Skip to content

Commit ef05b14

Browse files
cbarbian-sapcbarbian-sap
committed
make webhook tls setup work w/o cert-manager (optionally)
1 parent a9edb23 commit ef05b14

File tree

5 files changed

+133
-52
lines changed

5 files changed

+133
-52
lines changed

‎chart/README.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,11 @@ A Helm chart for https://github.com/sap/cf-service-operator
3030
| resources.limits.cpu | float | `0.1` | CPU limit |
3131
| resources.requests.memory | string | `"20Mi"` | Memory request |
3232
| resources.requests.cpu | float | `0.01` | CPU request |
33-
| enableSapBindingMetadata | bool | `false` | Enable SAP binding metadata (per default, can be overridden by annotation service-operator.cf.cs.sap.com/with-sap-binding-metadata) |
33+
| enableSapBindingMetadata | bool | `false` | Enable SAP binding metadata (per default, can be overridden by annotation per binding object) |
34+
| webhook.certManager.enabled | bool | `false` | Whether to use cert-manager to manage webhook tls |
35+
| webhook.certManager.issuerGroup | string | `""` | Issuer group (only relevant if enabled is true; if unset, the default cert-manager group is used) |
36+
| webhook.certManager.issuerKind | string | `""` | Issuer kind (only relevant if enabled is true; if unset, the default cert-manager type 'Issuer' is used) |
37+
| webhook.certManager.issuerName | string | `""` | Issuer name (only relevant if enabled is true; if unset, a self-signed issuer is used) |
3438

3539
----------------------------------------------
3640
Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0)

‎chart/templates/controller-deployment.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -98,5 +98,5 @@ spec:
9898
- name: tls
9999
secret:
100100
defaultMode: 420
101-
secretName: {{ include "cf-service-operator.fullname" . }}-tls
101+
secretName: {{ include "cf-service-operator.fullname" . }}-{{ ternary "tls-managed" "tls" .Values.webhook.certManager.enabled }}
102102

‎chart/templates/controller-service.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: {{ include "cf-service-operator.fullname" . }}
6+
labels:
7+
{{- include "cf-service-operator.labels" . | nindent 4 }}
8+
spec:
9+
ports:
10+
- port: 443
11+
protocol: TCP
12+
targetPort: webhook-server
13+
name: https
14+
selector:
15+
{{- include "cf-service-operator.selectorLabels" . | nindent 4 }}

‎chart/templates/webhook.yaml

+100-49
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,86 @@
1+
{{- $caCert := "" }}
2+
{{- if .Values.webhook.certManager.enabled }}
3+
{{- if not .Values.webhook.certManager.issuerName }}
4+
---
5+
apiVersion: cert-manager.io/v1
6+
kind: Issuer
7+
metadata:
8+
name: {{ include "cf-service-operator.fullname" . }}
9+
labels:
10+
{{- include "cf-service-operator.labels" . | nindent 4 }}
11+
spec:
12+
selfSigned: {}
13+
{{- end }}
14+
---
15+
apiVersion: cert-manager.io/v1
16+
kind: Certificate
17+
metadata:
18+
name: {{ include "cf-service-operator.fullname" . }}
19+
labels:
20+
{{- include "cf-service-operator.labels" . | nindent 4 }}
21+
spec:
22+
dnsNames:
23+
- {{ include "cf-service-operator.fullname" . }}
24+
- {{ include "cf-service-operator.fullname" . }}.{{ .Release.Namespace }}
25+
- {{ include "cf-service-operator.fullname" . }}.{{ .Release.Namespace }}.svc
26+
- {{ include "cf-service-operator.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
27+
issuerRef:
28+
{{- if .Values.webhook.certManager.issuerName }}
29+
{{- with .Values.webhook.certManager.issuerGroup }}
30+
group: {{ . }}
31+
{{- end }}
32+
{{- with .Values.webhook.certManager.issuerKind }}
33+
kind: {{ . }}
34+
{{- end }}
35+
name: {{ .Values.webhook.certManager.issuerName }}
36+
{{- else }}
37+
name: {{ include "cf-service-operator.fullname" . }}
38+
{{- end }}
39+
secretName: {{ include "cf-service-operator.fullname" . }}-tls-managed
40+
{{- else }}
41+
---
42+
apiVersion: v1
43+
kind: Secret
44+
metadata:
45+
name: {{ include "cf-service-operator.fullname" . }}-tls
46+
labels:
47+
{{- include "cf-service-operator.labels" . | nindent 4 }}
48+
type: Opaque
49+
data:
50+
{{- $data := (lookup "v1" "Secret" .Release.Namespace (printf "%s-tls" (include "cf-service-operator.fullname" .))).data }}
51+
{{- if $data }}
52+
{{ $data | toYaml | nindent 2 }}
53+
{{- $caCert = index $data "ca.crt" }}
54+
{{- else }}
55+
{{- $cn := printf "%s.%s.svc" (include "cf-service-operator.fullname" .) .Release.Namespace }}
56+
{{- $ca := genCA (printf "%s-ca" (include "cf-service-operator.fullname" .)) 36500 }}
57+
{{- $cert := genSignedCert $cn nil (list $cn) 36500 $ca }}
58+
ca.crt: {{ $ca.Cert | b64enc }}
59+
tls.crt: {{ $cert.Cert | b64enc }}
60+
tls.key: {{ $cert.Key | b64enc }}
61+
{{- $caCert = $ca.Cert | b64enc }}
62+
{{- end }}
63+
{{- end }}
164
---
265
apiVersion: admissionregistration.k8s.io/v1
366
kind: MutatingWebhookConfiguration
467
metadata:
568
name: {{ include "cf-service-operator.fullname" . }}-mutate
669
labels:
770
{{- include "cf-service-operator.labels" . | nindent 4 }}
71+
{{- if .Values.webhook.certManager.enabled }}
872
annotations:
973
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "cf-service-operator.fullname" . }}
74+
{{- end }}
1075
webhooks:
1176
- admissionReviewVersions:
1277
- v1
1378
clientConfig:
79+
{{- if not .Values.webhook.certManager.enabled }}
80+
caBundle: {{ $caCert }}
81+
{{- end }}
1482
service:
15-
name: {{ include "cf-service-operator.fullname" . }}-webhook
83+
name: {{ include "cf-service-operator.fullname" . }}
1684
namespace: {{ .Release.Namespace }}
1785
path: /mutate-cf-cs-sap-com-v1alpha1-clusterspace
1886
failurePolicy: Fail
@@ -32,8 +100,11 @@ webhooks:
32100
- admissionReviewVersions:
33101
- v1
34102
clientConfig:
103+
{{- if not .Values.webhook.certManager.enabled }}
104+
caBundle: {{ $caCert }}
105+
{{- end }}
35106
service:
36-
name: {{ include "cf-service-operator.fullname" . }}-webhook
107+
name: {{ include "cf-service-operator.fullname" . }}
37108
namespace: {{ .Release.Namespace }}
38109
path: /mutate-cf-cs-sap-com-v1alpha1-servicebinding
39110
failurePolicy: Fail
@@ -53,8 +124,11 @@ webhooks:
53124
- admissionReviewVersions:
54125
- v1
55126
clientConfig:
127+
{{- if not .Values.webhook.certManager.enabled }}
128+
caBundle: {{ $caCert }}
129+
{{- end }}
56130
service:
57-
name: {{ include "cf-service-operator.fullname" . }}-webhook
131+
name: {{ include "cf-service-operator.fullname" . }}
58132
namespace: {{ .Release.Namespace }}
59133
path: /mutate-cf-cs-sap-com-v1alpha1-serviceinstance
60134
failurePolicy: Fail
@@ -74,8 +148,11 @@ webhooks:
74148
- admissionReviewVersions:
75149
- v1
76150
clientConfig:
151+
{{- if not .Values.webhook.certManager.enabled }}
152+
caBundle: {{ $caCert }}
153+
{{- end }}
77154
service:
78-
name: {{ include "cf-service-operator.fullname" . }}-webhook
155+
name: {{ include "cf-service-operator.fullname" . }}
79156
namespace: {{ .Release.Namespace }}
80157
path: /mutate-cf-cs-sap-com-v1alpha1-space
81158
failurePolicy: Fail
@@ -99,14 +176,19 @@ metadata:
99176
name: {{ include "cf-service-operator.fullname" . }}-validate
100177
labels:
101178
{{- include "cf-service-operator.labels" . | nindent 4 }}
179+
{{- if .Values.webhook.certManager.enabled }}
102180
annotations:
103181
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "cf-service-operator.fullname" . }}
182+
{{- end }}
104183
webhooks:
105184
- admissionReviewVersions:
106185
- v1
107186
clientConfig:
187+
{{- if not .Values.webhook.certManager.enabled }}
188+
caBundle: {{ $caCert }}
189+
{{- end }}
108190
service:
109-
name: {{ include "cf-service-operator.fullname" . }}-webhook
191+
name: {{ include "cf-service-operator.fullname" . }}
110192
namespace: {{ .Release.Namespace }}
111193
path: /validate-cf-cs-sap-com-v1alpha1-clusterspace
112194
failurePolicy: Fail
@@ -126,8 +208,11 @@ webhooks:
126208
- admissionReviewVersions:
127209
- v1
128210
clientConfig:
211+
{{- if not .Values.webhook.certManager.enabled }}
212+
caBundle: {{ $caCert }}
213+
{{- end }}
129214
service:
130-
name: {{ include "cf-service-operator.fullname" . }}-webhook
215+
name: {{ include "cf-service-operator.fullname" . }}
131216
namespace: {{ .Release.Namespace }}
132217
path: /validate-cf-cs-sap-com-v1alpha1-servicebinding
133218
failurePolicy: Fail
@@ -147,8 +232,11 @@ webhooks:
147232
- admissionReviewVersions:
148233
- v1
149234
clientConfig:
235+
{{- if not .Values.webhook.certManager.enabled }}
236+
caBundle: {{ $caCert }}
237+
{{- end }}
150238
service:
151-
name: {{ include "cf-service-operator.fullname" . }}-webhook
239+
name: {{ include "cf-service-operator.fullname" . }}
152240
namespace: {{ .Release.Namespace }}
153241
path: /validate-cf-cs-sap-com-v1alpha1-serviceinstance
154242
failurePolicy: Fail
@@ -168,8 +256,11 @@ webhooks:
168256
- admissionReviewVersions:
169257
- v1
170258
clientConfig:
259+
{{- if not .Values.webhook.certManager.enabled }}
260+
caBundle: {{ $caCert }}
261+
{{- end }}
171262
service:
172-
name: {{ include "cf-service-operator.fullname" . }}-webhook
263+
name: {{ include "cf-service-operator.fullname" . }}
173264
namespace: {{ .Release.Namespace }}
174265
path: /validate-cf-cs-sap-com-v1alpha1-space
175266
failurePolicy: Fail
@@ -185,44 +276,4 @@ webhooks:
185276
resources:
186277
- spaces
187278
sideEffects: None
188-
timeoutSeconds: 10
189-
---
190-
apiVersion: v1
191-
kind: Service
192-
metadata:
193-
name: {{ include "cf-service-operator.fullname" . }}-webhook
194-
labels:
195-
{{- include "cf-service-operator.labels" . | nindent 4 }}
196-
spec:
197-
ports:
198-
- port: 443
199-
protocol: TCP
200-
targetPort: 9443
201-
selector:
202-
{{- include "cf-service-operator.selectorLabels" . | nindent 4 }}
203-
---
204-
apiVersion: cert-manager.io/v1
205-
kind: Issuer
206-
metadata:
207-
name: {{ include "cf-service-operator.fullname" . }}
208-
labels:
209-
{{- include "cf-service-operator.labels" . | nindent 4 }}
210-
spec:
211-
selfSigned: {}
212-
---
213-
apiVersion: cert-manager.io/v1
214-
kind: Certificate
215-
metadata:
216-
name: {{ include "cf-service-operator.fullname" . }}
217-
labels:
218-
{{- include "cf-service-operator.labels" . | nindent 4 }}
219-
spec:
220-
dnsNames:
221-
- {{ include "cf-service-operator.fullname" . }}-webhook
222-
- {{ include "cf-service-operator.fullname" . }}-webhook.{{ .Release.Namespace }}
223-
- {{ include "cf-service-operator.fullname" . }}-webhook.{{ .Release.Namespace }}.svc
224-
- {{ include "cf-service-operator.fullname" . }}-webhook.{{ .Release.Namespace }}.svc.cluster.local
225-
issuerRef:
226-
kind: Issuer
227-
name: {{ include "cf-service-operator.fullname" . }}
228-
secretName: {{ include "cf-service-operator.fullname" . }}-tls
279+
timeoutSeconds: 10

‎chart/values.yaml

+12-1
Original file line numberDiff line numberDiff line change
@@ -48,5 +48,16 @@ resources:
4848
# -- CPU request
4949
cpu: 0.01
5050

51-
# -- Enable SAP binding metadata (per default, can be overridden by annotation service-operator.cf.cs.sap.com/with-sap-binding-metadata)
51+
# -- Enable SAP binding metadata (per default, can be overridden by annotation per binding object)
5252
enableSapBindingMetadata: false
53+
54+
webhook:
55+
certManager:
56+
# -- Whether to use cert-manager to manage webhook tls
57+
enabled: false
58+
# -- Issuer group (only relevant if enabled is true; if unset, the default cert-manager group is used)
59+
issuerGroup: ""
60+
# -- Issuer kind (only relevant if enabled is true; if unset, the default cert-manager type 'Issuer' is used)
61+
issuerKind: ""
62+
# -- Issuer name (only relevant if enabled is true; if unset, a self-signed issuer is used)
63+
issuerName: ""

0 commit comments

Comments
 (0)