Skip to content

Commit 2a6147a

Browse files
sabre1041sabre1041
committed
Changes to ctlog to update to latest and incorporation of common chart
Signed-off-by: Andrew Block <[email protected]>
1 parent b80e299 commit 2a6147a

18 files changed

+863
-696
lines changed

‎charts/ctlog/Chart.yaml

+9-4
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ description: Certificate Log
44

55
type: application
66

7-
version: 0.2.44
7+
version: 0.3.0
88
appVersion: 0.3.0
99

1010
keywords:
@@ -16,14 +16,19 @@ home: https://sigstore.dev/
1616
maintainers:
1717
- name: The Sigstore Authors
1818

19+
dependencies:
20+
- name: common
21+
version: 0.1.0
22+
repository: https://sigstore.github.io/helm-charts
23+
1924
annotations:
2025
artifacthub.io/license: Apache-2.0
2126
artifacthub.io/images: |
2227
- name: ct_server
23-
image: ghcr.io/sigstore/scaffolding/ct_server@sha256:91d23363c34ca0a8ec1fb89129815fb32f851eb8986bfbf7b2aed85c98411f04
28+
image: ghcr.io/sigstore/scaffolding/ct_server@sha256:sha256:2ea576af6b64e154b718b058cd03b74fac8399affcf93c4251ab2234704ca432
2429
- name: createctconfig
2530
image: ghcr.io/sigstore/scaffolding/createctconfig@sha256:b3dae896ddb7b01b3257c668bc1e87f15aafe97f30a767f99426f557fa33e44c
2631
- name: createtree
27-
image: ghcr.io/sigstore/scaffolding/createtree@sha256:0c6a1a49f906da6e59e7cfbba08a473778fc0296abdf8b86115861d5f3556ed4
32+
image: ghcr.io/sigstore/scaffolding/createtree@sha256:2da5284bb29e18d125e4565d47256d0ded82c3a7001b44a4d152e2475ca1166c
2833
- name: curlimages/curl
29-
image: docker.io/curlimages/curl@sha256:dca6e1b1c8e7b8b8e7be4e79fc78a858d12fd56245cb31bfa281dbf7c73a6498
34+
image: docker.io/curlimages/curl@sha256:48318407b8d98e8c7d5bd4741c88e8e1a5442de660b47f63ba656e5c910bc3da

‎charts/ctlog/README.md

+9-13
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,11 @@ Certificate Log
2323
| createctconfig.image.pullPolicy | string | `"IfNotPresent"` | |
2424
| createctconfig.image.registry | string | `"ghcr.io"` | |
2525
| createctconfig.image.repository | string | `"sigstore/scaffolding/createctconfig"` | |
26-
| createctconfig.image.version | string | `"sha256:b3dae896ddb7b01b3257c668bc1e87f15aafe97f30a767f99426f557fa33e44c"` | v0.6.3 |
26+
| createctconfig.image.version | string | `"sha256:2d8072d832370a8dbbe96536eaf479a5bf3a738c997394c888fed8ddcbe84a1b"` | v0.6.5 |
2727
| createctconfig.initContainerImage.curl.imagePullPolicy | string | `"IfNotPresent"` | |
2828
| createctconfig.initContainerImage.curl.registry | string | `"docker.io"` | |
2929
| createctconfig.initContainerImage.curl.repository | string | `"curlimages/curl"` | |
30-
| createctconfig.initContainerImage.curl.version | string | `"sha256:dca6e1b1c8e7b8b8e7be4e79fc78a858d12fd56245cb31bfa281dbf7c73a6498"` | 7.82.0 |
30+
| createctconfig.initContainerImage.curl.version | string | `"sha256:dca6e1b1c8e7b8b8e7be4e79fc78a858d12fd56245cb31bfa281dbf7c73a6498"` | 7.88.1 |
3131
| createctconfig.logPrefix | string | `"sigstorescaffolding"` | |
3232
| createctconfig.name | string | `"createctconfig"` | |
3333
| createctconfig.privateKeyPasswordSecretName | string | `""` | |
@@ -47,7 +47,7 @@ Certificate Log
4747
| createtree.image.pullPolicy | string | `"IfNotPresent"` | |
4848
| createtree.image.registry | string | `"ghcr.io"` | |
4949
| createtree.image.repository | string | `"sigstore/scaffolding/createtree"` | |
50-
| createtree.image.version | string | `"sha256:d5776d8a43632291e1c5a22a9266608db0daa0a11663445d701e327f2205974c"` | |
50+
| createtree.image.version | string | `"sha256:47206322c1d6002ffc737d94852924fae0f749aa3a64c1899eee11f502f609a6"` | |
5151
| createtree.name | string | `"createtree"` | |
5252
| createtree.securityContext.runAsNonRoot | bool | `true` | |
5353
| createtree.securityContext.runAsUser | int | `65533` | |
@@ -65,7 +65,7 @@ Certificate Log
6565
| server.image.pullPolicy | string | `"IfNotPresent"` | |
6666
| server.image.registry | string | `"ghcr.io"` | |
6767
| server.image.repository | string | `"sigstore/scaffolding/ct_server"` | |
68-
| server.image.version | string | `"sha256:7c791d3b7c15e817807f07d4cdb00406529a114702ad448ee857e1d0fc5fb5a9"` | |
68+
| server.image.version | string | `"sha256:1ef2480cf8ddb1f99da0d931283f3c55babb84d79bf36f66d7bed29985bcca7e"` | |
6969
| server.ingress.annotations | object | `{}` | |
7070
| server.ingress.className | string | `"nginx"` | |
7171
| server.ingress.enabled | bool | `false` | |
@@ -77,9 +77,10 @@ Certificate Log
7777
| server.ingresses[0].frontendConfigSpec.redirectToHttps.enabled | bool | `true` | |
7878
| server.ingresses[0].frontendConfigSpec.sslPolicy | string | `"ctlog-ssl-policy"` | |
7979
| server.ingresses[0].hosts[0].host | string | `"fulcio.localhost"` | |
80-
| server.ingresses[0].hosts[0].path | string | `"/test"` | |
81-
| server.ingresses[0].hosts[1].host | string | `"fulcio.localhost"` | |
82-
| server.ingresses[0].hosts[1].path | string | `"/other-shard"` | |
80+
| server.ingresses[0].hosts[0].paths[0].path | string | `"/test"` | |
81+
| server.ingresses[0].hosts[0].paths[0].pathType | string | `"Prefix"` | |
82+
| server.ingresses[0].hosts[0].paths[1].path | string | `"/other-shard"` | |
83+
| server.ingresses[0].hosts[0].paths[1].serviceName | string | `"other-shard"` | |
8384
| server.ingresses[0].name | string | `"gce-ingress"` | |
8485
| server.ingresses[0].staticGlobalIP | string | `"lb-ext-ip"` | |
8586
| server.ingresses[0].tls | list | `[]` | |
@@ -97,12 +98,6 @@ Certificate Log
9798
| server.replicaCount | int | `1` | |
9899
| server.securityContext.runAsNonRoot | bool | `true` | |
99100
| server.securityContext.runAsUser | int | `65533` | |
100-
| server.service.backendConfig.name | string | `"ctlog-backend-config"` | |
101-
| server.service.backendConfig.spec.healthCheck.port | int | `6962` | |
102-
| server.service.backendConfig.spec.healthCheck.requestPath | string | `"/healthz"` | |
103-
| server.service.backendConfig.spec.healthCheck.type | string | `"HTTP"` | |
104-
| server.service.backendConfig.spec.logging.enable | bool | `true` | |
105-
| server.service.backendConfig.spec.securityPolicy.name | string | `"ctlog-security-policy"` | |
106101
| server.service.ports[0].name | string | `"6962-tcp"` | |
107102
| server.service.ports[0].port | int | `80` | |
108103
| server.service.ports[0].protocol | string | `"TCP"` | |
@@ -120,3 +115,4 @@ Certificate Log
120115
| trillian.logServer.portRPC | int | `8091` | |
121116
| trillian.namespace | string | `"trillian-system"` | |
122117

118+
----------------------------------------------

‎charts/ctlog/templates/_helpers.tpl

+17-81
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,3 @@
1-
{{/*
2-
Expand the name of the chart.
3-
*/}}
4-
{{- define "ctlog.name" -}}
5-
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6-
{{- end }}
7-
8-
{{/*
9-
Create a default fully qualified app name.
10-
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11-
If release name contains chart name it will be used as a full name.
12-
*/}}
13-
{{- define "ctlog.fullname" -}}
14-
{{- if .Values.fullnameOverride }}
15-
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16-
{{- else }}
17-
{{- $name := default .Chart.Name .Values.nameOverride }}
18-
{{- if contains $name .Release.Name }}
19-
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20-
{{- else }}
21-
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22-
{{- end }}
23-
{{- end }}
24-
{{- end }}
25-
26-
{{/*
27-
Define the raw ctlog.namespace template if set with forceNamespace or .Release.Namespace is set
28-
*/}}
29-
{{- define "ctlog.rawnamespace" -}}
30-
{{- if .Values.forceNamespace -}}
31-
{{ print .Values.forceNamespace }}
32-
{{- else -}}
33-
{{ print .Release.Namespace }}
34-
{{- end -}}
35-
{{- end -}}
36-
37-
{{/*
38-
Define the ctlog.namespace template if set with forceNamespace or .Release.Namespace is set
39-
*/}}
40-
{{- define "ctlog.namespace" -}}
41-
{{ printf "namespace: %s" (include "ctlog.rawnamespace" .) }}
42-
{{- end -}}
43-
441
{{/*
452
Create a fully qualified createctconfig name.
463
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
@@ -75,32 +32,7 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
7532
{{- end -}}
7633
{{- end -}}
7734

78-
{{/*
79-
Create chart name and version as used by the chart label.
80-
*/}}
81-
{{- define "ctlog.chart" -}}
82-
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
83-
{{- end }}
84-
85-
{{/*
86-
Common labels
87-
*/}}
88-
{{- define "ctlog.labels" -}}
89-
helm.sh/chart: {{ include "ctlog.chart" . }}
90-
{{ include "ctlog.selectorLabels" . }}
91-
{{- if .Chart.AppVersion }}
92-
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
93-
{{- end }}
94-
app.kubernetes.io/managed-by: {{ .Release.Service }}
95-
{{- end }}
9635

97-
{{/*
98-
Selector labels
99-
*/}}
100-
{{- define "ctlog.selectorLabels" -}}
101-
app.kubernetes.io/name: {{ include "ctlog.name" . }}
102-
app.kubernetes.io/instance: {{ .Release.Name }}
103-
{{- end }}
10436

10537
{{/*
10638
Server Arguments
@@ -126,7 +58,7 @@ Create the name of the service account to use
12658
*/}}
12759
{{- define "ctlog.serviceAccountName" -}}
12860
{{- if .Values.server.serviceAccount.create }}
129-
{{- default (include "ctlog.fullname" .) .Values.server.serviceAccount.name }}
61+
{{- default (include "common.names.fullname" .) .Values.server.serviceAccount.name }}
13062
{{- else }}
13163
{{- default "default" .Values.server.serviceAccount.name }}
13264
{{- end }}
@@ -154,29 +86,33 @@ Create the name of the service account to use for the createtree component
15486
{{- end -}}
15587
{{- end -}}
15688

157-
{{/*
158-
Create the image path for the passed in image field
159-
*/}}
160-
{{- define "ctlog.image" -}}
161-
{{- if eq (substr 0 7 .version) "sha256:" -}}
162-
{{- printf "%s/%s@%s" .registry .repository .version -}}
163-
{{- else -}}
164-
{{- printf "%s/%s:%s" .registry .repository .version -}}
165-
{{- end -}}
166-
{{- end -}}
16789

16890
{{/*
16991
Create the name of the config
17092
*/}}
17193
{{- define "ctlog.config" -}}
172-
{{ printf "%s-config" (include "ctlog.fullname" .) }}
94+
{{ include "common.names.fullnameSuffix" (dict "suffix" "config" "context" $) }}
17395
{{- end }}
17496

17597
{{/*
17698
Create the name of the secret
17799
*/}}
178100
{{- define "ctlog.secret" -}}
179-
{{ printf "%s-secret" (include "ctlog.fullname" .) }}
101+
{{ include "common.names.fullnameSuffix" (dict "suffix" "secret" "context" $) }}
102+
{{- end }}
103+
104+
{{/*
105+
Create the name of the secret operator
106+
*/}}
107+
{{- define "ctlog.secret-operator" -}}
108+
{{ include "common.names.fullnameSuffix" (dict "suffix" "secret-operator" "context" $) }}
109+
{{- end }}
110+
111+
{{/*
112+
Create the name of the cm operator
113+
*/}}
114+
{{- define "ctlog.cm-operator" -}}
115+
{{ include "common.names.fullnameSuffix" (dict "suffix" "cm-operator" "context" $) }}
180116
{{- end }}
181117

182118
{{/*

‎charts/ctlog/templates/cm-operator-role.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
apiVersion: rbac.authorization.k8s.io/v1
22
kind: Role
33
metadata:
4-
name: {{ template "ctlog.fullname" . }}-cm-operator
5-
{{ include "ctlog.namespace" . | indent 2 }}
4+
name: {{ template "ctlog.cm-operator" . }}
5+
{{ include "common.names.namespace" . | indent 2 }}
66
labels:
7-
{{- include "ctlog.labels" . | nindent 4 }}
7+
{{- include "common.labels.labels" . | nindent 4 }}
88
rules:
99
- apiGroups: [""] # "" indicates the core API group
1010
resources: ["configmaps"]

‎charts/ctlog/templates/cm-operator-rolebinding.yaml

+5-5
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
apiVersion: rbac.authorization.k8s.io/v1
22
kind: RoleBinding
33
metadata:
4-
name: {{ template "ctlog.fullname" . }}-cm-operator
5-
{{ include "ctlog.namespace" . | indent 2 }}
4+
name: {{ template "ctlog.cm-operator" . }}
5+
{{ include "common.names.namespace" . | indent 2 }}
66
labels:
7-
{{- include "ctlog.labels" . | nindent 4 }}
7+
{{- include "common.labels.labels" . | nindent 4 }}
88
roleRef:
99
apiGroup: rbac.authorization.k8s.io
1010
kind: Role
11-
name: {{ template "ctlog.fullname" . }}-cm-operator
11+
name: {{ template "ctlog.cm-operator" . }}
1212
subjects:
1313
- kind: ServiceAccount
1414
name: {{ template "ctlog.serviceAccountName.createtree" . }}
15-
{{ include "ctlog.namespace" . | indent 4 }}
15+
{{ include "common.names.namespace" . | indent 4 }}

‎charts/ctlog/templates/createctconfig-job.yaml

+6-6
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ apiVersion: batch/v1
33
kind: Job
44
metadata:
55
name: {{ template "ctlog.createctconfig.fullname" . }}
6-
{{ include "ctlog.namespace" . | indent 2 }}
6+
{{ include "common.names.namespace" . | indent 2 }}
77
labels:
8-
{{- include "ctlog.labels" . | nindent 4 }}
8+
{{- include "common.labels.labels" . | nindent 4 }}
99
{{- if .Values.createctconfig.annotations }}
1010
annotations:
1111
{{ toYaml .Values.createctconfig.annotations | indent 4 }}
@@ -22,7 +22,7 @@ spec:
2222
automountServiceAccountToken: {{ .Values.createctconfig.serviceAccount.mountToken }}
2323
initContainers:
2424
- name: "wait-for-createtree-configmap"
25-
image: "{{ template "ctlog.image" .Values.createctconfig.initContainerImage.curl }}"
25+
image: "{{ template "common.images.image" .Values.createctconfig.initContainerImage.curl }}"
2626
imagePullPolicy: {{ .Values.createctconfig.initContainerImage.curl.imagePullPolicy }}
2727
command: ["sh", "-c", "until curl --fail --header \"Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)\" --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt --max-time 10 https://kubernetes.default.svc/api/v1/namespaces/$(NAMESPACE)/configmaps/{{ template "ctlog.config" . }} | grep '\"treeID\":'; do echo waiting for Configmap {{ template "ctlog.config" . }}; sleep 5; done;"]
2828
env:
@@ -36,19 +36,19 @@ spec:
3636
{{- end }}
3737
containers:
3838
- name: {{ template "ctlog.createctconfig.fullname" . }}
39-
image: "{{ template "ctlog.image" .Values.createctconfig.image }}"
39+
image: "{{ template "common.images.image" .Values.createctconfig.image }}"
4040
imagePullPolicy: "{{ .Values.createctconfig.image.pullPolicy }}"
4141
args: [
4242
"--configmap={{ template "ctlog.config" . }}",
43-
"--secret={{ .Values.createctconfig.secret | default (printf "%s-secret" (include "ctlog.fullname" .)) }}",
43+
"--secret={{ .Values.createctconfig.secret | default (include "ctlog.secret" .) }}",
4444
{{- if .Values.createctconfig.privateSecret }}
4545
"--private-secret={{ .Values.createctconfig.privateSecret }}",
4646
{{- end }}
4747
{{- if .Values.createctconfig.pubkeysecret }}
4848
"--pubkeysecret={{ .Values.createctconfig.pubkeysecret }}",
4949
{{- end }}
5050
"--fulcio-url={{ .Values.createctconfig.fulcioURL }}",
51-
"--trillian-server={{ .Values.trillian.logServer.name }}.{{ .Values.trillian.namespace }}:{{ .Values.trillian.logServer.portRPC}}",
51+
"--trillian-server={{ .Values.trillian.logServer.name }}.{{ .Values.trillian.namespace.name }}:{{ .Values.trillian.logServer.portRPC}}",
5252
{{- if .Values.createctconfig.privateKeyPasswordSecretName }}
5353
"--key-password=$(PRIVATE_KEY_PASSWORD)",
5454
{{- end }}

‎charts/ctlog/templates/createctconfig-serviceaccount.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ apiVersion: v1
33
kind: ServiceAccount
44
metadata:
55
name: {{ template "ctlog.serviceAccountName.createctconfig" . }}
6-
{{ include "ctlog.namespace" . | indent 2 }}
6+
{{ include "common.names.namespace" . | indent 2 }}
77
labels:
8-
{{- include "ctlog.labels" . | nindent 4 }}
8+
{{- include "common.labels.labels" . | nindent 4 }}
99
annotations:
1010
{{ toYaml .Values.createctconfig.serviceAccount.annotations | indent 4 }}
1111
{{- end }}

‎charts/ctlog/templates/createtree-job.yaml

+4-4
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ apiVersion: batch/v1
33
kind: Job
44
metadata:
55
name: {{ template "ctlog.createtree.fullname" . }}
6-
{{ include "ctlog.namespace" . | indent 2 }}
6+
{{ include "common.names.namespace" . | indent 2 }}
77
labels:
8-
{{- include "ctlog.labels" . | nindent 4 }}
8+
{{- include "common.labels.labels" . | nindent 4 }}
99
{{- if .Values.createtree.annotations }}
1010
annotations:
1111
{{ toYaml .Values.createtree.annotations | indent 4 }}
@@ -21,7 +21,7 @@ spec:
2121
automountServiceAccountToken: {{ .Values.createtree.serviceAccount.mountToken }}
2222
containers:
2323
- name: {{ template "ctlog.createtree.fullname" . }}
24-
image: "{{ template "ctlog.image" .Values.createtree.image }}"
24+
image: "{{ template "common.images.image" .Values.createtree.image }}"
2525
imagePullPolicy: "{{ .Values.createtree.image.pullPolicy }}"
2626
env:
2727
- name: NAMESPACE
@@ -32,7 +32,7 @@ spec:
3232
"--namespace=$(NAMESPACE)",
3333
"--configmap={{ template "ctlog.config" . }}",
3434
"--display_name={{ .Values.createtree.displayName }}",
35-
"--admin_server={{ .Values.trillian.logServer.name }}.{{ .Values.trillian.namespace }}:{{ .Values.trillian.logServer.portRPC}}"
35+
"--admin_server={{ .Values.trillian.logServer.name }}.{{ .Values.trillian.namespace.name }}:{{ .Values.trillian.logServer.portRPC}}"
3636
]
3737
{{- if .Values.createtree.resources }}
3838
resources:

‎charts/ctlog/templates/createtree-serviceaccount.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@ apiVersion: v1
33
kind: ServiceAccount
44
metadata:
55
name: {{ template "ctlog.serviceAccountName.createtree" . }}
6-
{{ include "ctlog.namespace" . | indent 2 }}
6+
{{ include "common.names.namespace" . | indent 2 }}
77
labels:
8-
{{- include "ctlog.labels" . | nindent 4 }}
8+
{{- include "common.labels.labels" . | nindent 4 }}
99
annotations:
1010
{{ toYaml .Values.createtree.serviceAccount.annotations | indent 4 }}
1111
{{- end }}

‎charts/ctlog/templates/ctlog-configmap.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ apiVersion: v1
22
kind: ConfigMap
33
metadata:
44
name: {{ template "ctlog.config" . }}
5-
{{ include "ctlog.namespace" . | indent 2 }}
5+
{{ include "common.names.namespace" . | indent 2 }}
66
labels:
7-
{{- include "ctlog.labels" . | nindent 4 }}
7+
{{- include "common.labels.labels" . | nindent 4 }}
88
data:
99
__placeholder: |
1010
###################################################################

0 commit comments

Comments
 (0)