Helm chart now allows to enable TLS and basic auth #302

nvvfedorov · 2024-03-27T21:40:35Z

This PR adds the ability to enable TLS and HTTP Basic authentication for dcgm-exporter.

The following configuration values were added:

# HTTPS configuration
tlsServerConfig:
  # Enable or disable HTTPS configuration
  enabled: false
  # Use autogenerated self-signed TLS certificates
  autoGenerated: true
  # Existing secret containing your own server key and certificate
  existingSecret: ""
  # Certificate file name
  certFilename: "tls.crt"
  # Key file name
  keyFilename: "tls.key"
  # CA certificate file name
  caFilename: "ca.crt"
  # Server policy for client authentication. Maps to ClientAuth Policies.
  # For more detail on clientAuth options:
  # https://golang.org/pkg/crypto/tls/#ClientAuthType
  #
  # NOTE: If you want to enable client authentication, you need to use
  # RequireAndVerifyClientCert. Other values are insecure.
  clientAuthType: ""
  # TLS Key for HTTPS - ignored if existingSecret is provided
  key: ""
  # TLS Certificate for HTTPS - ignored if existingSecret is provided
  cert: ""
  # CA Certificate for HTTPS - ignored if existingSecret is provided
  ca: ""

basicAuth:
  #Object containing <user>:<passwords> key-value pairs for each user that will have access via basic authentication
  users: {}

Also, new E2E tests were added:

The dcgm-exporter deployment when TLS is enabled;
The dcgm-exporter deployment when HTTP basic authentication is enabled.

The E2E suite now allows to specify which tests to run:

make e2es-tests - run all e2e tests;
make e2e-basic-auth - run e2e scenario when basic auth is enabled;
make e2e-tls - run e2e scenario when TLS is enabled;
make e2e-default - run e2e scenario when tests deploy the helm chart with the default configuration.

Signed-off-by: Vadym Fedorov <vfedorov@nvidia.com>

…es is not recommended for production environments. Signed-off-by: Vadym Fedorov <vfedorov@nvidia.com>

rohit-arora-dev

Just a couple of minor things, looking god otherwise.

rohit-arora-dev · 2024-04-02T14:33:20Z

deployment/templates/daemonset.yaml

+    {{- if and .Values.tlsServerConfig.enabled }}
+      - name: "tls"
+        secret:
+          secretName: {{ include "dcgm-exporter.tlsCertsSecretName" . }}
+          defaultMode: 0664
+    {{- end }}
+    {{- if or .Values.tlsServerConfig.enabled $.Values.basicAuth.users}}
+      - name: "web-config-yaml"
+        configMap:
+          name: {{ include "dcgm-exporter.webConfigConfigMap" . }}
+          defaultMode: 0664
+    {{- end }}    


Indentation issue.

@rohit-arora-dev, can you be more specific about where the issue is?

Please look at the file, it has indentation issues.

@rohit-arora-dev Why do you think indentation is wrong when K8S accepts this yaml without issues?

If your question is about the if - end blocks, it is made intentionally to make it easy to see when the block starts and ends.

I see a mix of styles, the file in general follow a style where if-end aligns with the indentation, and does not stand out. Even in other parts of the code where you have added new if-end blocks the indentation is correct, but for this specific block it is different.

My suggestion is to make it consistent across the file, either change all the if-end to follow this style or this block should follow the style consistent with the rest of the file.

@rohit-arora-dev done.

Thanks, definitely looking better.

rohit-arora-dev · 2024-04-02T19:30:59Z

tests/e2e/e2e_suite_test.go

+		shouldResolvePath()

-			kubeClient = shouldCreateKubeClient(k8sConfig)
-
-			helmClient = shouldCreateHelmClient(k8sConfig)
-		})
+		kubeConfigShouldExists()

-		AfterAll(func(ctx context.Context) {
-			_, _ = fmt.Fprintln(GinkgoWriter, "Clean up: starting")
-
-			shouldUninstallHelmChart(helmClient, helmReleaseName)
-			shouldCleanupHelmClient(helmClient)
+		k8sConfig := shouldCreateK8SConfig()

-			shouldDeleteNamespace(ctx, kubeClient)
+		kubeClient = shouldCreateKubeClient(k8sConfig)

-			_, _ = fmt.Fprintln(GinkgoWriter, "Clean up: completed")
-		})
+		helmClient = shouldCreateHelmClient(k8sConfig)

-		It("should create namespace", func(ctx context.Context) {
-			shouldCreateNamespace(ctx, kubeClient, labels)
+		BeforeAll(func(ctx context.Context) {
+			shouldCreateNamespace(ctx, kubeClient, testRunLabels)
 		})


Just out of curiosity why are these not part of BeforeAll anymore?

@rohit-arora-dev Is it an old comment? BeforeAll now creates a namespace as part of the BeforeAll.

Global variables such as kubeClient, helmClient, and testRunLabels initialize once in the Context, which is the container (https://onsi.github.io/ginkgo/#organizing-specs-with-container-nodes. ) for e2e tests. After global variables are initialized, they are available for child specs, like BeforeAll, etc.

rohit-arora-dev · 2024-04-02T19:33:47Z

tests/e2e/main_test.go

+	flag.BoolVar(&testContext.noCleanup,
+		"no-cleanup",
+		false,
+		`Skip clean up after tests execution`)
+


In what scenario we need this flag?

@rohit-arora-dev Troubleshooting. E2E destroys all resources after the end of the test or cancelation. The flag allows to keep created resources for the investigation of failures.

Signed-off-by: Vadym Fedorov <vfedorov@nvidia.com>

rohit-arora-dev

/LGTM

Helm chart now allows to enable TLS and basic auth

97cd710

Signed-off-by: Vadym Fedorov <vfedorov@nvidia.com>

nvvfedorov self-assigned this Mar 27, 2024

nvvfedorov requested review from glowkey and rohit-arora-dev March 27, 2024 21:40

Added statement, that use of autogenerated self-signed TLS certificat…

26eaffe

…es is not recommended for production environments. Signed-off-by: Vadym Fedorov <vfedorov@nvidia.com>

rohit-arora-dev reviewed Apr 2, 2024

View reviewed changes

nvvfedorov requested a review from rohit-arora-dev April 3, 2024 21:31

Addressed code review comments

7409eac

Signed-off-by: Vadym Fedorov <vfedorov@nvidia.com>

rohit-arora-dev approved these changes Apr 3, 2024

View reviewed changes

nvvfedorov closed this Apr 3, 2024

nvvfedorov deleted the enable-tls-support-with-helm-charts branch April 3, 2024 22:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Helm chart now allows to enable TLS and basic auth #302

Helm chart now allows to enable TLS and basic auth #302

nvvfedorov commented Mar 27, 2024

rohit-arora-dev left a comment

rohit-arora-dev Apr 2, 2024

nvvfedorov Apr 3, 2024

rohit-arora-dev Apr 3, 2024

rohit-arora-dev Apr 3, 2024

nvvfedorov Apr 3, 2024

nvvfedorov Apr 3, 2024 •

edited

Loading

rohit-arora-dev Apr 3, 2024

nvvfedorov Apr 3, 2024

rohit-arora-dev Apr 3, 2024

rohit-arora-dev Apr 2, 2024

nvvfedorov Apr 3, 2024

rohit-arora-dev Apr 2, 2024

nvvfedorov Apr 3, 2024

rohit-arora-dev left a comment

Helm chart now allows to enable TLS and basic auth #302

Helm chart now allows to enable TLS and basic auth #302

Conversation

nvvfedorov commented Mar 27, 2024

rohit-arora-dev left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nvvfedorov Apr 3, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rohit-arora-dev left a comment

Choose a reason for hiding this comment

nvvfedorov Apr 3, 2024 •

edited

Loading