Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix installation fails when using Let's Encrypt cluster issuer #119

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Fix installation fails when using Let's Encrypt cluster issuer #119

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
37cf701
Fix tlsIssuer names and the consumers of these tlsIssuers
PhanLe1010 Aug 14, 2023
db311c7
The ingress of AMCE server need to be contact through http port
PhanLe1010 Aug 14, 2023
a6a8db4
Cannot use wildcard for http01 AMCE resolver
PhanLe1010 Aug 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/s3gw/templates/certificate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,6 @@ spec:
- '*.{{ include "s3gw.serviceName" . }}.{{ .Release.Namespace }}.{{ .Values.privateDomain }}'
issuerRef:
kind: ClusterIssuer
name: {{ .Release.Name }}-{{ .Release.Namespace }}-issuer
name: {{ .Release.Name }}-{{ .Release.Namespace }}-s3gw-issuer
secretName: {{ .Release.Name }}-{{ .Release.Namespace }}-cluster-ip-tls
{{- end }}
6 changes: 3 additions & 3 deletions charts/s3gw/templates/ingress-traefik.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,12 @@ metadata:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.middlewares:
'{{ .Release.Namespace }}-{{ include "s3gw.CORSMiddlewareName" . }}@kubernetescrd'
cert-manager.io/cluster-issuer: {{ default .Values.tlsIssuer .Values.customTlsIssuer | quote }}
cert-manager.io/cluster-issuer: {{ .Release.Name }}-{{ .Release.Namespace }}-{{ .Values.tlsIssuer }}
spec:
tls:
- hosts:
- '{{ include "s3gw.serviceName" . }}.{{ .Values.publicDomain }}'
- '*.{{ include "s3gw.serviceName" . }}.{{ .Values.publicDomain }}'
# - '*.{{ include "s3gw.serviceName" . }}.{{ .Values.publicDomain }}'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe @m-ildefons can comment on this, but I think this will not work. We need wildcard certificates for vhost-based bucket access.

Copy link
Author

@PhanLe1010 PhanLe1010 Aug 15, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @jecluis , we are discussing this wildcard cert topic inside our discuss-s3gw Slack channel. I will update the PR once we come to a conclusion

secretName: s3gw-ingress-tls
rules:
- host: '{{ include "s3gw.serviceName" . }}.{{ .Values.publicDomain }}'
Expand Down Expand Up @@ -88,7 +88,7 @@ metadata:
traefik.ingress.kubernetes.io/router.tls: "true"
traefik.ingress.kubernetes.io/router.middlewares:
'{{ .Release.Namespace }}-{{ include "s3gw.CORSMiddlewareName" . }}@kubernetescrd'
cert-manager.io/cluster-issuer: {{ default .Values.tlsIssuer .Values.customTlsIssuer | quote }}
cert-manager.io/cluster-issuer: {{ .Release.Name }}-{{ .Release.Namespace }}-{{ .Values.tlsIssuer }}
spec:
tls:
- hosts:
Expand Down
14 changes: 5 additions & 9 deletions charts/s3gw/templates/tls-issuer.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,4 @@
{{- if .Values.useCertManager }}
{{- if eq .Values.tlsIssuer "s3gw-issuer" }}
---
# Self-signed issuer
apiVersion: cert-manager.io/v1
Expand All @@ -15,19 +14,20 @@ spec:
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: {{ .Release.Name }}-{{ .Release.Namespace }}-issuer
name: {{ .Release.Name }}-{{ .Release.Namespace }}-s3gw-issuer
labels:
{{ include "s3gw.labels" . | indent 4}}
spec:
ca:
secretName: {{ .Release.Name }}-{{ .Release.Namespace }}-ca-root
{{- else if eq .Values.tlsIssuer "s3gw-letsencrypt-issuer" }}

{{- if eq .Values.tlsIssuer "s3gw-letsencrypt-issuer" }}
---
# Let's encrypt production issuer
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
name: {{ .Release.Name }}-{{ .Release.Namespace }}-letsencrypt-issuer
name: {{ .Release.Name }}-{{ .Release.Namespace }}-s3gw-letsencrypt-issuer
labels:
{{ include "s3gw.labels" . | indent 4}}
spec:
Expand All @@ -40,10 +40,6 @@ spec:
solvers:
- http01:
ingress:
ingressTemplate:
metadata:
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls: "true"
ingressClassName: traefik
{{- end }}
{{- end }}