Skip to content

Commit e76be29

Browse files
ArnobKumarSahaArnobKumarSaha
authored
Rename secrets for gw to avoid conflict (#1247)
Signed-off-by: Arnob kumar saha <arnob@appscode.com>
1 parent 30b1795 commit e76be29

31 files changed

Lines changed: 155 additions & 104 deletions

‎charts/ace-installer/resourcetemplates/helmreleases/ace/ace.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ spec:
3636
namespace: {{ $.Release.Namespace }}
3737
{{- if and (dig "catalog-manager" "enabled" false $.Values.helm.releases) (dig "service-gateway-presets" "enabled" false $.Values.helm.releases) }}
3838
- name: ace
39-
namespace: ace-gw
39+
namespace: ace
4040
{{- end }}
4141
chart:
4242
spec:

‎charts/ace-installer/templates/featuresets/saas-core/service-gateway-presets.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ spec:
1818
interval: 5m
1919
timeout: 30m
2020
releaseName: service-gateway-presets
21-
targetNamespace: ace-gw
22-
storageNamespace: ace-gw
21+
targetNamespace: ace
22+
storageNamespace: ace
2323
install:
2424
createNamespace: {{ $.Values.helm.createNamespace }}
2525
remediation:

‎charts/ace/templates/_helpers.tpl‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,25 @@ Determine database host name
209209
{{- end -}}
210210
{{- end -}}
211211

212+
{{/*
213+
Gateway-native FQDN for the ace deployment.
214+
Only used during the ingress→gateway migration window so
215+
phase-2 testers can hit the gateway directly while ingress still owns the main host.
216+
*/}}
217+
{{- define "ace.gateway.fqdn" -}}
218+
{{- printf "ace.ace.%s" .Values.global.platform.host -}}
219+
{{- end }}
220+
221+
{{/*
222+
True iff both ingress and gateway are enabled — i.e. the chart is rendered for
223+
ingress→gateway migration phase 2. Used to gate the inclusion of the gateway-native
224+
FQDN in cert SANs and HTTPRoute hostnames; new gateway-only deployments and
225+
ingress-only deployments do not need it.
226+
*/}}
227+
{{- define "ace.gateway.migrationActive" -}}
228+
{{- and (index .Values "ingress-nginx" "enabled") (index .Values "gateway" "enabled") -}}
229+
{{- end }}
230+
212231
{{/*
213232
Returns whether the OpenShift distribution is used
214233
*/}}

‎charts/ace/templates/cleaner/job.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ spec:
4040
kubectl delete jobs -n {{ .Release.Namespace }} --selector app.kubernetes.io/instance=ace || true ; \
4141
kubectl delete cert -n {{ .Release.Namespace }} {{ include "ace.fullname" . }} || true ; \
4242
kubectl delete secret -n {{ .Release.Namespace }} {{ include "ace.fullname" . }}-cert || true
43+
kubectl delete secret -n {{ .Release.Namespace }} {{ include "ace.fullname" . }}-gw-cert || true
4344
resources:
4445
{{- toYaml .Values.resources | nindent 12 }}
4546
{{- with .Values.nodeSelector }}

‎charts/ace/templates/gateway/cert-secret-ingress.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{{ if and (index .Values "gateway" "enabled") (index .Values "ingress-nginx" "enabled") }}
2+
3+
{{- $secretName := printf "%s-cert" (include "ace.fullname" .) }}
4+
{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName }}
5+
{{- if $existing }}
6+
apiVersion: v1
7+
kind: Secret
8+
metadata:
9+
name: {{ include "ace.fullname" . }}-ingress-cert
10+
namespace: {{ .Release.Namespace }}
11+
type: kubernetes.io/tls
12+
data:
13+
tls.crt: {{ index $existing.data "tls.crt" }}
14+
tls.key: {{ index $existing.data "tls.key" }}
15+
{{- end }}
16+
17+
{{- end }}

‎charts/ace/templates/gateway/gateway.yaml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@ metadata:
99
spec:
1010
gatewayClassName: ace
1111
listeners:
12+
- name: http
13+
protocol: HTTP
14+
port: 80
15+
allowedRoutes:
16+
namespaces:
17+
from: Same
1218
- name: https
1319
protocol: HTTPS
1420
port: 443
@@ -17,8 +23,16 @@ spec:
1723
certificateRefs:
1824
- group: ""
1925
kind: Secret
20-
name: {{ include "ace.fullname" . }}-cert
26+
name: {{ include "ace.fullname" . }}-gw-cert
2127
namespace: {{ .Release.Namespace }}
28+
{{- $secretName := printf "%s-ingress-cert" (include "ace.fullname" .) }}
29+
{{- $existing := lookup "v1" "Secret" .Release.Namespace $secretName }}
30+
{{- if $existing }}
31+
- group: ""
32+
kind: Secret
33+
name: {{ include "ace.fullname" . }}-ingress-cert
34+
namespace: {{ .Release.Namespace }}
35+
{{- end }}
2236
allowedRoutes:
2337
namespaces:
2438
from: Same

‎charts/ace/templates/gateway/route-home.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ spec:
1919
{{- if eq .Values.global.platform.hostType "domain" }}
2020
hostnames:
2121
- {{ .Values.global.platform.host }}
22+
{{- if eq (include "ace.gateway.migrationActive" .) "true" }}
23+
- {{ include "ace.gateway.fqdn" . }}
24+
{{- end }}
2225
{{- end }}
2326
rules:
2427
- matches:

‎charts/ace/templates/gateway/route-http-redirect.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
{{- if (index .Values "gateway" "enabled") }}
2+
3+
apiVersion: gateway.networking.k8s.io/v1
4+
kind: HTTPRoute
5+
metadata:
6+
name: {{ include "ace.fullname" . }}-http-redirect
7+
namespace: {{ .Release.Namespace }}
8+
{{- with .Values.gateway.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
spec:
13+
parentRefs:
14+
- group: gateway.networking.k8s.io
15+
kind: Gateway
16+
name: {{ include "ace.fullname" . }}
17+
namespace: {{ .Release.Namespace }}
18+
sectionName: http
19+
rules:
20+
- filters:
21+
- type: RequestRedirect
22+
requestRedirect:
23+
scheme: https
24+
statusCode: 301
25+
{{- end }}

‎charts/ace/templates/gateway/route-main.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ spec:
1919
{{- if eq .Values.global.platform.hostType "domain" }}
2020
hostnames:
2121
- {{ .Values.global.platform.host }}
22+
{{- if eq (include "ace.gateway.migrationActive" .) "true" }}
23+
- {{ include "ace.gateway.fqdn" . }}
24+
{{- end }}
2225
{{- end }}
2326
rules:
2427
- matches:

‎charts/ace/templates/gateway/route-nats.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,9 @@ spec:
1919
{{- if eq .Values.global.platform.hostType "domain" }}
2020
hostnames:
2121
- {{ .Values.global.platform.host }}
22+
{{- if eq (include "ace.gateway.migrationActive" .) "true" }}
23+
- {{ include "ace.gateway.fqdn" . }}
24+
{{- end }}
2225
{{- end }}
2326
rules:
2427
- matches:
@@ -53,7 +56,7 @@ spec:
5356
caCertificateRefs:
5457
- group: ""
5558
kind: Secret
56-
name: {{ include "ace.fullname" . }}-cert
59+
name: {{ include "ace.fullname" . }}-gw-cert
5760
{{ if eq (index .Values "global" "platform" "hostType") "ip" }}
5861
hostname: {{ include "ace.fullname" . }}-nats
5962
{{- else }}
@@ -73,10 +76,6 @@ spec:
7376
name: {{ include "ace.fullname" . }}
7477
namespace: {{ .Release.Namespace }}
7578
sectionName: nats-tcp
76-
{{- if eq .Values.global.platform.hostType "domain" }}
77-
hostnames:
78-
- {{ .Values.global.platform.host }}
79-
{{- end }}
8079
rules:
8180
- backendRefs:
8281
- group: ""

0 commit comments

Comments
 (0)