Skip to content

Commit

Permalink
feat(certgen): add flag for certificate overwrite
Browse files Browse the repository at this point in the history 
Signed-off-by: Guy Daich <guy.daich@sap.com>
  • Loading branch information
@guydc
guydc committed Jan 13, 2025
1 parent 00ed0b8 commit 8ed7638
Show file tree
Hide file tree
Showing 7 changed files with 19 additions and 4 deletions.
2 changes: 1 addition & 1 deletion charts/gateway-helm/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ To uninstall the chart:

| Key | Type | Default | Description |
|-----|------|---------|-------------|
| certgen | object | `{"job":{"affinity":{},"annotations":{},"nodeSelector":{},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
| certgen | object | `{"job":{"affinity":{},"annotations":{},"command":[],"nodeSelector":{},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
| config.envoyGateway.gateway.controllerName | string | `"gateway.envoyproxy.io/gatewayclass-controller"` | |
| config.envoyGateway.logging.level.default | string | `"info"` | |
| config.envoyGateway.provider.type | string | `"Kubernetes"` | |
Expand Down
4 changes: 4 additions & 0 deletions charts/gateway-helm/templates/certgen.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,12 @@ spec:
spec:
containers:
- command:
{{- if .Values.certgen.job.command }}
{{- toYaml .Values.certgen.job.command | nindent 8 }}
{{- else }}
- envoy-gateway
- certgen
{{- end }}
env:
- name: ENVOY_GATEWAY_NAMESPACE
valueFrom:
Expand Down
1 change: 1 addition & 0 deletions charts/gateway-helm/values.tmpl.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ kubernetesClusterDomain: cluster.local
certgen:
job:
annotations: {}
command: []
resources: {}
affinity: {}
tolerations: []
Expand Down
11 changes: 10 additions & 1 deletion internal/cmd/certgen.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ import (
"path"

"github.com/spf13/cobra"
"k8s.io/utils/ptr"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
clicfg "sigs.k8s.io/controller-runtime/pkg/client/config"
Expand All @@ -23,6 +24,9 @@ import (
"github.com/envoyproxy/gateway/internal/utils/file"
)

// cfgPath is the path to the EnvoyGateway configuration file.
var overwriteControlPlaneCerts bool

// TODO: make this path configurable or use server config directly.
const defaultLocalCertPath = "/tmp/envoy-gateway/certs"

Expand All @@ -40,7 +44,8 @@ func getCertGenCommand() *cobra.Command {

cmd.PersistentFlags().BoolVarP(&local, "local", "l", false,
"Generate all the certificates locally.")

cmd.PersistentFlags().BoolVarP(&overwriteControlPlaneCerts, "overwrite", "o", false,
"updates the secrets containing the control plane certs.")
return cmd
}

Expand All @@ -52,6 +57,10 @@ func certGen(local bool) error {
}
log := cfg.Logger

if overwriteControlPlaneCerts {
cfg.EnvoyGateway.Provider.Kubernetes.OverwriteControlPlaneCerts = ptr.To(true)
}

Check warning on line 62 in internal/cmd/certgen.go

View check run for this annotation

Codecov / codecov/patch

internal/cmd/certgen.go#L60-L62 

Added lines #L60 - L62 were not covered by tests

certs, err := crypto.GenerateCerts(cfg)
if err != nil {
return fmt.Errorf("failed to generate certificates: %w", err)
Expand Down
1 change: 1 addition & 0 deletions release-notes/current.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ bug fixes: |
Fixed a nil pointer error that occurs when a SecurityPolicy refers to a UDS backend
Fixed the Gateway API translator didn't use the TLS configuration from the BackendTLSPolicy when connecting to the OIDC provider's well-known endpoint.
Fixed a validation failure when multiple HTTPRoutes refer to the same extension filter
Fixed the ability to overwrite control plane certs with the certgen command by using a new command flag (-o).
# Enhancements that improve performance.
performance improvements: |
Expand Down
2 changes: 1 addition & 1 deletion site/content/en/latest/install/gateway-helm-api.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ The Helm chart for Envoy Gateway

| Key | Type | Default | Description |
|-----|------|---------|-------------|
| certgen | object | `{"job":{"affinity":{},"annotations":{},"nodeSelector":{},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
| certgen | object | `{"job":{"affinity":{},"annotations":{},"command":[],"nodeSelector":{},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
| config.envoyGateway.gateway.controllerName | string | `"gateway.envoyproxy.io/gatewayclass-controller"` | |
| config.envoyGateway.logging.level.default | string | `"info"` | |
| config.envoyGateway.provider.type | string | `"Kubernetes"` | |
Expand Down
2 changes: 1 addition & 1 deletion site/content/zh/latest/install/gateway-helm-api.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ The Helm chart for Envoy Gateway

| Key | Type | Default | Description |
|-----|------|---------|-------------|
| certgen | object | `{"job":{"affinity":{},"annotations":{},"nodeSelector":{},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
| certgen | object | `{"job":{"affinity":{},"annotations":{},"command":[],"nodeSelector":{},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}` | Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected. |
| config.envoyGateway.gateway.controllerName | string | `"gateway.envoyproxy.io/gatewayclass-controller"` | |
| config.envoyGateway.logging.level.default | string | `"info"` | |
| config.envoyGateway.provider.type | string | `"Kubernetes"` | |
Expand Down

0 comments on commit 8ed7638

Please sign in to comment.