Skip to content

Commit 5e41bbd

Browse files
KuromesiKuromesi
authored
add support for external certs (#108)
Signed-off-by: Kuromesi <[email protected]>
1 parent eab1d11 commit 5e41bbd

File tree

5 files changed

+96
-14
lines changed

5 files changed

+96
-14
lines changed

‎versions/kruise/1.7.0-alpha.1/README.md

+63-8
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,20 @@
44

55
The following table lists the configurable parameters of the kruise chart and their default values.
66

7-
### manager parameters
7+
## setup parameters
88
| Parameter | Description | Default |
99
| ----------------------------------------- | ------------------------------------------------------------ | ----------------------------- |
10-
| `featureGates` | Feature gates for Kruise, empty string means all enabled | ` ` |
11-
| `installation.namespace` | namespace for kruise installation | `kruise-system` |
10+
| `featureGates` | Feature gates for Kruise, empty string means all enabled | `""` |
11+
| `installation.namespace` | Namespace for kruise installation | `kruise-system` |
1212
| `installation.createNamespace` | Whether to create the installation.namespace | `true` |
13+
| `installation.roleListGroups` | ApiGroups which kruise is permit to list, default set to be all | `*` |
14+
| `crds.managed` | Kruise will not install CRDs with chart if this is false | `true` |
15+
| `imagePullSecrets` | The list of image pull secrets for kruise image | `[]` |
16+
17+
18+
### manager parameters
19+
| Parameter | Description | Default |
20+
| ----------------------------------------- | ------------------------------------------------------------ | ----------------------------- |
1321
| `manager.log.level` | Log level that kruise-manager printed | `4` |
1422
| `manager.replicas` | Replicas of kruise-controller-manager deployment | `2` |
1523
| `manager.image.repository` | Repository for kruise-manager image | `openkruise/kruise-manager` |
@@ -24,12 +32,8 @@ The following table lists the configurable parameters of the kruise chart and th
2432
| `manager.nodeAffinity` | Node affinity policy for kruise-manager pod | `{}` |
2533
| `manager.nodeSelector` | Node labels for kruise-manager pod | `{}` |
2634
| `manager.tolerations` | Tolerations for kruise-manager pod | `[]` |
27-
| `webhookConfiguration.timeoutSeconds` | The timeoutSeconds for all webhook configuration | `30` |
28-
| `crds.managed` | Kruise will not install CRDs with chart if this is false | `true` |
2935
| `manager.resyncPeriod` | Resync period of informer kruise-manager, defaults no resync | `0` |
3036
| `manager.hostNetwork` | Whether kruise-manager pod should run with hostnetwork | `false` |
31-
| `imagePullSecrets` | The list of image pull secrets for kruise image | `false` |
32-
| `enableKubeCacheMutationDetector` | Whether to enable KUBE_CACHE_MUTATION_DETECTOR | `false` |
3337

3438
### daemon parameters
3539
| Parameter | Description | Default |
@@ -49,7 +53,15 @@ The following table lists the configurable parameters of the kruise chart and th
4953
| `daemon.credentialProvider.hostPath` | credential provider plugin node dir, will volume mount into kruise-daemon | `credential-provider-plugin` |
5054
| `daemon.credentialProvider.configmap` | credential provider yaml configmap name in kruise-system ns | `credential-provider-config` |
5155

52-
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
56+
### other parameters
57+
| Parameter | Description | Default |
58+
| ----------------------------------------- | ------------------------------------------------------------ | ----------------------------- |
59+
| `externalCerts.annotations` | Annotations to patch for webhook configuration and crd when featuregate `EnableExternalCerts` is enabled. For example, `cert-manager.io/inject-ca-from: kruise-system/kruise-webhook-certs`. | `{}` |
60+
| `enableKubeCacheMutationDetector` | Whether to enable KUBE_CACHE_MUTATION_DETECTOR | `false` |
61+
| `webhookConfiguration.timeoutSeconds` | The timeoutSeconds for all webhook configuration | `30` |
62+
| `serviceAccount.annotations` | Annotations to patch for serviceAccounts | `{}` |
63+
64+
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, `helm install kruise https://... --set featureGates="AllAlpha=true"`.
5365

5466
### Optional: feature-gate
5567

@@ -80,6 +92,7 @@ Feature-gate controls some influential features in Kruise:
8092
| `ImagePullJobGate` | ImagePullJobGate enable imagepulljob-controller execute ImagePullJob | `false` | ImagePullJob and PreDownloadImageForInPlaceUpdate are disabled |
8193
| `ResourceDistributionGate` | ResourceDistributionGate enable resourcedistribution-controller execute ResourceDistribution. | `false` | ResourceDistribution disabled |
8294
| `DeletionProtectionForCRDCascadingGate` | DeletionProtectionForCRDCascadingGate enable deletionProtection for crd Cascading | `false` | CustomResourceDefinition deletion protection disabled |
95+
| `EnableExternalCerts` | Using certs generated externally, cert-manager e.g., for webhook server | `false` | kruise-manager will generate self-signed certs for webhook server |
8396

8497
If you want to configure the feature-gate, just set the parameter when install or upgrade. Such as:
8598

@@ -98,3 +111,45 @@ If you are in China and have problem to pull image from official DockerHub, you
98111
$ helm install kruise https://... --set manager.image.repository=openkruise-registry.cn-hangzhou.cr.aliyuncs.com/openkruise/kruise-manager
99112
...
100113
```
114+
115+
### Optional: use certificates with certificate provisioner like cert-manager
116+
117+
Kruise needs certificates to enable mutating, validating and conversion webhooks. By default, kruise will generate self-signed certificates for webhook server. If you want to use certificates provisioned externally, taking cert-manager as an example, you can follow these steps when install or upgrade:
118+
119+
1. Enable kruise reading certs generated externally by setting `featureGates=EnableExternalCerts=true` when install or upgrade.
120+
2. Create issuer and certificate resources if you have not done this before.
121+
```yaml
122+
apiVersion: cert-manager.io/v1
123+
kind: Certificate
124+
metadata:
125+
name: kruise-webhook
126+
# consistent with installation.namespace
127+
namespace: kruise-system
128+
spec:
129+
# where to store the certificates
130+
# cert-manager would generate a secret kruise-system/kruise-webhook-certs with the certificates
131+
# DO NOT CHANGE THE SECRET NAME SINCE KRUISE READ CERTS FROM THIS SECRET
132+
secretName: kruise-webhook-certs
133+
dnsNames:
134+
- kruise-webhook-service.kruise-system.svc
135+
- localhost
136+
issuerRef:
137+
name: selfsigned-kruise
138+
kind: Issuer
139+
---
140+
apiVersion: cert-manager.io/v1
141+
kind: Issuer
142+
metadata:
143+
name: selfsigned-kruise
144+
namespace: kruise-system
145+
spec:
146+
selfSigned: {}
147+
```
148+
3. Set the parameter `externalCerts.annotations` to set annotations for crd and webhook configurations for cert-manager to recognize and patch. For example:
149+
```yaml
150+
externalCerts:
151+
annotations:
152+
# inject certificates from Certificate resource kruise-system/kruise-webhook-certs
153+
cert-manager.io/inject-ca-from: kruise-system/kruise-webhook-certs
154+
```
155+
Visit [CA Injector - cert manager](https://cert-manager.io/docs/concepts/ca-injector/) for more details.

‎versions/kruise/1.7.0-alpha.1/templates/apps.kruise.io_statefulsets.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@ kind: CustomResourceDefinition
66
metadata:
77
annotations:
88
controller-gen.kubebuilder.io/version: v0.14.0
9+
{{- if contains "EnableExternalCerts=true" .Values.featureGates }}
10+
{{- range $key, $value := .Values.externalCerts.annotations }}
11+
{{ $key }}: {{ $value | quote }}
12+
{{- end }}
13+
{{- end }}
914
name: statefulsets.apps.kruise.io
1015
spec:
1116
conversion:

‎versions/kruise/1.7.0-alpha.1/templates/rbac_role.yaml

+6-2
Original file line numberDiff line numberDiff line change
@@ -144,19 +144,23 @@ rules:
144144
verbs:
145145
- get
146146
- list
147+
- watch
148+
{{- if not (contains "EnableExternalCerts=true" .Values.featureGates) }}
147149
- patch
148150
- update
149-
- watch
151+
{{- end }}
150152
- apiGroups:
151153
- admissionregistration.k8s.io
152154
resources:
153155
- validatingwebhookconfigurations
154156
verbs:
155157
- get
156158
- list
159+
- watch
160+
{{- if not (contains "EnableExternalCerts=true" .Values.featureGates) }}
157161
- patch
158162
- update
159-
- watch
163+
{{- end }}
160164
- apiGroups:
161165
- apiextensions.k8s.io
162166
resources:

‎versions/kruise/1.7.0-alpha.1/templates/webhookconfiguration.yaml

+14-4
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,14 @@ kind: MutatingWebhookConfiguration
33
metadata:
44
name: kruise-mutating-webhook-configuration
55
annotations:
6+
{{- if contains "EnableExternalCerts=true" .Values.featureGates }}
7+
{{- range $key, $value := .Values.externalCerts.annotations }}
8+
{{ $key }}: {{ $value | quote }}
9+
{{- end }}
10+
{{- end }}
611
template: ""
712
webhooks:
8-
{{ if not (contains "PodWebhook=false" .Values.featureGates) }}
13+
{{- if not (contains "PodWebhook=false" .Values.featureGates) }}
914
- admissionReviewVersions:
1015
- v1
1116
- v1beta1
@@ -37,7 +42,7 @@ webhooks:
3742
resources:
3843
- pods
3944
sideEffects: None
40-
{{ end }}
45+
{{- end }}
4146
- admissionReviewVersions:
4247
- v1
4348
- v1beta1
@@ -287,6 +292,11 @@ kind: ValidatingWebhookConfiguration
287292
metadata:
288293
name: kruise-validating-webhook-configuration
289294
annotations:
295+
{{- if contains "EnableExternalCerts=true" .Values.featureGates }}
296+
{{- range $key, $value := .Values.externalCerts.annotations }}
297+
{{ $key }}: {{ $value | quote }}
298+
{{- end }}
299+
{{- end }}
290300
template: ""
291301
webhooks:
292302
- admissionReviewVersions:
@@ -508,7 +518,7 @@ webhooks:
508518
resources:
509519
- services
510520
sideEffects: None
511-
{{ if not (contains "PodWebhook=false" .Values.featureGates) }}
521+
{{- if not (contains "PodWebhook=false" .Values.featureGates) }}
512522
- admissionReviewVersions:
513523
- v1
514524
- v1beta1
@@ -572,7 +582,7 @@ webhooks:
572582
resources:
573583
- pods/eviction
574584
sideEffects: None
575-
{{ end }}
585+
{{- end }}
576586
- admissionReviewVersions:
577587
- v1
578588
- v1beta1

‎versions/kruise/1.7.0-alpha.1/values.yaml

+8
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,17 @@ installation:
1212

1313
featureGates: "ImagePullJobGate=true"
1414

15+
externalCerts:
16+
# annotations to patch for webhook configuration and crd
17+
# e.g. cert-manager.io/inject-ca-from: kruise-system/kruise-webhook
18+
annotations: {}
19+
1520
# KUBE_CACHE_MUTATION_DETECTOR
1621
enableKubeCacheMutationDetector: false
1722

23+
# imagePullSecrets to pull kruise images
24+
imagePullSecrets: []
25+
1826
manager:
1927
# settings for log print
2028
log:

0 commit comments

Comments
 (0)