feat(*) allow ca.crt to be in separate k8s secret

This feature adds option to provide ca.crt in separate k8s secret than tls.key/tls.crt, which allows to provide CA and certificates using for example cert-manager + two small stylistic changes in helm chart's values.yaml file suggested by my IDE Signed-off-by: Bart Smykla <bartek@smykla.com>
kumahq · Jan 4, 2022 · 73a9160 · 73a9160
1 parent cf671dd
commit 73a9160
Show file tree

Hide file tree

Showing 15 changed files with 142 additions and 17 deletions.
diff --git a/app/kumactl/cmd/completion/testdata/bash.golden b/app/kumactl/cmd/completion/testdata/bash.golden
@@ -2842,6 +2842,10 @@ _kumactl_install_control-plane()
     two_word_flags+=("--tls-general-ca-bundle")
     local_nonpersistent_flags+=("--tls-general-ca-bundle")
     local_nonpersistent_flags+=("--tls-general-ca-bundle=")
+    flags+=("--tls-general-ca-secret=")
+    two_word_flags+=("--tls-general-ca-secret")
+    local_nonpersistent_flags+=("--tls-general-ca-secret")
+    local_nonpersistent_flags+=("--tls-general-ca-secret=")
     flags+=("--tls-general-secret=")
     two_word_flags+=("--tls-general-secret")
     local_nonpersistent_flags+=("--tls-general-secret")

diff --git a/app/kumactl/cmd/install/context/install_control_plane_context.go b/app/kumactl/cmd/install/context/install_control_plane_context.go
@@ -15,6 +15,7 @@ type InstallControlPlaneArgs struct {
 	ControlPlane_image_tag                       string            `helm:"controlPlane.image.tag"`
 	ControlPlane_service_name                    string            `helm:"controlPlane.service.name"`
 	ControlPlane_tls_general_secret              string            `helm:"controlPlane.tls.general.secretName"`
+	ControlPlane_tls_general_ca_secret           string            `helm:"controlPlane.tls.general.caSecretName"`
 	ControlPlane_tls_general_caBundle            string            `helm:"controlPlane.tls.general.caBundle"`
 	ControlPlane_tls_apiServer_secret            string            `helm:"controlPlane.tls.apiServer.secretName"`
 	ControlPlane_tls_apiServer_clientCertsSecret string            `helm:"controlPlane.tls.apiServer.clientCertsSecretName"`

diff --git a/app/kumactl/cmd/install/install_control_plane.go b/app/kumactl/cmd/install/install_control_plane.go
@@ -112,7 +112,8 @@ This command requires that the KUBECONFIG environment is set`,
 	cmd.Flags().StringVar(&args.ControlPlane_image_repository, "control-plane-repository", args.ControlPlane_image_repository, "repository for the image of the Kuma Control Plane component")
 	cmd.Flags().StringVar(&args.ControlPlane_image_tag, "control-plane-version", args.ControlPlane_image_tag, "version of the image of the Kuma Control Plane component")
 	cmd.Flags().StringVar(&args.ControlPlane_service_name, "control-plane-service-name", args.ControlPlane_service_name, "Service name of the Kuma Control Plane")
-	cmd.Flags().StringVar(&args.ControlPlane_tls_general_secret, "tls-general-secret", args.ControlPlane_tls_general_secret, "Secret that contains tls.crt, key.crt and ca.crt for protecting Kuma in-cluster communication")
+	cmd.Flags().StringVar(&args.ControlPlane_tls_general_secret, "tls-general-secret", args.ControlPlane_tls_general_secret, "Secret that contains tls.crt, key.crt [and ca.crt when no --tls-general-ca-secret specified] for protecting Kuma in-cluster communication")
+	cmd.Flags().StringVar(&args.ControlPlane_tls_general_ca_secret, "tls-general-ca-secret", args.ControlPlane_tls_general_ca_secret, "Secret that contains ca.crt for protecting Kuma in-cluster communication (ca.crt present in this secret have precedence over the one provided in --tls-general-secret)")
 	cmd.Flags().StringVar(&args.ControlPlane_tls_general_caBundle, "tls-general-ca-bundle", args.ControlPlane_tls_general_secret, "Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)")
 	cmd.Flags().StringVar(&args.ControlPlane_tls_apiServer_secret, "tls-api-server-secret", args.ControlPlane_tls_apiServer_secret, "Secret that contains tls.crt, key.crt for protecting Kuma API on HTTPS")
 	cmd.Flags().StringVar(&args.ControlPlane_tls_apiServer_clientCertsSecret, "tls-api-server-client-certs-secret", args.ControlPlane_tls_apiServer_clientCertsSecret, "Secret that contains list of .pem certificates that can access admin endpoints of Kuma API on HTTPS")

diff --git a/app/kumactl/cmd/install/install_control_plane_test.go b/app/kumactl/cmd/install/install_control_plane_test.go
@@ -57,7 +57,16 @@ var _ = Describe("kumactl install control-plane", func() {
 
 			// given
 			rootCmd := cmd.NewRootCmd(rootCtx)
-			rootCmd.SetArgs(append([]string{"install", "control-plane", "--tls-general-secret", "general-tls-secret", "--tls-general-ca-bundle", "XYZ"}, given.extraArgs...))
+			rootCmd.SetArgs(append(
+				[]string{
+					"install",
+					"control-plane",
+					"--tls-general-secret", "general-tls-secret",
+					"--tls-general-ca-secret", "general-tls-secret-ca",
+					"--tls-general-ca-bundle", "XYZ",
+				},
+				given.extraArgs...,
+			))
 			rootCmd.SetOut(stdout)
 			rootCmd.SetErr(stderr)
 

diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.cni-enabled.golden.yaml
@@ -1462,7 +1462,16 @@ spec:
               memory: 256Mi
           volumeMounts:
             - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
+              subPath: tls.crt
+              readOnly: true
+            - name: general-tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
+              subPath: tls.key
+              readOnly: true
+            - name: general-tls-cert-ca
+              mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
+              subPath: ca.crt
               readOnly: true
             - name: kuma-control-plane-config
               mountPath: /etc/kuma.io/kuma-control-plane
@@ -1471,6 +1480,9 @@ spec:
         - name: general-tls-cert
           secret:
             secretName: general-tls-secret
+        - name: general-tls-cert-ca
+          secret:
+            secretName: general-tls-secret-ca
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config

diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.defaults.golden.yaml
@@ -1287,7 +1287,16 @@ spec:
               memory: 256Mi
           volumeMounts:
             - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
+              subPath: tls.crt
+              readOnly: true
+            - name: general-tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
+              subPath: tls.key
+              readOnly: true
+            - name: general-tls-cert-ca
+              mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
+              subPath: ca.crt
               readOnly: true
             - name: kuma-control-plane-config
               mountPath: /etc/kuma.io/kuma-control-plane
@@ -1296,6 +1305,9 @@ spec:
         - name: general-tls-cert
           secret:
             secretName: general-tls-secret
+        - name: general-tls-cert-ca
+          secret:
+            secretName: general-tls-secret-ca
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config

diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.global.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.global.golden.yaml
@@ -1294,7 +1294,16 @@ spec:
               memory: 256Mi
           volumeMounts:
             - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
+              subPath: tls.crt
+              readOnly: true
+            - name: general-tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
+              subPath: tls.key
+              readOnly: true
+            - name: general-tls-cert-ca
+              mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
+              subPath: ca.crt
               readOnly: true
             - name: kuma-control-plane-config
               mountPath: /etc/kuma.io/kuma-control-plane
@@ -1303,6 +1312,9 @@ spec:
         - name: general-tls-cert
           secret:
             secretName: general-tls-secret
+        - name: general-tls-cert-ca
+          secret:
+            secretName: general-tls-secret-ca
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config

diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.override-env-vars.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.override-env-vars.golden.yaml
@@ -1287,7 +1287,16 @@ spec:
               memory: 256Mi
           volumeMounts:
             - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
+              subPath: tls.crt
+              readOnly: true
+            - name: general-tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
+              subPath: tls.key
+              readOnly: true
+            - name: general-tls-cert-ca
+              mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
+              subPath: ca.crt
               readOnly: true
             - name: kuma-control-plane-config
               mountPath: /etc/kuma.io/kuma-control-plane
@@ -1296,6 +1305,9 @@ spec:
         - name: general-tls-cert
           secret:
             secretName: general-tls-secret
+        - name: general-tls-cert-ca
+          secret:
+            secretName: general-tls-secret-ca
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config

diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.overrides.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.overrides.golden.yaml
@@ -1307,7 +1307,16 @@ spec:
               memory: 256Mi
           volumeMounts:
             - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
+              subPath: tls.crt
+              readOnly: true
+            - name: general-tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
+              subPath: tls.key
+              readOnly: true
+            - name: general-tls-cert-ca
+              mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
+              subPath: ca.crt
               readOnly: true
             - name: kuma-control-plane-config
               mountPath: /etc/kuma.io/kuma-control-plane
@@ -1328,6 +1337,9 @@ spec:
         - name: general-tls-cert
           secret:
             secretName: general-tls-secret
+        - name: general-tls-cert-ca
+          secret:
+            secretName: general-tls-secret-ca
         - name: api-server-tls-cert
           secret:
             secretName: api-server-secret

diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.with-ingress.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.with-ingress.golden.yaml
@@ -1316,7 +1316,16 @@ spec:
               memory: 256Mi
           volumeMounts:
             - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
+              subPath: tls.crt
+              readOnly: true
+            - name: general-tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
+              subPath: tls.key
+              readOnly: true
+            - name: general-tls-cert-ca
+              mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
+              subPath: ca.crt
               readOnly: true
             - name: kuma-control-plane-config
               mountPath: /etc/kuma.io/kuma-control-plane
@@ -1325,6 +1334,9 @@ spec:
         - name: general-tls-cert
           secret:
             secretName: general-tls-secret
+        - name: general-tls-cert-ca
+          secret:
+            secretName: general-tls-secret-ca
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config

diff --git a/app/kumactl/cmd/install/testdata/install-control-plane.zone.golden.yaml b/app/kumactl/cmd/install/testdata/install-control-plane.zone.golden.yaml
@@ -1295,7 +1295,16 @@ spec:
               memory: 256Mi
           volumeMounts:
             - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
+              subPath: tls.crt
+              readOnly: true
+            - name: general-tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
+              subPath: tls.key
+              readOnly: true
+            - name: general-tls-cert-ca
+              mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
+              subPath: ca.crt
               readOnly: true
             - name: kuma-control-plane-config
               mountPath: /etc/kuma.io/kuma-control-plane
@@ -1304,6 +1313,9 @@ spec:
         - name: general-tls-cert
           secret:
             secretName: general-tls-secret
+        - name: general-tls-cert-ca
+          secret:
+            secretName: general-tls-secret-ca
         - name: kuma-control-plane-config
           configMap:
             name: kuma-control-plane-config

diff --git a/deployments/charts/kuma/README.md b/deployments/charts/kuma/README.md
@@ -12,7 +12,7 @@ A Helm chart for the Kuma Control Plane
 |-----|------|---------|-------------|
 | global.image.registry | string | `"docker.io/kumahq"` | Default registry for all Kuma Images |
 | global.image.tag | string | `nil` | The default tag for all Kuma images, which itself defaults to .Chart.AppVersion |
-| patchSystemNamespace | bool | `true` | Whether or not to patch the target namespace with the system label |
+| patchSystemNamespace | bool | `true` | Whether to patch the target namespace with the system label |
 | installCrdsOnUpgrade | object | `{"enabled":true,"imagePullSecrets":[]}` | Whether ot not install new CRDs before upgrade  (if any were introduced    with the new version of Kuma) |
 | controlPlane.logLevel | string | `"info"` | Kuma CP log level: one of off,info,debug |
 | controlPlane.mode | string | `"standalone"` | Kuma CP modes: one of standalone,zone,global |
@@ -35,9 +35,10 @@ A Helm chart for the Kuma Control Plane
 | controlPlane.globalZoneSyncService.loadBalancerIP | string | `nil` | Optionally specify IP to be used by cloud provider when configuring load balancer |
 | controlPlane.globalZoneSyncService.annotations | object | `{}` | Additional annotations to put on the Global Zone Sync Service |
 | controlPlane.globalZoneSyncService.port | int | `5685` | Port on which Global Zone Sync Service is exposed |
-| controlPlane.defaults.skipMeshCreation | bool | `false` | Whether or not to skip creating the default Mesh |
+| controlPlane.defaults.skipMeshCreation | bool | `false` | Whether to skip creating the default Mesh |
 | controlPlane.resources | string | `nil` | Optionally override the resource spec |
-| controlPlane.tls.general.secretName | string | `""` | Secret that contains tls.crt, key.crt and ca.crt for protecting Kuma in-cluster communication |
+| controlPlane.tls.general.secretName | string | `""` | Secret that contains tls.crt, key.crt [and ca.crt when no controlPlane.tls.general.coSecretName specified] for protecting Kuma in-cluster communication |
+| controlPlane.tls.general.caSecretName | string | `""` | Secret that contains ca.crt for protecting Kuma in-cluster communication (ca.crt present in this secret have precedence over the one provided in the controlPlane.tls.general.secretName) |
 | controlPlane.tls.general.caBundle | string | `""` | Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt) |
 | controlPlane.tls.apiServer.secretName | string | `""` | Secret that contains tls.crt, key.crt for protecting Kuma API on HTTPS |
 | controlPlane.tls.apiServer.clientCertsSecretName | string | `""` | Secret that contains list of .pem certificates that can access admin endpoints of Kuma API on HTTPS |

diff --git a/deployments/charts/kuma/templates/cp-deployment.yaml b/deployments/charts/kuma/templates/cp-deployment.yaml
@@ -110,7 +110,20 @@ spec:
           {{- end }}
           volumeMounts:
             - name: general-tls-cert
-              mountPath: /var/run/secrets/kuma.io/tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.crt
+              subPath: tls.crt
+              readOnly: true
+            - name: general-tls-cert
+              mountPath: /var/run/secrets/kuma.io/tls-cert/tls.key
+              subPath: tls.key
+              readOnly: true
+          {{- if .Values.controlPlane.tls.general.caSecretName }}
+            - name: general-tls-cert-ca
+          {{- else}}
+            - name: general-tls-cert
+          {{- end }}
+              mountPath: /var/run/secrets/kuma.io/tls-cert/ca.crt
+              subPath: ca.crt
               readOnly: true
             - name: {{ include "kuma.name" . }}-control-plane-config
               mountPath: /etc/kuma.io/kuma-control-plane
@@ -145,6 +158,11 @@ spec:
           secret:
             secretName: {{ include "kuma.name" . }}-tls-cert
         {{- end }}
+        {{- if .Values.controlPlane.tls.general.caSecretName }}
+        - name: general-tls-cert-ca
+          secret:
+            secretName: {{ .Values.controlPlane.tls.general.caSecretName }}
+        {{- end }}
         {{- if .Values.controlPlane.tls.apiServer.secretName }}
         - name: api-server-tls-cert
           secret:

diff --git a/deployments/charts/kuma/values.yaml b/deployments/charts/kuma/values.yaml
@@ -5,7 +5,7 @@ global:
     # -- The default tag for all Kuma images, which itself defaults to .Chart.AppVersion
     tag:
 
-# -- Whether or not to patch the target namespace with the system label
+# -- Whether to patch the target namespace with the system label
 patchSystemNamespace: true
 
 # -- Whether ot not install new CRDs before upgrade  (if any were introduced
@@ -84,7 +84,7 @@ controlPlane:
     port: 5685
 
   defaults:
-    # -- Whether or not to skip creating the default Mesh
+    # -- Whether to skip creating the default Mesh
     skipMeshCreation: false
 
   # -- Optionally override the resource spec
@@ -97,8 +97,14 @@ controlPlane:
   # TLS for various servers
   tls:
     general:
-      # -- Secret that contains tls.crt, key.crt and ca.crt for protecting Kuma in-cluster communication
+      # -- Secret that contains tls.crt, key.crt [and ca.crt when no
+      # controlPlane.tls.general.coSecretName specified] for protecting
+      # Kuma in-cluster communication
       secretName: ""
+      # -- Secret that contains ca.crt for protecting Kuma in-cluster communication
+      # (ca.crt present in this secret have precedence over the one provided in
+      # the controlPlane.tls.general.secretName)
+      caSecretName: ""
       # -- Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)
       caBundle: ""
     apiServer:

diff --git a/docs/cmd/kumactl/kumactl_install_control-plane.md b/docs/cmd/kumactl/kumactl_install_control-plane.md
@@ -45,7 +45,8 @@ kumactl install control-plane [flags]
       --tls-api-server-client-certs-secret string   Secret that contains list of .pem certificates that can access admin endpoints of Kuma API on HTTPS
       --tls-api-server-secret string                Secret that contains tls.crt, key.crt for protecting Kuma API on HTTPS
       --tls-general-ca-bundle string                Base64 encoded CA certificate (the same as in controlPlane.tls.general.secret#ca.crt)
-      --tls-general-secret string                   Secret that contains tls.crt, key.crt and ca.crt for protecting Kuma in-cluster communication
+      --tls-general-ca-secret string                Secret that contains ca.crt for protecting Kuma in-cluster communication (ca.crt present in this secret have precedence over the one provided in --tls-general-secret)
+      --tls-general-secret string                   Secret that contains tls.crt, key.crt [and ca.crt when no --tls-general-ca-secret specified] for protecting Kuma in-cluster communication
       --tls-kds-global-server-secret string         Secret that contains tls.crt, key.crt for protecting cross cluster communication
       --tls-kds-zone-client-secret string           Secret that contains ca.crt which was used to sign KDS Global server. Used for CP verification
       --use-node-port                               use NodePort instead of LoadBalancer