cluster.tls_certificates.cm_self_ca_cert_name" -}}
119+
{{- printf "%s-cm-self-ca" ((include "cluster.fullname" .) | trimSuffix "-" | trunc 53) -}}
120+
{{- end }}
121+
122+
{{- define "cluster.tls_certificates.cm_issuer_kind" -}}
123+
{{- if .Values.cluster.tls_certificates.cert_manager.issuer.generate -}}
124+
{{- if and (not .Values.cluster.tls_certificates.cert_manager.ca.generate) (not (empty .Values.cluster.tls_certificates.cert_manager.ca.secret_namespace)) -}}
125+
{{- "ClusterIssuer" -}}
126+
{{- else -}}
127+
{{- "Issuer" -}}
128+
{{- end -}}
129+
{{- else -}}
130+
{{- .Values.cluster.tls_certificates.cert_manager.issuer.kind -}}
131+
{{- end -}}
132+
{{- end }}
133+
134+
{{- define "cluster.tls_certificates.cm_issuer_group" -}}
135+
{{- if .Values.cluster.tls_certificates.cert_manager.issuer.generate -}}
136+
{{- "cert-manager.io" -}}
137+
{{- else -}}
138+
{{- .Values.cluster.tls_certificates.cert_manager.issuer.group -}}
139+
{{- end -}}
140+
{{- end }}
141+
142+
{{/*
143+
If we are generating the Issuer we are going to use the CA secret for the inject-ca annotation,
144+
because the Issuer maybe not ready yet.
145+
*/}}
146+
{{- define "cluster.tls_certificates.cm_use_ca_secret" -}}
147+
{{- if (include "cluster.tls_certificates.cm_generate_issuer" .) -}}
148+
{{- true -}}
149+
{{- end -}}
150+
{{- end }}
151+
152+
{{- define "cluster.tls_certificates.cm_ca_secret_template" -}}
153+
{{- $tmpl := .Values.cluster.tls_certificates.cert_manager.ca.secret_template -}}
154+
{{- $injectAnnotation := "cert-manager.io/allow-direct-injection" -}}
155+
{{- if and (include "cluster.tls_certificates.cm_generate_ca" .) (include "cluster.tls_certificates.cm_generate_issuer" .) -}}
156+
{{- $currentAnnotations := $tmpl.annotations | default (dict) -}}
157+
{{- $_ := set $tmpl "annotations" (merge $currentAnnotations (dict $injectAnnotation "true")) -}}
158+
{{- end -}}
159+
{{- $tmpl | toYaml -}}
160+
{{- end }}

‎charts/shield/templates/cluster/cert-manager-certificate.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{{- if (include "cluster.tls_certificates.use_cert_manager" .) }}
2+
---
3+
apiVersion: cert-manager.io/v1
4+
kind: Certificate
5+
metadata:
6+
name: {{ include "cluster.tls_certificates.cm_certificate_name" . }}
7+
namespace: {{ .Release.Namespace }}
8+
labels:
9+
{{- include "cluster.labels" . | nindent 4 }}
10+
spec:
11+
secretName: {{ include "cluster.tls_certificates.cm_certificate_name" . }}
12+
privateKey:
13+
algorithm: RSA
14+
encoding: PKCS1
15+
size: 2048
16+
issuerRef:
17+
name: {{ include "cluster.tls_certificates.cm_issuer_name" . }}
18+
kind: {{ include "cluster.tls_certificates.cm_issuer_kind" . }}
19+
group: {{ include "cluster.tls_certificates.cm_issuer_group" . }}
20+
duration: {{ .Values.cluster.tls_certificates.cert_manager.duration }}
21+
renewBefore: {{ .Values.cluster.tls_certificates.cert_manager.renew_before }}
22+
subject:
23+
organizations:
24+
- "Sysdig, Inc."
25+
isCA: false
26+
usages:
27+
- server auth
28+
- client auth
29+
commonName: {{ include "cluster.fullname" . }}
30+
dnsNames:
31+
{{- include "cluster.tls_certificates.dns_names" . | nindent 4 }}
32+
ipAddresses:
33+
- "127.0.0.1"
34+
{{- end }}

‎charts/shield/templates/cluster/cert-manager-self-generate.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{{- if and (include "cluster.tls_certificates.cm_generate_ca" .) (include "cluster.tls_certificates.cm_generate_issuer" .) }}
2+
apiVersion: cert-manager.io/v1
3+
kind: Issuer
4+
metadata:
5+
name: {{ include "cluster.tls_certificates.cm_self_ca_cert_name" . }}
6+
namespace: {{ include "cluster.tls_certificates.cm_issuer_namespace" . }}
7+
labels:
8+
{{- include "cluster.labels" . | nindent 4 }}
9+
spec:
10+
selfSigned: {}
11+
---
12+
apiVersion: cert-manager.io/v1
13+
kind: Certificate
14+
metadata:
15+
name: {{ include "cluster.tls_certificates.cm_self_ca_cert_name" . }}
16+
namespace: {{ include "cluster.tls_certificates.cm_issuer_namespace" . }}
17+
labels:
18+
{{- include "cluster.labels" . | nindent 4 }}
19+
spec:
20+
isCA: true
21+
commonName: {{ include "cluster.fullname" . }}
22+
secretName: {{ include "cluster.tls_certificates.cm_ca_secret_name" . }}
23+
secretTemplate:
24+
{{- (include "cluster.tls_certificates.cm_ca_secret_template" .) | nindent 4 }}
25+
privateKey:
26+
algorithm: RSA
27+
size: 2048
28+
duration: 43800h0m0s # 5 years
29+
renewBefore: 14600h0m0s # 1.6 year, 1/3rd of the duration
30+
issuerRef:
31+
name: {{ include "cluster.tls_certificates.cm_self_ca_cert_name" . }}
32+
kind: Issuer
33+
group: cert-manager.io
34+
{{- end }}
35+
{{- if (include "cluster.tls_certificates.cm_generate_issuer" .) }}
36+
---
37+
apiVersion: cert-manager.io/v1
38+
kind: {{ include "cluster.tls_certificates.cm_issuer_kind" . }}
39+
metadata:
40+
name: {{ include "cluster.tls_certificates.cm_issuer_name" . }}
41+
{{- if eq (include "cluster.tls_certificates.cm_issuer_kind" .) "Issuer" }}
42+
namespace: {{ include "cluster.tls_certificates.cm_issuer_namespace" . }}
43+
{{- end }}
44+
labels:
45+
{{- include "cluster.labels" . | nindent 4 }}
46+
spec:
47+
ca:
48+
secretName: {{ include "cluster.tls_certificates.cm_ca_secret_name" . }}
49+
{{- end }}

‎charts/shield/templates/cluster/tls-certificates-admissionregistration.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
{{- if (include "cluster.tls_certificates.required" .) }}
2+
{{- include "cluster.tls_certificates.check_conflicts" . -}}
23
{{- $cert := dict -}}
4+
{{- if not (include "cluster.tls_certificates.use_cert_manager" .) }}
35
{{- $existingTlsCertificatesSecret := lookup "v1" "Secret" .Release.Namespace (include "cluster.tls_certificates.secret_name" .) -}}
46
{{- if $existingTlsCertificatesSecret -}}
57
{{- $_ := set $cert "Cert" (index $existingTlsCertificatesSecret.data (include "cluster.tls_certificates.cert_file_name" .)) -}}
@@ -18,6 +20,7 @@
1820
{{- $_ := set $cert "Key" ($tlsCert.Key | b64enc) -}}
1921
{{- $_ := set $cert "CACert" ($ca.Cert | b64enc) -}}
2022
{{- end -}}
23+
{{- end -}}
2124
{{- if .Values.cluster.tls_certificates.create }}
2225
---
2326
apiVersion: v1
@@ -40,6 +43,14 @@ metadata:
4043
name: {{ include "cluster.audit_webhook_name" . }}
4144
labels:
4245
{{- include "cluster.labels" . | nindent 4 }}
46+
{{- if (include "cluster.tls_certificates.use_cert_manager" .) }}
47+
annotations:
48+
{{- if (include "cluster.tls_certificates.cm_use_ca_secret" .) }}
49+
cert-manager.io/inject-ca-from-secret: {{ include "cluster.tls_certificates.cm_issuer_namespace" . }}/{{ include "cluster.tls_certificates.cm_ca_secret_name" . }}
50+
{{- else }}
51+
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "cluster.tls_certificates.cm_certificate_name" . }}
52+
{{- end }}
53+
{{- end }}
4354
webhooks:
4455
- name: audit.secure.sysdig.com
4556
{{ with .Values.features.detections.kubernetes_audit.excluded_namespaces }}
@@ -63,7 +74,9 @@ webhooks:
6374
name: {{ include "cluster.service_name" . }}
6475
path: /k8s-audit
6576
port: {{ include "cluster.audit_service_port" . }}
77+
{{- if not (include "cluster.tls_certificates.use_cert_manager" .) }}
6678
caBundle: {{ $cert.CACert }}
79+
{{- end }}
6780
admissionReviewVersions: ["v1", "v1beta1"]
6881
sideEffects: None
6982
timeoutSeconds: {{ .Values.features.detections.kubernetes_audit.timeout }}
@@ -77,6 +90,14 @@ metadata:
7790
name: {{ include "cluster.admission_control_webhook_name" . }}
7891
labels:
7992
{{- include "cluster.labels" . | nindent 4 }}
93+
{{- if (include "cluster.tls_certificates.use_cert_manager" .) }}
94+
annotations:
95+
{{- if (include "cluster.tls_certificates.cm_use_ca_secret" .) }}
96+
cert-manager.io/inject-ca-from-secret: {{ include "cluster.tls_certificates.cm_issuer_namespace" . }}/{{ include "cluster.tls_certificates.cm_ca_secret_name" . }}
97+
{{- else }}
98+
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "cluster.tls_certificates.cm_certificate_name" . }}
99+
{{- end }}
100+
{{- end }}
80101
webhooks:
81102
- name: vac.secure.sysdig.com
82103
namespaceSelector:
@@ -112,7 +133,9 @@ webhooks:
112133
name: {{ include "cluster.service_name" . }}
113134
path: /validate
114135
port: {{ include "cluster.admission_control_service_port" . }}
136+
{{- if not (include "cluster.tls_certificates.use_cert_manager" .) }}
115137
caBundle: {{ $cert.CACert }}
138+
{{- end }}
116139
admissionReviewVersions: ["v1", "v1beta1"]
117140
sideEffects: None
118141
timeoutSeconds: {{ .Values.features.admission_control.timeout }}

‎charts/shield/values.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -440,6 +440,33 @@ cluster:
440440
create: true
441441
# The name of the secret that contains the TLS certificates
442442
secret_name:
443+
cert_manager:
444+
# Enable cert-manager for certificate management
445+
enabled: false
446+
ca:
447+
# Generate the CA certificate using cert-manager
448+
generate: false
449+
# The template for the CA certificate secret (if generate is true)
450+
# will automatically add the annotation `cert-manager.io/allow-direct-injection: "true"` if not present
451+
secret_template: {}
452+
# The name of the existing CA certificate secret (if generate is false)
453+
# has to be annotated with `cert-manager.io/allow-direct-injection: "true"`
454+
secret_name: ""
455+
# The namespace of the existing CA certificate secret (if generate is false)
456+
secret_namespace: ""
457+
issuer:
458+
# Generate the Issuer instead of using an existing one
459+
generate: false
460+
# The name of the existing issuer
461+
name: ""
462+
# The kind of the existing issuer (Issuer, ClusterIssuer)
463+
kind: Issuer
464+
# The group of the existing issuer
465+
group: cert-manager.io
466+
# Certificate duration (default: 30 days)
467+
duration: "720h"
468+
# How long before expiry to renew (default: 15 days)
469+
renew_before: "360h"
443470
resources:
444471
requests:
445472
# The CPU request for the cluster shield

0 commit comments

Comments
 (0)