openstack/openstack-helm
Code Issues Proposed changes

Support TLS for ks jobs and oslo_db/oslo_message in deployment - barbican

Browse Source 
Change-Id: I8bee4e7a075d8431e22941c4b88e31889bb6701c
This commit is contained in:
josebb 2021-12-02 18:45:34 +02:00
parent 350d55baad
commit 178e4ce313
8 changed files with 29 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
barbican/Chart.yaml
View File

@ -14,7 +14,7 @@ apiVersion: v1
appVersion: v1.0.0
description: OpenStack-Helm Barbican
name: barbican
version: 0.2.17
version: 0.2.18
home: https://docs.openstack.org/barbican/latest/
icon: https://www.openstack.org/themes/openstack/images/project-mascots/Barbican/OpenStack_Project_Barbican_vertical.png
sources:

11
barbican/templates/deployment-api.yaml
View File

@ -64,6 +64,11 @@ spec:
command:
- /tmp/barbican.sh
- start
env:
{{- if .Values.manifests.certificates }}
- name: REQUESTS_CA_BUNDLE
value: "/etc/barbican/certs/ca.crt"
{{- end }}
lifecycle:
preStop:
exec:
@ -114,6 +119,9 @@ spec:
subPath: barbican.sh
readOnly: true
{{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal "path" "/etc/mysql/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
{{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.key_manager.api.internal "path" "/etc/barbican/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
{{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal "path" "/etc/rabbitmq/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
{{ if $mounts_barbican_api.volumeMounts }}{{ toYaml $mounts_barbican_api.volumeMounts | indent 12 }}{{ end }}
volumes:
- name: pod-tmp
@ -129,5 +137,8 @@ spec:
name: barbican-bin
defaultMode: 0555
{{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
{{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.key_manager.api.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
{{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
{{ if $mounts_barbican_api.volumes }}{{ toYaml $mounts_barbican_api.volumes | indent 8 }}{{ end }}
{{- end }}

3
barbican/templates/job-bootstrap.yaml
View File

@ -24,5 +24,8 @@ helm.sh/hook-weight: "5"
{{- if .Values.pod.tolerations.barbican.enabled -}}
{{- $_ := set $bootstrapJob "tolerationsEnabled" true -}}
{{- end -}}
{{- if .Values.manifests.certificates -}}
{{- $_ := set $bootstrapJob "tlsSecret" .Values.secrets.tls.key_manager.api.internal -}}
{{- end -}}
{{ $bootstrapJob | include "helm-toolkit.manifests.job_bootstrap" }}
{{- end }}

3
barbican/templates/job-ks-endpoints.yaml
View File

@ -24,5 +24,8 @@ helm.sh/hook-weight: "-2"
{{- if .Values.pod.tolerations.barbican.enabled -}}
{{- $_ := set $ksServiceJob "tolerationsEnabled" true -}}
{{- end -}}
{{- if .Values.manifests.certificates -}}
{{- $_ := set $ksServiceJob "tlsSecret" .Values.secrets.tls.key_manager.api.internal -}}
{{- end -}}
{{ $ksServiceJob | include "helm-toolkit.manifests.job_ks_endpoints" }}
{{- end }}

3
barbican/templates/job-ks-service.yaml
View File

@ -24,5 +24,8 @@ helm.sh/hook-weight: "-3"
{{- if .Values.pod.tolerations.barbican.enabled -}}
{{- $_ := set $ksServiceJob "tolerationsEnabled" true -}}
{{- end -}}
{{- if .Values.manifests.certificates -}}
{{- $_ := set $ksServiceJob "tlsSecret" .Values.secrets.tls.key_manager.api.internal -}}
{{- end -}}
{{ $ksServiceJob | include "helm-toolkit.manifests.job_ks_service" }}
{{- end }}

3
barbican/templates/job-ks-user.yaml
View File

@ -24,5 +24,8 @@ helm.sh/hook-weight: "-1"
{{- if .Values.pod.tolerations.barbican.enabled -}}
{{- $_ := set $ksUserJob "tolerationsEnabled" true -}}
{{- end -}}
{{- if .Values.manifests.certificates -}}
{{- $_ := set $ksUserJob "tlsSecret" .Values.secrets.tls.key_manager.api.internal -}}
{{- end -}}
{{ $ksUserJob | include "helm-toolkit.manifests.job_ks_user" }}
{{- end }}

4
barbican/values.yaml
View File

@ -496,6 +496,7 @@ secrets:
key_manager:
api:
public: barbican-tls-public
internal: barbican-tls-internal
oci_image_registry:
barbican: barbican-oci-image-registry
@ -601,6 +602,9 @@ endpoints:
admin:
username: rabbitmq
password: password
secret:
tls:
internal: rabbitmq-tls-direct
barbican:
username: barbican
password: password

1
releasenotes/notes/barbican.yaml
View File

@ -21,4 +21,5 @@ barbican:
- 0.2.15 Added OCI registry authentication
- 0.2.16 Distinguish between port number of internal endpoint and binding port number
- 0.2.17 Use HTTP probe instead of TCP probe
- 0.2.18 Support TLS for ks jobs
...