diff options
| author |   Andreas Geissler <andreas-geissler@telekom.de> | 2022-07-26 13:51:08 +0200 |
|---|---|---|
| committer | Andreas Geissler <andreas-geissler@telekom.de> | 2022-08-23 11:07:43 +0000 |
| commit | 9794a7b6c51208c55586ec8bd4e96723c6ad7d5f (patch) | |
| tree | 0095d105c1af05dd415b86ed257a498042920d24 /kubernetes/platform/components/oom-cert-service/templates/certificate.yaml | |
| parent | 46461e1970d7c938dbe360c0f61d5793ea786146 (diff) | |
[PLATFORM] Create Ingress Certificates for ServiceMesh
Add issuers and self-signed certificates for the Ingress controller
Additionally a new override file is created for Istio Ingress setup
Issue-ID: OOM-3001
Signed-off-by: Andreas Geissler <andreas-geissler@telekom.de>
Change-Id: I6da12e54ecc4bbb15e3bcf1aa259e50f5be320b6
Diffstat (limited to 'kubernetes/platform/components/oom-cert-service/templates/certificate.yaml')
| -rw-r--r-- | kubernetes/platform/components/oom-cert-service/templates/certificate.yaml | 53 |
1 files changed, 53 insertions, 0 deletions
diff --git a/kubernetes/platform/components/oom-cert-service/templates/certificate.yaml b/kubernetes/platform/components/oom-cert-service/templates/certificate.yaml index fd317703e3..8f49424b54 100644 --- a/kubernetes/platform/components/oom-cert-service/templates/certificate.yaml +++ b/kubernetes/platform/components/oom-cert-service/templates/certificate.yaml @@ -14,4 +14,57 @@ # limitations under the License. */}} +{{- if .Values.global.cmpv2Enabled }} {{ include "certManagerCertificate.certificate" . }} +{{- end -}} + +{{- if (include "common.onServiceMesh" .) }} +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: ingress-ca-certificate + namespace: {{ .Values.tls.issuer.ingressCa.namespace }} +spec: + isCA: true + commonName: "{{ .Values.global.ingress.virtualhost.baseurl }}" #not important as it is self signed + secretName: {{ .Values.tls.issuer.ingressCa.secret.name }} + usages: + - server auth + - client auth + privateKey: + algorithm: ECDSA + size: 256 + issuerRef: + name: {{ .Values.tls.issuer.ingressSelfsigned.name }} + kind: Issuer + group: cert-manager.io +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: ingress-selfsigned-certificate + namespace: {{ .Values.tls.issuer.ingressSelfsigned.namespace }} +spec: + secretName: ingress-tls-secret + privateKey: + rotationPolicy: Always + algorithm: RSA + encoding: PKCS1 + size: 4096 + duration: 9000h0m0s # 1 Year + renewBefore: 4000h0m0s #9 months + commonName: "*.{{ .Values.global.ingress.virtualhost.baseurl }}" +# usages: +# - server auth +# - client auth + dnsNames: + - {{ .Values.global.ingress.virtualhost.baseurl }} + - "*.{{ .Values.global.ingress.virtualhost.baseurl }}" + - "*.*.{{ .Values.global.ingress.virtualhost.baseurl }}" + - "*.*.*.{{ .Values.global.ingress.virtualhost.baseurl }}" + issuerRef: + name: {{ .Values.tls.issuer.ingressCa.name }} + kind: Issuer + group: cert-manager.io +{{- end -}} |