[Kubeapps Chart] Simplify ingress configuration for cert-manager (#740)

chart/kubeapps/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: kubeapps
-version: 0.8.0
+version: 0.9.0
 appVersion: DEVEL
 description: Kubeapps is a dashboard for your Kubernetes cluster that makes it easy to deploy and manage applications in your cluster using Helm
 icon: https://raw.githubusercontent.com/kubeapps/kubeapps/master/docs/img/logo.png

chart/kubeapps/README.md

@@ -171,15 +171,26 @@ To enable ingress integration, please set `ingress.enabled` to `true`
 
 ##### Hosts
 
-Most likely you will only want to have one hostname that maps to this Kubeapps installation, however, it is possible to have more than one host.  To facilitate this, the `ingress.hosts` object is an array.
+Most likely you will only want to have one hostname that maps to this Kubeapps installation, however, it is possible to have more than one host. To facilitate this, the `ingress.hosts` object is an array.
 
 ##### Annotations
 
 For annotations, please see [this document](https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md). Not all annotations are supported by all ingress controllers, but this document does a good job of indicating which annotation is supported by many popular ingress controllers. Annotations can be set using `ingress.annotations`.
 
 ##### TLS
 
-TLS can be configured using the `ingress.tls` object in the same format that the Kubernetes Ingress requests. Please see [this example](https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx/examples/tls) for more information.
+TLS can be configured using setting the `ingress.hosts[].tls` boolean of the corresponding hostname to true, then you can choose the TLS secret name setting `ingress.hosts[].tlsSecret`. Please see [this example](https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx/examples/tls) for more information.
+
+You can provide your own certificates using the `ingress.secrets` object. If your cluster has a [cert-manager](https://github.com/jetstack/cert-manager) add-on to automate the management and issuance of TLS certificates, set `ingress.hosts[].certManager` boolean to true to enable the corresponding annotations for cert-manager as shown in the example below:
+
+```console
+helm install --name kubeapps --namespace kubeapps bitnami/kubeapps \
+  --set ingress.enabled=true \
+  --set ingress.certManager=true \
+  --set ingress.hosts[0].name=kubeapps.custom.domain \
+  --set ingress.hosts[0].tls=true \
+  --set ingress.hosts[0].tlsSecret=kubeapps-tls
+```
 
 ## Troubleshooting
 

chart/kubeapps/templates/ingress.yaml

@@ -1,38 +1,37 @@
 {{- if .Values.ingress.enabled -}}
-{{- $fullName := include "kubeapps.fullname" . -}}
-{{- $ingressPath := .Values.ingress.path -}}
 apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
-  name: {{ $fullName }}
+  name: {{ template "kubeapps.fullname" . }}
   labels:
-    app: {{ include "kubeapps.name" . }}
-    chart: {{ include "kubeapps.chart" . }}
+    app: {{ template "kubeapps.name" . }}
+    chart: {{ template "kubeapps.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
-{{- with .Values.ingress.annotations }}
   annotations:
-{{ toYaml . | indent 4 }}
-{{- end }}
+    {{- if .Values.ingress.certManager }}
+    kubernetes.io/tls-acme: "true"
+    {{- end }}
+    {{- range $key, $value := .Values.ingress.annotations }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
 spec:
-{{- if .Values.ingress.tls }}
-  tls:
-  {{- range .Values.ingress.tls }}
-    - hosts:
-      {{- range .hosts }}
-        - {{ . | quote }}
-      {{- end }}
-      secretName: {{ .secretName }}
-  {{- end }}
-{{- end }}
   rules:
   {{- range .Values.ingress.hosts }}
-    - host: {{ . | quote }}
-      http:
-        paths:
-          - path: {{ $ingressPath }}
-            backend:
-              serviceName: {{ $fullName }}
-              servicePort: http
+  - host: {{ .name }}
+    http:
+      paths:
+      - path: {{ default "/" .path }}
+        backend:
+          serviceName: {{ template "kubeapps.fullname" $ }}
+          servicePort: http
+  {{- end }}
+  tls:
+  {{- range .Values.ingress.hosts }}
+  {{- if .tls }}
+  - hosts:
+    - {{ .name }}
+    secretName: {{ .tlsSecret }}
+  {{- end }}
   {{- end }}
 {{- end }}

chart/kubeapps/templates/tls-secrets.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.ingress.enabled }}
+{{- range .Values.ingress.secrets }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .name }}
+  labels:
+    app: {{ template "kubeapps.name" $ }}
+    chart: {{ template "kubeapps.chart" $ }}
+    release: {{ $.Release.Name }}
+    heritage: {{ $.Release.Service }}
+type: kubernetes.io/tls
+data:
+  tls.crt: {{ .certificate | b64enc }}
+  tls.key: {{ .key | b64enc }}
+{{- end }}
+{{- end }}

chart/kubeapps/values.yaml

@@ -6,16 +6,48 @@
 # The frontend service is the main reverse proxy used to access the Kubeapps UI
 # To expose Kubeapps externally either configure the ingress object below or
 # set frontend.service.type=LoadBalancer in the frontend configuration.
+# ref: http://kubernetes.io/docs/user-guide/ingress/
+#
 ingress:
+  # Set to true to enable ingress record generation
   enabled: false
-  annotations: {}
-  path: /
+
+  # Set this to true in order to add the corresponding annotations for cert-manager
+  certManager: false
+
+  # Ingress annotations done as key:value pairs
+  # For a full list of possible ingress annotations, please see
+  # ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md
+  #
+  # If certManager is set to true, annotation kubernetes.io/tls-acme: "true" will automatically be set
+  annotations:
+  #  kubernetes.io/ingress.class: nginx
+
+  # The list of hostnames to be covered with this ingress record.
+  # Most likely this will be just one host, but in the event more hosts are needed, this is an array
   hosts:
-  - kubeapps.local
-  tls: []
-  #  - secretName: chart-example-tls
-  #    hosts:
-  #      - chart-example.local
+  - name: kubeapps.local
+    path: /
+
+    # Set this to true in order to enable TLS on the ingress record
+    tls: false
+
+    ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS
+    tlsSecret: kubeapps.local-tls
+
+  secrets:
+  # If you're providing your own certificates, please use this to add the certificates as secrets
+  # key and certificate should start with -----BEGIN CERTIFICATE----- or
+  # -----BEGIN RSA PRIVATE KEY-----
+  #
+  # name should line up with a tlsSecret set further up
+  # If you're using cert-manager, this is unneeded, as it will create the secret for you if it is not set
+  #
+  # It is also possible to create and manage the certificates outside of this helm chart
+  # Please see README.md for more information
+  # - name: kubeapps.local-tls
+  #   key:
+  #   certificate:
 
 frontend:
   replicaCount: 2