Support TLS traffic with cert-manager. #357
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* bump redis-consumers to 0.6.1
Add new CERTIFICATE_MANAGER_ENABLED env var.
* don't deploy helm anymore, using helm3, no tiller required. * helm3 removes client/server achritecture and relies on binary only; no need for "helm init". * kubernetes 1.16 updates all APIs to apps/v1 instead of extensions/v1beta1 * update nginx-ingress chart to support kube1.16. unstringify the helmfile too. * Update base images to latest versions. * update recommended API versions for ClusterRole, ClusterRoleBinding and Ingress * remove references to --purge, unused in helm3.
MekWarrior
approved these changes
Oct 5, 2020
willgraf
added a commit
that referenced
this pull request
Dec 16, 2020
* Support TLS traffic with cert-manager. (#357) * Fix frontend ingress issue when no hosts are provided. (#381) * Template frontend ingress annotations using `CERTIFICATE_MANAGER_ENABLED` (#383) * Create tf-serving configuration files using an initContainer. (#382) * Fix whitespace issue in tasks/Makefile.kubectl (#386) * Bump openvpn to 4.2.3 (#385) * Upgrade certificate manager to version 1.0.3 (#384) * Add screenshot of successfully created cluster to docs. (#388) * Set up an AlertManager with slack receiver support (#317) * Install procps to give access to sysctl. (#390) * Migrate CI/CD from TravisCI to GitHub Actions (#394) * Change the redis helm chart repo to bitnami (#393) * Upgrade tf-serving chart to 0.3.0 for application version 0.4.0 (#392) * Move the frontend HPA definition into the helm chart. (#395) * Move the tf-serving HPA into the helm chart. (#396) * Move redis-consumer HPA into the helm chart. (#397) * Remove deprecated and unused charts (#398) * Migrate stable helm chart repo to archived URL. (#399) * Destroy the secret and remove the key from the DNS solver SA in a new task: `gke/destroy/certificate-manager-secret` (fixes #391). * Use GCP_SERVICE_ACCOUNT for DNS resolution (#401) * Clean up docs and test them with new GitHub Action workflow (#402) * Add code-formatted filename to list of files to change (#403) * Update ELK stack helmfiles (#380) * Move the prometheus-redis-exporter script to a chart using incubator/raw. (#405) * Use `kubectl del pvc` instead of deleting all pds with the cluster name. (#406) * Update helmfile defaults for faster helm deployments. (#404) * Skip gke/destroy/node-pools during cluster teardown. (#407) * Update docs to reflect the pending 1.4.0 release. (#408) * Bump redis-consumer version to 0.8.3 (#409) * Run integration tests on all PRs to master OR if they have the commit message. (#411) * Remove helm defaults for ELK helmfiles (#413) Co-authored-by: Morgan Schwartz <msschwartz21@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
cert-managercan generate and manage TLS certificates. This PR introduces thecert-manager, and deploys 2ClusterIssuersto issue certificates for let's encrypt staging and prod environment, as well as a certificate (staging by default).This certificate is then referenced by the
frontendhelm chart, which it uses to authenticate requests.Fixes #266