Skip to content

Commit 5ead21c

Browse files
Cyril TOVENAmarkmandel
Cyril TOVENA
authored and
markmandel
committed
Generate Certs for Mutation/Validatiion Webhooks
- Add the ability to generate tls cert from helm for webhooks. - By default it's on but you can pass your own certificates. - Target gen-install use our default certificate to stay idempotent - certificates are passed by kubernetes secrets. - Remove certs from controller container (Dockerfile) - Add a target to remove gcloud deployment, usefull to reset - Update helm chart documentation - Generate new install.yaml - update installation documentation
1 parent a046c54 commit 5ead21c

13 files changed

Lines changed: 242 additions & 196 deletions

File tree

‎build/Makefile‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,9 @@ push-agones-sdk-image: ensure-build-image
170170
# Generate the static install script
171171
gen-install: ensure-build-image
172172
docker run --rm $(common_mounts) $(DOCKER_RUN_ARGS) $(build_tag) bash -c \
173-
'helm template --name=agones-manual $(mount_path)/install/helm/agones > $(mount_path)/install/yaml/install.yaml'
173+
'helm template --name=agones-manual $(mount_path)/install/helm/agones \
174+
--set agones.controller.generateTLS=false \
175+
> $(mount_path)/install/yaml/install.yaml'
174176

175177
# Generate the SDK gRPC server and client code
176178
gen-gameservers-sdk-grpc: ensure-build-image
@@ -271,6 +273,10 @@ gcloud-test-cluster: ensure-build-image
271273
docker run --rm -it $(common_mounts) $(DOCKER_RUN_ARGS) $(build_tag) kubectl apply -f $(mount_path)/build/helm.yaml
272274
docker run --rm $(common_mounts) $(DOCKER_RUN_ARGS) $(build_tag) helm init --service-account helm
273275

276+
clean-gcloud-test-cluster: ensure-build-image
277+
docker run --rm -it $(common_mounts) $(DOCKER_RUN_ARGS) $(build_tag) gcloud \
278+
deployment-manager deployments delete test-cluster
279+
274280
# Pulls down authentication information for kubectl against a cluster, name can be specified through CLUSTER_NAME
275281
# (defaults to 'test-cluster')
276282
gcloud-auth-cluster: ensure-build-image

‎cmd/controller/Dockerfile‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ FROM alpine:3.7
33
RUN apk --update add ca-certificates && \
44
adduser -D agones
55

6-
COPY ./certs /home/agones/certs
76
COPY ./bin/controller /home/agones/controller
87

98
RUN chown -R agones /home/agones && \

‎docs/installing_agones.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,10 @@ We can install Agones to the cluster using the
193193
kubectl apply -f https://raw.githubusercontent.com/googlecloudplatform/agones/release-0.1/install.yaml
194194
```
195195

196+
> Note: Installing Agones with the `intall.yaml` will setup the TLS certificates stored in this repository for securing
197+
> kubernetes webhooks communication. If you want to generates new certificates or use your own,
198+
> we recommend using the helm installation.
199+
196200
## Install using Helm
197201

198202
Also, we can install Agones using [Helm][helm] package manager. If you want more details and configuration

‎install/helm/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ The following tables lists the configurable parameters of the Agones chart and t
7878
| `agones.controller.healthCheck.failureThreshold` | Number of times before giving up (in seconds) | `3` |
7979
| `agones.controller.healthCheck.timeoutSeconds` | Number of seconds after which the probe times out (in seconds) | `1` |
8080
| `agones.controller.resources` | Controller resource requests/limit | `{}`
81+
| `agones.controller.generateTLS` | Set to true to generate TLS certificates or false to provide your own certificates in `certs/*` | `true`
8182
| `gameservers.namespaces` | a list of namespaces you are planning to use to deploy game servers | `["defaut"]` |
8283
| `gameservers.minPort` | Minimum port to use for dynamic port allocation | `7000` |
8384
| `gameservers.maxPort` | Maximum port to use for dynamic port allocation | `8000` |

cmd/controller/certs/cert.sh renamed to install/helm/agones/certs/cert.sh

File renamed without changes.

cmd/controller/certs/server.crt renamed to install/helm/agones/certs/server.crt

File renamed without changes.

cmd/controller/certs/server.key renamed to install/helm/agones/certs/server.key

File renamed without changes.

‎install/helm/agones/templates/admissionregistration.yaml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
# Copyright 2018 Google Inc. All Rights Reserved.
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
{{- $ca := genCA "admission-controller-ca" 3650 }}
15+
{{- $cn := printf "agones-controller-service" }}
16+
{{- $altName1 := printf "agones-controller-service.%s" .Values.agones.namespace }}
17+
{{- $altName2 := printf "agones-controller-service.%s.svc" .Values.agones.namespace }}
18+
{{- $cert := genSignedCert $cn nil (list $altName1 $altName2) 3650 $ca }}
19+
---
20+
apiVersion: admissionregistration.k8s.io/v1beta1
21+
kind: ValidatingWebhookConfiguration
22+
metadata:
23+
name: agones-validation-webhook
24+
namespace: {{ .Values.agones.namespace }}
25+
webhooks:
26+
- name: validations.stable.agones.dev
27+
failurePolicy: Fail
28+
clientConfig:
29+
service:
30+
name: agones-controller-service
31+
namespace: {{ .Values.agones.namespace }}
32+
path: /validate
33+
{{- if .Values.agones.controller.generateTLS }}
34+
caBundle: {{ b64enc $ca.Cert }}
35+
{{- else }}
36+
caBundle: {{ .Files.Get "certs/server.crt" | b64enc }}
37+
{{- end }}
38+
rules:
39+
- apiGroups:
40+
- stable.agones.dev
41+
resources:
42+
- "gameservers"
43+
- "fleetallocations"
44+
apiVersions:
45+
- "v1alpha1"
46+
operations:
47+
- CREATE
48+
- apiGroups:
49+
- stable.agones.dev
50+
resources:
51+
- "gameserversets"
52+
- "fleetallocations"
53+
apiVersions:
54+
- "v1alpha1"
55+
operations:
56+
- UPDATE
57+
---
58+
apiVersion: admissionregistration.k8s.io/v1beta1
59+
kind: MutatingWebhookConfiguration
60+
metadata:
61+
name: agones-mutation-webhook
62+
namespace: {{ .Values.agones.namespace }}
63+
labels:
64+
component: controller
65+
app: {{ template "agones.name" . }}
66+
chart: {{ template "agones.chart" . }}
67+
release: {{ .Release.Name }}
68+
heritage: {{ .Release.Service }}
69+
webhooks:
70+
- name: mutations.stable.agones.dev
71+
failurePolicy: Fail
72+
clientConfig:
73+
service:
74+
name: agones-controller-service
75+
namespace: {{ .Values.agones.namespace }}
76+
path: /mutate
77+
{{- if .Values.agones.controller.generateTLS }}
78+
caBundle: {{ b64enc $ca.Cert }}
79+
{{- else }}
80+
caBundle: {{ .Files.Get "certs/server.crt" | b64enc }}
81+
{{- end }}
82+
rules:
83+
- apiGroups:
84+
- stable.agones.dev
85+
resources:
86+
- "gameservers"
87+
- "fleets"
88+
- "fleetallocations"
89+
apiVersions:
90+
- "v1alpha1"
91+
operations:
92+
- CREATE
93+
---
94+
apiVersion: v1
95+
kind: Secret
96+
metadata:
97+
name: {{ template "agones.fullname" . }}-cert
98+
namespace: {{ .Values.agones.namespace }}
99+
labels:
100+
app: {{ template "agones.fullname" . }}
101+
chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
102+
release: "{{ .Release.Name }}"
103+
heritage: "{{ .Release.Service }}"
104+
type: Opaque
105+
data:
106+
{{- if .Values.agones.controller.generateTLS }}
107+
server.crt: {{ b64enc $cert.Cert }}
108+
server.key: {{ b64enc $cert.Key }}
109+
{{- else }}
110+
server.crt: {{ .Files.Get "certs/server.crt" | b64enc }}
111+
server.key: {{ .Files.Get "certs/server.key" | b64enc }}
112+
{{- end }}

‎install/helm/agones/templates/controller.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,3 +64,11 @@ spec:
6464
resources:
6565
{{ toYaml .Values.agones.controller.resources | indent 10 }}
6666
{{- end }}
67+
volumeMounts:
68+
- name: certs
69+
mountPath: /home/agones/certs
70+
readOnly: true
71+
volumes:
72+
- name: certs
73+
secret:
74+
secretName: {{ template "agones.fullname" . }}-cert

‎install/helm/agones/templates/mutatingwebhook.yaml‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

0 commit comments

Comments
 (0)