Skip to content

Commit dd6d188

Browse files
rahil-pmarkmandel
rahil-p
and
markmandel
authored
expose Helm chart values for custom certs (agones-dev#2367)
* expose Helm chart values for custom certs * add custom cert defaults to Helm values * document Helm values for custom certs * rename Helm `tlsCrt` value to `tlsCert` * expose Helm chart value for allocator's allowed client CAs Co-authored-by: Mark Mandel <markmandel@google.com>
1 parent 2be5e3b commit dd6d188

4 files changed

Lines changed: 24 additions & 10 deletions

File tree

‎install/helm/agones/templates/extensions.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ spec:
3838
{{- if .Values.agones.controller.generateTLS }}
3939
caBundle: {{ b64enc $ca.Cert }}
4040
{{- else }}
41-
caBundle: {{ .Files.Get "certs/server.crt" | b64enc }}
41+
caBundle: {{ default (.Files.Get "certs/server.crt") .Values.agones.controller.tlsCert | b64enc }}
4242
{{- end }}
4343
version: v1
4444
{{- end}}
@@ -68,7 +68,7 @@ webhooks:
6868
{{- if .Values.agones.controller.generateTLS }}
6969
caBundle: {{ b64enc $ca.Cert }}
7070
{{- else }}
71-
caBundle: {{ .Files.Get "certs/server.crt" | b64enc }}
71+
caBundle: {{ default (.Files.Get "certs/server.crt") .Values.agones.controller.tlsCert | b64enc }}
7272
{{- end }}
7373
rules:
7474
- apiGroups:
@@ -125,7 +125,7 @@ webhooks:
125125
{{- if .Values.agones.controller.generateTLS }}
126126
caBundle: {{ b64enc $ca.Cert }}
127127
{{- else }}
128-
caBundle: {{ .Files.Get "certs/server.crt" | b64enc }}
128+
caBundle: {{ default (.Files.Get "certs/server.crt") .Values.agones.controller.tlsCert | b64enc }}
129129
{{- end }}
130130
rules:
131131
- apiGroups:
@@ -164,6 +164,6 @@ data:
164164
server.crt: {{ b64enc $cert.Cert }}
165165
server.key: {{ b64enc $cert.Key }}
166166
{{- else }}
167-
server.crt: {{ .Files.Get "certs/server.crt" | b64enc }}
168-
server.key: {{ .Files.Get "certs/server.key" | b64enc }}
167+
server.crt: {{ default (.Files.Get "certs/server.crt") .Values.agones.controller.tlsCert | b64enc }}
168+
server.key: {{ default (.Files.Get "certs/server.key") .Values.agones.controller.tlsKey | b64enc }}
169169
{{- end }}

‎install/helm/agones/templates/service/allocation.yaml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -358,6 +358,10 @@ data:
358358
{{- end }}
359359
{{- if .Values.agones.allocator.generateTLS }}
360360
client-ca.crt: {{ b64enc $ca.Cert }}
361+
{{- else if .Values.agones.allocator.clientCAs }}
362+
{{- range $caField, $caContent := .Values.agones.allocator.clientCAs }}
363+
{{ $caField }}: {{ b64enc $caContent }}
364+
{{- end }}
361365
{{- else }}
362366
{{- (.Files.Glob "certs/allocator/client-ca/*").AsSecrets | nindent 2 }}
363367
{{- end }}
@@ -381,8 +385,8 @@ data:
381385
tls.crt: {{ b64enc $cert.Cert }}
382386
tls.key: {{ b64enc $cert.Key }}
383387
{{- else }}
384-
tls.crt: {{ .Files.Get "certs/allocator/server.crt" | b64enc }}
385-
tls.key: {{ .Files.Get "certs/allocator/server.key" | b64enc }}
388+
tls.crt: {{ default (.Files.Get "certs/allocator/server.crt") .Values.agones.allocator.tlsCert | b64enc }}
389+
tls.key: {{ default (.Files.Get "certs/allocator/server.key") .Values.agones.allocator.tlsKey | b64enc }}
386390
{{- end }}
387391

388392
---
@@ -401,7 +405,7 @@ data:
401405
{{- if .Values.agones.allocator.generateTLS }}
402406
tls-ca.crt: {{ b64enc $ca.Cert }}
403407
{{- else }}
404-
tls-ca.crt: {{ .Files.Get "certs/allocator/server.crt" | b64enc }}
408+
tls-ca.crt: {{ default (.Files.Get "certs/allocator/server.crt") .Values.agones.allocator.tlsCert | b64enc }}
405409
{{- end }}
406410

407411
# Default allocation client secret

‎install/helm/agones/values.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,8 @@ agones:
6565
- key: agones.dev/agones-system
6666
operator: Exists
6767
generateTLS: true
68+
tlsCert: ""
69+
tlsKey: ""
6870
safeToEvict: false
6971
persistentLogs: true
7072
persistentLogsSizeLimitMB: 10000
@@ -176,7 +178,10 @@ agones:
176178
portName: http
177179
disableSecretCreation: false
178180
generateTLS: true
181+
tlsCert: ""
182+
tlsKey: ""
179183
generateClientTLS: true
184+
clientCAs: {}
180185
disableMTLS: false
181186
disableTLS: false
182187
remoteAllocationTimeout: 10s

‎site/content/en/docs/Installation/Install Agones/helm.md‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ The following tables lists the configurable parameters of the Agones chart and t
117117
| `agones.controller.healthCheck.failureThreshold` | Number of times before giving up (in seconds) | `3` |
118118
| `agones.controller.healthCheck.timeoutSeconds` | Number of seconds after which the probe times out (in seconds) | `1` |
119119
| `agones.controller.resources` | Controller [resource requests/limit][resources] | `{}` |
120-
| `agones.controller.generateTLS` | Set to true to generate TLS certificates or false to provide your own certificates in `certs/*` | `true` |
120+
| `agones.controller.generateTLS` | Set to true to generate TLS certificates or false to provide your own certificates | `true` |
121121
| `agones.controller.nodeSelector` | Controller [node labels][nodeSelector] for pod assignment | `{}` |
122122
| `agones.controller.tolerations` | Controller [toleration][toleration] labels for pod assignment | `[]` |
123123
| `agones.controller.affinity` | Controller [affinity][affinity] settings for pod assignment | `{}` |
@@ -172,7 +172,7 @@ The following tables lists the configurable parameters of the Agones chart and t
172172
| `agones.allocator.service.grpc.port` | The port that is exposed externally by the [allocator service][allocator] for [gRPC requests][grpc-requests] | `443` |
173173
| `agones.allocator.service.grpc.targetPort` | The port that is used by the allocator pod to listen for [gRPC requests][grpc-requests]. Note that the allocator server cannot bind to low numbered ports. | `8443` |
174174
| `agones.allocator.generateClientTLS` | Set to true to generate client TLS certificates or false to provide certificates in `certs/allocator/allocator-client.default/*` | `true` |
175-
| `agones.allocator.generateTLS` | Set to true to generate TLS certificates or false to provide certificates in `certs/allocator/*`| `true` |
175+
| `agones.allocator.generateTLS` | Set to true to generate TLS certificates or false to provide your own certificates | `true` |
176176
| `agones.allocator.disableMTLS` | Turns off client cert authentication for incoming connections to the allocator. | `false` |
177177
| `agones.allocator.disableTLS` | Turns off TLS security for incoming connections to the allocator. Only applicable to the REST API. It currently does not work for the gRPC API. ([issue](https://github.com/googleforgames/agones/issues/1945)) | `false` |
178178
| `agones.allocator.disableSecretCreation` | Disables the creation of any allocator secrets. If true, you MUST provide the `allocator-tls`, `allocator-tls-ca`, and `allocator-client-ca` secrets before installation. | `false` |
@@ -199,6 +199,11 @@ The following tables lists the configurable parameters of the Agones chart and t
199199
| --------------------------------------------------- | ----------------------------------------------------------------------------------------------- | ---------------------- |
200200
| `agones.serviceaccount.sdk.annotations` | A map of namespaces to maps of [Annotations][annotations] added to the Agones SDK service account for the specified namespaces | `{}` |
201201
| `agones.metrics.serviceMonitor.interval` | Default scraping interval for ServiceMonitor | `30s` |
202+
| `agones.controller.tlsCert` | Custom TLS certificate provided as a string | \`\` |
203+
| `agones.controller.tlsKey` | Custom TLS private key provided as a string | \`\` |
204+
| `agones.allocator.tlsCert` | Custom TLS certificate provided as a string | \`\` |
205+
| `agones.allocator.tlsKey` | Custom TLS private key provided as a string | \`\` |
206+
| `agones.allocator.clientCAs` | A map of secret key names to allowed client CA certificates provided as strings | `{}` |
202207
| `agones.allocator.serviceMetrics.name` | Second Service name for the allocator | `agones-allocator-metrics-service` |
203208
| `agones.allocator.serviceMetrics.annotations` | [Annotations][annotations] added to the Agones allocator second Service | `{}` |
204209
| `agones.allocator.serviceMetrics.http.port` | The port that is exposed within cluster by the [allocator service][allocator] for http requests | `8080` |

0 commit comments

Comments
 (0)