Skip to content

Commit 5ebba26

Browse files
yecs1999yecs1999
committed
separate name for client and node certmanagerissuer
1 parent 5c3a510 commit 5ebba26

File tree

6 files changed

+52
-38
lines changed

6 files changed

+52
-38
lines changed

‎build/templates/README.md‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ By enabling `tls.certs.tlsSecret` the tls secrets are projected on to the correc
147147
If you wish to supply certificates with [cert-manager][3], set
148148

149149
* `tls.certs.certManager` to `yes`/`true`
150-
* `tls.certs.certManagerIssuer` to an IssuerRef (as they appear in certificate resources) pointing to a clusterIssuer or issuer, you have set up in the cluster
150+
* `tls.certs.nodeCertManagerIssuer` or `tls.certs.clientCertManagerIssuer` to an IssuerRef (as they appear in certificate resources) pointing to a clusterIssuer or issuer, you have set up in the cluster
151151

152152
Example issuer:
153153

@@ -403,13 +403,16 @@ For details see the [`values.yaml`](values.yaml) file.
403403
| `tls.certs.selfSigner.readinessWait` | Wait time for each cockroachdb replica to become ready once it comes in running state. Only considered when rotateCerts is set to true | `30s` |
404404
| `tls.certs.selfSigner.podUpdateTimeout` | Wait time for each cockroachdb replica to get to running state. Only considered when rotateCerts is set to true | `2m` |
405405
| `tls.certs.certManager` | Provision certificates with cert-manager | `false` |
406-
| `tls.certs.certManagerIssuer.group` | IssuerRef group to use when generating certificates | `cert-manager.io` |
407-
| `tls.certs.certManagerIssuer.kind` | IssuerRef kind to use when generating certificates | `Issuer` |
408-
| `tls.certs.certManagerIssuer.name` | IssuerRef name to use when generating certificates | `cockroachdb` |
409-
| `tls.certs.certManagerIssuer.clientCertDuration` | Duration of client cert in hours | `672h` |
410-
| `tls.certs.certManagerIssuer.clientCertExpiryWindow` | Expiry window of client cert means a window before actual expiry in which client cert should be rotated | `48h` |
411-
| `tls.certs.certManagerIssuer.nodeCertDuration` | Duration of node cert in hours | `8760h` |
412-
| `tls.certs.certManagerIssuer.nodeCertExpiryWindow` | Expiry window of node certificates means a window before actual expiry in which node certs should be rotated. | `168h` |
406+
| `tls.certs.clientCertManagerIssuer.group` | IssuerRef group to use when generating client certificates | `cert-manager.io` |
407+
| `tls.certs.clientCertManagerIssuer.kind` | IssuerRef kind to use when generating client certificates | `Issuer` |
408+
| `tls.certs.clientCertManagerIssuer.name` | IssuerRef name to use when generating client certificates | `cockroachdb` |
409+
| `tls.certs.nodeCertManagerIssuer.group` | IssuerRef group to use when generating node certificates | `cert-manager.io` |
410+
| `tls.certs.nodeCertManagerIssuer.kind` | IssuerRef kind to use when generating node certificates | `Issuer` |
411+
| `tls.certs.nodeCertManagerIssuer.name` | IssuerRef name to use when generating node certificates | `cockroachdb` |
412+
| `tls.certs.clientCertManagerIssuer.certDuration` | Duration of client cert in hours | `672h` |
413+
| `tls.certs.clientCertManagerIssuer.certExpiryWindow` | Expiry window of client cert means a window before actual expiry in which client cert should be rotated | `48h` |
414+
| `tls.certs.nodeCertManagerIssuer.certDuration` | Duration of node cert in hours | `8760h` |
415+
| `tls.certs.nodeCertManagerIssuer.certExpiryWindow` | Expiry window of node certificates means a window before actual expiry in which node certs should be rotated. | `168h` |
413416
| `tls.selfSigner.image.repository` | Image to use for self signing TLS certificates | `cockroachlabs-helm-charts/cockroach-self-signer-cert`|
414417
| `tls.selfSigner.image.tag` | Image tag to use for self signing TLS certificates | `0.1` |
415418
| `tls.selfSigner.image.pullPolicy` | Self signing TLS certificates container pull policy | `IfNotPresent` |

‎build/templates/values.yaml‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -481,18 +481,22 @@ tls:
481481
# Specify an Issuer or a ClusterIssuer to use, when issuing
482482
# node and client certificates. The values correspond to the
483483
# issuerRef specified in the certificate.
484-
certManagerIssuer:
484+
clientCertManagerIssuer:
485485
group: cert-manager.io
486486
kind: Issuer
487-
name: cockroachdb
487+
name: cockroachdb-client
488488
# Duration of Client certificates in hours
489-
clientCertDuration: 672h
489+
certDuration: 672h
490490
# Expiry window of client certificates means a window before actual expiry in which client certs should be rotated.
491-
clientCertExpiryWindow: 48h
491+
certExpiryWindow: 48h
492+
nodeCertManagerIssuer:
493+
group: cert-manager.io
494+
kind: Issuer
495+
name: cockroachdb-node
492496
# Duration of node certificates in hours
493-
nodeCertDuration: 8760h
497+
certDuration: 8760h
494498
# Expiry window of node certificates means a window before actual expiry in which node certs should be rotated.
495-
nodeCertExpiryWindow: 168h
499+
certExpiryWindow: 168h
496500
# Enable if you run cert-manager >=1.0 on K8s <=1.15 with legacy CRDs
497501
# Legacy CRDs only support cert-manager.io/v1 API Versions
498502
useCertManagerV1CRDs: false

‎cockroachdb/README.md‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,7 @@ By enabling `tls.certs.tlsSecret` the tls secrets are projected on to the correc
148148
If you wish to supply certificates with [cert-manager][3], set
149149

150150
* `tls.certs.certManager` to `yes`/`true`
151-
* `tls.certs.certManagerIssuer` to an IssuerRef (as they appear in certificate resources) pointing to a clusterIssuer or issuer, you have set up in the cluster
151+
* `tls.certs.nodeCertManagerIssuer` or `tls.certs.clientCertManagerIssuer` to an IssuerRef (as they appear in certificate resources) pointing to a clusterIssuer or issuer, you have set up in the cluster
152152

153153
Example issuer:
154154

@@ -404,13 +404,16 @@ For details see the [`values.yaml`](values.yaml) file.
404404
| `tls.certs.selfSigner.readinessWait` | Wait time for each cockroachdb replica to become ready once it comes in running state. Only considered when rotateCerts is set to true | `30s` |
405405
| `tls.certs.selfSigner.podUpdateTimeout` | Wait time for each cockroachdb replica to get to running state. Only considered when rotateCerts is set to true | `2m` |
406406
| `tls.certs.certManager` | Provision certificates with cert-manager | `false` |
407-
| `tls.certs.certManagerIssuer.group` | IssuerRef group to use when generating certificates | `cert-manager.io` |
408-
| `tls.certs.certManagerIssuer.kind` | IssuerRef kind to use when generating certificates | `Issuer` |
409-
| `tls.certs.certManagerIssuer.name` | IssuerRef name to use when generating certificates | `cockroachdb` |
410-
| `tls.certs.certManagerIssuer.clientCertDuration` | Duration of client cert in hours | `672h` |
411-
| `tls.certs.certManagerIssuer.clientCertExpiryWindow` | Expiry window of client cert means a window before actual expiry in which client cert should be rotated | `48h` |
412-
| `tls.certs.certManagerIssuer.nodeCertDuration` | Duration of node cert in hours | `8760h` |
413-
| `tls.certs.certManagerIssuer.nodeCertExpiryWindow` | Expiry window of node certificates means a window before actual expiry in which node certs should be rotated. | `168h` |
407+
| `tls.certs.clientCertManagerIssuer.group` | IssuerRef group to use when generating client certificates | `cert-manager.io` |
408+
| `tls.certs.clientCertManagerIssuer.kind` | IssuerRef kind to use when generating client certificates | `Issuer` |
409+
| `tls.certs.clientCertManagerIssuer.name` | IssuerRef name to use when generating client certificates | `cockroachdb` |
410+
| `tls.certs.nodeCertManagerIssuer.group` | IssuerRef group to use when generating node certificates | `cert-manager.io` |
411+
| `tls.certs.nodeCertManagerIssuer.kind` | IssuerRef kind to use when generating node certificates | `Issuer` |
412+
| `tls.certs.nodeCertManagerIssuer.name` | IssuerRef name to use when generating node certificates | `cockroachdb` |
413+
| `tls.certs.clientCertManagerIssuer.clientCertDuration` | Duration of client cert in hours | `672h` |
414+
| `tls.certs.clientCertManagerIssuer.clientCertExpiryWindow` | Expiry window of client cert means a window before actual expiry in which client cert should be rotated | `48h` |
415+
| `tls.certs.nodeCertManagerIssuer.nodeCertDuration` | Duration of node cert in hours | `8760h` |
416+
| `tls.certs.nodeCertManagerIssuer.nodeCertExpiryWindow` | Expiry window of node certificates means a window before actual expiry in which node certs should be rotated. | `168h` |
414417
| `tls.selfSigner.image.repository` | Image to use for self signing TLS certificates | `cockroachlabs-helm-charts/cockroach-self-signer-cert`|
415418
| `tls.selfSigner.image.tag` | Image tag to use for self signing TLS certificates | `0.1` |
416419
| `tls.selfSigner.image.pullPolicy` | Self signing TLS certificates container pull policy | `IfNotPresent` |

‎cockroachdb/templates/certificate.client.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ metadata:
1717
{{- toYaml . | nindent 4 }}
1818
{{- end }}
1919
spec:
20-
duration: {{ .Values.tls.certs.certManagerIssuer.clientCertDuration }}
21-
renewBefore: {{ .Values.tls.certs.certManagerIssuer.clientCertExpiryWindow }}
20+
duration: {{ .Values.tls.certs.clientCertManagerIssuer.certDuration }}
21+
renewBefore: {{ .Values.tls.certs.clientCertManagerIssuer.certExpiryWindow }}
2222
usages:
2323
- digital signature
2424
- key encipherment
@@ -42,7 +42,7 @@ spec:
4242
{{- end }}
4343
secretName: {{ .Values.tls.certs.clientRootSecret }}
4444
issuerRef:
45-
name: {{ .Values.tls.certs.certManagerIssuer.name }}
46-
kind: {{ .Values.tls.certs.certManagerIssuer.kind }}
47-
group: {{ .Values.tls.certs.certManagerIssuer.group }}
45+
name: {{ .Values.tls.certs.clientCertManagerIssuer.name }}
46+
kind: {{ .Values.tls.certs.clientCertManagerIssuer.kind }}
47+
group: {{ .Values.tls.certs.clientCertManagerIssuer.group }}
4848
{{- end }}

‎cockroachdb/templates/certificate.node.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@ metadata:
1717
{{- toYaml . | nindent 4 }}
1818
{{- end }}
1919
spec:
20-
duration: {{ .Values.tls.certs.certManagerIssuer.nodeCertDuration }}
21-
renewBefore: {{ .Values.tls.certs.certManagerIssuer.nodeCertExpiryWindow }}
20+
duration: {{ .Values.tls.certs.nodeCertManagerIssuer.certDuration }}
21+
renewBefore: {{ .Values.tls.certs.nodeCertManagerIssuer.certExpiryWindow }}
2222
usages:
2323
- digital signature
2424
- key encipherment
@@ -52,7 +52,7 @@ spec:
5252
- {{ printf "*.%s.%s.svc.%s" (include "cockroachdb.fullname" .) .Release.Namespace .Values.clusterDomain | quote }}
5353
secretName: {{ .Values.tls.certs.nodeSecret }}
5454
issuerRef:
55-
name: {{ .Values.tls.certs.certManagerIssuer.name }}
56-
kind: {{ .Values.tls.certs.certManagerIssuer.kind }}
57-
group: {{ .Values.tls.certs.certManagerIssuer.group }}
55+
name: {{ .Values.tls.certs.nodeCertManagerIssuer.name }}
56+
kind: {{ .Values.tls.certs.nodeCertManagerIssuer.kind }}
57+
group: {{ .Values.tls.certs.nodeCertManagerIssuer.group }}
5858
{{- end }}

‎cockroachdb/values.yaml‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -482,18 +482,22 @@ tls:
482482
# Specify an Issuer or a ClusterIssuer to use, when issuing
483483
# node and client certificates. The values correspond to the
484484
# issuerRef specified in the certificate.
485-
certManagerIssuer:
485+
clientCertManagerIssuer:
486486
group: cert-manager.io
487487
kind: Issuer
488-
name: cockroachdb
488+
name: cockroachdb-client
489489
# Duration of Client certificates in hours
490-
clientCertDuration: 672h
490+
certDuration: 672h
491491
# Expiry window of client certificates means a window before actual expiry in which client certs should be rotated.
492-
clientCertExpiryWindow: 48h
492+
certExpiryWindow: 48h
493+
nodeCertManagerIssuer:
494+
group: cert-manager.io
495+
kind: Issuer
496+
name: cockroachdb-node
493497
# Duration of node certificates in hours
494-
nodeCertDuration: 8760h
498+
certDuration: 8760h
495499
# Expiry window of node certificates means a window before actual expiry in which node certs should be rotated.
496-
nodeCertExpiryWindow: 168h
500+
certExpiryWindow: 168h
497501
# Enable if you run cert-manager >=1.0 on K8s <=1.15 with legacy CRDs
498502
# Legacy CRDs only support cert-manager.io/v1 API Versions
499503
useCertManagerV1CRDs: false

0 commit comments

Comments
 (0)