Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[scalardl-ledger] Support TLS in ScalarDL Ledger chart #256

Merged
merged 4 commits into from
Mar 27, 2024
+87 −2
Merged

[scalardl-ledger] Support TLS in ScalarDL Ledger chart #256

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
29a58b1
[scalardl-ledger] Support TLS in ScalarDL Ledger chart
kota2and3kan Feb 27, 2024
2c457b6
Update description of each parameter
kota2and3kan Mar 18, 2024
8d0ec98
Add if statement for overrideAuthority configuration
kota2and3kan Mar 22, 2024
476acf4
Merge branch 'main' into support-tls-scalardl-ledger
kota2and3kan Mar 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions charts/scalardl/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,5 +74,10 @@ Current chart version is `5.0.0-SNAPSHOT`
| ledger.strategy.rollingUpdate.maxSurge | string | `"25%"` | The number of pods that can be created above the desired amount of pods during an update |
| ledger.strategy.rollingUpdate.maxUnavailable | string | `"25%"` | The number of pods that can be unavailable during the update process |
| ledger.strategy.type | string | `"RollingUpdate"` | New pods are added gradually, and old pods are terminated gradually, e.g: Recreate or RollingUpdate |
| ledger.tls.caRootCertSecret | string | `""` | Name of the Secret containing the custom CA root certificate for TLS communication. |
| ledger.tls.certChainSecret | string | `""` | Name of the Secret containing the certificate chain file used for TLS communication. |
| ledger.tls.enabled | bool | `false` | Enable TLS. You need to enable TLS when you use wire encryption feature of ScalarDL Ledger. |
| ledger.tls.overrideAuthority | string | `""` | The custom authority for TLS communication. This doesn't change what host is actually connected. This is intended for testing, but may safely be used outside of tests as an alternative to DNS overrides. For example, you can specify the hostname presented in the certificate chain file that you set by using `ledger.tls.certChainSecret`. This chart uses this value for startupProbe and livenessProbe. |
| ledger.tls.privateKeySecret | string | `""` | Name of the Secret containing the private key file used for TLS communication. |
| ledger.tolerations | list | `[]` | Tolerations are applied to pods, and allow (but do not require) the pods to schedule onto nodes with matching taints. |
| nameOverride | string | `""` | String to partially override scalardl.fullname template (will maintain the release name) |
52 changes: 50 additions & 2 deletions charts/scalardl/templates/ledger/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,21 @@ spec:
- name: scalardl-ledger-properties-volume
configMap:
name: {{ include "scalardl.fullname" . }}-ledger-properties
{{- if .Values.ledger.tls.caRootCertSecret }}
- name: scalardl-ledger-tls-ca-root-volume
secret:
secretName: {{ .Values.ledger.tls.caRootCertSecret }}
{{- end }}
{{- if .Values.ledger.tls.certChainSecret }}
- name: scalardl-ledger-tls-cert-chain-volume
secret:
secretName: {{ .Values.ledger.tls.certChainSecret }}
{{- end }}
{{- if .Values.ledger.tls.privateKeySecret }}
- name: scalardl-ledger-tls-private-key-volume
secret:
secretName: {{ .Values.ledger.tls.privateKeySecret }}
{{- end }}
{{- with .Values.ledger.extraVolumes }}
{{- toYaml . | nindent 8 }}
{{- end }}
Expand All @@ -61,6 +76,21 @@ spec:
- name: scalardl-ledger-properties-volume
mountPath: /scalar/ledger/ledger.properties
subPath: ledger.properties
{{- if .Values.ledger.tls.caRootCertSecret }}
- name: scalardl-ledger-tls-ca-root-volume
mountPath: /tls/certs/ca-root-cert.pem
subPath: ca-root-cert
{{- end }}
{{- if .Values.ledger.tls.certChainSecret }}
- name: scalardl-ledger-tls-cert-chain-volume
mountPath: /tls/certs/cert-chain.pem
subPath: cert-chain
{{- end }}
{{- if .Values.ledger.tls.privateKeySecret }}
- name: scalardl-ledger-tls-private-key-volume
mountPath: /tls/certs/private-key.pem
subPath: private-key
{{- end }}
{{- with .Values.ledger.extraVolumeMounts }}
{{- toYaml . | nindent 12 }}
{{- end }}
Expand Down Expand Up @@ -113,14 +143,32 @@ spec:
exec:
command:
- /usr/local/bin/grpc_health_probe
- -addr=:50051
- -addr=localhost:50051
{{- if .Values.ledger.tls.enabled }}
- -tls
{{- if .Values.ledger.tls.caRootCertSecret }}
- -tls-ca-cert=/tls/certs/ca-root-cert.pem
{{- end }}
{{- if .Values.ledger.tls.overrideAuthority }}
- -tls-server-name={{ .Values.ledger.tls.overrideAuthority }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ditto. (The same question as the ScalarDB Cluster PR.)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your review!
I answered it on the ScalarDB Cluster PR side.
#255 (comment)

{{- end }}
{{- end }}
failureThreshold: 60
periodSeconds: 5
livenessProbe:
exec:
command:
- /usr/local/bin/grpc_health_probe
- -addr=:50051
- -addr=localhost:50051
{{- if .Values.ledger.tls.enabled }}
- -tls
{{- if .Values.ledger.tls.caRootCertSecret }}
- -tls-ca-cert=/tls/certs/ca-root-cert.pem
{{- end }}
{{- if .Values.ledger.tls.overrideAuthority }}
- -tls-server-name={{ .Values.ledger.tls.overrideAuthority }}
{{- end }}
{{- end }}
failureThreshold: 3
periodSeconds: 10
successThreshold: 1
Expand Down
20 changes: 20 additions & 0 deletions charts/scalardl/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -325,6 +325,26 @@
}
}
},
"tls": {
"type": "object",
"properties": {
"caRootCertSecret": {
"type": "string"
},
"certChainSecret": {
"type": "string"
},
"enabled": {
"type": "boolean"
},
"overrideAuthority": {
"type": "string"
},
"privateKeySecret": {
"type": "string"
}
}
},
"tolerations": {
"type": "array"
}
Expand Down
12 changes: 12 additions & 0 deletions charts/scalardl/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -233,3 +233,15 @@ ledger:
serviceAccountName: ""
# -- Specify to mount a service account token or not
automountServiceAccountToken: false

tls:
# -- Enable TLS. You need to enable TLS when you use wire encryption feature of ScalarDL Ledger.
enabled: false
# -- The custom authority for TLS communication. This doesn't change what host is actually connected. This is intended for testing, but may safely be used outside of tests as an alternative to DNS overrides. For example, you can specify the hostname presented in the certificate chain file that you set by using `ledger.tls.certChainSecret`. This chart uses this value for startupProbe and livenessProbe.
overrideAuthority: ""
# -- Name of the Secret containing the custom CA root certificate for TLS communication.
caRootCertSecret: ""
# -- Name of the Secret containing the certificate chain file used for TLS communication.
certChainSecret: ""
# -- Name of the Secret containing the private key file used for TLS communication.
privateKeySecret: ""
Loading