Tiller TLS CA validation (#616)

* Tiller TLS CA validation * Use require instead * Remove params
vmware-tanzu · Sep 12, 2018 · f352719 · f352719
1 parent bf27e31
commit f352719
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/chart/kubeapps/Chart.yaml b/chart/kubeapps/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: kubeapps
-version: 0.4.2
+version: 0.4.3
 appVersion: DEVEL
 description: Kubeapps is a dashboard for your Kubernetes cluster that makes it easy to deploy and manage applications in your cluster using Helm
 icon: https://raw.githubusercontent.com/kubeapps/kubeapps/master/docs/img/logo.png

diff --git a/chart/kubeapps/templates/tiller-proxy-secret.yaml b/chart/kubeapps/templates/tiller-proxy-secret.yaml
@@ -1,4 +1,6 @@
+# The tls ca certificate is only required when tls.verify is set to true, we fail otherwise.
 {{-  if .Values.tillerProxy.tls -}}
+{{ required "A valid CA certificate \".Values.tillerProxy.tls.ca\" needs to be provided if tls-verify is set to true" (and .Values.tillerProxy.tls.verify .Values.tillerProxy.tls.ca) }} 
 apiVersion: v1
 kind: Secret
 metadata:
@@ -9,8 +11,10 @@ metadata:
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
 data:
+{{- if .Values.tillerProxy.tls.ca }}
   ca.crt: |-
 {{ .Values.tillerProxy.tls.ca | b64enc | indent 4 }}
+{{- end }}
   tls.crt: |-
 {{ .Values.tillerProxy.tls.cert | b64enc | indent 4 }}
   tls.key: |-