Skip to content

Commit 28a94de

Browse files
thongdk8thongdk8
committed
Add TLS support for scalar manager
1 parent e8414a4 commit 28a94de

File tree

5 files changed

+558
-1
lines changed

5 files changed

+558
-1
lines changed

‎charts/scalar-manager/README.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,39 @@ Current chart version is `3.0.0-SNAPSHOT`
3333
| scalarManager.securityContext.runAsNonRoot | bool | `true` | |
3434
| scalarManager.serviceAccount.automountServiceAccountToken | bool | `true` | |
3535
| scalarManager.serviceAccount.serviceAccountName | string | `""` | |
36+
| scalarManager.tls | object | `{"certManager":{"dnsNames":["localhost","scalar-manager"],"duration":"8760h0m0s","enabled":false,"issuerRef":{},"privateKey":{"algorithm":"RSA","encoding":"PKCS8","size":2048},"renewBefore":"360h0m0s","selfSigned":{"enabled":false,"type":"ca"},"usages":["server auth","key encipherment","signing"]},"downstream":{"caRootCertSecret":"","certChainSecret":"","enabled":false,"privateKeySecret":""},"upstream":{"grafana":{"caRootCertSecret":"","enabled":false,"overrideAuthority":""},"prometheus":{"caRootCertSecret":"","enabled":false,"overrideAuthority":""},"scalardb":{"caRootCertSecret":"","enabled":false,"overrideAuthority":""},"scalardl":{"caRootCertSecret":"","enabled":false,"overrideAuthority":""}}}` | Unified TLS configuration for both API and Web components. |
37+
| scalarManager.tls.certManager | object | `{"dnsNames":["localhost","scalar-manager"],"duration":"8760h0m0s","enabled":false,"issuerRef":{},"privateKey":{"algorithm":"RSA","encoding":"PKCS8","size":2048},"renewBefore":"360h0m0s","selfSigned":{"enabled":false,"type":"ca"},"usages":["server auth","key encipherment","signing"]}` | Cert-manager integration for automatic certificate management. |
38+
| scalarManager.tls.certManager.dnsNames | list | `["localhost","scalar-manager"]` | DNS names for the certificate. |
39+
| scalarManager.tls.certManager.duration | string | `"8760h0m0s"` | Duration of the certificate. |
40+
| scalarManager.tls.certManager.enabled | bool | `false` | Enable cert-manager integration. |
41+
| scalarManager.tls.certManager.issuerRef | object | `{}` | Reference to the issuer for the certificate. |
42+
| scalarManager.tls.certManager.privateKey | object | `{"algorithm":"RSA","encoding":"PKCS8","size":2048}` | Private key configurations. |
43+
| scalarManager.tls.certManager.renewBefore | string | `"360h0m0s"` | How long before expiry the certificate should be renewed. |
44+
| scalarManager.tls.certManager.selfSigned | object | `{"enabled":false,"type":"ca"}` | Use a self-signed certificate. |
45+
| scalarManager.tls.certManager.selfSigned.type | string | `"ca"` | Type of self-signed issuer (ca or selfSigned). |
46+
| scalarManager.tls.certManager.usages | list | `["server auth","key encipherment","signing"]` | Usages for the certificate. |
47+
| scalarManager.tls.downstream | object | `{"caRootCertSecret":"","certChainSecret":"","enabled":false,"privateKeySecret":""}` | Enable downstream TLS for Scalar Manager (applies to both API and Web components). |
48+
| scalarManager.tls.downstream.caRootCertSecret | string | `""` | Secret containing the CA root certificate for web-to-API communication (Web needs to validate API's TLS certificate). |
49+
| scalarManager.tls.downstream.certChainSecret | string | `""` | Secret containing the certificate for downstream TLS. |
50+
| scalarManager.tls.downstream.enabled | bool | `false` | Enable downstream TLS (Web and API share the same certificate). |
51+
| scalarManager.tls.downstream.privateKeySecret | string | `""` | Secret containing the private key for downstream TLS. |
52+
| scalarManager.tls.upstream | object | `{"grafana":{"caRootCertSecret":"","enabled":false,"overrideAuthority":""},"prometheus":{"caRootCertSecret":"","enabled":false,"overrideAuthority":""},"scalardb":{"caRootCertSecret":"","enabled":false,"overrideAuthority":""},"scalardl":{"caRootCertSecret":"","enabled":false,"overrideAuthority":""}}` | Upstream TLS configuration for external service connections. |
53+
| scalarManager.tls.upstream.grafana | object | `{"caRootCertSecret":"","enabled":false,"overrideAuthority":""}` | Grafana TLS configuration. |
54+
| scalarManager.tls.upstream.grafana.caRootCertSecret | string | `""` | Secret containing the CA root certificate for validating Grafana SSL certificates. |
55+
| scalarManager.tls.upstream.grafana.enabled | bool | `false` | Enable TLS for Grafana proxy connections. |
56+
| scalarManager.tls.upstream.grafana.overrideAuthority | string | `""` | Override the hostname for TLS SNI when connecting to Grafana. |
57+
| scalarManager.tls.upstream.prometheus | object | `{"caRootCertSecret":"","enabled":false,"overrideAuthority":""}` | Prometheus TLS configuration. |
58+
| scalarManager.tls.upstream.prometheus.caRootCertSecret | string | `""` | Secret containing the CA root certificate for validating Prometheus SSL certificates. |
59+
| scalarManager.tls.upstream.prometheus.enabled | bool | `false` | Enable TLS for Prometheus connections. |
60+
| scalarManager.tls.upstream.prometheus.overrideAuthority | string | `""` | Override the hostname for TLS SNI when connecting to Prometheus. |
61+
| scalarManager.tls.upstream.scalardb | object | `{"caRootCertSecret":"","enabled":false,"overrideAuthority":""}` | ScalarDB TLS configuration. |
62+
| scalarManager.tls.upstream.scalardb.caRootCertSecret | string | `""` | Secret containing the CA root certificate for validating ScalarDB SSL certificates. |
63+
| scalarManager.tls.upstream.scalardb.enabled | bool | `false` | Enable TLS for ScalarDB connections. |
64+
| scalarManager.tls.upstream.scalardb.overrideAuthority | string | `""` | Override the hostname for TLS SNI when connecting to ScalarDB. |
65+
| scalarManager.tls.upstream.scalardl | object | `{"caRootCertSecret":"","enabled":false,"overrideAuthority":""}` | ScalarDL TLS configuration. |
66+
| scalarManager.tls.upstream.scalardl.caRootCertSecret | string | `""` | Secret containing the CA root certificate for validating ScalarDL SSL certificates. |
67+
| scalarManager.tls.upstream.scalardl.enabled | bool | `false` | Enable TLS for ScalarDL connections. |
68+
| scalarManager.tls.upstream.scalardl.overrideAuthority | string | `""` | Override the hostname for TLS SNI when connecting to ScalarDL. |
3669
| scalarManager.tolerations | list | `[]` | |
3770
| scalarManager.web.env | list | `[{"name":"GRAFANA_SERVER_URL","value":"http://scalardb-cluster-monitoring-grafana:3000"}]` | The environment variables for Scalar Manager web container. If you want to customize environment variables, you can override this value with your environment variables. |
3871
| scalarManager.web.image.pullPolicy | string | `"IfNotPresent"` | |

‎charts/scalar-manager/templates/scalar-manager/certmanager.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
{{- if and .Values.scalarManager.tls.downstream.enabled .Values.scalarManager.tls.certManager.enabled }}
2+
{{- if .Values.scalarManager.tls.certManager.selfSigned.enabled }}
3+
{{- if eq .Values.scalarManager.tls.certManager.selfSigned.type "ca" }}
4+
---
5+
# This issuer is for creating the self-signed CA certificate.
6+
apiVersion: cert-manager.io/v1
7+
kind: Issuer
8+
metadata:
9+
name: {{ include "scalar-manager.fullname" . }}-bootstrap-selfsigned-issuer
10+
namespace: {{ .Release.Namespace }}
11+
spec:
12+
selfSigned: {}
13+
---
14+
# This is the CA certificate.
15+
apiVersion: cert-manager.io/v1
16+
kind: Certificate
17+
metadata:
18+
name: {{ include "scalar-manager.fullname" . }}-ca-cert
19+
namespace: {{ .Release.Namespace }}
20+
spec:
21+
isCA: true
22+
commonName: {{ include "scalar-manager.fullname" . }}-ca
23+
secretName: {{ include "scalar-manager.fullname" . }}-ca-cert
24+
duration: {{ .Values.scalarManager.tls.certManager.duration }}
25+
renewBefore: {{ .Values.scalarManager.tls.certManager.renewBefore }}
26+
privateKey:
27+
algorithm: {{ .Values.scalarManager.tls.certManager.privateKey.algorithm }}
28+
encoding: {{ .Values.scalarManager.tls.certManager.privateKey.encoding }}
29+
size: {{ .Values.scalarManager.tls.certManager.privateKey.size }}
30+
issuerRef:
31+
name: {{ include "scalar-manager.fullname" . }}-bootstrap-selfsigned-issuer
32+
kind: Issuer
33+
---
34+
# This issuer uses the CA certificate to sign other certificates.
35+
apiVersion: cert-manager.io/v1
36+
kind: Issuer
37+
metadata:
38+
name: {{ include "scalar-manager.fullname" . }}-ca-issuer
39+
namespace: {{ .Release.Namespace }}
40+
spec:
41+
ca:
42+
secretName: {{ include "scalar-manager.fullname" . }}-ca-cert
43+
{{- else }}
44+
---
45+
# This is a self-signed issuer for non-CA self-signed certificates.
46+
apiVersion: cert-manager.io/v1
47+
kind: Issuer
48+
metadata:
49+
name: {{ include "scalar-manager.fullname" . }}-self-signed-issuer
50+
namespace: {{ .Release.Namespace }}
51+
spec:
52+
selfSigned: {}
53+
{{- end }}
54+
{{- end }}
55+
---
56+
apiVersion: cert-manager.io/v1
57+
kind: Certificate
58+
metadata:
59+
name: {{ include "scalar-manager.fullname" . }}-tls-cert
60+
namespace: {{ .Release.Namespace }}
61+
spec:
62+
secretName: {{ include "scalar-manager.fullname" . }}-tls-cert
63+
commonName: {{ include "scalar-manager.fullname" . }}
64+
{{- with .Values.scalarManager.tls.certManager.dnsNames }}
65+
dnsNames:
66+
{{- range . }}
67+
- {{ . | quote }}
68+
{{- end }}
69+
{{- end }}
70+
duration: {{ .Values.scalarManager.tls.certManager.duration }}
71+
renewBefore: {{ .Values.scalarManager.tls.certManager.renewBefore }}
72+
{{- with .Values.scalarManager.tls.certManager.usages }}
73+
usages:
74+
{{- range . }}
75+
- {{ . | quote }}
76+
{{- end }}
77+
{{- end }}
78+
privateKey:
79+
algorithm: {{ .Values.scalarManager.tls.certManager.privateKey.algorithm }}
80+
encoding: {{ .Values.scalarManager.tls.certManager.privateKey.encoding }}
81+
size: {{ .Values.scalarManager.tls.certManager.privateKey.size }}
82+
issuerRef:
83+
{{- if .Values.scalarManager.tls.certManager.selfSigned.enabled }}
84+
{{- if eq .Values.scalarManager.tls.certManager.selfSigned.type "ca" }}
85+
name: {{ include "scalar-manager.fullname" . }}-ca-issuer
86+
{{- else }}
87+
name: {{ include "scalar-manager.fullname" . }}-self-signed-issuer
88+
{{- end }}
89+
kind: Issuer
90+
{{- else }}
91+
{{- if not (len .Values.scalarManager.tls.certManager.issuerRef) }}
92+
{{- fail "When using cert-manager with an external issuer, scalarManager.tls.certManager.issuerRef must be configured." -}}
93+
{{- end }}
94+
{{- toYaml .Values.scalarManager.tls.certManager.issuerRef | nindent 4 }}
95+
{{- end }}
96+
{{- end }}

0 commit comments

Comments
 (0)