2 # Copyright © 2020-2021, Nokia
4 # Licensed under the Apache License, Version 2.0 (the "License");
5 # you may not use this file except in compliance with the License.
6 # You may obtain a copy of the License at
8 # http://www.apache.org/licenses/LICENSE-2.0
10 # Unless required by applicable law or agreed to in writing, software
11 # distributed under the License is distributed on an "AS IS" BASIS,
12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 # See the License for the specific language governing permissions and
14 # limitations under the License.*/}}
17 # This is a template for requesting a certificate from the cert-manager (https://cert-manager.io).
19 # To request a certificate following steps are to be done:
20 # - create an object 'certificates' in the values.yaml
21 # - create a file templates/certificates.yaml and invoke the function "certManagerCertificate.certificate".
23 # Here is an example of the certificate request for a component:
25 # Directory structure:
31 # To be added in the file certificates.yamll
33 # To be added in the file values.yaml
34 # 1. Minimal version (certificates only in PEM format)
36 # - commonName: component.onap.org
38 # 2. Extended version (with defined own issuer and additional certificate format):
40 # - name: onap-component-certificate
41 # secretName: onap-component-certificate
42 # commonName: component.onap.org
44 # - component.onap.org
46 # group: certmanager.onap.org
48 # name: cmpv2-issuer-for-the-component
57 # Fields 'name', 'secretName' and 'commonName' are mandatory and required to be defined.
58 # Other mandatory fields for the certificate definition do not have to be defined directly,
59 # in that case they will be taken from default values.
61 # Default values are defined in file onap/values.yaml (see-> global.certificate.default)
62 # and can be overriden during onap installation process.
66 {{- define "certManagerCertificate.certificate" -}}
67 {{- $dot := default . .dot -}}
68 {{- $initRoot := default $dot.Values.certManagerCertificate .initRoot -}}
70 {{- $certificates := $dot.Values.certificates -}}
71 {{- $subchartGlobal := mergeOverwrite (deepCopy $initRoot.global) $dot.Values.global }}
73 {{ range $i, $certificate := $certificates }}
74 {{/*# General certifiacate attributes #*/}}
75 {{- $name := include "common.fullname" $dot -}}
76 {{- $certName := default (printf "%s-cert-%d" $name $i) $certificate.name -}}
77 {{- $secretName := default (printf "%s-secret-%d" $name $i) $certificate.secretName -}}
78 {{- $commonName := (required "'commonName' for Certificate is required." $certificate.commonName) -}}
79 {{- $renewBefore := default $subchartGlobal.certificate.default.renewBefore $certificate.renewBefore -}}
80 {{- $duration := default $subchartGlobal.certificate.default.duration $certificate.duration -}}
81 {{- $namespace := $dot.Release.Namespace -}}
83 {{- $dnsNames := $certificate.dnsNames -}}
84 {{- $ipAddresses := $certificate.ipAddresses -}}
85 {{- $uris := $certificate.uris -}}
86 {{- $emailAddresses := $certificate.emailAddresses -}}
88 {{- $subject := $subchartGlobal.certificate.default.subject -}}
89 {{- if $certificate.subject -}}
90 {{- $subject = $certificate.subject -}}
93 {{- $issuer := $subchartGlobal.certificate.default.issuer -}}
94 {{- if $certificate.issuer -}}
95 {{- $issuer = $certificate.issuer -}}
98 {{- if $certificate.keystore }}
99 {{- $passwordSecretRef := $certificate.keystore.passwordSecretRef -}}
100 {{- $password := include "common.createPassword" (dict "dot" $dot "uid" $certName) | quote }}
104 name: {{ $passwordSecretRef.name }}
105 namespace: {{ $namespace }}
108 {{ $passwordSecretRef.key }}: {{ $password }}
111 apiVersion: cert-manager.io/v1
114 name: {{ $certName }}
115 namespace: {{ $namespace }}
117 secretName: {{ $secretName }}
118 commonName: {{ $commonName }}
119 renewBefore: {{ $renewBefore }}
121 duration: {{ $duration }}
125 - {{ $subject.organization }}
127 - {{ $subject.country }}
129 - {{ $subject.locality }}
131 - {{ $subject.province }}
133 - {{ $subject.organizationalUnit }}
136 {{- range $dnsName := $dnsNames }}
140 {{- if $ipAddresses }}
142 {{- range $ipAddress := $ipAddresses }}
148 {{- range $uri := $uris }}
152 {{- if $emailAddresses }}
154 {{- range $emailAddress := $emailAddresses }}
155 - {{ $emailAddress }}
159 group: {{ $issuer.group }}
160 kind: {{ $issuer.kind }}
161 name: {{ $issuer.name }}
162 {{- if $certificate.keystore }}
164 {{- range $outputType := $certificate.keystore.outputType }}
165 {{- if eq $outputType "p12" }}
166 {{- $outputType = "pkcs12" }}
171 name: {{ $certificate.keystore.passwordSecretRef.name }}
172 key: {{ $certificate.keystore.passwordSecretRef.key }}
178 {{- define "common.certManager.volumeMounts" -}}
179 {{- $dot := default . .dot -}}
180 {{- $initRoot := default $dot.Values.certManagerCertificate .initRoot -}}
181 {{- $subchartGlobal := mergeOverwrite (deepCopy $initRoot.global) $dot.Values.global -}}
182 {{- range $i, $certificate := $dot.Values.certificates -}}
183 {{- $mountPath := $certificate.mountPath -}}
184 - mountPath: {{ $mountPath }}
185 name: certmanager-certs-volume-{{ $i }}
189 {{- define "common.certManager.volumes" -}}
190 {{- $dot := default . .dot -}}
191 {{- $initRoot := default $dot.Values.certManagerCertificate .initRoot -}}
192 {{- $subchartGlobal := mergeOverwrite (deepCopy $initRoot.global) $dot.Values.global -}}
193 {{- $certificates := $dot.Values.certificates -}}
194 {{- range $i, $certificate := $certificates -}}
195 {{- $name := include "common.fullname" $dot -}}
196 {{- $certificatesSecretName := default (printf "%s-secret-%d" $name $i) $certificate.secretName -}}
197 - name: certmanager-certs-volume-{{ $i }}
201 name: {{ $certificatesSecretName }}
202 {{- if $certificate.keystore }}
204 {{- range $outputType := $certificate.keystore.outputType }}
205 - key: keystore.{{ $outputType }}
206 path: keystore.{{ $outputType }}
207 - key: truststore.{{ $outputType }}
208 path: truststore.{{ $outputType }}
211 name: {{ $certificate.keystore.passwordSecretRef.name }}
213 - key: {{ $certificate.keystore.passwordSecretRef.key }}
215 - key: {{ $certificate.keystore.passwordSecretRef.key }}
216 path: truststore.pass