Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(truststore): declarative configuration of TLS trusted certificate Secrets #219

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat(truststore): declarative configuration of TLS trusted certificate Secrets #219

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
404547d
feat(truststore): declarative configuration of TLS trusted certificat…
andrewazores Nov 27, 2024
8554e11
test
andrewazores Nov 27, 2024
c400d0d
projected volume
andrewazores Dec 4, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions charts/cryostat/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,8 @@ helm install cryostat ./charts/cryostat
| `core.discovery.kubernetes.portNames` | List of port names that the Cryostat application should look for in order to consider a target as JMX connectable | `[]` |
| `core.discovery.kubernetes.builtInPortNumbersDisabled` | When false and `portNumbers` is empty, the Cryostat application will use the default port number `9091` to look for JMX connectable targets. | `false` |
| `core.discovery.kubernetes.portNumbers` | List of port numbers that the Cryostat application should look for in order to consider a target as JMX connectable | `[]` |
| `core.config.declarative.fsMode` | default filesystem mode (permissions) for declarative configuration volumes | `440` |
| `core.config.tlsTruststore.secretNames` | List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore. | `[]` |

### Report Generator Deployment

Expand Down
13 changes: 13 additions & 0 deletions charts/cryostat/templates/cryostat_deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,10 @@ spec:
failureThreshold: 18
resources:
{{- toYaml .Values.core.resources | nindent 12 }}
volumeMounts:
- name: declarative-trusted-tls-certs
mountPath: /truststore
readOnly: true
- name: {{ printf "%s-%s" .Chart.Name "grafana" }}
securityContext:
{{- toYaml .Values.grafana.securityContext | nindent 12 }}
Expand Down Expand Up @@ -216,3 +220,12 @@ spec:
secret:
secretName: {{ .Release.Name }}-proxy-tls
{{- end }}
- name: declarative-trusted-tls-certs
projected:
defaultMode: {{ .Values.core.config.declarative.fsMode }}
sources:
{{- range .Values.core.config.tlsTruststore.secretNames }}
- secret:
secretName: {{ . }}
optional: false
{{- end }}
28 changes: 28 additions & 0 deletions charts/cryostat/tests/cryostat_deployment_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,6 +180,8 @@ tests:
requests:
cpu: 500m
memory: 384Mi
- notExists:
path: spec.template.spec.contains[?(@.name=='cryostat')].volumeMounts

- it: should set log level
set:
Expand Down Expand Up @@ -514,3 +516,29 @@ tests:
path: spec.template.spec.containers[?(@.name=='cryostat-jfr-datasource')].imagePullPolicy
value: "IfNotPresent"

- it: should add volume mounts for declarative TLS truststore
set:
core.config.tlsTruststore.secretNames: ['a', 'b']
asserts:
- equal:
path: spec.template.spec.containers[?(@.name=='cryostat')].volumeMounts
value:
- name: declarative-trusted-tls-certs
mountPath: /truststore
readOnly: true
- equal:
path: spec.template.spec.volumes
value:
- name: alpha-config
configMap:
name: RELEASE-NAME-alpha-config
- name: declarative-trusted-tls-certs
projected:
defaultMode: 0440
sources:
- secret:
secretName: a
optional: false
- secret:
secretName: b
optional: false
26 changes: 26 additions & 0 deletions charts/cryostat/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -258,6 +258,32 @@
}
}
}
},
"config": {
"type": "object",
"properties": {
"declarative": {
"type": "object",
"properties": {
"fsMode": {
"type": "number",
"description": "default filesystem mode (permissions) for declarative configuration volumes",
"default": 440
}
}
},
"tlsTruststore": {
"type": "object",
"properties": {
"secretNames": {
"type": "array",
"description": "List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore.",
"default": [],
"items": {}
}
}
}
}
}
}
},
Expand Down
7 changes: 7 additions & 0 deletions charts/cryostat/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,6 +85,13 @@ core:
builtInPortNumbersDisabled: false
## @param core.discovery.kubernetes.portNumbers [array] List of port numbers that the Cryostat application should look for in order to consider a target as JMX connectable
portNumbers: []
config:
declarative:
## @param core.config.declarative.fsMode default filesystem mode (permissions) for declarative configuration volumes
fsMode: 0440
tlsTruststore:
## @param core.config.tlsTruststore.secretNames [array] List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore.
secretNames: []

## @section Report Generator Deployment
## @extra reports Configuration for the Reports Generator deployment
Expand Down
Loading