Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make it possible to add ca-certs as secret #5

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

Make it possible to add ca-certs as secret #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d1d8b0d
feat: make it possible to add ca-certs as secret
philipsens Sep 25, 2023
857f98d
fix: add more flexability for ca certs
philipsens Sep 25, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/zaakbrug/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ description: A Helm chart for running ZaakBrug on Kubernetes
name: zaakbrug
icon: https://raw.githubusercontent.com/wearefrank/charts/master/charts/zaakbrug/icon.png
type: application
version: 2.0.7
version: 2.1.0

dependencies:
- name: ff-common
Expand Down
16 changes: 16 additions & 0 deletions charts/zaakbrug/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,22 @@ helm delete zaakbrug
| `frank.server.transactionManager` | Set the transaction manager for Tomcat. Options: `NARAYANA`, `BTM`, `` | `""` |
| `frank.environmentVariables` | Set extra environment variables for the Frank! | `{}` |

### Section CA Certificates

Adds given CA Certificated to the truststore.

The key in the secret will be used as filename.

Ref: https://github.com/docker-library/docs/blob/master/eclipse-temurin/README.md#can-i-add-my-internal-ca-certificates-to-the-truststore

| Name | Description | Value |
| ----------------------------------------- | -------------------------------------------- | ------- |
| `frank.caCertificates.enabled` | Use system certificates | `false` |
| `frank.caCertificates.secrets` | List of secretNames | `[]` |
| `frank.caCertificates.secrets.secretName` | Name of the secret to use | `""` |
| `frank.caCertificates.secrets.subPath` | Key in the secret to use | `""` |
| `frank.caCertificates.secrets.mountPath` | Filename to mount in `/certificates/` folder | `""` |

### Frank!Framework Connection parameters

| Name | Description | Value |
Expand Down
5 changes: 4 additions & 1 deletion charts/zaakbrug/templates/configmap.zaakbrug.env.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,7 @@ metadata:
labels:
{{- include "ff-common.labels" . | nindent 4 }}
data:
zaakbrug.zds.timezone: "{{ .Values.zaakbrug.zds.timezone | default "UTC" }}"
zaakbrug.zds.timezone: "{{ .Values.zaakbrug.zds.timezone | default "UTC" }}"
{{- with .Values.frank.caCertificates.enabled }}
USE_SYSTEM_CA_CERTS: "Yes Please"
{{- end }}
24 changes: 20 additions & 4 deletions charts/zaakbrug/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
{{- template "ff-common.deployment" (list . "ff-test.deployment") -}}
{{- define "ff-test.deployment" -}}
{{- template "ff-common.deployment" (list . "zaakbrug.deployment") -}}
{{- define "zaakbrug.deployment" -}}
spec:
template:
spec:
containers:
-
{{ include "ff-common.container" (list . "ff-test.deployment.container") | nindent 10}}
{{ include "ff-common.container" (list . "zaakbrug.deployment.container") | nindent 10}}
volumes:
{{- if .Values.securityContext.readOnlyRootFilesystem }}
- name: tmpfs
Expand Down Expand Up @@ -41,8 +41,15 @@ spec:
configMap:
name: {{ template "ff-common.fullname" . }}-profiles
{{- end -}}
{{- if .Values.frank.caCertificates.enabled }}
{{- range $index, $value := .Values.frank.caCertificates.secrets }}
- name: ca-cert-{{ $index }}
secret:
secretName: {{ $value.secretName }}
{{- end }}
{{- end }}
{{- end -}}
{{- define "ff-test.deployment.container" -}}
{{- define "zaakbrug.deployment.container" -}}
envFrom:
- configMapRef:
name: {{ template "ff-common.fullname" . }}-env
Expand Down Expand Up @@ -94,4 +101,13 @@ volumeMounts:
subPath: Profiles.json
readOnly: true
{{- end }}
{{- if .Values.frank.caCertificates.enabled }}
{{- range $index, $value := .Values.frank.caCertificates.secrets }}
- name: ca-cert-{{ $index }}
mountPath: "/certificates/{{ default "" $value.mountPath }}"
{{- with $value.subPath }}
subPath: {{ . }}
{{- end }}
{{- end }}
{{- end }}
{{- end -}}
56 changes: 36 additions & 20 deletions charts/zaakbrug/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,6 +182,22 @@
"default": "NARAYANA"
}
}
},
"caCertificates": {
"type": "object",
"properties": {
"enabled": {
"type": "boolean",
"description": "Use system certificates",
"default": false
},
"secrets": {
"type": "array",
"description": "List of secretNames",
"default": [],
"items": {}
}
}
}
}
},
Expand Down Expand Up @@ -364,26 +380,6 @@
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
"create": {
"type": "boolean",
"description": "Enable creation of ServiceAccount for Frank!Framework pod",
"default": true
},
"annotations": {
"type": "object",
"description": "Additional custom annotations for the ServiceAccount",
"default": {}
},
"name": {
"type": "string",
"description": "The name of the ServiceAccount to use.",
"default": ""
}
}
},
"zaakbrug": {
"type": "object",
"properties": {
Expand Down Expand Up @@ -711,6 +707,26 @@
}
}
},
"serviceAccount": {
"type": "object",
"properties": {
"create": {
"type": "boolean",
"description": "Enable creation of ServiceAccount for Frank!Framework pod",
"default": true
},
"annotations": {
"type": "object",
"description": "Additional custom annotations for the ServiceAccount",
"default": {}
},
"name": {
"type": "string",
"description": "The name of the ServiceAccount to use.",
"default": ""
}
}
},
"podAnnotations": {
"type": "object",
"description": "Annotations for Frank!Framework pods",
Expand Down
18 changes: 18 additions & 0 deletions charts/zaakbrug/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,24 @@ frank:
## @param frank.environmentVariables [object] Set extra environment variables for the Frank!
##
environmentVariables: { }
## @section Section CA Certificates
## @descriptionStart
## Adds given CA Certificated to the truststore.
##
## The key in the secret will be used as filename.
##
## Ref: https://github.com/docker-library/docs/blob/master/eclipse-temurin/README.md#can-i-add-my-internal-ca-certificates-to-the-truststore
## @descriptionEnd
##
## @param frank.caCertificates.enabled Use system certificates
## @param frank.caCertificates.secrets [array] List of secretNames
## @param frank.caCertificates.secrets.secretName [string] Name of the secret to use
## @param frank.caCertificates.secrets.subPath [string] Key in the secret to use
## @param frank.caCertificates.secrets.mountPath [string] Filename to mount in `/certificates/` folder
##
caCertificates:
enabled: false
secrets: []

## @section Frank!Framework Connection parameters
##
Expand Down