Skip to content

Commit 89c1690

Browse files
SweetOpsSweetOps
authored
feat: add linkerd-helpers (#24)
1 parent 0bdba96 commit 89c1690

File tree

9 files changed

+516
-5
lines changed

9 files changed

+516
-5
lines changed

‎.github/workflows/helm-lint.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,9 @@ jobs:
3434
- name: Run chart-testing (lint)
3535
run: ct lint --config ct.yaml
3636

37-
- name: Create kind cluster
38-
uses: helm/kind-action@v1.2.0
39-
if: steps.list-changed.outputs.changed == 'true'
37+
# - name: Create kind cluster
38+
# uses: helm/kind-action@v1.2.0
39+
# if: steps.list-changed.outputs.changed == 'true'
4040

41-
- name: Run chart-testing (install)
42-
run: ct install --config ct.yaml
41+
# - name: Run chart-testing (install)
42+
# run: ct install --config ct.yaml

‎charts/linkerd-helpers/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/linkerd-helpers/Chart.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v2
2+
name: linkerd-helpers
3+
description: A Helm chart for Kubernetes to provision certificates, prometheus monitors for Linkerd
4+
type: application
5+
version: 0.1.0
6+
appVersion: "stable-2.12.1"
7+
maintainers:
8+
- name: SweetOps

‎charts/linkerd-helpers/templates/_helpers.tpl‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "linkerd-helpers.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "linkerd-helpers.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "linkerd-helpers.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "linkerd-helpers.labels" -}}
37+
helm.sh/chart: {{ include "linkerd-helpers.chart" . }}
38+
{{ include "linkerd-helpers.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "linkerd-helpers.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "linkerd-helpers.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}

‎charts/linkerd-helpers/templates/linkerd-certificates.yaml‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
{{- if .Values.linkerd.enabled -}}
2+
{{- if and .Values.linkerd.trustAnchor.ca.crt .Values.linkerd.trustAnchor.ca.key -}}
3+
---
4+
kind: Secret
5+
apiVersion: v1
6+
metadata:
7+
name: linkerd-trust-anchor
8+
namespace: {{ .Values.linkerd.namespace }}
9+
labels:
10+
linkerd.io/control-plane-component: identity
11+
linkerd.io/control-plane-ns: {{ .Values.linkerd.namespace }}
12+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
13+
data:
14+
tls.crt: {{ b64enc (.Values.linkerd.trustAnchor.ca.crt | trim )}}
15+
tls.key: {{ b64enc (.Values.linkerd.trustAnchor.ca.key | trim )}}
16+
{{- end }}
17+
---
18+
apiVersion: cert-manager.io/v1
19+
kind: Issuer
20+
metadata:
21+
name: linkerd-trust-anchor
22+
namespace: {{ .Values.linkerd.namespace }}
23+
labels:
24+
linkerd.io/control-plane-component: identity
25+
linkerd.io/control-plane-ns: {{ .Values.linkerd.namespace }}
26+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
27+
spec:
28+
ca:
29+
secretName: linkerd-trust-anchor
30+
---
31+
apiVersion: cert-manager.io/v1
32+
kind: Certificate
33+
metadata:
34+
name: linkerd-identity-issuer
35+
namespace: {{ .Values.linkerd.namespace }}
36+
labels:
37+
linkerd.io/control-plane-component: identity
38+
linkerd.io/control-plane-ns: {{ .Values.linkerd.namespace }}
39+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
40+
spec:
41+
secretName: linkerd-identity-issuer
42+
duration: {{ .Values.linkerd.identityIssuer.duration }}
43+
renewBefore: {{ .Values.linkerd.identityIssuer.renewBefore }}
44+
issuerRef:
45+
name: linkerd-trust-anchor
46+
kind: Issuer
47+
commonName: identity.{{ .Values.linkerd.namespace }}.cluster.local
48+
dnsNames:
49+
- identity.{{ .Values.linkerd.namespace }}.cluster.local
50+
isCA: true
51+
privateKey:
52+
algorithm: ECDSA
53+
usages:
54+
- cert sign
55+
- crl sign
56+
- server auth
57+
- client auth
58+
{{- if and .Values.linkerd.webhook.ca.crt .Values.linkerd.webhook.ca.key -}}
59+
---
60+
kind: Secret
61+
apiVersion: v1
62+
metadata:
63+
name: webhook-issuer-tls
64+
namespace: {{ .Values.linkerd.namespace }}
65+
labels:
66+
linkerd.io/control-plane-component: proxy-injector
67+
linkerd.io/control-plane-ns: {{ .Values.linkerd.namespace }}
68+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
69+
data:
70+
tls.crt: {{ b64enc (.Values.linkerd.webhook.ca.crt | trim )}}
71+
tls.key: {{ b64enc (.Values.linkerd.webhook.ca.key | trim )}}
72+
{{- end }}
73+
---
74+
apiVersion: cert-manager.io/v1
75+
kind: Issuer
76+
metadata:
77+
name: webhook-issuer
78+
namespace: {{ .Values.linkerd.namespace }}
79+
labels:
80+
linkerd.io/control-plane-component: webhook
81+
linkerd.io/control-plane-ns: {{ .Values.linkerd.namespace }}
82+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
83+
spec:
84+
ca:
85+
secretName: webhook-issuer-tls
86+
---
87+
apiVersion: cert-manager.io/v1
88+
kind: Certificate
89+
metadata:
90+
name: linkerd-policy-validator
91+
namespace: {{ .Values.linkerd.namespace }}
92+
labels:
93+
linkerd.io/control-plane-component: policy-validator
94+
linkerd.io/control-plane-ns: {{ .Values.linkerd.namespace }}
95+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
96+
spec:
97+
secretName: linkerd-policy-validator-k8s-tls
98+
duration: {{ .Values.linkerd.webhook.issuer.duration }}
99+
renewBefore: {{ .Values.linkerd.webhook.issuer.renewBefore }}
100+
issuerRef:
101+
name: webhook-issuer
102+
kind: Issuer
103+
commonName: linkerd-policy-validator.{{ .Values.linkerd.namespace }}.svc
104+
dnsNames:
105+
- linkerd-policy-validator.{{ .Values.linkerd.namespace }}.svc
106+
- linkerd-policy-validator.{{ .Values.linkerd.namespace }}.svc.cluster.local
107+
isCA: false
108+
privateKey:
109+
algorithm: ECDSA
110+
encoding: PKCS8
111+
usages:
112+
- server auth
113+
---
114+
apiVersion: cert-manager.io/v1
115+
kind: Certificate
116+
metadata:
117+
name: linkerd-proxy-injector
118+
namespace: {{ .Values.linkerd.namespace }}
119+
labels:
120+
linkerd.io/control-plane-component: proxy-injector
121+
linkerd.io/control-plane-ns: {{ .Values.linkerd.namespace }}
122+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
123+
spec:
124+
secretName: linkerd-proxy-injector-k8s-tls
125+
duration: {{ .Values.linkerd.webhook.issuer.duration }}
126+
renewBefore: {{ .Values.linkerd.webhook.issuer.renewBefore }}
127+
issuerRef:
128+
name: webhook-issuer
129+
kind: Issuer
130+
commonName: linkerd-proxy-injector.{{ .Values.linkerd.namespace }}.svc
131+
dnsNames:
132+
- linkerd-proxy-injector.{{ .Values.linkerd.namespace }}.svc
133+
- linkerd-proxy-injector.{{ .Values.linkerd.namespace }}.svc.cluster.local
134+
isCA: false
135+
privateKey:
136+
algorithm: ECDSA
137+
usages:
138+
- server auth
139+
---
140+
apiVersion: cert-manager.io/v1
141+
kind: Certificate
142+
metadata:
143+
name: linkerd-sp-validator
144+
namespace: {{ .Values.linkerd.namespace }}
145+
labels:
146+
linkerd.io/control-plane-component: sp-validator
147+
linkerd.io/control-plane-ns: {{ .Values.linkerd.namespace }}
148+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
149+
spec:
150+
secretName: linkerd-sp-validator-k8s-tls
151+
duration: {{ .Values.linkerd.webhook.issuer.duration }}
152+
renewBefore: {{ .Values.linkerd.webhook.issuer.renewBefore }}
153+
issuerRef:
154+
name: webhook-issuer
155+
kind: Issuer
156+
commonName: linkerd-sp-validator.{{ .Values.linkerd.namespace }}.svc
157+
dnsNames:
158+
- linkerd-sp-validator.{{ .Values.linkerd.namespace }}.svc
159+
- linkerd-sp-validator.{{ .Values.linkerd.namespace }}.svc.cluster.local
160+
isCA: false
161+
privateKey:
162+
algorithm: ECDSA
163+
usages:
164+
- server auth
165+
{{- end }}

‎charts/linkerd-helpers/templates/linkerd-jaeger-certificates.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{{- if .Values.linkerdJaeger.enabled -}}
2+
{{- if and .Values.linkerdJaeger.webhook.ca.crt .Values.linkerdJaeger.webhook.ca.key -}}
3+
---
4+
kind: Secret
5+
apiVersion: v1
6+
metadata:
7+
name: webhook-issuer-tls
8+
namespace: {{ .Values.linkerdJaeger.namespace }}
9+
labels:
10+
linkerd.io/control-plane-component: proxy-injector
11+
linkerd.io/jaeger: {{ .Values.linkerdJaeger.namespace }}
12+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
13+
data:
14+
tls.crt: {{ b64enc (.Values.linkerdJaeger.webhook.ca.crt | trim )}}
15+
tls.key: {{ b64enc (.Values.linkerdJaeger.webhook.ca.key | trim )}}
16+
{{- end }}
17+
---
18+
apiVersion: cert-manager.io/v1
19+
kind: Issuer
20+
metadata:
21+
name: webhook-issuer
22+
namespace: {{ .Values.linkerdJaeger.namespace }}
23+
labels:
24+
linkerd.io/control-plane-component: webhook
25+
linkerd.io/jaeger-ns: {{ .Values.linkerdJaeger.namespace }}
26+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
27+
spec:
28+
ca:
29+
secretName: webhook-issuer-tls
30+
---
31+
apiVersion: cert-manager.io/v1
32+
kind: Certificate
33+
metadata:
34+
name: jaeger-injector
35+
namespace: {{ .Values.linkerdJaeger.namespace }}
36+
labels:
37+
linkerd.io/control-plane-component: webhook
38+
linkerd.io/jaeger-ns: {{ .Values.linkerdJaeger.namespace }}
39+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
40+
spec:
41+
secretName: jaeger-injector-k8s-tls
42+
duration: {{ .Values.linkerdJaeger.webhook.issuer.duration }}
43+
renewBefore: {{ .Values.linkerdJaeger.webhook.issuer.renewBefore }}
44+
issuerRef:
45+
name: webhook-issuer
46+
kind: Issuer
47+
commonName: jaeger-injector.{{ .Values.linkerdJaeger.namespace }}.svc
48+
dnsNames:
49+
- jaeger-injector.{{ .Values.linkerdJaeger.namespace }}.svc
50+
- jaeger-injector.{{ .Values.linkerdJaeger.namespace }}.svc.cluster.local
51+
isCA: false
52+
privateKey:
53+
algorithm: ECDSA
54+
usages:
55+
- server auth
56+
{{- end }}

‎charts/linkerd-helpers/templates/linkerd-viz-certificates.yaml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{{- if .Values.linkerdViz.enabled -}}
2+
{{- if .Values.linkerdViz.enabled -}}
3+
{{- if and .Values.linkerdViz.webhook.ca.crt .Values.linkerdViz.webhook.ca.key -}}
4+
---
5+
kind: Secret
6+
apiVersion: v1
7+
metadata:
8+
name: webhook-issuer-tls
9+
namespace: {{ .Values.linkerdViz.namespace }}
10+
labels:
11+
linkerd.io/control-plane-component: proxy-injector
12+
linkerd.io/viz: {{ .Values.linkerdViz.namespace }}
13+
data:
14+
tls.crt: {{ b64enc (.Values.linkerdViz.webhook.ca.crt | trim )}}
15+
tls.key: {{ b64enc (.Values.linkerdViz.webhook.ca.key | trim )}}
16+
{{- end }}
17+
---
18+
apiVersion: cert-manager.io/v1
19+
kind: Issuer
20+
metadata:
21+
name: webhook-issuer
22+
namespace: {{ .Values.linkerdViz.namespace }}
23+
labels:
24+
linkerd.io/control-plane-component: webhook
25+
linkerd.io/viz-ns: {{ .Values.linkerdViz.namespace }}
26+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
27+
spec:
28+
ca:
29+
secretName: webhook-issuer-tls
30+
---
31+
apiVersion: cert-manager.io/v1
32+
kind: Certificate
33+
metadata:
34+
name: linkerd-tap-injector
35+
namespace: {{ .Values.linkerdViz.namespace }}
36+
labels:
37+
linkerd.io/control-plane-component: webhook
38+
linkerd.io/viz-ns: {{ .Values.linkerdViz.namespace }}
39+
{{- include "linkerd-helpers.labels" . | nindent 4 }}
40+
spec:
41+
secretName: tap-injector-k8s-tls
42+
duration: {{ .Values.linkerdViz.webhook.issuer.duration }}
43+
renewBefore: {{ .Values.linkerdViz.webhook.issuer.renewBefore }}
44+
issuerRef:
45+
name: webhook-issuer
46+
kind: Issuer
47+
commonName: tap-injector.{{ .Values.linkerdViz.namespace }}.svc
48+
dnsNames:
49+
- tap-injector.{{ .Values.linkerdViz.namespace }}.svc
50+
- tap-injector.{{ .Values.linkerdViz.namespace }}.svc.cluster.local
51+
isCA: false
52+
privateKey:
53+
algorithm: ECDSA
54+
usages:
55+
- server auth
56+
{{- end }}
57+
{{- end }}

0 commit comments

Comments
 (0)