Skip to content

Commit d7c5dd4

Browse files
poussapoussa
authored
Add trusted-certificate-issuer helm chart (#4)
1 parent fad24fa commit d7c5dd4

13 files changed

+618
-0
lines changed

‎charts/trusted-certificate-issuer/.helmignore

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/trusted-certificate-issuer/Chart.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v2
2+
name: tcs-issuer
3+
description: A Helm chart for Trusted Certificate Issuer
4+
home: https://github.com/intel/trusted-certificate-issuer
5+
type: application
6+
version: 0.2.0
7+
appVersion: "0.2.0"

‎charts/trusted-certificate-issuer/README.md

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Trusted Certificate Issuer Helm chart
2+
3+
Trusted Certificate Service (TCS) is a K8s service to protect signing keys using Intel's SGX technology. Kubernetes certificate signing request (CSR) and cert-manager CertificateRequest APIs are both supported.
4+
5+
This document covers how to install Trusted Certificate Service (TCS) issuer (TCI) by using Helm charts.
6+
7+
To learn more check the documentation [here](https://github.com/intel/trusted-certificate-issuer).
8+
9+
## Prerequisites
10+
11+
- Helm 3.x
12+
- Kubernetes cluster with SGX node
13+
- cert-manager Custom Resource Definitions ([CRDs](https://cert-manager.io/docs/installation/helm/#3-install-customresourcedefinitions))
14+
15+
## Installing the Chart
16+
17+
Use the following command to install TCI (to namespace `intel-system` which will be created).
18+
19+
The Intel's Helm charts repository:
20+
21+
```console
22+
$ helm repo add intel https://intel.github.io/helm-charts
23+
$ helm repo update
24+
```
25+
Install the chart:
26+
27+
> NOTE: This will also install the CRDs.
28+
29+
```console
30+
$ helm install tci intel/tcs-issuer -n intel-system --create-namespace
31+
```
32+
33+
Use the following command to verify the installation status.
34+
35+
```console
36+
$ helm ls -n intel-system
37+
```
38+
39+
## Uninstalling the Chart
40+
41+
In case you want to uninstall TCI, use the following command:
42+
43+
> NOTE: the below command does not uninstall the CRDs.
44+
45+
```console
46+
$ helm delete tci -n intel-system
47+
```
48+
49+
## Configuration
50+
51+
The following table lists the configurable parameters of the TCS issuer chart and their default values. You can change the default values either via `helm --set <parameter=value>` or editing the `values.yaml` and passing the file to helm via `helm install -f values.yaml ...` option.
52+
53+
| Parameter | Description | Default
54+
| --- | --- | --- |
55+
| `image.hub`| Image repository | intel |
56+
| `image.name`| Image name | trusted-certificate-issuer |
57+
| `image.tag`| Image tag | Chart's appVersion |
58+
| `image.pullPolicy`| Image pull policy | IfNotPresent |
59+
| `controllerExtraArgs`| List of extra arguments passed to the controller | <empty> |
60+
| `imagePullSecrets`| Array of secrets pull an image from a private container image registry or repository | <empty> |
61+
| `pkcs11.sopin`| Create service account | V0lwbUJCybc2Oc6M06Vz |
62+
| `pkcs11.userpin`| Create service account | U3BnbGIyTUl3ZV9lSHUy |
63+
| `serviceAccount.create`| Create service account | true |
64+
| `serviceAccount.annotations`| Dictionary of service account annotations | <empty> |
65+
| `serviceAccount.name`| Name of the service account | Full name of the chart |
66+
| `podAnnotations`| Dictionary of pod annotations | sgx.intel.com/quote-provider: aesmd |
67+
| `podSecurityContext`| Dictionary of pod security context settings | <empty> |
68+
| `service.type`| Service type | ClusterIP |
69+
| `service.port`| Service port | 8443 |
70+
| `resources.limits.cpu`| CPU limit | 500m |
71+
| `resources.limits.memory`| Memory limit | 100Mi |
72+
| `resources.limits.sgx.intel.com/enclave`| SGX enclave limit | 1 |
73+
| `resources.limits.sgx.intel.com/epc`| SGX epc memory limit | 512Ki |
74+
| `resources.requests.cpu`| CPU request | 100m |
75+
| `resources.requests.memory`| Memory request | 20Mi |
76+
| `resources.requests.sgx.intel.com/enclave`| SGX enclave request | 1 |
77+
| `resources.requests.sgx.intel.com/epc`| SGX epc memory request | 512Ki |
78+
| `nodeSelector`| Dictionary of node selector settings | <empty> |
79+
| `tolerations`| Array of tolerations settings | <empty> |
80+
| `affinity`| Dictionary of affinity settings | <empty> |
81+
82+

‎charts/trusted-certificate-issuer/templates/NOTES.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Thank you for installing {{ .Chart.Name }}.

‎charts/trusted-certificate-issuer/templates/_helpers.tpl

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "trusted-certificate-issuer.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "trusted-certificate-issuer.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "trusted-certificate-issuer.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "trusted-certificate-issuer.labels" -}}
37+
helm.sh/chart: {{ include "trusted-certificate-issuer.chart" . }}
38+
{{ include "trusted-certificate-issuer.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "trusted-certificate-issuer.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "trusted-certificate-issuer.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "trusted-certificate-issuer.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "trusted-certificate-issuer.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎charts/trusted-certificate-issuer/templates/deployment.yaml

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "trusted-certificate-issuer.fullname" . }}
5+
labels:
6+
{{- include "trusted-certificate-issuer.labels" . | nindent 4 }}
7+
spec:
8+
replicas: 1
9+
selector:
10+
matchLabels:
11+
{{- include "trusted-certificate-issuer.selectorLabels" . | nindent 6 }}
12+
template:
13+
metadata:
14+
{{- with .Values.podAnnotations }}
15+
annotations:
16+
{{- toYaml . | nindent 8 }}
17+
{{- end }}
18+
labels:
19+
{{- include "trusted-certificate-issuer.selectorLabels" . | nindent 8 }}
20+
spec:
21+
{{- with .Values.imagePullSecrets }}
22+
imagePullSecrets:
23+
{{- toYaml . | nindent 8 }}
24+
{{- end }}
25+
serviceAccountName: {{ include "trusted-certificate-issuer.serviceAccountName" . }}
26+
securityContext:
27+
{{- toYaml .Values.podSecurityContext | nindent 8 }}
28+
containers:
29+
- args:
30+
- --leader-elect
31+
- --zap-devel
32+
- --zap-log-level=5
33+
- --metrics-bind-address=:8082
34+
- --health-probe-bind-address=:8083
35+
- --user-pin=$USER_PIN
36+
- --so-pin=$SO_PIN
37+
- --use-random-nonce=true
38+
{{- if .Values.controllerExtraArgs }}
39+
{{- with .Values.controllerExtraArgs }}
40+
{{- tpl . $ | trim | indent 8 }}
41+
{{- end }}
42+
{{- end }}
43+
command:
44+
- /tcs-issuer
45+
env:
46+
- name: USER_PIN
47+
valueFrom:
48+
secretKeyRef:
49+
key: userpin
50+
name: tcs-issuer-pkcs11-conf
51+
- name: SO_PIN
52+
valueFrom:
53+
secretKeyRef:
54+
key: sopin
55+
name: tcs-issuer-pkcs11-conf
56+
name: {{ .Chart.Name }}
57+
securityContext:
58+
allowPrivilegeEscalation: false
59+
readOnlyRootFilesystem: true
60+
image: "{{ .Values.image.hub }}/{{ .Values.image.name }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
61+
imagePullPolicy: {{ .Values.image.pullPolicy }}
62+
ports:
63+
- name: http
64+
containerPort: 80
65+
protocol: TCP
66+
livenessProbe:
67+
httpGet:
68+
path: /healthz
69+
port: 8083
70+
initialDelaySeconds: 10
71+
periodSeconds: 180
72+
readinessProbe:
73+
httpGet:
74+
path: /readyz
75+
port: 8083
76+
initialDelaySeconds: 10
77+
periodSeconds: 5
78+
resources:
79+
{{- toYaml .Values.resources | nindent 12 }}
80+
volumeMounts:
81+
- mountPath: /home/tcs-issuer/tokens
82+
name: tokens-dir
83+
initContainers:
84+
- command:
85+
- /bin/chown
86+
- -R
87+
- 5000:5000
88+
- /home/tcs-issuer/tokens
89+
image: busybox
90+
imagePullPolicy: {{ .Values.image.pullPolicy }}
91+
name: init
92+
volumeMounts:
93+
- mountPath: /home/tcs-issuer/tokens
94+
name: tokens-dir
95+
volumes:
96+
- hostPath:
97+
path: /var/lib/tcs-issuer/tokens
98+
type: DirectoryOrCreate
99+
name: tokens-dir
100+
{{- with .Values.nodeSelector }}
101+
nodeSelector:
102+
{{- toYaml . | nindent 8 }}
103+
{{- end }}
104+
{{- with .Values.affinity }}
105+
affinity:
106+
{{- toYaml . | nindent 8 }}
107+
{{- end }}
108+
{{- with .Values.tolerations }}
109+
tolerations:
110+
{{- toYaml . | nindent 8 }}
111+
{{- end }}

0 commit comments

Comments
 (0)