Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Acme certificate resolver configuration #419

Merged
merged 4 commits into from
May 31, 2022
Merged

Add Acme certificate resolver configuration #419

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
cffcbbe
Add certificate resolver configuration
valerauko May 15, 2021
39a1687
Add tests for cert resolver config
valerauko May 15, 2021
716527f
Leave certResolvers empty by default
valerauko May 15, 2021
16cda2a
bump chart version
May 30, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion traefik/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: traefik
description: A Traefik based Kubernetes ingress controller
type: application
version: 10.20.0
version: 10.20.1
appVersion: 2.7.0
keywords:
- traefik
Expand Down
11 changes: 11 additions & 0 deletions traefik/templates/_podtemplate.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,6 +274,17 @@
{{- if hasKey .Values.pilot "dashboard" }}
- "--pilot.dashboard={{ .Values.pilot.dashboard }}"
{{- end }}
{{- range $resolver, $config := $.Values.certResolvers }}
{{- range $option, $setting := $config }}
{{- if kindIs "map" $setting }}
{{- range $field, $value := $setting }}
- "--certificatesresolvers.{{ $resolver }}.acme.{{ $option }}.{{ $field }}={{ if kindIs "slice" $value }}{{ join "," $value }}{{ else }}{{ $value }}{{ end }}"
{{- end }}
{{- else }}
- "--certificatesresolvers.{{ $resolver }}.acme.{{ $option }}={{ $setting }}"
{{- end }}
{{- end }}
{{- end }}
{{- with .Values.additionalArguments }}
{{- range . }}
- {{ . | quote }}
Expand Down
28 changes: 28 additions & 0 deletions traefik/tests/pod-config_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,6 +232,34 @@ tests:
- contains:
path: spec.template.spec.containers[0].args
content: "--providers.kubernetesgateway"
- it: should have the certificate resolver options applied
set:
certResolvers:
myAcmeResolver:
email: email@example.com
dnsChallenge:
provider: myProvider
resolvers:
- 1.1.1.1
- 8.8.8.8
tlsChallenge: true
asserts:
- contains:
path: spec.template.spec.containers[0].args
content:
"--certificatesresolvers.myAcmeResolver.acme.email=email@example.com"
- contains:
path: spec.template.spec.containers[0].args
content:
"--certificatesresolvers.myAcmeResolver.acme.dnsChallenge.provider=myProvider"
- contains:
path: spec.template.spec.containers[0].args
content:
"--certificatesresolvers.myAcmeResolver.acme.dnsChallenge.resolvers=1.1.1.1,8.8.8.8"
- contains:
path: spec.template.spec.containers[0].args
content:
"--certificatesresolvers.myAcmeResolver.acme.tlsChallenge=true"
- it: should have the pilot dashboard enabled by default
asserts:
- notContains:
Expand Down
21 changes: 21 additions & 0 deletions traefik/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -433,6 +433,27 @@ persistence:
annotations: {}
# subPath: "" # only mount a subpath of the Volume into the pod

certResolvers: {}
# letsencrypt:
Copy link
Contributor

@jakubhajek jakubhajek Aug 25, 2021 •
edited by ldez
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that indention is not correct, there should 2 white spaces instead of 3.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's # (sharp-space) for the comment and two spaces for the indentation.

Other places have a space after the sharp for comments too. Is is a problem?

# # for challenge options cf. https://doc.traefik.io/traefik/https/acme/
# email: email@example.com
# dnsChallenge:
# # also add the provider's required configuration under env
Copy link
Contributor

@jakubhajek jakubhajek Aug 25, 2021 •
edited by ldez
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have to emphasize that Kubernetes Secret containing DNS provider data is mandatory. Otherwise, a user might be confused about where the sensitive (APK_KEY, login) data should be added.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm a bit confused. How would you rephrase the current comment to be more clear?

# # or expand then from secrets/configmaps with envfrom
# # cf. https://doc.traefik.io/traefik/https/acme/#providers
# provider: digitalocean
# # add futher options for the dns challenge as needed
# # cf. https://doc.traefik.io/traefik/https/acme/#dnschallenge
# delayBeforeCheck: 30
# resolvers:
# - 1.1.1.1
# - 8.8.8.8
# tlsChallenge: true
# httpChallenge:
# entryPoint: "web"
# # match the path to persistence
# storage: /data/acme.json

# If hostNetwork is true, runs traefik in the host network namespace
# To prevent unschedulabel pods due to port collisions, if hostNetwork=true
# and replicas>1, a pod anti-affinity is recommended and will be set if the
Expand Down