Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

US-568873 - Changes to support cert manager #688

Merged
merged 20 commits into from
Jan 9, 2024
Merged

US-568873 - Changes to support cert manager #688

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
72f84d6
US-568873 - Changes to support cert manager
Dec 21, 2023
5f9d0c5
US-568873 - Changes to support cert manager
Dec 21, 2023
21dd241
US-568873 - Changes to support cert manager
Dec 21, 2023
289f907
Merge branch 'master' into feature/US-568873
Saurabh-16 Dec 21, 2023
aa22fe9
US-568873 - changes for certs manager
Dec 22, 2023
2b4ab3a
Merge branch 'feature/US-568873' of https://github.com/Saurabh-16/peg…
Dec 22, 2023
d6d0e0f
US-568873 - Certs changes
Dec 22, 2023
3097acc
US-568873 - Certs changes
Dec 22, 2023
3d0feac
US-568873 - Certs changes
Dec 22, 2023
d22efce
US-568873 - Certs changes
Dec 22, 2023
aac2776
US-568873 - Certs changes
Dec 22, 2023
26aa2eb
US-568873 - Certs changes
Dec 22, 2023
e44deb0
US-568873 - Refactoring the test cases
Dec 24, 2023
c3ed8c8
US-568873 - Test case failure fix
Dec 24, 2023
4f1a0d3
US-568873 - Test case failure fix
Dec 24, 2023
310b127
US-568873 - Additional changes for successful deployment
Dec 26, 2023
676d8f2
US-568873 - changes to remove hard coded values
Dec 27, 2023
550d9ac
US-568873 - Adding comment for default tomcat keystore name
Jan 3, 2024
f4cd581
Merge branch 'master' into feature/US-568873
Saurabh-16 Jan 3, 2024
c1c49b4
Merge branch 'master' into feature/US-568873
Saurabh-16 Jan 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions charts/pega/config/deploy/server.xml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@

<!-- Define a SSL/TLS HTTPS Connector on port 8443 -->

{{ if or (exists "/opt/pega/tomcatcertsmount/TOMCAT_KEYSTORE_CONTENT") (exists "/opt/pega/tomcatcertsmount/TOMCAT_CERTIFICATE_FILE") }}
{{ if or (exists .Env.TOMCAT_KEYSTORE_CONTENT) (exists "/opt/pega/tomcatcertsmount/TOMCAT_CERTIFICATE_FILE") }}

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
scheme="https" secure="true" SSLEnabled="true"
Expand All @@ -94,9 +94,9 @@
maxHeaderCount="100"
maxThreads="{{ default .Env.CONFIG_CATALINA_CONNECTOR_8443_MAXTHREADS 200 }}" >
<SSLHostConfig certificateVerification="none" sslProtocol="TLS">
{{ if ( and (exists "/opt/pega/tomcatcertsmount/TOMCAT_KEYSTORE_CONTENT") .Env.TOMCAT_KEYSTORE_PASSWORD ) }}
{{ if ( and (exists .Env.TOMCAT_KEYSTORE_CONTENT) .Env.TOMCAT_KEYSTORE_PASSWORD ) }}

<Certificate certificateKeystoreFile="/opt/pega/tomcatcertsmount/TOMCAT_KEYSTORE_CONTENT"
<Certificate certificateKeystoreFile="{{ .Env.TOMCAT_KEYSTORE_CONTENT }}"
certificateKeystorePassword="{{ .Env.TOMCAT_KEYSTORE_PASSWORD }}" />

{{ else }}
Expand Down
18 changes: 11 additions & 7 deletions charts/pega/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,15 +58,19 @@

{{- define "pegaVolumeTomcatKeystoreTemplate" }}
- name: {{ template "pegaVolumeTomcatKeystore" }}
secret:
# This name will be referred in the volume mounts kind.
{{ if ((.node.service).tls).external_secret_name }}
secretName: {{ ((.node.service).tls).external_secret_name }}
projected:
defaultMode: 420
sources:
{{ if (((.node.service).tls).external_secret_names) }}
{{- range (((.node.service).tls).external_secret_names) }}
- secret:
name: {{ . }}
{{- end }}
{{ else }}
secretName: {{ template "pegaTomcatKeystoreSecret" $ }}
# This name will be referred in the volume mounts kind.
- secret:
name: {{ template "pegaTomcatKeystoreSecret" $ }}
{{ end }}
# Used to specify permissions on files within the volume.
defaultMode: 420
{{- end}}

{{- define "pegaVolumeConfig" }}pega-volume-config{{- end }}
Expand Down
6 changes: 6 additions & 0 deletions charts/pega/templates/_pega-deployment.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,12 @@ spec:
- name: COSMOS_SETTINGS
value: "Pega-UIEngine/cosmosservicesURI=/c11n"
{{- end }}
{{- if ((.node.service).tls).enabled }}
- name: EXTERNAL_KEYSTORE_NAME
value: "{{ (((.node.service).tls).external_keystore_name) }}"
- name: EXTERNAL_KEYSTORE_PASSWORD
value: "{{ (((.node.service).tls).external_keystore_password) }}"
{{- end }}
{{- if .custom }}
{{- if .custom.env }}
# Additional custom env vars
Expand Down
4 changes: 2 additions & 2 deletions charts/pega/templates/_pega-traefik-config.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ spec:
{{- end }}
#For traefik, it expects the root CA certificate in a secret under the field ca.crt
rootCAsSecrets:
{{- if .node.service.tls.external_secret_name }}
- {{ .node.service.tls.external_secret_name }}
{{- if .node.service.tls.external_secret_names }}
- {{ first .node.service.tls.external_secret_names }}
{{- else }}
- {{ .depname }}-tomcat-keystore-secret
{{- end }}
Expand Down
9 changes: 8 additions & 1 deletion charts/pega/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,14 @@ global:
# To avoid entering the certificate values in plain text, configure the keystore, keystorepassword, cacertificate parameter
# values in the External Secrets Manager, and enter the external secret name below
# make sure the keys in the secret should be TOMCAT_KEYSTORE_CONTENT, TOMCAT_KEYSTORE_PASSWORD and ca.crt respectively
external_secret_name: ""
# In case of providing multiple secrets, please provide them in comma separated string format.
external_secret_names: []
# If using tools like cert-manager to generate certificates, please provide the keystore name that is autogenerated by the external tool.
# Default is TOMCAT_KEYSTORE_CONTENT
external_keystore_name: ""
# If using external secrets operator and not using standard Password Key, please provide the key for keystore password.
# Default is TOMCAT_KEYSTORE_PASSWORD
external_keystore_password: ""
keystore:
keystorepassword:
port: 443
Expand Down
6 changes: 3 additions & 3 deletions terratest/src/test/pega/data/expectedInstallDeployServer.xml.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@

<!-- Define a SSL/TLS HTTPS Connector on port 8443 -->

{{ if or (exists "/opt/pega/tomcatcertsmount/TOMCAT_KEYSTORE_CONTENT") (exists "/opt/pega/tomcatcertsmount/TOMCAT_CERTIFICATE_FILE") }}
{{ if or (exists .Env.TOMCAT_KEYSTORE_CONTENT) (exists "/opt/pega/tomcatcertsmount/TOMCAT_CERTIFICATE_FILE") }}

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
scheme="https" secure="true" SSLEnabled="true"
Expand All @@ -94,9 +94,9 @@
maxHeaderCount="100"
maxThreads="{{ default .Env.CONFIG_CATALINA_CONNECTOR_8443_MAXTHREADS 200 }}" >
<SSLHostConfig certificateVerification="none" sslProtocol="TLS">
{{ if ( and (exists "/opt/pega/tomcatcertsmount/TOMCAT_KEYSTORE_CONTENT") .Env.TOMCAT_KEYSTORE_PASSWORD ) }}
{{ if ( and (exists .Env.TOMCAT_KEYSTORE_CONTENT) .Env.TOMCAT_KEYSTORE_PASSWORD ) }}

<Certificate certificateKeystoreFile="/opt/pega/tomcatcertsmount/TOMCAT_KEYSTORE_CONTENT"
<Certificate certificateKeystoreFile="{{ .Env.TOMCAT_KEYSTORE_CONTENT }}"
certificateKeystorePassword="{{ .Env.TOMCAT_KEYSTORE_PASSWORD }}" />

{{ else }}
Expand Down
Loading