[stable/traefik] adding support for traefik wildcard certificates #6015

billimek · 2018-06-10T04:22:44Z

What this PR does / why we need it: This PR is to include wildcard certificate support for the traefik chart. See https://docs.traefik.io/configuration/acme/#wildcard-domains for more details on this capability.

Which issue this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close that issue when PR gets merged): fixes #5379

Special notes for your reviewer: Based on the original work provided by @farfeduc

k8s-ci-robot · 2018-06-10T04:22:46Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please email the CNCF helpdesk: helpdesk@rt.linuxfoundation.org

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

billimek · 2018-06-10T04:50:55Z

Signed CLA

billimek · 2018-06-10T04:51:54Z

/assign @krancour

billimek · 2018-06-11T19:47:22Z

Added support for multiple sets of domains

billimek · 2018-06-12T15:02:06Z

When testing this change locally this is a subset of the output to demonstrate it working as intended:

helm install --debug --dry-run local/traefik --set acme.enabled=true,acme.domains.enabled=true:

<snip>
data:
  traefik.toml: |
    # traefik.toml
    logLevel = "INFO"
    defaultEntryPoints = ["http", "httpn"]
    [entryPoints]
      [entryPoints.http]
      address = ":80"
      compress = true
      [entryPoints.httpn]
      address = ":8880"
      compress = true
    [kubernetes]
    [acme]
    email = "admin@example.com"
    storage = "/acme/acme.json"
    entryPoint = "https"
    onHostRule = true
    caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
    [[acme.domains]]
       main = "*.example.com"
       sans = ["example.com"]
    [[acme.domains]]
       main = "*.example2.com"
       sans = ["test1.example2.com", "test2.example2.com"]
<snip>

unguiculus · 2018-06-17T19:27:39Z

/ok-to-test

unguiculus · 2018-06-17T19:27:47Z

/assign

unguiculus · 2018-06-28T17:30:36Z

ping @krancour

billimek · 2018-06-29T11:33:12Z

/assign @dtomcej

k8s-ci-robot · 2018-06-29T11:33:14Z

@billimek: GitHub didn't allow me to assign the following users: dtomcej.

Note that only kubernetes members and repo collaborators can be assigned.

In response to this:

/assign @dtomcej

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

billimek · 2018-06-29T11:34:28Z

/assign @emilevauge

k8s-ci-robot · 2018-06-29T11:34:29Z

@billimek: GitHub didn't allow me to assign the following users: emilevauge.

Note that only kubernetes members and repo collaborators can be assigned.

In response to this:

/assign @emilevauge

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

billimek · 2018-06-29T11:35:58Z

@unguiculus with @krancour unfortunately stepping away from Traefik review duties, do you know how to get another person in the OWNERS file assigned to this PR?

ldez · 2018-06-29T13:01:35Z

/assign @dtomcej

k8s-ci-robot · 2018-06-29T13:01:36Z

@ldez: GitHub didn't allow me to assign the following users: dtomcej.

Note that only kubernetes members and repo collaborators can be assigned.

In response to this:

/assign @dtomcej

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dtomcej · 2018-06-29T15:51:11Z

I have been trying! but I'm not part of the proper org it seems...

krancour · 2018-06-30T17:55:46Z

@dtomcej apart from being in the owner's file, you also need to be in the Kubernetes github org. I hadn't realized that you and other Traefik maintainers were not.

The process for requesting membership is here: https://github.com/kubernetes/community/blob/master/community-membership.md#requirements

You can use me as a sponsor. If you know anyone else who's already a member, as them as well.

jseguillon · 2018-07-03T14:30:16Z

Tested on my development kub8s -> Works like a charm 👏 👏 👏 👏

jseguillon · 2018-07-12T08:49:07Z

Hi @billimek & @krancour. Any chance to get this approved ?

veeramarni · 2018-07-12T18:31:51Z

@dtomcej wondering if you got a chance to approve this?

dtomcej · 2018-07-12T20:50:38Z

/lgtm

k8s-ci-robot · 2018-07-12T20:50:45Z

@dtomcej: changing LGTM is restricted to assignees, and only kubernetes/charts repo collaborators may be assigned issues.

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

grugnog · 2018-07-12T22:37:48Z

stable/traefik/values.yaml

+    enabled: false
+    # List of sets of main and (optional) SANs to generate for
+    # for wildcard certificates see https://docs.traefik.io/configuration/acme/#wildcard-domains
+    domainsList:


I think the examples in this section should be commented out - this is the norm for examples and avoids you accidentally attempting to request certs for example domains.

Finally some feedback, thank you @grugnog!

Changes pushed.

unguiculus · 2018-07-15T16:24:59Z

/lgtm

k8s-ci-robot · 2018-07-15T16:25:08Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: billimek, dtomcej, unguiculus

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~stable/traefik/OWNERS~~ [unguiculus]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

…labels * kubernetes/master: (411 commits) [stable/efs-provisioner] Chart for efs-provisioner, a Kubernetes external-storage provisioner (helm#3233) [stable/filebeat] filebeat fixes (helm#6332) [stable/stolon] Add support for priorityClasses (helm#6607) [stable/external-dns] Add support for priorityClasses (helm#6606) [stable/minio] Add support for priorityClasses (helm#6604) [stable/cluster-autoscaler] Add support for priorityClasses (helm#6603) [stable/oauth2-proxy] Add support for priorityClasses (helm#6586) [stable/elasticsearch-exporter] add support for priorityClasses (helm#6584) [stable/traefik] adding support for traefik wildcard certificates (helm#6015) gcloud-sqlproxy: add tolerations and affinity to the Deployment (helm#6495) Review readme (helm#6399) [stable/mongodb-replicaset] Prometheus Metrics export (helm#6282) [stable/artifactory-ha] Typo fix: livessProbed->livenessProbed (helm#6462) [stable/artifactory] livessProbed->livenessProbed (helm#6461) [incubator/kube-spot-termination-notice-handler] Add Support for Tolerations (helm#5813) [stable/kanister-operator] RBAC changes and kanister profile creation (helm#6280) fix redis-ha NOTE.txt, stable/redis-ha don't create master-0 pod (helm#6131) [stable/concourse] add support for custom envvars for the web containers (helm#6441) upgrade to latest prometheus release 2.3.2 and alertmanager 0.15.1 (helm#6623) cert-manager: fast-forward to upstream 777ce6f4 (helm#6625) ...

veeramarni · 2018-07-16T18:54:27Z

stable/traefik/README.md

@@ -122,8 +122,9 @@ The following table lists the configurable parameters of the Traefik chart and t
 | `acme.staging`                  | Whether to get certs from Let's Encrypt's staging environment        | `true`                                    |
 | `acme.logging`                  | Display debug log messages from the ACME client library              | `false`                                   |
 | `acme.domains.enabled`          | Enable certificate creation by default for specific domain           | `false`                                   |
-| `acme.domains.main`             | Main domain name of the generated certificate                        | `*.example.com`                           |
-| `acme.domains.sans`             | List of alternative subject name to give to the certificate          | `[]`                                      |
+| `acme.domains.domainList`       | List of domains & (optional) subject names                           | `[]`                                      |


@billimek Does it suppose to be acme.domains.domainsList? Missing s in the Readme

…lm#6015) * adding support for traefik wildcard certificates * adding support for multiple sets of domains * making values sans example more readable * bumping version of Chart * commenting domain examples from values.yml Signed-off-by: Jakob Niggel <info@jakobniggel.de>

…lm#6015) * adding support for traefik wildcard certificates * adding support for multiple sets of domains * making values sans example more readable * bumping version of Chart * commenting domain examples from values.yml

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Jun 10, 2018

k8s-ci-robot requested review from krancour and mgoodness June 10, 2018 04:22

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jun 10, 2018

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jun 10, 2018

k8s-ci-robot assigned krancour Jun 10, 2018

billimek changed the title ~~adding support for traefik wildcard certificates~~ [stable/traefik] adding support for traefik wildcard certificates Jun 11, 2018

billimek mentioned this pull request Jun 11, 2018

leverage wildcard certs with traefik billimek/k8s-templates#18

Closed

k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 17, 2018

k8s-ci-robot assigned unguiculus Jun 17, 2018

k8s-ci-robot removed the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jul 1, 2018

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Jul 1, 2018

billimek force-pushed the wildcard branch from fe5c8d3 to 4f1e161 Compare July 1, 2018 20:34

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 1, 2018

billimek added 4 commits July 1, 2018 17:56

adding support for traefik wildcard certificates

48d0e7c

adding support for multiple sets of domains

64f8a3b

making values sans example more readable

9f70e2c

bumping version of Chart

50847e1

billimek force-pushed the wildcard branch from 4f1e161 to 50847e1 Compare July 1, 2018 22:04

grugnog suggested changes Jul 12, 2018

View reviewed changes

commenting domain examples from values.yml

35402c3

k8s-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 15, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 15, 2018

k8s-ci-robot merged commit ebe24f6 into helm:master Jul 15, 2018

veeramarni reviewed Jul 16, 2018

View reviewed changes

billimek deleted the wildcard branch September 16, 2018 18:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[stable/traefik] adding support for traefik wildcard certificates #6015

[stable/traefik] adding support for traefik wildcard certificates #6015

billimek commented Jun 10, 2018

k8s-ci-robot commented Jun 10, 2018

billimek commented Jun 10, 2018

billimek commented Jun 10, 2018

billimek commented Jun 11, 2018

billimek commented Jun 12, 2018

unguiculus commented Jun 17, 2018

unguiculus commented Jun 17, 2018

unguiculus commented Jun 28, 2018

billimek commented Jun 29, 2018

k8s-ci-robot commented Jun 29, 2018

billimek commented Jun 29, 2018

k8s-ci-robot commented Jun 29, 2018

billimek commented Jun 29, 2018 •

edited

ldez commented Jun 29, 2018

k8s-ci-robot commented Jun 29, 2018

dtomcej commented Jun 29, 2018

krancour commented Jun 30, 2018

jseguillon commented Jul 3, 2018

jseguillon commented Jul 12, 2018

veeramarni commented Jul 12, 2018

dtomcej commented Jul 12, 2018

k8s-ci-robot commented Jul 12, 2018

grugnog Jul 12, 2018 •

edited

billimek Jul 13, 2018 •

edited

unguiculus commented Jul 15, 2018

k8s-ci-robot commented Jul 15, 2018

veeramarni Jul 16, 2018

[stable/traefik] adding support for traefik wildcard certificates #6015

[stable/traefik] adding support for traefik wildcard certificates #6015

Conversation

billimek commented Jun 10, 2018

k8s-ci-robot commented Jun 10, 2018

billimek commented Jun 10, 2018

billimek commented Jun 10, 2018

billimek commented Jun 11, 2018

billimek commented Jun 12, 2018

unguiculus commented Jun 17, 2018

unguiculus commented Jun 17, 2018

unguiculus commented Jun 28, 2018

billimek commented Jun 29, 2018

k8s-ci-robot commented Jun 29, 2018

billimek commented Jun 29, 2018

k8s-ci-robot commented Jun 29, 2018

billimek commented Jun 29, 2018 • edited

ldez commented Jun 29, 2018

k8s-ci-robot commented Jun 29, 2018

dtomcej commented Jun 29, 2018

krancour commented Jun 30, 2018

jseguillon commented Jul 3, 2018

jseguillon commented Jul 12, 2018

veeramarni commented Jul 12, 2018

dtomcej commented Jul 12, 2018

k8s-ci-robot commented Jul 12, 2018

grugnog Jul 12, 2018 • edited

Choose a reason for hiding this comment

billimek Jul 13, 2018 • edited

Choose a reason for hiding this comment

unguiculus commented Jul 15, 2018

k8s-ci-robot commented Jul 15, 2018

veeramarni Jul 16, 2018

Choose a reason for hiding this comment

billimek commented Jun 29, 2018 •

edited

grugnog Jul 12, 2018 •

edited

billimek Jul 13, 2018 •

edited