Support external cert secret #559
Conversation
Signed-off-by: ericsyh <ericshenyuhao@outlook.com>
Signed-off-by: ericsyh <ericshenyuhao@outlook.com>
Signed-off-by: ericsyh <ericshenyuhao@outlook.com>
charts/pulsar/values.yaml
Outdated
| # settings for generating certs for proxy | ||
| proxy: | ||
| enabled: false | ||
| cert_name: tls-proxy | ||
| createCert: true # set to false if you want to use an existing certificate | ||
| # specify name of secret contain certificate if using pre-generated certificate | ||
| certSecretName: | ||
| untrustedCa: true |
There was a problem hiding this comment.
Please add documentation comments for the added untrustedCa configuration keys. I wonder if this is the best possible name for the configuration key. Please consider a better name, for example mountKeyAndCertificate etc. if that's what this is about.
There was a problem hiding this comment.
updated the description in 20ed697
charts/pulsar/values.yaml
Outdated
| # settings for generating certs for broker | ||
| broker: | ||
| enabled: false | ||
| cert_name: tls-broker | ||
| # specify name of secret contain certificate if using pre-generated certificate | ||
| certSecretName: | ||
| untrustedCa: true |
There was a problem hiding this comment.
I don't see this key Values.broker.untrustedCa being referenced in the templates.
There was a problem hiding this comment.
this comment is fixed by 736dbf8 commit
charts/pulsar/values.yaml
Outdated
| # settings for generating certs for bookies | ||
| bookie: | ||
| enabled: false | ||
| cert_name: tls-bookie | ||
| # specify name of secret contain certificate if using pre-generated certificate | ||
| certSecretName: | ||
| untrustedCa: true |
There was a problem hiding this comment.
I don't see this key Values.bookie.untrustedCa being referenced in the templates.
There was a problem hiding this comment.
this comment is fixed by 736dbf8 commit
charts/pulsar/values.yaml
Outdated
| # settings for generating certs for zookeeper | ||
| zookeeper: | ||
| enabled: false | ||
| cert_name: tls-zookeeper | ||
| # specify name of secret contain certificate if using pre-generated certificate | ||
| certSecretName: | ||
| untrustedCa: true |
There was a problem hiding this comment.
I don't see this key Values.zookeeper.untrustedCa being referenced in the templates.
There was a problem hiding this comment.
this comment is fixed by 736dbf8 commit
charts/pulsar/values.yaml
Outdated
| # settings for generating certs for recovery | ||
| autorecovery: | ||
| cert_name: tls-recovery | ||
| # specify name of secret contain certificate if using pre-generated certificate | ||
| certSecretName: | ||
| untrustedCa: true |
There was a problem hiding this comment.
I don't see this key Values.autorecovery.untrustedCa being referenced in the templates.
There was a problem hiding this comment.
this comment is fixed by 736dbf8 commit
charts/pulsar/values.yaml
Outdated
| # settings for generating certs for toolset | ||
| toolset: | ||
| cert_name: tls-toolset | ||
| # specify name of secret contain certificate if using pre-generated certificate | ||
| certSecretName: | ||
| untrustedCa: true |
There was a problem hiding this comment.
I don't see this key Values.toolset.untrustedCa being referenced in the templates.
There was a problem hiding this comment.
this comment is fixed by 736dbf8 commit
Signed-off-by: ericsyh <ericshenyuhao@outlook.com>
Signed-off-by: ericsyh <ericshenyuhao@outlook.com>
Signed-off-by: ericsyh <ericshenyuhao@outlook.com>
Signed-off-by: ericsyh <ericshenyuhao@outlook.com>
Fixes #
Motivation
To support the scenario that users have pre-generated tls certificates. Case like users have existing certificate secrets created by cert-manager or by manual, with this PR we can allow the zk, bk, broker, proxy and toolset to use the pre-generated secrets.
Modifications
In the values, we add several new fields:
tls.common.caSecretName: the pre-generated ca certificate, only used when theuntrustedCaequalstruetls.component.certSecretName: the pre-generated tls certificate for each component.tls.component.untrustedCa: untrustedCa means the selfsigned, and will require the caSecret.Verifying this change