add option to reuse previously auto-generated cert

charts/opentelemetry-operator/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: opentelemetry-operator
-version: 0.42.2
+version: 0.42.3
 description: OpenTelemetry Operator Helm chart for Kubernetes
 type: application
 home: https://opentelemetry.io/

charts/opentelemetry-operator/UPGRADING.md

@@ -1,5 +1,10 @@
 # Upgrade guidelines
 
+## <0.42.3 to 0.42.3
+
+A type of flag `autoGenerateCert` has been changed, now it is an object with two attributes `enabled` and `recreate`.
+If you previously set `autoGenerateCert` to `true` or `false` you have to set `autoGenerateCert.enabled` accordingly.
+
 ## <0.35.0 to 0.35.0
 OpenTelemetry Operator [0.82.0](https://github.com/open-telemetry/opentelemetry-operator/releases/tag/v0.82.0) includes a change that allows setting the management state of custom resources [PR 1888](https://github.com/open-telemetry/opentelemetry-operator/pull/1888). Since helm doesn't upgrade CRDs ([documented](https://github.com/open-telemetry/opentelemetry-helm-charts/tree/main/charts/opentelemetry-operator#upgrade-chart)) it is critical to manually update CRDs from chart `0.35.0` or above, possibly using [this procedure](https://github.com/open-telemetry/opentelemetry-helm-charts/issues/69#issuecomment-1567285625).  If this step isn't taken existing otelcol CRs won't be reconciled by the operator.
 

charts/opentelemetry-operator/_helpers.tpl

@@ -0,0 +1,120 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "opentelemetry-operator.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "opentelemetry-operator.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "opentelemetry-operator.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "opentelemetry-operator.labels" -}}
+helm.sh/chart: {{ include "opentelemetry-operator.chart" . }}
+{{ include "opentelemetry-operator.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "opentelemetry-operator.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "opentelemetry-operator.name" . }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "opentelemetry-operator.serviceAccountName" -}}
+{{- if .Values.manager.serviceAccount.create }}
+{{- default (include "opentelemetry-operator.name" .) .Values.manager.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.manager.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "opentelemetry-operator.podAnnotations" -}}
+{{- if .Values.manager.podAnnotations }}
+{{- .Values.manager.podAnnotations | toYaml }}
+{{- end }}
+{{- end }}
+
+{{- define "opentelemetry-operator.podLabels" -}}
+{{- if .Values.manager.podLabels }}
+{{- .Values.manager.podLabels | toYaml }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create an ordered name of the MutatingWebhookConfiguration
+*/}}
+{{- define "opentelemetry-operator.MutatingWebhookName" -}}
+{{- printf "%s-%s" (.Values.admissionWebhooks.namePrefix | toString) (include "opentelemetry-operator.fullname" .) | trimPrefix "-" }}
+{{- end }}
+
+
+{{/*
+Return certificate and CA for Webhooks.
+It handles variants when a cert has to be generated by Helm,
+a cert is loaded from an existing secret or is provided via `.Values`
+*/}}
+{{- define "opentelemetry-operator.WebhookCerts" -}}
+{{- $altNames := list ( printf "%s-webhook.%s" (include "opentelemetry-operator.fullname" .) .Release.Namespace ) ( printf "%s-webhook.%s.svc" (include "opentelemetry-operator.fullname" .) .Release.Namespace ) -}}
+{{- $caCertEnc := "" }}
+{{- $certCrtEnc := "" }}
+{{- $certKeyEnc := "" }}
+{{- if .Values.admissionWebhooks.autoGenerateCert.enabled }}
+{{- $prevSecret := (lookup "v1" "Secret" .Release.Namespace (default (printf "%s-controller-manager-service-cert" (include "opentelemetry-operator.fullname" .)) .Values.admissionWebhooks.secretName )) }}
+{{- if and (not .Values.admissionWebhooks.autoGenerateCert.recreate) $prevSecret }}
+{{- $certCrtEnc = index $prevSecret "data" "tls.crt" }}
+{{- $certKeyEnc = index $prevSecret "data" "tls.key" }}
+{{- $caCertEnc = index $prevSecret "data" "ca.crt" }}
+{{- if not $caCertEnc }}
+{{- $prevHook := (lookup "admissionregistration.k8s.io/v1" "MutatingWebhookConfiguration" .Release.Namespace (print (include "opentelemetry-operator.MutatingWebhookName" . ) "-mutation")) }}
+{{- $caCertEnc = (first $prevHook.webhooks).clientConfig.caBundle }}
+{{- end }}
+{{- else }}
+{{- $ca := genCA "opentelemetry-operator-operator-ca" 365 }}
+{{- $cert := genSignedCert (include "opentelemetry-operator.fullname" .) nil $altNames 365 $ca }}
+{{- $certCrtEnc = b64enc $cert.Cert }}
+{{- $certKeyEnc = b64enc $cert.Key }}
+{{- $caCertEnc = b64enc $ca.Cert }}
+{{- end }}
+{{- else }}
+{{- $certCrtEnc = b64enc .Values.admissionWebhooks.cert_file }}
+{{- $certKeyEnc = b64enc .Values.admissionWebhooks.key_file }}
+{{- $caCertEnc = b64enc .Values.admissionWebhooks.ca_file }}
+{{- end }}
+{{- {'crt': $certCrtEnc, 'key': $certKeyEnc, 'ca': $caCertEnc} | toYaml }}
+{{- end }}
+
+
+

charts/opentelemetry-operator/examples/default/rendered/admission-webhooks/operator-webhook-with-cert-manager.yaml

@@ -6,7 +6,7 @@ metadata:
   annotations:
     cert-manager.io/inject-ca-from: default/example-opentelemetry-operator-serving-cert
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm
@@ -88,7 +88,7 @@ metadata:
   annotations:
     cert-manager.io/inject-ca-from: default/example-opentelemetry-operator-serving-cert
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm

charts/opentelemetry-operator/examples/default/rendered/certmanager.yaml

@@ -4,7 +4,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm
@@ -29,7 +29,7 @@ apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm

charts/opentelemetry-operator/examples/default/rendered/clusterrole.yaml

@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm
@@ -253,7 +253,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm
@@ -271,7 +271,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm

charts/opentelemetry-operator/examples/default/rendered/clusterrolebinding.yaml

@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm
@@ -25,7 +25,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm

charts/opentelemetry-operator/examples/default/rendered/deployment.yaml

@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm

charts/opentelemetry-operator/examples/default/rendered/role.yaml

@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm

charts/opentelemetry-operator/examples/default/rendered/rolebinding.yaml

@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm

charts/opentelemetry-operator/examples/default/rendered/service.yaml

@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm
@@ -31,7 +31,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm

charts/opentelemetry-operator/examples/default/rendered/serviceaccount.yaml

@@ -6,7 +6,7 @@ metadata:
   name: opentelemetry-operator
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm

charts/opentelemetry-operator/examples/default/rendered/tests/test-certmanager-connection.yaml

@@ -6,7 +6,7 @@ metadata:
   name: "example-opentelemetry-operator-cert-manager"
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm

charts/opentelemetry-operator/examples/default/rendered/tests/test-service-connection.yaml

@@ -6,7 +6,7 @@ metadata:
   name: "example-opentelemetry-operator-metrics"
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm
@@ -43,7 +43,7 @@ metadata:
   name: "example-opentelemetry-operator-webhook"
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.42.2
+    helm.sh/chart: opentelemetry-operator-0.42.3
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.88.0"
     app.kubernetes.io/managed-by: Helm

charts/opentelemetry-operator/templates/_helpers.tpl

@@ -79,3 +79,39 @@ Create an ordered name of the MutatingWebhookConfiguration
 {{- define "opentelemetry-operator.MutatingWebhookName" -}}
 {{- printf "%s-%s" (.Values.admissionWebhooks.namePrefix | toString) (include "opentelemetry-operator.fullname" .) | trimPrefix "-" }}
 {{- end }}
+
+{{/*
+Return certificate and CA for Webhooks.
+It handles variants when a cert has to be generated by Helm,
+a cert is loaded from an existing secret or is provided via `.Values`
+*/}}
+{{- define "opentelemetry-operator.WebhookCert" -}}
+{{- $caCertEnc := "" }}
+{{- $certCrtEnc := "" }}
+{{- $certKeyEnc := "" }}
+{{- if .Values.admissionWebhooks.autoGenerateCert.enabled }}
+{{- $prevSecret := (lookup "v1" "Secret" .Release.Namespace (default (printf "%s-controller-manager-service-cert" (include "opentelemetry-operator.fullname" .)) .Values.admissionWebhooks.secretName )) }}
+{{- if and (not .Values.admissionWebhooks.autoGenerateCert.recreate) $prevSecret }}
+{{- $certCrtEnc = index $prevSecret "data" "tls.crt" }}
+{{- $certKeyEnc = index $prevSecret "data" "tls.key" }}
+{{- $caCertEnc = index $prevSecret "data" "ca.crt" }}
+{{- if not $caCertEnc }}
+{{- $prevHook := (lookup "admissionregistration.k8s.io/v1" "MutatingWebhookConfiguration" .Release.Namespace (print (include "opentelemetry-operator.MutatingWebhookName" . ) "-mutation")) }}
+{{- $caCertEnc = (first $prevHook.webhooks).clientConfig.caBundle }}
+{{- end }}
+{{- else }}
+{{- $altNames := list ( printf "%s-webhook.%s" (include "opentelemetry-operator.fullname" .) .Release.Namespace ) ( printf "%s-webhook.%s.svc" (include "opentelemetry-operator.fullname" .) .Release.Namespace ) -}}
+{{- $ca := genCA "opentelemetry-operator-operator-ca" 365 }}
+{{- $cert := genSignedCert (include "opentelemetry-operator.fullname" .) nil $altNames 365 $ca }}
+{{- $certCrtEnc = b64enc $cert.Cert }}
+{{- $certKeyEnc = b64enc $cert.Key }}
+{{- $caCertEnc = b64enc $ca.Cert }}
+{{- end }}
+{{- else }}
+{{- $certCrtEnc = b64enc .Values.admissionWebhooks.cert_file }}
+{{- $certKeyEnc = b64enc .Values.admissionWebhooks.key_file }}
+{{- $caCertEnc = b64enc .Values.admissionWebhooks.ca_file }}
+{{- end }}
+{{- $result := dict "crt" $certCrtEnc "key" $certKeyEnc "ca" $caCertEnc }}
+{{- $result | toYaml }}
+{{- end }}