mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
Akram Ben Aissi
ed0026aae1
The certgen hook and cert-manager Certificate template hardcoded openshell.openshell.svc.cluster.local in server certificate SANs, breaking deployments in any namespace other than openshell. Use .Release.Namespace in the templates so the SANs match the actual service FQDN regardless of the target namespace. Closes #2060 Signed-off-by: Akram <akram.benaissi@gmail.com>
118 lines
3.6 KiB
YAML
118 lines
3.6 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
{{- if or .Values.pkiInitJob.enabled .Values.certManager.enabled }}
|
|
{{- $hookName := printf "%s-certgen" (include "openshell.fullname" .) }}
|
|
{{- $ns := .Release.Namespace }}
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: {{ $hookName }}
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- include "openshell.labels" . | nindent 4 }}
|
|
annotations:
|
|
helm.sh/hook: pre-install,pre-upgrade
|
|
helm.sh/hook-weight: "-30"
|
|
helm.sh/hook-delete-policy: before-hook-creation
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: {{ $hookName }}
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- include "openshell.labels" . | nindent 4 }}
|
|
annotations:
|
|
helm.sh/hook: pre-install,pre-upgrade
|
|
helm.sh/hook-weight: "-30"
|
|
helm.sh/hook-delete-policy: before-hook-creation
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["get", "create"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: {{ $hookName }}
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- include "openshell.labels" . | nindent 4 }}
|
|
annotations:
|
|
helm.sh/hook: pre-install,pre-upgrade
|
|
helm.sh/hook-weight: "-30"
|
|
helm.sh/hook-delete-policy: before-hook-creation
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: {{ $hookName }}
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: {{ $hookName }}
|
|
namespace: {{ $ns }}
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: {{ $hookName }}
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- include "openshell.labels" . | nindent 4 }}
|
|
annotations:
|
|
helm.sh/hook: pre-install,pre-upgrade
|
|
helm.sh/hook-weight: "-20"
|
|
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
|
spec:
|
|
backoffLimit: 3
|
|
activeDeadlineSeconds: 120
|
|
ttlSecondsAfterFinished: 300
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "openshell.selectorLabels" . | nindent 8 }}
|
|
spec:
|
|
restartPolicy: OnFailure
|
|
serviceAccountName: {{ $hookName }}
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: certgen
|
|
image: {{ include "openshell.image" . | quote }}
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
env:
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
command: ["/usr/local/bin/openshell-gateway"]
|
|
args:
|
|
- generate-certs
|
|
{{- if .Values.certManager.enabled }}
|
|
- --jwt-only
|
|
{{- else }}
|
|
- --server-secret-name={{ .Values.server.tls.certSecretName }}
|
|
- --client-secret-name={{ .Values.server.tls.clientTlsSecretName }}
|
|
{{- end }}
|
|
- --jwt-secret-name={{ include "openshell.sandboxJwtSecretName" . }}
|
|
{{- if and .Values.pkiInitJob.enabled (not .Values.certManager.enabled) }}
|
|
{{- range (include "openshell.defaultServerDnsNames" . | fromYamlArray) }}
|
|
- --server-san={{ . }}
|
|
{{- end }}
|
|
- --server-san=127.0.0.1
|
|
{{- range .Values.pkiInitJob.serverDnsNames }}
|
|
- --server-san={{ . }}
|
|
{{- end }}
|
|
{{- range .Values.pkiInitJob.serverIpAddresses }}
|
|
- --server-san={{ . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|