Skip to content

Commit e14c95c

Browse files
chaosi-zjuchaosi-zju
committed
standardize the naming of karmada secrets in helm method
Signed-off-by: chaosi-zju <[email protected]>
1 parent 920ac89 commit e14c95c

16 files changed

+117
-195
lines changed

‎charts/karmada/templates/_helpers.tpl‎

Lines changed: 32 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -110,19 +110,47 @@ app: {{- include "karmada.name" .}}-kube-controller-manager
110110
{{- end }}
111111
{{- end -}}
112112

113+
{{- define "karmada.karmada-certs.volume" -}}
114+
- name: karmada-certs
115+
secret:
116+
secretName: karmada-certs
117+
{{- end -}}
118+
119+
{{- define "karmada.karmada-certs.volumeMount" -}}
120+
- name: karmada-certs
121+
mountPath: /etc/karmada/pki
122+
readOnly: true
123+
{{- end -}}
124+
113125
{{- define "karmada.kubeconfig.volume" -}}
114-
{{- $name := include "karmada.name" . -}}
115-
- name: kubeconfig-secret
126+
- name: karmada-kubeconfig
116127
secret:
117-
secretName: {{ $name }}-kubeconfig
128+
secretName: karmada-kubeconfig
118129
{{- end -}}
119130

120131
{{- define "karmada.kubeconfig.volumeMount" -}}
121-
- name: kubeconfig-secret
132+
- name: karmada-kubeconfig
122133
subPath: kubeconfig
123134
mountPath: /etc/kubeconfig
124135
{{- end -}}
125136

137+
{{- define "karmada.etcd-certs.volume" -}}
138+
- name: etcd-certs
139+
secret:
140+
{{- if eq .Values.etcd.mode "internal" }}
141+
secretName: karmada-certs
142+
{{- end }}
143+
{{- if eq .Values.etcd.mode "external" }}
144+
secretName: karmada-external-etcd-cert
145+
{{- end }}
146+
{{- end -}}
147+
148+
{{- define "karmada.etcd-certs.volumeMount" -}}
149+
- name: etcd-certs
150+
mountPath: /etc/etcd/pki
151+
readOnly: true
152+
{{- end -}}
153+
126154
{{- define "karmada.kubeconfig.caData" -}}
127155
{{- if eq .Values.certs.mode "auto" }}
128156
certificate-authority-data: {{ print "{{ ca_crt }}" }}
@@ -194,20 +222,6 @@ app: {{$name}}
194222
{{- end }}
195223
{{- end -}}
196224

197-
{{- define "karmada.descheduler.kubeconfig.volume" -}}
198-
{{ $name := include "karmada.name" . }}
199-
{{- if eq .Values.installMode "host" -}}
200-
- name: kubeconfig-secret
201-
secret:
202-
secretName: {{ $name }}-kubeconfig
203-
{{- else -}}
204-
- name: kubeconfig-secret
205-
secret:
206-
secretName: {{ .Values.descheduler.kubeconfig }}
207-
{{- end -}}
208-
{{- end -}}
209-
210-
211225
{{- define "karmada.webhook.labels" -}}
212226
{{ $name := include "karmada.name" .}}
213227
{{- if .Values.webhook.labels }}
@@ -318,44 +332,6 @@ app: {{- include "karmada.name" .}}-search
318332
{{- include "karmada.commonLabels" . -}}
319333
{{- end -}}
320334

321-
{{- define "karmada.search.kubeconfig.volume" -}}
322-
{{ $name := include "karmada.name" . }}
323-
{{- if eq .Values.installMode "host" -}}
324-
- name: k8s-certs
325-
secret:
326-
secretName: {{ $name }}-cert
327-
- name: kubeconfig-secret
328-
secret:
329-
secretName: {{ $name }}-kubeconfig
330-
{{- else -}}
331-
- name: k8s-certs
332-
secret:
333-
secretName: {{ .Values.search.certs }}
334-
- name: kubeconfig-secret
335-
secret:
336-
secretName: {{ .Values.search.kubeconfig }}
337-
{{- end -}}
338-
{{- end -}}
339-
340-
{{- define "karmada.search.etcd.cert.volume" -}}
341-
{{ $name := include "karmada.name" . }}
342-
- name: etcd-certs
343-
secret:
344-
{{- if eq .Values.etcd.mode "internal" }}
345-
secretName: {{ $name }}-cert
346-
{{- end }}
347-
{{- if eq .Values.etcd.mode "external" }}
348-
secretName: {{ $name }}-external-etcd-cert
349-
{{- end }}
350-
{{- end -}}
351-
352-
{{- define "karmada.scheduler.cert.volume" -}}
353-
{{ $name := include "karmada.name" . }}
354-
- name: karmada-certs
355-
secret:
356-
secretName: {{ $name }}-cert
357-
{{- end -}}
358-
359335
{{/*
360336
Return the proper karmada internal etcd image name
361337
*/}}

‎charts/karmada/templates/etcd.yaml‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ spec:
5252
command:
5353
- /bin/sh
5454
- -ec
55-
- 'etcdctl get /registry --prefix --keys-only --endpoints https://127.0.0.1:2379 --cacert /etc/kubernetes/pki/etcd/server-ca.crt --cert /etc/kubernetes/pki/etcd/karmada.crt --key /etc/kubernetes/pki/etcd/karmada.key'
55+
- 'etcdctl get /registry --prefix --keys-only --endpoints https://127.0.0.1:2379 --cacert /etc/karmada/pki/ca.crt --cert /etc/karmada/pki/karmada.crt --key /etc/karmada/pki/karmada.key'
5656
failureThreshold: 3
5757
initialDelaySeconds: 600
5858
periodSeconds: 60
@@ -73,11 +73,9 @@ spec:
7373
resources:
7474
{{- toYaml .Values.etcd.internal.resources | nindent 12 }}
7575
volumeMounts:
76+
{{- include "karmada.karmada-certs.volumeMount" . | nindent 12 }}
7677
- mountPath: /var/lib/etcd
7778
name: etcd-data
78-
- name: etcd-cert
79-
mountPath: /etc/kubernetes/pki/etcd
80-
readOnly: true
8179
command:
8280
- /usr/local/bin/etcd
8381
- --name
@@ -92,19 +90,17 @@ spec:
9290
- {{ include "etcd.initial.clusters" . }}
9391
- --initial-cluster-state
9492
- new
95-
- --cert-file=/etc/kubernetes/pki/etcd/karmada.crt
93+
- --cert-file=/etc/karmada/pki/karmada.crt
9694
- --client-cert-auth=true
97-
- --key-file=/etc/kubernetes/pki/etcd/karmada.key
98-
- --trusted-ca-file=/etc/kubernetes/pki/etcd/server-ca.crt
95+
- --key-file=/etc/karmada/pki/karmada.key
96+
- --trusted-ca-file=/etc/karmada/pki/ca.crt
9997
- --data-dir=/var/lib/etcd
10098
# Setting Golang's secure cipher suites as etcd's cipher suites.
10199
# They are obtained by the return value of the function CipherSuites() under the go/src/crypto/tls/cipher_suites.go package.
102100
# Consistent with the Preferred values of k8s’s default cipher suites.
103101
- --cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
104102
volumes:
105-
- name: etcd-cert
106-
secret:
107-
secretName: {{ include "karmada.name" . }}-cert
103+
{{- include "karmada.karmada-certs.volume" . | nindent 8 }}
108104
{{- if eq .Values.etcd.internal.storageType "hostPath" }}
109105
- hostPath:
110106
path: /var/lib/{{ include "karmada.namespace" . }}/karmada-etcd

‎charts/karmada/templates/karmada-agent.yaml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ subjects:
3333
apiVersion: v1
3434
kind: Secret
3535
metadata:
36-
name: {{ $name }}-kubeconfig
36+
name: karmada-kubeconfig
3737
namespace: {{ include "karmada.namespace" . }}
3838
stringData:
3939
kubeconfig: |-
@@ -103,7 +103,7 @@ spec:
103103
imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
104104
command:
105105
- /bin/karmada-agent
106-
- --karmada-kubeconfig=/etc/kubeconfig/kubeconfig
106+
- --karmada-kubeconfig=/etc/kubeconfig
107107
- --cluster-name={{ .Values.agent.clusterName }}
108108
{{- if .Values.agent.clusterEndpoint }}
109109
- --cluster-api-endpoint={{ .Values.agent.clusterEndpoint }}
@@ -126,14 +126,15 @@ spec:
126126
name: metrics
127127
protocol: TCP
128128
volumeMounts:
129-
- name: kubeconfig
129+
- name: karmada-kubeconfig
130+
subPath: kubeconfig
130131
mountPath: /etc/kubeconfig
131132
resources:
132133
{{- toYaml .Values.agent.resources | nindent 12 }}
133134
volumes:
134-
- name: kubeconfig
135+
- name: karmada-kubeconfig
135136
secret:
136-
secretName: {{ $name }}-kubeconfig
137+
secretName: karmada-kubeconfig
137138

138139
{{ if .Values.agent.podDisruptionBudget }}
139140
---

‎charts/karmada/templates/karmada-aggregated-apiserver.yaml‎

Lines changed: 7 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,8 @@ spec:
3737
imagePullPolicy: {{ .Values.aggregatedApiServer.image.pullPolicy }}
3838
volumeMounts:
3939
{{- include "karmada.kubeconfig.volumeMount" . | nindent 12 }}
40-
- name: etcd-cert
41-
mountPath: /etc/etcd/pki
42-
readOnly: true
43-
- name: apiserver-cert
44-
mountPath: /etc/kubernetes/pki
45-
readOnly: true
40+
{{- include "karmada.karmada-certs.volumeMount" . | nindent 12 }}
41+
{{- include "karmada.etcd-certs.volumeMount" . | nindent 12 }}
4642
command:
4743
- /bin/karmada-aggregated-apiserver
4844
- --kubeconfig=/etc/kubeconfig
@@ -56,13 +52,13 @@ spec:
5652
- --etcd-prefix={{ .Values.etcd.external.registryPrefix }}
5753
{{- end }}
5854
{{- if eq .Values.etcd.mode "internal" }}
59-
- --etcd-cafile=/etc/etcd/pki/server-ca.crt
55+
- --etcd-cafile=/etc/etcd/pki/ca.crt
6056
- --etcd-certfile=/etc/etcd/pki/karmada.crt
6157
- --etcd-keyfile=/etc/etcd/pki/karmada.key
6258
- --etcd-servers=https://etcd-client.{{ include "karmada.namespace" . }}.svc.{{ .Values.clusterDomain }}:2379
6359
{{- end }}
64-
- --tls-cert-file=/etc/kubernetes/pki/karmada.crt
65-
- --tls-private-key-file=/etc/kubernetes/pki/karmada.key
60+
- --tls-cert-file=/etc/karmada/pki/karmada.crt
61+
- --tls-private-key-file=/etc/karmada/pki/karmada.key
6662
- --audit-log-path=-
6763
- --audit-log-maxage=0
6864
- --audit-log-maxbackup=0
@@ -99,17 +95,8 @@ spec:
9995
{{- end }}
10096
volumes:
10197
{{- include "karmada.kubeconfig.volume" . | nindent 8 }}
102-
- name: apiserver-cert
103-
secret:
104-
secretName: {{ $name }}-cert
105-
- name: etcd-cert
106-
secret:
107-
{{- if eq .Values.etcd.mode "internal" }}
108-
secretName: {{ $name }}-cert
109-
{{- end }}
110-
{{- if eq .Values.etcd.mode "external" }}
111-
secretName: {{ $name }}-external-etcd-cert
112-
{{- end }}
98+
{{- include "karmada.karmada-certs.volume" . | nindent 8 }}
99+
{{- include "karmada.etcd-certs.volume" . | nindent 8 }}
113100
---
114101
apiVersion: v1
115102
kind: Service

‎charts/karmada/templates/karmada-apiserver.yaml‎

Lines changed: 15 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ spec:
3838
- kube-apiserver
3939
- --allow-privileged=true
4040
- --authorization-mode=Node,RBAC
41-
- --client-ca-file=/etc/kubernetes/pki/server-ca.crt
41+
- --client-ca-file=/etc/karmada/pki/ca.crt
4242
- --disable-admission-plugins=StorageObjectInUseProtection,ServiceAccount
4343
- --enable-bootstrap-token-auth=true
4444
{{- if eq .Values.etcd.mode "external" }}
@@ -49,30 +49,30 @@ spec:
4949
- --etcd-prefix={{ .Values.etcd.external.registryPrefix }}
5050
{{- end }}
5151
{{- if eq .Values.etcd.mode "internal" }}
52-
- --etcd-cafile=/etc/etcd/pki/server-ca.crt
52+
- --etcd-cafile=/etc/etcd/pki/ca.crt
5353
- --etcd-certfile=/etc/etcd/pki/karmada.crt
5454
- --etcd-keyfile=/etc/etcd/pki/karmada.key
5555
- --etcd-servers=https://etcd-client.{{ include "karmada.namespace" . }}.svc.{{ .Values.clusterDomain }}:2379
5656
{{- end }}
5757
- --bind-address=0.0.0.0
58-
- --kubelet-client-certificate=/etc/kubernetes/pki/karmada.crt
59-
- --kubelet-client-key=/etc/kubernetes/pki/karmada.key
58+
- --kubelet-client-certificate=/etc/karmada/pki/karmada.crt
59+
- --kubelet-client-key=/etc/karmada/pki/karmada.key
6060
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
6161
- --runtime-config=
6262
- --secure-port=5443
6363
- --service-account-issuer=https://kubernetes.default.svc.{{ .Values.clusterDomain }}
64-
- --service-account-key-file=/etc/kubernetes/pki/karmada.key
65-
- --service-account-signing-key-file=/etc/kubernetes/pki/karmada.key
64+
- --service-account-key-file=/etc/karmada/pki/karmada.key
65+
- --service-account-signing-key-file=/etc/karmada/pki/karmada.key
6666
- --service-cluster-ip-range={{ .Values.apiServer.serviceClusterIPRange }}
67-
- --proxy-client-cert-file=/etc/kubernetes/pki/front-proxy-client.crt
68-
- --proxy-client-key-file=/etc/kubernetes/pki/front-proxy-client.key
67+
- --proxy-client-cert-file=/etc/karmada/pki/front-proxy-client.crt
68+
- --proxy-client-key-file=/etc/karmada/pki/front-proxy-client.key
6969
- --requestheader-allowed-names=front-proxy-client
70-
- --requestheader-client-ca-file=/etc/kubernetes/pki/front-proxy-ca.crt
70+
- --requestheader-client-ca-file=/etc/karmada/pki/front-proxy-ca.crt
7171
- --requestheader-extra-headers-prefix=X-Remote-Extra-
7272
- --requestheader-group-headers=X-Remote-Group
7373
- --requestheader-username-headers=X-Remote-User
74-
- --tls-cert-file=/etc/kubernetes/pki/karmada.crt
75-
- --tls-private-key-file=/etc/kubernetes/pki/karmada.key
74+
- --tls-cert-file=/etc/karmada/pki/karmada.crt
75+
- --tls-private-key-file=/etc/karmada/pki/karmada.key
7676
- --max-requests-inflight={{ .Values.apiServer.maxRequestsInflight }}
7777
- --max-mutating-requests-inflight={{ .Values.apiServer.maxMutatingRequestsInflight }}
7878
- --tls-min-version=VersionTLS13
@@ -105,12 +105,8 @@ spec:
105105
terminationMessagePath: /dev/termination-log
106106
terminationMessagePolicy: File
107107
volumeMounts:
108-
- name: apiserver-cert
109-
mountPath: /etc/kubernetes/pki
110-
readOnly: true
111-
- name: etcd-cert
112-
mountPath: /etc/etcd/pki
113-
readOnly: true
108+
{{- include "karmada.karmada-certs.volumeMount" . | nindent 12 }}
109+
{{- include "karmada.etcd-certs.volumeMount" . | nindent 12 }}
114110
{{- if .Values.apiServer.hostNetwork }}
115111
dnsPolicy: ClusterFirstWithHostNet
116112
{{- end }}
@@ -137,17 +133,8 @@ spec:
137133
{{- toYaml . | nindent 8 }}
138134
{{- end }}
139135
volumes:
140-
- name: apiserver-cert
141-
secret:
142-
secretName: {{ $name }}-cert
143-
- name: etcd-cert
144-
secret:
145-
{{- if eq .Values.etcd.mode "internal" }}
146-
secretName: {{ $name }}-cert
147-
{{- end }}
148-
{{- if eq .Values.etcd.mode "external" }}
149-
secretName: {{ $name }}-external-etcd-cert
150-
{{- end }}
136+
{{- include "karmada.karmada-certs.volume" . | nindent 8 }}
137+
{{- include "karmada.etcd-certs.volume" . | nindent 8 }}
151138
---
152139
apiVersion: v1
153140
kind: Service

‎charts/karmada/templates/karmada-cert.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,13 @@
22
apiVersion: v1
33
kind: Secret
44
metadata:
5-
name: {{ include "karmada.name" . }}-cert
5+
name: karmada-certs
66
namespace: {{ include "karmada.namespace" . }}
77
type: Opaque
88
data:
9-
server-ca.crt: |
9+
ca.crt: |
1010
{{ b64enc .Values.certs.custom.caCrt }}
11-
server-ca.key: |
11+
ca.key: |
1212
{{ b64enc .Values.certs.custom.caKey }}
1313
karmada.crt: |
1414
{{ b64enc .Values.certs.custom.crt }}
@@ -24,7 +24,7 @@ data:
2424
apiVersion: v1
2525
kind: Secret
2626
metadata:
27-
name: {{ include "karmada.name" . }}-webhook-cert
27+
name: karmada-webhook-cert
2828
namespace: {{ include "karmada.namespace" . }}
2929
type: kubernetes.io/tls
3030
data:
@@ -39,7 +39,7 @@ data:
3939
apiVersion: v1
4040
kind: Secret
4141
metadata:
42-
name: {{ include "karmada.name" . }}-external-etcd-cert
42+
name: karmada-external-etcd-cert
4343
namespace: {{ include "karmada.namespace" . }}
4444
type: Opaque
4545
data:

0 commit comments

Comments
 (0)