Skip to content

Commit 0666f3a

Browse files
John ZakrzewskiJohn Zakrzewski
John Zakrzewski
authored and
John Zakrzewski
committed
feat: adding configurations for grpc
Signed-off-by: John Zakrzewski <[email protected]>
1 parent 63e99e2 commit 0666f3a

File tree

12 files changed

+112
-38
lines changed

12 files changed

+112
-38
lines changed

‎chart/Chart.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,11 +48,6 @@ dependencies:
4848
version: 4.2.0
4949
repository: https://openebs.github.io/dynamic-localpv-provisioner
5050
condition: localpv-provisioner.enabled
51-
- name: cert-manager
52-
version: v1.12.10
53-
repository: https://charts.jetstack.io
54-
alias: cert-manager
55-
condition: cert-manager.enabled
5651
annotations:
5752
helm.sh/images: |
5853
- name: bats

‎chart/README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,6 @@ This removes all the Kubernetes components associated with the chart and deletes
5656
|------------|------|---------|
5757
| | crds | 0.0.0 |
5858
| https://charts.bitnami.com/bitnami | etcd | 8.6.0 |
59-
| https://charts.jetstack.io | cert-manager(cert-manager) | v1.17.0 |
6059
| https://grafana.github.io/helm-charts | loki-stack | 2.9.11 |
6160
| https://jaegertracing.github.io/helm-charts | jaeger-operator | 2.50.1 |
6261
| https://nats-io.github.io/k8s/helm/charts/ | nats | 0.19.14 |
@@ -120,7 +119,7 @@ This removes all the Kubernetes components associated with the chart and deletes
120119
| base.&ZeroWidthSpace;logging.&ZeroWidthSpace;format | Valid values for format are pretty, json and compact | `"pretty"` |
121120
| base.&ZeroWidthSpace;logging.&ZeroWidthSpace;silenceLevel | Silence specific module components | `nil` |
122121
| base.&ZeroWidthSpace;metrics.&ZeroWidthSpace;enabled | Enable the metrics exporter | `true` |
123-
| cert-manager.&ZeroWidthSpace;enabled | Enable cert-manager only if tls is enabled | `true` |
122+
| cert-manager.&ZeroWidthSpace;enabled | Enable cert-manager only if tls is enabled | `false` |
124123
| crds.&ZeroWidthSpace;csi.&ZeroWidthSpace;volumeSnapshots.&ZeroWidthSpace;enabled | Install Volume Snapshot CRDs | `true` |
125124
| crds.&ZeroWidthSpace;enabled | Disables the installation of all CRDs if set to false | `true` |
126125
| csi.&ZeroWidthSpace;controller.&ZeroWidthSpace;logLevel | Log level for the csi controller | `"info"` |

‎chart/templates/hooks/wait-for-cert-manager.yaml‎

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,45 @@ spec:
106106
issuerRef:
107107
name: ca-issuer
108108
kind: Issuer
109-
secretName: api-rest-tls
109+
secretName: rest-api-server-cert
110+
EOF
111+
echo "Creating core-agent-server certificate..."
112+
kubectl apply -f - <<EOF
113+
apiVersion: cert-manager.io/v1
114+
kind: Certificate
115+
metadata:
116+
name: agent-core-server
117+
namespace: {{ .Release.Namespace }}
118+
spec:
119+
duration: 175200h
120+
isCA: false
121+
dnsNames:
122+
- {{ .Release.Name }}-agent-core.{{ .Release.Namespace }}.svc
123+
- {{ .Release.Name }}-agent-core.{{ .Release.Namespace }}.svc.cluster.local
124+
- {{ .Release.Name }}-agent-core
125+
issuerRef:
126+
name: ca-issuer
127+
kind: Issuer
128+
secretName: agent-core-server-cert
129+
EOF
130+
echo "Creating io-engine-server certificate..."
131+
kubectl apply -f - <<EOF
132+
apiVersion: cert-manager.io/v1
133+
kind: Certificate
134+
metadata:
135+
name: io-engine-server
136+
namespace: {{ .Release.Namespace }}
137+
spec:
138+
duration: 175200h
139+
isCA: false
140+
dnsNames:
141+
- {{ .Release.Name }}-io-engine.{{ .Release.Namespace }}.svc
142+
- {{ .Release.Name }}-io-engine.{{ .Release.Namespace }}.svc.cluster.local
143+
- {{ .Release.Name }}-io-engine
144+
issuerRef:
145+
name: ca-issuer
146+
kind: Issuer
147+
secretName: io-engine-server-cert
110148
EOF
111149
restartPolicy: OnFailure
112150
{{- end }}

‎chart/templates/mayastor/agents/core/agent-core-deployment.yaml‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,11 @@ spec:
6969
- "--max-rebuilds={{ .Values.agents.core.rebuild.maxConcurrent }}"{{ end }}
7070
{{- if eq ((.Values.agents.core.rebuild).partial).enabled false }}
7171
- "--disable-partial-rebuild"{{ end }}
72+
{{- if .Values.tls.enabled }}
73+
- --tls-server-cert-path=/etc/cert/tls.crt
74+
- --tls-server-key-path=/etc/cert/tls.key
75+
- --tls-client-ca-path=/etc/client_cert/ca.crt # CA cert for client verification with io-engine
76+
{{- end }}
7277
ports:
7378
- containerPort: 50051
7479
env:
@@ -86,6 +91,16 @@ spec:
8691
valueFrom:
8792
fieldRef:
8893
fieldPath: metadata.namespace
94+
{{- if .Values.tls.enabled }}
95+
volumeMounts:
96+
- name: agent-core-server-cert
97+
mountPath: /etc/cert
98+
readOnly: true
99+
- name: ca-cert
100+
mountPath: /etc/client_cert/ca.crt
101+
subPath: ca.crt
102+
readOnly: true
103+
{{- end }}
89104
- name: agent-ha-cluster
90105
resources:
91106
limits:
@@ -99,7 +114,12 @@ spec:
99114
args:
100115
- "-g=[::]:50052"
101116
- "--store=http://{{ include "etcdUrl" . }}"
102-
- "--core-grpc=https://{{ .Release.Name }}-agent-core:50051"{{ if .Values.base.jaeger.enabled }}
117+
{{- if .Values.tls.enabled }}
118+
- "--core-grpc=https://{{ .Release.Name }}-agent-core:50051"
119+
{{- else }}
120+
- "--core-grpc=http://{{ .Release.Name }}-agent-core:50051"
121+
{{- end }}
122+
{{ if .Values.base.jaeger.enabled }}
103123
- "--jaeger={{ include "jaeger_url" . }}"{{ end }}{{ if .Values.eventing.enabled }}
104124
- "--events-url=nats://{{ .Release.Name }}-nats:4222"{{ end }}
105125
- "--ansi-colors={{ .Values.base.logging.color }}"
@@ -121,3 +141,13 @@ spec:
121141
valueFrom:
122142
fieldRef:
123143
fieldPath: metadata.namespace
144+
{{- if .Values.tls.enabled }}
145+
volumes:
146+
- name: agent-core-server-cert
147+
secret:
148+
secretName: agent-core-server-cert
149+
- name: ca-cert
150+
secret:
151+
defaultMode: 420
152+
secretName: ca-root-cert
153+
{{- end }}

‎chart/templates/mayastor/apis/api-rest-deployment.yaml‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,11 @@ spec:
4949
- "--http=[::]:8081"
5050
- "--request-timeout={{ .Values.base.default_req_timeout }}"{{ if .Values.base.jaeger.enabled }}
5151
- "--jaeger={{ include "jaeger_url" . }}"{{ end }}
52+
{{- if .Values.tls.enabled }}
5253
- "--core-grpc=https://{{ .Release.Name }}-agent-core:50051"
54+
{{- else }}
55+
- "--core-grpc=http://{{ .Release.Name }}-agent-core:50051"
56+
{{- end }}
5357
- "--ansi-colors={{ .Values.base.logging.color }}"
5458
- "--fmt-style={{ include "logFormat" . }}"
5559
{{- if .Values.apis.rest.healthProbes.readiness.enabled }}
@@ -60,16 +64,11 @@ spec:
6064
{{- else }}
6165
- --cert-file=/etc/tls/tls.crt
6266
- --key-file=/etc/tls/tls.key
63-
# - --tls-client-ca-path=/etc/client_cert/ca.crt # CA cert for client verification with core-agent
67+
- --tls-client-ca-path=/etc/tls/ca.crt # CA cert for client verification with core-agent
6468
volumeMounts:
6569
- name: certs
6670
mountPath: /etc/tls
6771
readOnly: true
68-
# - name: ca-cert
69-
# mountPath: /etc/client_cert/ca.crt
70-
# subPath: ca.crt
71-
# readOnly: true
72-
7372
{{- end }}
7473
ports:
7574
- containerPort: 8080
@@ -105,9 +104,5 @@ spec:
105104
volumes:
106105
- name: certs
107106
secret:
108-
secretName: api-rest-tls
109-
# - name: ca-cert
110-
# secret:
111-
# defaultMode: 420
112-
# secretName: agent-core-server-cert
107+
secretName: rest-api-server-cert
113108
{{- end }}

‎chart/templates/mayastor/csi/csi-controller-deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,5 +155,5 @@ spec:
155155
- name: ca-cert
156156
secret:
157157
defaultMode: 420
158-
secretName: api-rest-tls
158+
secretName: ca-root-cert
159159
{{- end }}

‎chart/templates/mayastor/csi/csi-node-daemonset.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -107,10 +107,10 @@ spec:
107107
- "--fmt-style={{ include "logFormat" . }}"
108108
- "--ansi-colors={{ .Values.base.logging.color }}"
109109
{{- if .Values.tls.enabled }}
110-
- "--endpoint=https://{{ .Release.Name }}-api-rest:8080"
110+
- "--rest-endpoint=https://{{ .Release.Name }}-api-rest:8080"
111111
- "--tls-client-ca-path=/etc/client_cert/ca.crt" # CA cert for client verification with rest
112112
{{- else }}
113-
- "--endpoint=http://{{ .Release.Name }}-api-rest:8081"
113+
- "--rest-endpoint=http://{{ .Release.Name }}-api-rest:8081"
114114
{{- end }}
115115
command:
116116
- csi-node
@@ -191,5 +191,5 @@ spec:
191191
- name: ca-cert
192192
secret:
193193
defaultMode: 420
194-
secretName: api-rest-tls
194+
secretName: ca-root-cert
195195
{{- end }}

‎chart/templates/mayastor/io/io-engine-daemonset.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,11 @@ spec:
100100
# If you use 2 CPUs, the CPU: field should also read 2.
101101
- "--grpc-ip=$(MY_POD_IP)"
102102
- "-N$(MY_NODE_NAME)"
103+
{{- if .Values.tls.enabled }}
103104
- "-Rhttps://{{ .Release.Name }}-agent-core:50051"
105+
{{- else }}
106+
- "-Rhttp://{{ .Release.Name }}-agent-core:50051"
107+
{{- end }}
104108
- "-y/var/local/{{ .Release.Name }}/io-engine/config.yaml"
105109
- "-l{{ include "cpuFlag" . }}"
106110
- "-p={{ include "etcdUrl" . }}"{{ if .Values.io_engine.target.nvmf.ptpl }}
@@ -113,6 +117,11 @@ spec:
113117
- "--tgt-crdt={{ .Values.io_engine.target.nvmf.hostCmdRetryDelay.crdt1 }}"{{ if .Values.eventing.enabled }}
114118
- "--events-url=nats://{{ .Release.Name }}-nats:4222"{{ end }}
115119
- "--ps-retries={{ default 300 .Values.io_engine.pstorRetries }}"
120+
{{- if .Values.tls.enabled }}
121+
- "--tls-server-key-path=/etc/server_cert/tls.key"
122+
- "--tls-server-cert-path=/etc/server_cert/tls.crt"
123+
- "--tls-client-ca-path=/etc/cert/ca.crt"
124+
{{- end }}
116125
command:
117126
- io-engine
118127
securityContext:
@@ -128,6 +137,14 @@ spec:
128137
mountPath: /var/local/{{ .Release.Name }}/io-engine/
129138
- name: hugepage
130139
mountPath: /dev/hugepages
140+
{{- if .Values.tls.enabled }}
141+
- name: io-engine-server-cert
142+
mountPath: "/etc/server_cert/"
143+
readOnly: true
144+
- name: ca-cert
145+
mountPath: "/etc/cert"
146+
readOnly: true
147+
{{- end }}
131148
resources:
132149
limits:
133150
cpu: {{ .Values.io_engine.resources.limits.cpu | default (include "coreCount" .) | quote }}
@@ -161,3 +178,11 @@ spec:
161178
hostPath:
162179
path: /var/local/{{ .Release.Name }}/io-engine/
163180
type: DirectoryOrCreate
181+
{{- if .Values.tls.enabled }}
182+
- name: io-engine-server-cert
183+
secret:
184+
secretName: io-engine-server-cert
185+
- name: ca-cert
186+
secret:
187+
secretName: ca-root-cert
188+
{{- end }}

‎chart/templates/mayastor/obs/obs-callhome-deployment.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,6 @@ spec:
100100
- name: ca-cert
101101
secret:
102102
defaultMode: 420
103-
secretName: api-rest-tls
103+
secretName: ca-root-cert
104104
{{- end }}
105105
{{- end }}

‎chart/templates/mayastor/operators/operator-diskpool-deployment.yaml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -75,17 +75,9 @@ spec:
7575
mountPath: /etc/client_cert/ca.crt
7676
subPath: ca.crt
7777
readOnly: true
78-
# - name: agent-ca-cert
79-
# mountPath: /etc/client_cert/agent-ca.crt
80-
# subPath: agent-ca.crt
81-
# readOnly: true
8278
volumes:
8379
- name: ca-cert
8480
secret:
8581
defaultMode: 420
86-
secretName: api-rest-tls
87-
# - name: agent-ca-cert
88-
# secret:
89-
# defaultMode: 420
90-
# secretName: agent-core-server-cert
82+
secretName: ca-root-cert
9183
{{- end}}

0 commit comments

Comments
 (0)