Skip to content

Commit d8d4c21

Browse files
author
Adam Sayah
committed
Initial init
1 parent 5e8e1d1 commit d8d4c21

File tree

7 files changed

+233
-1
lines changed

7 files changed

+233
-1
lines changed

‎Chart.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
appVersion: "1.0"
3+
description: Helm chart to deploy the needed secrets for Axway Amplify Mesh Governance.
4+
name: apic-hybrid-init
5+
version: 0.1.0

‎Dockerfile

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM alpine
2+
RUN apk add openssl curl
3+
RUN curl -LO https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl && chmod +x ./kubectl && mv ./kubectl /usr/local/bin/kubectl

‎README.md

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,25 @@
11
# Axway-Amplify-Mesh-Init
2-
Helm chart to deploy the needed secrets for Axway Amplify Mesh Governance.
2+
3+
## Create the needed namespaces
4+
```Shell
5+
kubectl create namespace istio-system #if not existing
6+
kubectl create namespace apic-control #if not exisiting
7+
```
8+
9+
## Start the init
10+
11+
```Shell
12+
git clone https://github.com/asayah/Axway-Amplify-Mesh-Init
13+
# (Optional) If you specify gatewayHost, a self signed certificate will be created for your gateway Host.
14+
helm install . -n apic-init --set gatewayHost=example.com
15+
```
16+
17+
## If You want to use diffrents namespaces
18+
19+
```Shell
20+
git clone https://github.com/asayah/Axway-Amplify-Mesh-Init
21+
kubectl create namespace foo
22+
kubectl create namespace bar
23+
# (Optional) If you specify gatewayHost, a self signed certificate will be created for your gateway Host.
24+
helm install . -n apic-init --set gatewayHost=example.com --set apic.namespace=foo --set istio.namespace=bar
25+
```

‎templates/_helpers.tpl

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{{/* vim: set filetype=mustache: */}}
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "apic-hybrid-init.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
7+
{{- end -}}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
12+
If release name contains chart name it will be used as a full name.
13+
*/}}
14+
{{- define "apic-hybrid-init.fullname" -}}
15+
{{- if .Values.fullnameOverride -}}
16+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
17+
{{- else -}}
18+
{{- $name := default .Chart.Name .Values.nameOverride -}}
19+
{{- if contains $name .Release.Name -}}
20+
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
21+
{{- else -}}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
23+
{{- end -}}
24+
{{- end -}}
25+
{{- end -}}
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "apic-hybrid-init.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
32+
{{- end -}}
33+
34+
{{/*
35+
Common labels
36+
*/}}
37+
{{- define "apic-hybrid-init.labels" -}}
38+
app.kubernetes.io/name: {{ include "apic-hybrid-init.name" . }}
39+
helm.sh/chart: {{ include "apic-hybrid-init.chart" . }}
40+
app.kubernetes.io/instance: {{ .Release.Name }}
41+
{{- if .Chart.AppVersion }}
42+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
43+
{{- end }}
44+
app.kubernetes.io/managed-by: {{ .Release.Service }}
45+
{{- end -}}
46+
47+
{{/*
48+
Create a cert name form gatway DNS host.
49+
*/}}
50+
51+
{{- define "gatewayCertName" }}
52+
{{- printf "%s-%s-certs" (split "." .Values.gatewayHost)._0 (split "." .Values.gatewayHost)._1 }}
53+
{{- end }}

‎templates/agent-secrets.yaml

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: apic-secrets-prereq
5+
namespace: {{ .Values.apic.namespace }}
6+
---
7+
8+
apiVersion: rbac.authorization.k8s.io/v1
9+
kind: Role
10+
metadata:
11+
name: access-secrets-for-agent-mesh-secrets-creation
12+
namespace: {{ .Values.apic.namespace }}
13+
rules:
14+
- apiGroups:
15+
- ""
16+
resources:
17+
- secrets
18+
verbs:
19+
- create
20+
21+
---
22+
23+
apiVersion: rbac.authorization.k8s.io/v1
24+
kind: RoleBinding
25+
metadata:
26+
name: apic-prereq-to-secrets
27+
namespace: {{ .Values.apic.namespace }}
28+
roleRef:
29+
apiGroup: rbac.authorization.k8s.io
30+
kind: Role
31+
name: access-secrets-for-agent-mesh-secrets-creation
32+
subjects:
33+
- kind: ServiceAccount
34+
name: apic-secrets-prereq
35+
namespace: {{ .Values.apic.namespace }}
36+
37+
---
38+
39+
apiVersion: batch/v1
40+
kind: Job
41+
metadata:
42+
name: apic-secrets-prereq
43+
namespace: {{ .Values.apic.namespace }}
44+
spec:
45+
parallelism: 1
46+
completions: 1
47+
template:
48+
metadata:
49+
name: apic-secrets-prereq
50+
spec:
51+
serviceAccountName: apic-secrets-prereq
52+
containers:
53+
- name: secret-init
54+
image: asayah/kubectl
55+
command:
56+
- sh
57+
- -c
58+
- |
59+
mkdir -p /tmp/sda
60+
mkdir -p /tmp/csa
61+
openssl genpkey -algorithm RSA -out /tmp/sda/private_key.pem -pkeyopt rsa_keygen_bits:2048
62+
openssl rsa -pubout -in /tmp/sda/private_key.pem -out /tmp/sda/public_key.der -outform der && base64 /tmp/sda/public_key.der > /tmp/sda/public_key
63+
openssl genpkey -algorithm RSA -out /tmp/csa/private_key.pem -pkeyopt rsa_keygen_bits:2048
64+
openssl rsa -pubout -in /tmp/csa/private_key.pem -out /tmp/csa/public_key.der -outform der && base64 /tmp/csa/public_key.der > /tmp/csa/public_key
65+
kubectl create secret generic csa-secrets --from-file=publicKey=/tmp/csa/public_key --from-file=privateKey=/tmp/csa/private_key.pem --from-literal=password="" -o yaml
66+
kubectl create secret generic sda-secrets --from-file=publicKey=/tmp/sda/public_key --from-file=privateKey=/tmp/sda/private_key.pem --from-literal=password="" -o yaml
67+
68+
restartPolicy: Never
69+
---

‎templates/gateway-secrets.yaml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{{- if (.Values.gatewayHost) }}
2+
3+
apiVersion: v1
4+
kind: ServiceAccount
5+
metadata:
6+
name: istio-secrets-prereq
7+
namespace: {{ .Values.istio.namespace }}
8+
---
9+
10+
apiVersion: rbac.authorization.k8s.io/v1
11+
kind: Role
12+
metadata:
13+
name: access-secrets-for-gateway-secrets-creation
14+
namespace: {{ .Values.istio.namespace }}
15+
rules:
16+
- apiGroups:
17+
- ""
18+
resources:
19+
- secrets
20+
verbs:
21+
- create
22+
23+
---
24+
25+
apiVersion: rbac.authorization.k8s.io/v1
26+
kind: RoleBinding
27+
metadata:
28+
name: istio-prereq-to-secrets
29+
namespace: {{ .Values.istio.namespace }}
30+
roleRef:
31+
apiGroup: rbac.authorization.k8s.io
32+
kind: Role
33+
name: access-secrets-for-gateway-secrets-creation
34+
subjects:
35+
- kind: ServiceAccount
36+
name: istio-secrets-prereq
37+
namespace: {{ .Values.istio.namespace }}
38+
39+
---
40+
41+
apiVersion: batch/v1
42+
kind: Job
43+
metadata:
44+
name: istio-secrets-prereq
45+
namespace: {{ .Values.istio.namespace }}
46+
spec:
47+
parallelism: 1
48+
completions: 1
49+
template:
50+
metadata:
51+
name: istio-secrets-prereq
52+
spec:
53+
serviceAccountName: istio-secrets-prereq
54+
containers:
55+
- name: secret-init
56+
image: asayah/kubectl
57+
env:
58+
- name: GATEWAY_DNS
59+
value: {{ .Values.gatewayHost }}
60+
- name: GATEWAY_SECRET_NAME
61+
value: {{ template "gatewayCertName" . }}
62+
command:
63+
- sh
64+
- -c
65+
- |
66+
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /tmp/ca-selfsigned.key -out /tmp/ca-selfsigned.crt -subj "/C=US/ST=Phoenix/L=Phoenix/O=Global Security/OU=Axway RD/CN=$GATEWAY_DNS"
67+
kubectl create secret tls $GATEWAY_SECRET_NAME --cert /tmp/ca-selfsigned.crt --key /tmp/ca-selfsigned.key -o yaml
68+
69+
restartPolicy: Never
70+
---
71+
{{- end }}

‎values.yaml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
istio:
2+
namespace: istio-system
3+
4+
apic:
5+
namespace: apic-control
6+
7+
# To create edge gateway cert, set gatewayHost var.
8+
#gatewayHost=exemple.com

0 commit comments

Comments
 (0)