helm-op: Add support for connecting to tiller using tls #1200
Conversation
- Add support for connecting to tiller using TLS authentication. It is based on the way the helm client itself configures the TLS authentication. The default is tls disabled. - Updates the helm chart to support the TLS options. Expects the helm client certificates to be stored in a k8s secret in the same namespace as the helm-operator is deployed. The secretName can be passed along using the helm-deployment. When configuring TLS Verify, a CA certificate has to be passed and this will be created as a ConfigMap during the deployment. Closes fluxcd#1198
stefanprodan
changed the title
|
Thanks @thojkooi can you please provide an Docker Hub or Quay image for helm-op with your changes so I can test it. |
|
@stefanprodan , sure. I just pushed one at |
|
I can confirm that this change doesn't break setups without TLS and works ok with Tiller TLS. |
| - --tiller-namespace={{ .Values.helmOperator.tillerNamespace }} | ||
| {{- if .Values.helmOperator.tls.enable }} | ||
| - --tiller-tls-enable={{ .Values.helmOperator.tls.enable }} | ||
| - --tiller-tls-key-path={{ .Values.helmOperator.tls.keyPath }} |
This comment was marked as abuse.
This comment was marked as abuse.
Sorry, something went wrong.
This comment was marked as abuse.
This comment was marked as abuse.
Sorry, something went wrong.
This comment was marked as abuse.
This comment was marked as abuse.
Sorry, something went wrong.
…d of the full path - Includes a fix for the CA Certificate ConfigMap. The ca.crt file content was not properly templated. - Instead of the full path, a user only has the option to configure the key and certificate file name, as the path is hardcoded within the template. - Add new helmOperator properties to the chart's README file
|
I've made some changes to the templating of the TLS cert and key paths with the suggestions from @squaremo. I've also fixed an issue I encountered with passing the CA Certificate. I've written up some steps on how to configure flux and tiller with TLS here. Is this something you would like added to the documentation from Flux? I'm unsure what a good location for this would be. |
…th TLS Expans the flux chart README file with a section on how to configure the Helm Operator and install Tiller with TLS authentication enabled.
|
@stefanprodan done. |
|
@thojkooi Thank you very much! @stefanprodan I'll leave it to you to push the big green button |
|
Thanks for merging! 👍 |
It is based on the way the helm client itself configures the TLS authentication and behaves the same way. The default is TLS disabled.
Closes #1198