Skip to content

Commit 0925030

Browse files
mikhail-klimkomikhail-klimko
committed
feat: add support for custom TLS certificates from the platform (#519)
1 parent 72e8302 commit 0925030

File tree

4 files changed

+201
-3
lines changed

4 files changed

+201
-3
lines changed

‎charts/gitops-runtime/Chart.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,4 +129,4 @@ dependencies:
129129
condition: gitops-operator.enabled
130130
- name: cf-argocd-extras
131131
repository: oci://quay.io/codefresh/charts
132-
version: 0.5.2
132+
version: 0.5.4

‎charts/gitops-runtime/templates/event-reporter.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,11 @@
1818
{{- $_ := set $cfArgoCdExtrasContext.Values.eventReporter.container.env "ARGOCD_SERVER_ROOTPATH" (index .Values "global" "external-argo-cd" "server" "rootpath") }}
1919
{{- end }}
2020

21+
{{- if or .Values.global.codefresh.tls.caCerts.secret.create .Values.global.codefresh.tls.caCerts.secretKeyRef }}
22+
{{- $secretName := .Values.global.codefresh.tls.caCerts.secretKeyRef.name | default "codefresh-tls-certs" }}
23+
{{- $secretKey := .Values.global.codefresh.tls.caCerts.secret.create | ternary (default "ca-bundle.crt" .Values.global.codefresh.tls.caCerts.secret.key) .Values.global.codefresh.tls.caCerts.secretKeyRef.key }}
24+
{{- $_ := set $cfArgoCdExtrasContext.Values.eventReporter.container.env "CODEFRESH_SSL_CERT_PATH" (printf "/app/config/codefresh-tls-certs/%s" $secretKey ) }}
25+
{{- $_ := set (index $cfArgoCdExtrasContext.Values.eventReporter.volumes "codefresh-tls-certs") "nameOverride" $secretName }}
26+
{{- end }}
27+
2128
{{ include "cf-argocd-extras.event-reporter.resources" $cfArgoCdExtrasContext }}

‎charts/gitops-runtime/templates/sources-server.yaml

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,19 @@
1010
{{- $_ := set $cfArgoCdExtrasContext.Values.sourcesServer.container.env "ARGO_CD_TOKEN_SECRET_KEY" (required ".Values.global.external-argo-cd.auth.type is set to 'token' therefore .Values.global.external-argo-cd.auth.tokenSecretKeyRef.key is required" (index .Values "global" "external-argo-cd" "auth" "tokenSecretKeyRef" "key" )) }}
1111
{{- else }}
1212
{{- $_ := set $cfArgoCdExtrasContext.Values.sourcesServer.container.env "ARGO_CD_TOKEN_SECRET_NAME" "gitops-runtime-argo-cd-token" }}
13-
{{- $_ := set $cfArgoCdExtrasContext.Values.sourcesServer.container.env "ARGO_CD_TOKEN_SECRET_KEY" "token" }}
13+
{{- $_ := set $cfArgoCdExtrasContext.Values.sourcesServer.container.env "ARGO_CD_TOKEN_SECRET_KEY" "token" }}
1414
{{- end }}
1515
{{- end }}
1616

1717
{{- if and (index .Values "global" "external-argo-cd" "server" "rootpath") }}
18-
{{- $_ := set $cfArgoCdExtrasContext.Values.sourcesServer.container.env "ARGOCD_SERVER_ROOTPATH" (index .Values "global" "external-argo-cd" "server" "rootpath") }}
18+
{{- $_ := set $cfArgoCdExtrasContext.Values.sourcesServer.container.env "ARGOCD_SERVER_ROOTPATH" (index .Values "global" "external-argo-cd" "server" "rootpath") }}
19+
{{- end }}
20+
21+
{{- if or .Values.global.codefresh.tls.caCerts.secret.create .Values.global.codefresh.tls.caCerts.secretKeyRef }}
22+
{{- $secretName := .Values.global.codefresh.tls.caCerts.secretKeyRef.name | default "codefresh-tls-certs" }}
23+
{{- $secretKey := .Values.global.codefresh.tls.caCerts.secret.create | ternary (default "ca-bundle.crt" .Values.global.codefresh.tls.caCerts.secret.key) .Values.global.codefresh.tls.caCerts.secretKeyRef.key }}
24+
{{- $_ := set $cfArgoCdExtrasContext.Values.sourcesServer.container.env "CODEFRESH_SSL_CERT_PATH" (printf "/app/config/codefresh-tls-certs/%s" $secretKey ) }}
25+
{{- $_ := set (index $cfArgoCdExtrasContext.Values.sourcesServer.volumes "codefresh-tls-certs") "nameOverride" $secretName }}
1926
{{- end }}
2027

2128
{{- include "cf-argocd-extras.sources-server.hpa" $cfArgoCdExtrasContext }}

‎charts/gitops-runtime/tests/cf-argocd-extras_test.yaml

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,3 +154,187 @@ tests:
154154
- equal:
155155
path: data["redis.server"]
156156
value: RELEASE-NAME-redis-ha-haproxy:6379
157+
158+
- it: Sources-Server should have an OPTIONAL codefresh-tls-certs volume and volumeMount by default
159+
template: sources-server.yaml
160+
documentSelector:
161+
path: kind
162+
value: Deployment
163+
values:
164+
- ./values/mandatory-values-ingress.yaml
165+
asserts:
166+
- contains:
167+
path: spec.template.spec.volumes
168+
content:
169+
name: codefresh-tls-certs
170+
secret:
171+
secretName: codefresh-tls-certs
172+
optional: true
173+
- contains:
174+
path: spec.template.spec.containers[0].volumeMounts
175+
content:
176+
name: codefresh-tls-certs
177+
mountPath: /app/config/codefresh-tls-certs
178+
readOnly: true
179+
180+
- it: Sources-Server should have CODEFRESH_SSL_CERT_PATH env var when .Values.global.codefresh.tls.caCerts.secret.create is true
181+
template: sources-server.yaml
182+
documentSelector:
183+
path: kind
184+
value: Deployment
185+
values:
186+
- ./values/mandatory-values-ingress.yaml
187+
set:
188+
global:
189+
codefresh:
190+
tls:
191+
caCerts:
192+
secret:
193+
create: true
194+
key: ca-bundle.crt
195+
content: |
196+
-----BEGIN CERTIFICATE-----
197+
MIID...
198+
-----END CERTIFICATE-----
199+
asserts:
200+
- equal:
201+
path: spec.template.spec.containers[0].env[?(@.name == 'CODEFRESH_SSL_CERT_PATH')].value
202+
value: /app/config/codefresh-tls-certs/ca-bundle.crt
203+
- contains:
204+
path: spec.template.spec.volumes
205+
content:
206+
name: codefresh-tls-certs
207+
secret:
208+
secretName: codefresh-tls-certs
209+
optional: true
210+
- contains:
211+
path: spec.template.spec.containers[0].volumeMounts
212+
content:
213+
name: codefresh-tls-certs
214+
mountPath: /app/config/codefresh-tls-certs
215+
readOnly: true
216+
217+
- it: Sources-Server should have CODEFRESH_SSL_CERT_PATH env var when .Values.global.codefresh.tls.caCerts.secretKeyRef is set
218+
template: sources-server.yaml
219+
documentSelector:
220+
path: kind
221+
value: Deployment
222+
values:
223+
- ./values/mandatory-values-ingress.yaml
224+
set:
225+
global:
226+
codefresh:
227+
tls:
228+
caCerts:
229+
secretKeyRef:
230+
name: my-codefresh-tls-certs
231+
key: my-ca-bundle.crt
232+
asserts:
233+
- equal:
234+
path: spec.template.spec.containers[0].env[?(@.name == 'CODEFRESH_SSL_CERT_PATH')].value
235+
value: /app/config/codefresh-tls-certs/my-ca-bundle.crt
236+
- contains:
237+
path: spec.template.spec.volumes
238+
content:
239+
name: codefresh-tls-certs
240+
secret:
241+
secretName: my-codefresh-tls-certs
242+
optional: true
243+
- contains:
244+
path: spec.template.spec.containers[0].volumeMounts
245+
content:
246+
name: codefresh-tls-certs
247+
mountPath: /app/config/codefresh-tls-certs
248+
readOnly: true
249+
250+
- it: Event-Reporter should have an OPTIONAL codefresh-tls-certs volume and volumeMount by default
251+
template: event-reporter.yaml
252+
documentSelector:
253+
path: kind
254+
value: StatefulSet
255+
values:
256+
- ./values/mandatory-values-ingress.yaml
257+
asserts:
258+
- contains:
259+
path: spec.template.spec.volumes
260+
content:
261+
name: codefresh-tls-certs
262+
secret:
263+
secretName: codefresh-tls-certs
264+
optional: true
265+
- contains:
266+
path: spec.template.spec.containers[0].volumeMounts
267+
content:
268+
name: codefresh-tls-certs
269+
mountPath: /app/config/codefresh-tls-certs
270+
readOnly: true
271+
272+
- it: Event-Reporter should have CODEFRESH_SSL_CERT_PATH env var when .Values.global.codefresh.tls.caCerts.secret.create is true
273+
template: event-reporter.yaml
274+
documentSelector:
275+
path: kind
276+
value: StatefulSet
277+
values:
278+
- ./values/mandatory-values-ingress.yaml
279+
set:
280+
global:
281+
codefresh:
282+
tls:
283+
caCerts:
284+
secret:
285+
create: true
286+
key: ca-bundle.crt
287+
content: |
288+
-----BEGIN CERTIFICATE-----
289+
MIID...
290+
-----END CERTIFICATE-----
291+
asserts:
292+
- equal:
293+
path: spec.template.spec.containers[0].env[?(@.name == 'CODEFRESH_SSL_CERT_PATH')].value
294+
value: /app/config/codefresh-tls-certs/ca-bundle.crt
295+
- contains:
296+
path: spec.template.spec.volumes
297+
content:
298+
name: codefresh-tls-certs
299+
secret:
300+
secretName: codefresh-tls-certs
301+
optional: true
302+
- contains:
303+
path: spec.template.spec.containers[0].volumeMounts
304+
content:
305+
name: codefresh-tls-certs
306+
mountPath: /app/config/codefresh-tls-certs
307+
readOnly: true
308+
309+
- it: Event-Reporter should have CODEFRESH_SSL_CERT_PATH env var when .Values.global.codefresh.tls.caCerts.secretKeyRef is set
310+
template: event-reporter.yaml
311+
documentSelector:
312+
path: kind
313+
value: StatefulSet
314+
values:
315+
- ./values/mandatory-values-ingress.yaml
316+
set:
317+
global:
318+
codefresh:
319+
tls:
320+
caCerts:
321+
secretKeyRef:
322+
name: my-codefresh-tls-certs
323+
key: my-ca-bundle.crt
324+
asserts:
325+
- equal:
326+
path: spec.template.spec.containers[0].env[?(@.name == 'CODEFRESH_SSL_CERT_PATH')].value
327+
value: /app/config/codefresh-tls-certs/my-ca-bundle.crt
328+
- contains:
329+
path: spec.template.spec.volumes
330+
content:
331+
name: codefresh-tls-certs
332+
secret:
333+
secretName: my-codefresh-tls-certs
334+
optional: true
335+
- contains:
336+
path: spec.template.spec.containers[0].volumeMounts
337+
content:
338+
name: codefresh-tls-certs
339+
mountPath: /app/config/codefresh-tls-certs
340+
readOnly: true

0 commit comments

Comments
 (0)