fixup! chart: fix hubble tls generation with certmanager

Signed-off-by: Valentin Flaux <valentin_flaux@connect-tech.sncf>
cilium · Mar 28, 2023 · 63d9843 · 63d9843
1 parent 65404d2
commit 63d9843
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 4 deletions.
diff --git a/install/kubernetes/cilium/README.md b/install/kubernetes/cilium/README.md
diff --git a/install/kubernetes/cilium/templates/hubble/tls-certmanager/hubble-issuer.yaml b/install/kubernetes/cilium/templates/hubble/tls-certmanager/hubble-issuer.yaml
@@ -14,9 +14,12 @@ metadata:
   name: hubble-ca
   namespace: {{ .Release.Namespace }}
 spec:
-  commonName: Cilium CA
+  commonName: Hubble CA
   duration: {{ printf "%dh0m0s" (mul .Values.hubble.tls.auto.issuerCertValidityDuration 24) }}
   isCA: true
+  privateKey:
+    algorithm: ECDSA
+    size: 256
   issuerRef:
     group: cert-manager.io
     kind: Issuer

diff --git a/install/kubernetes/cilium/values.yaml b/install/kubernetes/cilium/values.yaml
diff --git a/install/kubernetes/cilium/values.yaml.tmpl b/install/kubernetes/cilium/values.yaml.tmpl
@@ -993,6 +993,9 @@ hubble:
       # -- certmanager issuer used when hubble.tls.auto.method=certmanager.
       # If not specified, a CA issuer will be created.
       certManagerIssuerRef: {}
+      # -- Generated CA certificate validity duration in days for the Issuer.
+      # Only used if certManagerIssuerRef is not specified.
+      issuerCertValidityDuration: 26280
 
     # -- Deprecated in favor of tls.ca. To be removed in 1.13.
     # base64 encoded PEM values for the Hubble CA certificate and private key.