[COMMON] Make certInitializer share truststore among instances

Truststore is quite heavy. If it is included several times in the
component it can easily cross helm chart size limit.

To fix this issue let's make sure that the truststore is created only
once and then shared among all certInitializer instances.

Issue-ID: AAF-1134
Change-Id: I546a88fea3fe869748194682e7dcf3ad566282ab
Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>

diff --git a/kubernetes/common/Makefile b/kubernetes/common/Makefile
index 58125f8..817a2e2 100644 (file)
--- a/kubernetes/common/Makefile
+++ b/kubernetes/common/Makefile
@@ -20,12 +20,14 @@ SECRET_DIR := $(OUTPUT_DIR)/secrets
 COMMON_CHARTS_DIR := common
 
 EXCLUDES :=
+PROCESSED_LAST := cert-wrapper
+TO_FILTER := $(EXCLUDES) $(PROCESSED_LAST)
 
 HELM_BIN := helm
-HELM_CHARTS := $(filter-out $(EXCLUDES), $(sort $(patsubst %/.,%,$(wildcard */.))))
+HELM_CHARTS := $(filter-out $(TO_FILTER), $(sort $(patsubst %/.,%,$(wildcard */.)))) $(PROCESSED_LAST)
 HELM_VER := $(shell $(HELM_BIN) version --template "{{.Version}}")
 
-.PHONY: $(EXCLUDES) $(HELM_CHARTS)
+.PHONY: $(HELM_CHARTS) $(TO_FILTER)
 
 all: $(COMMON_CHARTS_DIR) $(HELM_CHARTS)
 

diff --git a/kubernetes/common/cert-wrapper/Chart.yaml b/kubernetes/common/cert-wrapper/Chart.yaml
new file mode 100644 (file)
index 0000000..68d5400
--- /dev/null
+++ b/kubernetes/common/cert-wrapper/Chart.yaml
@@ -0,0 +1,18 @@
+# Copyright © 2020 Samsung Electronics
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+description: Wrapper chart to allow truststore to be shared among cert-initializer instances
+name: cert-wrapper
+version: 6.0.0

diff --git a/kubernetes/common/cert-wrapper/requirements.yaml b/kubernetes/common/cert-wrapper/requirements.yaml
new file mode 100644 (file)
index 0000000..b6a667e
--- /dev/null
+++ b/kubernetes/common/cert-wrapper/requirements.yaml
@@ -0,0 +1,18 @@
+# Copyright © 2020 Samsung Electronics
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+dependencies:
+  - name: certInitializer
+    version: ~6.x-0
+    repository: 'file://../certInitializer'

diff --git a/kubernetes/common/cert-wrapper/values.yaml b/kubernetes/common/cert-wrapper/values.yaml
new file mode 100644 (file)
index 0000000..fcece0e
--- /dev/null
+++ b/kubernetes/common/cert-wrapper/values.yaml
@@ -0,0 +1,17 @@
+# Copyright © 2020 Samsung Electronics
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+certInitializer:
+  nameOverride: cert-initializer
+  createCertsCM: true

diff --git a/kubernetes/common/certInitializer/templates/_certInitializer.yaml b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
index 6734e0b..800364f 100644 (file)
--- a/kubernetes/common/certInitializer/templates/_certInitializer.yaml
+++ b/kubernetes/common/certInitializer/templates/_certInitializer.yaml
@@ -172,7 +172,7 @@
     medium: Memory
 - name: aaf-agent-certs
   configMap:
-    name: {{ include "common.fullname" $subchartDot }}-certs
+    name: {{ tpl $subchartDot.Values.certsCMName $subchartDot }}
     defaultMode: 0700
 
 {{-     if $initRoot.aaf_add_config }}

diff --git a/kubernetes/common/certInitializer/templates/configmap.yaml b/kubernetes/common/certInitializer/templates/configmap.yaml
index a89a331..69d74e1 100644 (file)
--- a/kubernetes/common/certInitializer/templates/configmap.yaml
+++ b/kubernetes/common/certInitializer/templates/configmap.yaml
@@ -23,6 +23,7 @@ data:
   aaf-add-config.sh: |
     {{ tpl .Values.aaf_add_config . | indent 4 }}
 {{- end }}
+{{- if .Values.createCertsCM }}
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -30,3 +31,4 @@ kind: ConfigMap
 metadata: {{- include "common.resourceMetadata" (dict "suffix" $suffix "dot" . ) | nindent 2 }}
 data:
 {{ tpl (.Files.Glob "resources/*").AsConfig . | indent 2 }}
+{{- end -}}

diff --git a/kubernetes/common/certInitializer/values.yaml b/kubernetes/common/certInitializer/values.yaml
index 642fe77..00e74c4 100644 (file)
--- a/kubernetes/common/certInitializer/values.yaml
+++ b/kubernetes/common/certInitializer/values.yaml
@@ -56,3 +56,6 @@ importCustomCertsEnabled: false
 truststoreMountpath: ""
 truststoreOutputFileName: truststore.jks
 truststorePassword: changeit
+
+createCertsCM: false
+certsCMName: '{{ include "common.release" . }}-cert-initializer-certs'

diff --git a/kubernetes/onap/requirements.yaml b/kubernetes/onap/requirements.yaml
index 9143c1f..7110117 100755 (executable)
--- a/kubernetes/onap/requirements.yaml
+++ b/kubernetes/onap/requirements.yaml
@@ -162,3 +162,7 @@ dependencies:
     version: ~6.x-0
     repository: '@local'
     condition: a1policymanagement.enabled
+  - name: cert-wrapper
+    version: ~6.x-0
+    repository: '@local'
+    condition: cert-wrapper.enabled

diff --git a/kubernetes/onap/values.yaml b/kubernetes/onap/values.yaml
index 3413c38..2791f0f 100755 (executable)
--- a/kubernetes/onap/values.yaml
+++ b/kubernetes/onap/values.yaml
@@ -313,3 +313,6 @@ platform:
   enabled: false
 a1policymanagement:
   enabled: false
+
+cert-wrapper:
+  enabled: true