Skip to content

Commit cdcff24

Browse files
KuromesiKuromesi
committed
add support for external certs
Signed-off-by: kuromesi <[email protected]>
1 parent eab1d11 commit cdcff24

File tree

5 files changed

+49
-13
lines changed

5 files changed

+49
-13
lines changed

‎versions/kruise/1.7.0-alpha.1/README.md

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,19 @@
44

55
The following table lists the configurable parameters of the kruise chart and their default values.
66

7-
### manager parameters
7+
## setup parameters
88
| Parameter | Description | Default |
99
| ----------------------------------------- | ------------------------------------------------------------ | ----------------------------- |
10-
| `featureGates` | Feature gates for Kruise, empty string means all enabled | ` ` |
11-
| `installation.namespace` | namespace for kruise installation | `kruise-system` |
10+
| `featureGates` | Feature gates for Kruise, empty string means all enabled | `""` |
11+
| `installation.namespace` | Namespace for kruise installation | `kruise-system` |
1212
| `installation.createNamespace` | Whether to create the installation.namespace | `true` |
13+
| `installation.roleListGroups` | ApiGroups which kruise is permit to list, default set to be all | `*` |
14+
| `crds.managed` | Kruise will not install CRDs with chart if this is false | `true` |
15+
16+
17+
### manager parameters
18+
| Parameter | Description | Default |
19+
| ----------------------------------------- | ------------------------------------------------------------ | ----------------------------- |
1320
| `manager.log.level` | Log level that kruise-manager printed | `4` |
1421
| `manager.replicas` | Replicas of kruise-controller-manager deployment | `2` |
1522
| `manager.image.repository` | Repository for kruise-manager image | `openkruise/kruise-manager` |
@@ -24,12 +31,8 @@ The following table lists the configurable parameters of the kruise chart and th
2431
| `manager.nodeAffinity` | Node affinity policy for kruise-manager pod | `{}` |
2532
| `manager.nodeSelector` | Node labels for kruise-manager pod | `{}` |
2633
| `manager.tolerations` | Tolerations for kruise-manager pod | `[]` |
27-
| `webhookConfiguration.timeoutSeconds` | The timeoutSeconds for all webhook configuration | `30` |
28-
| `crds.managed` | Kruise will not install CRDs with chart if this is false | `true` |
2934
| `manager.resyncPeriod` | Resync period of informer kruise-manager, defaults no resync | `0` |
3035
| `manager.hostNetwork` | Whether kruise-manager pod should run with hostnetwork | `false` |
31-
| `imagePullSecrets` | The list of image pull secrets for kruise image | `false` |
32-
| `enableKubeCacheMutationDetector` | Whether to enable KUBE_CACHE_MUTATION_DETECTOR | `false` |
3336

3437
### daemon parameters
3538
| Parameter | Description | Default |
@@ -49,6 +52,14 @@ The following table lists the configurable parameters of the kruise chart and th
4952
| `daemon.credentialProvider.hostPath` | credential provider plugin node dir, will volume mount into kruise-daemon | `credential-provider-plugin` |
5053
| `daemon.credentialProvider.configmap` | credential provider yaml configmap name in kruise-system ns | `credential-provider-config` |
5154

55+
### other parameters
56+
| Parameter | Description | Default |
57+
| ----------------------------------------- | ------------------------------------------------------------ | ----------------------------- |
58+
| `externalCerts.annotations` | Annotations to patch for webhook configuration and crd when featuregate `EnableExternalCerts` is enabled | `{}` |
59+
| `enableKubeCacheMutationDetector` | Whether to enable KUBE_CACHE_MUTATION_DETECTOR | `false` |
60+
| `webhookConfiguration.timeoutSeconds` | The timeoutSeconds for all webhook configuration | `30` |
61+
| `serviceAccount.annotations` | Annotations to patch for serviceAccounts | `{}` |
62+
5263
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
5364

5465
### Optional: feature-gate
@@ -80,6 +91,7 @@ Feature-gate controls some influential features in Kruise:
8091
| `ImagePullJobGate` | ImagePullJobGate enable imagepulljob-controller execute ImagePullJob | `false` | ImagePullJob and PreDownloadImageForInPlaceUpdate are disabled |
8192
| `ResourceDistributionGate` | ResourceDistributionGate enable resourcedistribution-controller execute ResourceDistribution. | `false` | ResourceDistribution disabled |
8293
| `DeletionProtectionForCRDCascadingGate` | DeletionProtectionForCRDCascadingGate enable deletionProtection for crd Cascading | `false` | CustomResourceDefinition deletion protection disabled |
94+
| `EnableExternalCerts` | Using certs generated externally, cert-manager e.g., for webhook server | `false` | kruise-manager will generate self-signed certs for webhook server |
8395

8496
If you want to configure the feature-gate, just set the parameter when install or upgrade. Such as:
8597

‎versions/kruise/1.7.0-alpha.1/templates/apps.kruise.io_statefulsets.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,11 @@ kind: CustomResourceDefinition
66
metadata:
77
annotations:
88
controller-gen.kubebuilder.io/version: v0.14.0
9+
{{- if contains "EnableExternalCerts=true" .Values.featureGates }}
10+
{{- range $key, $value := .Values.externalCerts.annotations }}
11+
{{ $key }}: {{ $value | quote }}
12+
{{- end }}
13+
{{- end }}
914
name: statefulsets.apps.kruise.io
1015
spec:
1116
conversion:

‎versions/kruise/1.7.0-alpha.1/templates/rbac_role.yaml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,19 +144,23 @@ rules:
144144
verbs:
145145
- get
146146
- list
147+
- watch
148+
{{- if not (contains "EnableExternalCerts=true" .Values.featureGates) }}
147149
- patch
148150
- update
149-
- watch
151+
{{- end }}
150152
- apiGroups:
151153
- admissionregistration.k8s.io
152154
resources:
153155
- validatingwebhookconfigurations
154156
verbs:
155157
- get
156158
- list
159+
- watch
160+
{{- if not (contains "EnableExternalCerts=true" .Values.featureGates) }}
157161
- patch
158162
- update
159-
- watch
163+
{{- end }}
160164
- apiGroups:
161165
- apiextensions.k8s.io
162166
resources:

‎versions/kruise/1.7.0-alpha.1/templates/webhookconfiguration.yaml

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,14 @@ kind: MutatingWebhookConfiguration
33
metadata:
44
name: kruise-mutating-webhook-configuration
55
annotations:
6+
{{- if contains "EnableExternalCerts=true" .Values.featureGates }}
7+
{{- range $key, $value := .Values.externalCerts.annotations }}
8+
{{ $key }}: {{ $value | quote }}
9+
{{- end }}
10+
{{- end }}
611
template: ""
712
webhooks:
8-
{{ if not (contains "PodWebhook=false" .Values.featureGates) }}
13+
{{- if not (contains "PodWebhook=false" .Values.featureGates) }}
914
- admissionReviewVersions:
1015
- v1
1116
- v1beta1
@@ -37,7 +42,7 @@ webhooks:
3742
resources:
3843
- pods
3944
sideEffects: None
40-
{{ end }}
45+
{{- end }}
4146
- admissionReviewVersions:
4247
- v1
4348
- v1beta1
@@ -287,6 +292,11 @@ kind: ValidatingWebhookConfiguration
287292
metadata:
288293
name: kruise-validating-webhook-configuration
289294
annotations:
295+
{{- if contains "EnableExternalCerts=true" .Values.featureGates }}
296+
{{- range $key, $value := .Values.externalCerts.annotations }}
297+
{{ $key }}: {{ $value | quote }}
298+
{{- end }}
299+
{{- end }}
290300
template: ""
291301
webhooks:
292302
- admissionReviewVersions:
@@ -508,7 +518,7 @@ webhooks:
508518
resources:
509519
- services
510520
sideEffects: None
511-
{{ if not (contains "PodWebhook=false" .Values.featureGates) }}
521+
{{- if not (contains "PodWebhook=false" .Values.featureGates) }}
512522
- admissionReviewVersions:
513523
- v1
514524
- v1beta1
@@ -572,7 +582,7 @@ webhooks:
572582
resources:
573583
- pods/eviction
574584
sideEffects: None
575-
{{ end }}
585+
{{- end }}
576586
- admissionReviewVersions:
577587
- v1
578588
- v1beta1

‎versions/kruise/1.7.0-alpha.1/values.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,11 @@ installation:
1212

1313
featureGates: "ImagePullJobGate=true"
1414

15+
externalCerts:
16+
# annotations to patch for webhook configuration and crd
17+
# e.g. cert-manager.io/inject-ca-from: kruise-system/kruise-webhook
18+
annotations: {}
19+
1520
# KUBE_CACHE_MUTATION_DETECTOR
1621
enableKubeCacheMutationDetector: false
1722

0 commit comments

Comments
 (0)