Skip to content

Commit 361f435

Browse files
laveryalaverya
committed
specify private CAs configmap via CLI
1 parent 6cf0941 commit 361f435

File tree

4 files changed

+151
-91
lines changed

4 files changed

+151
-91
lines changed

‎cmd/kots/cli/install.go

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,6 @@ func InstallCmd() *cobra.Command {
309309
AdditionalLabels: additionalLabels,
310310
AdditionalAnnotations: additionalAnnotations,
311311
TrustedCAsConfigmap: v.GetString("private-ca-configmap"),
312-
TrustedCAsConfigmapNS: v.GetString("private-ca-configmap-namespace"),
313312

314313
RegistryConfig: *registryConfig,
315314

@@ -554,7 +553,6 @@ func InstallCmd() *cobra.Command {
554553
cmd.Flags().StringArray("additional-annotations", []string{}, "additional annotations to add to kotsadm pods")
555554
cmd.Flags().StringArray("additional-labels", []string{}, "additional labels to add to kotsadm pods")
556555
cmd.Flags().String("private-ca-configmap", "", "the name of a configmap containing private CAs to add to the kotsadm deployment")
557-
cmd.Flags().String("private-ca-configmap-namespace", "", "the namespace of a configmap containing private CAs to add to the kotsadm deployment")
558556

559557
registryFlags(cmd.Flags())
560558

‎pkg/kotsadm/objects/kotsadm_objects.go

Lines changed: 151 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -344,6 +344,17 @@ func KotsadmDeployment(deployOptions types.DeployOptions) (*appsv1.Deployment, e
344344
})
345345
}
346346

347+
if deployOptions.TrustedCAsConfigmap != "" {
348+
env = append(env, corev1.EnvVar{
349+
Name: "SSL_CERT_DIR",
350+
Value: "/certs",
351+
})
352+
env = append(env, corev1.EnvVar{
353+
Name: "SSL_CERT_CONFIGMAP",
354+
Value: deployOptions.TrustedCAsConfigmap,
355+
})
356+
}
357+
347358
podAnnotations := map[string]string{
348359
"backup.velero.io/backup-volumes": "backup",
349360
"pre.hook.backup.velero.io/command": `["/backup.sh"]`,
@@ -359,6 +370,60 @@ func KotsadmDeployment(deployOptions types.DeployOptions) (*appsv1.Deployment, e
359370
podLabels[k] = v
360371
}
361372

373+
volumes := []corev1.Volume{
374+
{
375+
Name: "migrations",
376+
VolumeSource: corev1.VolumeSource{
377+
EmptyDir: &corev1.EmptyDirVolumeSource{
378+
Medium: corev1.StorageMediumMemory,
379+
},
380+
},
381+
},
382+
{
383+
Name: "backup",
384+
VolumeSource: corev1.VolumeSource{
385+
EmptyDir: &corev1.EmptyDirVolumeSource{},
386+
},
387+
},
388+
{
389+
Name: "tmp",
390+
VolumeSource: corev1.VolumeSource{
391+
EmptyDir: &corev1.EmptyDirVolumeSource{},
392+
},
393+
},
394+
}
395+
396+
if deployOptions.TrustedCAsConfigmap != "" {
397+
volumes = append(volumes, corev1.Volume{
398+
Name: "kotsadm-private-cas",
399+
VolumeSource: corev1.VolumeSource{
400+
ConfigMap: &corev1.ConfigMapVolumeSource{
401+
LocalObjectReference: corev1.LocalObjectReference{
402+
Name: deployOptions.TrustedCAsConfigmap,
403+
},
404+
},
405+
},
406+
})
407+
}
408+
409+
volumeMounts := []corev1.VolumeMount{
410+
{
411+
Name: "backup",
412+
MountPath: "/backup",
413+
},
414+
{
415+
Name: "tmp",
416+
MountPath: "/tmp",
417+
},
418+
}
419+
420+
if deployOptions.TrustedCAsConfigmap != "" {
421+
volumeMounts = append(volumeMounts, corev1.VolumeMount{
422+
Name: "kotsadm-private-cas",
423+
MountPath: "/certs",
424+
})
425+
}
426+
362427
deployment := &appsv1.Deployment{
363428
TypeMeta: metav1.TypeMeta{
364429
APIVersion: "apps/v1",
@@ -385,29 +450,8 @@ func KotsadmDeployment(deployOptions types.DeployOptions) (*appsv1.Deployment, e
385450
Affinity: &corev1.Affinity{
386451
NodeAffinity: defaultKOTSNodeAffinity(),
387452
},
388-
SecurityContext: securityContext,
389-
Volumes: []corev1.Volume{
390-
{
391-
Name: "migrations",
392-
VolumeSource: corev1.VolumeSource{
393-
EmptyDir: &corev1.EmptyDirVolumeSource{
394-
Medium: corev1.StorageMediumMemory,
395-
},
396-
},
397-
},
398-
{
399-
Name: "backup",
400-
VolumeSource: corev1.VolumeSource{
401-
EmptyDir: &corev1.EmptyDirVolumeSource{},
402-
},
403-
},
404-
{
405-
Name: "tmp",
406-
VolumeSource: corev1.VolumeSource{
407-
EmptyDir: &corev1.EmptyDirVolumeSource{},
408-
},
409-
},
410-
},
453+
SecurityContext: securityContext,
454+
Volumes: volumes,
411455
ServiceAccountName: "kotsadm",
412456
RestartPolicy: corev1.RestartPolicyAlways,
413457
ImagePullSecrets: pullSecrets,
@@ -631,17 +675,8 @@ func KotsadmDeployment(deployOptions types.DeployOptions) (*appsv1.Deployment, e
631675
},
632676
},
633677
},
634-
VolumeMounts: []corev1.VolumeMount{
635-
{
636-
Name: "backup",
637-
MountPath: "/backup",
638-
},
639-
{
640-
Name: "tmp",
641-
MountPath: "/tmp",
642-
},
643-
},
644-
Env: env,
678+
VolumeMounts: volumeMounts,
679+
Env: env,
645680
Resources: corev1.ResourceRequirements{
646681
Limits: corev1.ResourceList{
647682
"cpu": resource.MustParse("1"),
@@ -694,6 +729,7 @@ func UpdateKotsadmStatefulSet(existingStatefulset *appsv1.StatefulSet, desiredSt
694729
return nil
695730
}
696731

732+
// TODO add configmap for additional CAs
697733
func KotsadmStatefulSet(deployOptions types.DeployOptions, size resource.Quantity) (*appsv1.StatefulSet, error) {
698734
securityContext := k8sutil.SecurePodContext(1001, 1001, deployOptions.StrictSecurityContext)
699735
if deployOptions.IsOpenShift {
@@ -846,6 +882,17 @@ func KotsadmStatefulSet(deployOptions types.DeployOptions, size resource.Quantit
846882
})
847883
}
848884

885+
if deployOptions.TrustedCAsConfigmap != "" {
886+
env = append(env, corev1.EnvVar{
887+
Name: "SSL_CERT_DIR",
888+
Value: "/certs",
889+
})
890+
env = append(env, corev1.EnvVar{
891+
Name: "SSL_CERT_CONFIGMAP",
892+
Value: deployOptions.TrustedCAsConfigmap,
893+
})
894+
}
895+
849896
var storageClassName *string
850897
if deployOptions.StorageClassName != "" {
851898
storageClassName = &deployOptions.StorageClassName
@@ -866,6 +913,72 @@ func KotsadmStatefulSet(deployOptions types.DeployOptions, size resource.Quantit
866913
podLabels[k] = v
867914
}
868915

916+
volumes := []corev1.Volume{
917+
{
918+
Name: "kotsadmdata",
919+
VolumeSource: corev1.VolumeSource{
920+
PersistentVolumeClaim: &corev1.PersistentVolumeClaimVolumeSource{
921+
ClaimName: "kotsadmdata",
922+
},
923+
},
924+
},
925+
{
926+
Name: "migrations",
927+
VolumeSource: corev1.VolumeSource{
928+
EmptyDir: &corev1.EmptyDirVolumeSource{
929+
Medium: corev1.StorageMediumMemory,
930+
},
931+
},
932+
},
933+
{
934+
Name: "backup",
935+
VolumeSource: corev1.VolumeSource{
936+
EmptyDir: &corev1.EmptyDirVolumeSource{},
937+
},
938+
},
939+
{
940+
Name: "tmp",
941+
VolumeSource: corev1.VolumeSource{
942+
EmptyDir: &corev1.EmptyDirVolumeSource{},
943+
},
944+
},
945+
}
946+
947+
if deployOptions.TrustedCAsConfigmap != "" {
948+
volumes = append(volumes, corev1.Volume{
949+
Name: "kotsadm-private-cas",
950+
VolumeSource: corev1.VolumeSource{
951+
ConfigMap: &corev1.ConfigMapVolumeSource{
952+
LocalObjectReference: corev1.LocalObjectReference{
953+
Name: deployOptions.TrustedCAsConfigmap,
954+
},
955+
},
956+
},
957+
})
958+
}
959+
960+
volumeMounts := []corev1.VolumeMount{
961+
{
962+
Name: "kotsadmdata",
963+
MountPath: "/kotsadmdata",
964+
},
965+
{
966+
Name: "backup",
967+
MountPath: "/backup",
968+
},
969+
{
970+
Name: "tmp",
971+
MountPath: "/tmp",
972+
},
973+
}
974+
975+
if deployOptions.TrustedCAsConfigmap != "" {
976+
volumeMounts = append(volumeMounts, corev1.VolumeMount{
977+
Name: "kotsadm-private-cas",
978+
MountPath: "/certs",
979+
})
980+
}
981+
869982
statefulset := &appsv1.StatefulSet{
870983
TypeMeta: metav1.TypeMeta{
871984
APIVersion: "apps/v1",
@@ -893,37 +1006,8 @@ func KotsadmStatefulSet(deployOptions types.DeployOptions, size resource.Quantit
8931006
Affinity: &corev1.Affinity{
8941007
NodeAffinity: defaultKOTSNodeAffinity(),
8951008
},
896-
SecurityContext: securityContext,
897-
Volumes: []corev1.Volume{
898-
{
899-
Name: "kotsadmdata",
900-
VolumeSource: corev1.VolumeSource{
901-
PersistentVolumeClaim: &corev1.PersistentVolumeClaimVolumeSource{
902-
ClaimName: "kotsadmdata",
903-
},
904-
},
905-
},
906-
{
907-
Name: "migrations",
908-
VolumeSource: corev1.VolumeSource{
909-
EmptyDir: &corev1.EmptyDirVolumeSource{
910-
Medium: corev1.StorageMediumMemory,
911-
},
912-
},
913-
},
914-
{
915-
Name: "backup",
916-
VolumeSource: corev1.VolumeSource{
917-
EmptyDir: &corev1.EmptyDirVolumeSource{},
918-
},
919-
},
920-
{
921-
Name: "tmp",
922-
VolumeSource: corev1.VolumeSource{
923-
EmptyDir: &corev1.EmptyDirVolumeSource{},
924-
},
925-
},
926-
},
1009+
SecurityContext: securityContext,
1010+
Volumes: volumes,
9271011
ServiceAccountName: "kotsadm",
9281012
RestartPolicy: corev1.RestartPolicyAlways,
9291013
ImagePullSecrets: pullSecrets,
@@ -1153,21 +1237,8 @@ func KotsadmStatefulSet(deployOptions types.DeployOptions, size resource.Quantit
11531237
},
11541238
},
11551239
},
1156-
VolumeMounts: []corev1.VolumeMount{
1157-
{
1158-
Name: "kotsadmdata",
1159-
MountPath: "/kotsadmdata",
1160-
},
1161-
{
1162-
Name: "backup",
1163-
MountPath: "/backup",
1164-
},
1165-
{
1166-
Name: "tmp",
1167-
MountPath: "/tmp",
1168-
},
1169-
},
1170-
Env: env,
1240+
VolumeMounts: volumeMounts,
1241+
Env: env,
11711242
Resources: corev1.ResourceRequirements{
11721243
Limits: corev1.ResourceList{
11731244
"cpu": resource.MustParse("1"),

‎pkg/kotsadm/types/deployoptions.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ type DeployOptions struct {
6060
AdditionalAnnotations map[string]string
6161
AdditionalLabels map[string]string
6262
TrustedCAsConfigmap string
63-
TrustedCAsConfigmapNS string
6463

6564
IdentityConfig kotsv1beta1.IdentityConfig
6665
IngressConfig kotsv1beta1.IngressConfig

‎pkg/template/static_context.go

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -684,11 +684,3 @@ func (ctx StaticCtx) privateCACert() string {
684684
// return the name of a configmap holding additional CA certificates provided by the end user at install time
685685
return os.Getenv("SSL_CERT_CONFIGMAP")
686686
}
687-
688-
func (ctx StaticCtx) privateCACertNamespace() string {
689-
// return the namespace of a configmap holding additional CA certificates provided by the end user at install time
690-
if os.Getenv("SSL_CERT_CONFIGMAP_NAMESPACE") != "" {
691-
return os.Getenv("SSL_CERT_CONFIGMAP_NAMESPACE")
692-
}
693-
return ctx.namespace()
694-
}

0 commit comments

Comments
 (0)