feat(certificates): support certificates

The following patch enables you to generate certificates using cert-manager or,
alternatively, to mount a secret with TLS certificates.

The HTTP server is then automatically configured to use the TLS certificates to
encrypt HTTP traffic.

If an ingress controller is also used, such as the nginx-ingress controller, the
necessary annotations must still be set to inform the nginx-ingress controller
that the HTTP upstream server communicates via HTTPS.

templates/_certificate.tpl

@@ -0,0 +1,25 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{/* annotations */}}
+
+{{- define "athens-proxy.certificates.server.annotations" -}}
+{{ include "athens-proxy.annotations" . }}
+{{- if .Values.certificate.new.annotations }}
+{{ toYaml .Values.certificate.new.annotations }}
+{{- end }}
+{{- end }}
+
+{{/* labels */}}
+
+{{- define "athens-proxy.certificates.server.labels" -}}
+{{ include "athens-proxy.labels" . }}
+{{- if .Values.certificate.new.labels }}
+{{ toYaml .Values.certificate.new.labels }}
+{{- end }}
+{{- end }}
+
+{{/* names */}}
+
+{{- define "athens-proxy.certificates.server.name" -}}
+{{ include "athens-proxy.fullname" . }}-tls
+{{- end -}}

templates/_deployment.tpl

@@ -26,6 +26,13 @@
 {{- $env = concat $env (list (dict "name" "GOMAXPROCS" "valueFrom" (dict "resourceFieldRef" (dict "divisor" "1" "resource" "limits.cpu")))) }}
 {{- end }}
 
+{{- if .Values.certificate.enabled }}
+{{- $env = concat $env (list
+      (dict "name" "ATHENS_TLSCERT_FILE" "value" "/etc/athens-proxy/tls/tls.crt")
+      (dict "name" "ATHENS_TLSKEY_FILE" "value" "/etc/athens-proxy/tls/tls.key")
+    ) }}
+{{- end }}
+
 {{ toYaml (dict "env" $env) }}
 
 {{- end -}}
@@ -124,6 +131,12 @@
 
 {{- end }}
 
+
+{{/* volumeMounts (tls) */}}
+{{- if .Values.certificate.enabled }}
+{{- $volumeMounts = concat $volumeMounts (list (dict "name" "tls" "mountPath" "/etc/athens-proxy/tls" )) }}
+{{- end }}
+
 {{ toYaml (dict "volumeMounts" $volumeMounts) }}
 {{- end -}}
 
@@ -252,5 +265,15 @@
 {{- $volumes = concat $volumes (list $projectedSecretVolume) }}
 {{- end }}
 
+{{/* volumes (tls) */}}
+{{- if .Values.certificate.enabled }}
+{{- $secretName := include "athens-proxy.certificates.server.name" $ }}
+{{- if .Values.certificate.existingSecret.enabled }}
+{{- $secretName := .Values.certificate.existingSecret.secretName }}
+{{- end }}
+{{- $volumes = concat $volumes (list (dict "name" "tls" "secret" (dict "secretName" $secretName))) }}
+{{- end }}
+
+
 {{ toYaml (dict "volumes" $volumes) }}
 {{- end -}}

templates/certificate.yaml

@@ -0,0 +1,87 @@
+{{- if and .Values.certificate.enabled (not .Values.certificate.existingSecret.enabled) -}}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  {{- with (include "athens-proxy.certificates.server.annotations" . | fromYaml) }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with (include "athens-proxy.certificates.server.labels" . | fromYaml) }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  name: {{ include "athens-proxy.certificates.server.name" . }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  commonName: {{ include "athens-proxy.fullname" . }}
+  {{- if empty .Values.certificate.new.dnsNames }}
+  dnsNames:
+  - {{ include "athens-proxy.fullname" . }}
+  - {{ include "athens-proxy.fullname" . }}.{{ .Release.Namespace }}
+  - {{ include "athens-proxy.fullname" . }}.{{ .Release.Namespace }}.svc
+  - {{ include "athens-proxy.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}
+  {{- else }}
+  dnsNames:
+  {{- range .Values.certificate.new.dnsNames }}
+  - {{ . }}
+  {{- end }}
+  {{- end }}
+  duration: {{ .Values.certificate.new.duration }}
+  {{- if not (empty .Values.certificate.new.ipAddresses) }}
+  ipAddresses:
+  {{- range .Values.certificate.new.ipAddresses }}
+  - {{ . }}
+  {{- end }}
+  {{- end }}
+  isCA: false
+  issuerRef:
+    kind: {{ required "No certificate issuer kind defined!" .Values.certificate.new.issuerRef.kind }}
+    name: {{ required "No certificate issuer name defined!" .Values.certificate.new.issuerRef.name }}
+  privateKey:
+    algorithm: {{ .Values.certificate.new.privateKey.algorithm }}
+    rotationPolicy: {{ .Values.certificate.new.privateKey.rotationPolicy }}
+    size: {{ .Values.certificate.new.privateKey.size }}
+  renewBefore: {{ .Values.certificate.new.renewBefore }}
+  secretName: {{ include "athens-proxy.certificates.server.name" . }}
+  {{- with .Values.certificate.new.secretTemplate }}
+  secretTemplate:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  subject:
+    {{- with .Values.certificate.new.subject.countries }}
+    countries:
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.certificate.new.subject.localities }}
+    localities:
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.certificate.new.subject.organizationalUnits }}
+    organizationalUnits:
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.certificate.new.subject.organizations }}
+    organizations:
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.certificate.new.subject.postalCodes }}
+    postalCodes:
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- with .Values.certificate.new.subject.provinces }}
+    provinces:
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+    {{- if .Values.certificate.new.subject.serialNumber }}
+    serialNumber: {{ .Values.certificate.new.subject.serialNumber }}
+    {{- end }}
+    {{- with .Values.certificate.new.subject.streetAddresses }}
+    streetAddresses:
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  usages:
+  {{- range .Values.certificate.new.usages }}
+  - {{ . }}
+  {{- end }}
+{{- end }}

templates/deployment.yaml

@@ -50,16 +50,24 @@ spec:
         image: {{ include "athens-proxy.deployment.images.athens-proxy.fqin" . | quote }}
         imagePullPolicy: {{ .Values.deployment.athensProxy.image.pullPolicy }}
         livenessProbe:
-          tcpSocket:
-            port: http
+          exec:
+            {{- if not .Values.certificate.enabled }}
+            command: [ "wget", "-T", "3", "-O", "/dev/null", "http://localhost:3000" ]
+            {{- else }}
+            command: [ "wget", "--no-check-certificate", "-T", "3", "-O", "/dev/null", "https://localhost:3000" ]
+            {{- end }}
           failureThreshold: 3
           initialDelaySeconds: 5
           periodSeconds: 60
           successThreshold: 1
           timeoutSeconds: 3
         readinessProbe:
-          tcpSocket:
-            port: http
+          exec:
+            {{- if not .Values.certificate.enabled }}
+            command: [ "wget", "-T", "3", "-O", "/dev/null", "http://localhost:3000" ]
+            {{- else }}
+            command: [ "wget", "--no-check-certificate", "-T", "3", "-O", "/dev/null", "https://localhost:3000" ]
+            {{- end }}
           failureThreshold: 3
           initialDelaySeconds: 5
           periodSeconds: 15