manage etcd-cert with cert-manager

helm-charts/konk/scripts/provision.sh

@@ -41,39 +41,6 @@ kubeadm init phase certs etcd-server --config=/tmp/kubeadmcfg.yaml
 kubeadm init phase kubeconfig admin --control-plane-endpoint $FULLNAME.$NAMESPACE.svc
 find /etc/kubernetes/pki
 
-if secret_not_found $FULLNAME-etcd-cert
-then
-  kubectl -n $NAMESPACE create secret generic $FULLNAME-etcd-cert \
-    --from-file=/etc/kubernetes/pki/etcd/ca.crt \
-    --from-file=/etc/kubernetes/pki/etcd/server.crt \
-    --from-file=/etc/kubernetes/pki/etcd/server.key
-  kubectl -n $NAMESPACE label secret $FULLNAME-etcd-cert $LABELS
-else
-  kubectl -n $NAMESPACE patch secret $FULLNAME-etcd-cert --type=json -p '[
-    {"op":"replace","path":"/data/server.crt","value":"'"$(base64 --wrap=0 < /etc/kubernetes/pki/etcd/server.crt)"'"},
-    {"op":"replace","path":"/data/server.key","value":"'"$(base64 --wrap=0 < /etc/kubernetes/pki/etcd/server.key)"'"}
-  ]'
-fi
-
-if secret_not_found $FULLNAME-apiserver-cert
-then
-  kubectl -n $NAMESPACE create secret generic $FULLNAME-apiserver-cert \
-    --from-file=/etc/kubernetes/pki/apiserver.crt \
-    --from-file=/etc/kubernetes/pki/apiserver.key \
-    --from-file=/etc/kubernetes/pki/ca.crt \
-    --from-file=etcd-ca.crt=/etc/kubernetes/pki/etcd/ca.crt \
-    --from-file=/etc/kubernetes/pki/apiserver-etcd-client.crt \
-    --from-file=/etc/kubernetes/pki/apiserver-etcd-client.key
-  kubectl -n $NAMESPACE label secret $FULLNAME-apiserver-cert $LABELS
-else
-  kubectl -n $NAMESPACE patch secret $FULLNAME-apiserver-cert --type=json -p '[
-    {"op":"replace","path":"/data/apiserver.crt","value":"'"$(base64 --wrap=0 < /etc/kubernetes/pki/apiserver.crt)"'"},
-    {"op":"replace","path":"/data/apiserver.key","value":"'"$(base64 --wrap=0 < /etc/kubernetes/pki/apiserver.key)"'"},
-    {"op":"replace","path":"/data/apiserver-etcd-client.crt","value":"'"$(base64 --wrap=0 < /etc/kubernetes/pki/apiserver-etcd-client.crt)"'"},
-    {"op":"replace","path":"/data/apiserver-etcd-client.key","value":"'"$(base64 --wrap=0 < /etc/kubernetes/pki/apiserver-etcd-client.key)"'"}
-  ]'
-fi
-
 if secret_not_found $FULLNAME-ca
 then
   kubectl -n $NAMESPACE create secret tls $FULLNAME-ca \
@@ -115,7 +82,7 @@ fi
 kubectl -n $NAMESPACE wait --timeout=3m --for=condition=progressing deployments.apps -l app.kubernetes.io/instance=$RELEASE
 
 DEPLOYMENT_UID=$(kubectl get deployments.apps -n $NAMESPACE $FULLNAME -o jsonpath='{.metadata.uid}')
-for name in $FULLNAME-apiserver-cert $FULLNAME-etcd-cert $FULLNAME-ca $FULLNAME-etcd-ca $FULLNAME-kubeconfig
+for name in $FULLNAME-apiserver-cert $FULLNAME-ca $FULLNAME-etcd-ca $FULLNAME-kubeconfig
 do
   kubectl patch -n $NAMESPACE secret $name -p '{"metadata":{"ownerReferences":[{"apiVersion":"apps/v1", "kind":"Deployment", "name":"'${FULLNAME}'", "uid":"'${DEPLOYMENT_UID}'"}]}}'
 done

helm-charts/konk/templates/apiserver-cert.yaml

@@ -0,0 +1,32 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ include "konk.fullname" . }}-apiserver-ca
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "konk.labels" . | nindent 4 }}
+spec:
+ ca:
+   secretName: {{ include "konk.fullname" . }}-apiserver-ca
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "konk.fullname" . }}-apiserver-cert
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "konk.labels" . | nindent 4 }}
+spec:
+  secretName: {{ include "konk.fullname" . }}-apiserver-cert
+  commonName: {{ include "konk.fullname" . }}
+  dnsNames:
+  - {{ include "konk.fullname" . }}-apiserver
+  - {{ include "konk.fullname" . }}
+  - {{ include "konk.fullname" . }}.{{ .Release.Namespace }}
+  - {{ include "konk.fullname" . }}.{{ .Release.Namespace }}.svc
+  - {{ include "konk.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
+  issuerRef:
+    name: {{ include "konk.fullname" . }}-apiserver-ca
+    kind: Issuer
+  revisionHistoryLimit: 1
+...

helm-charts/konk/templates/deployment.yaml

@@ -110,9 +110,9 @@ spec:
           command:
             - etcd
             - --advertise-client-urls=https://127.0.0.1:2379
-            - --cert-file=/etc/kubernetes/pki/apiserver/etcd/server.crt
+            - --cert-file=/etc/kubernetes/pki/apiserver/etcd/tls.crt
             - --client-cert-auth=true
-            - --key-file=/etc/kubernetes/pki/apiserver/etcd/server.key
+            - --key-file=/etc/kubernetes/pki/apiserver/etcd/tls.key
             - --listen-client-urls=https://127.0.0.1:2379
             - --listen-metrics-urls=http://0.0.0.0:2381
             - --name={{ .Chart.Name }}

helm-charts/konk/templates/etcd-cert.yaml

@@ -0,0 +1,28 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ include "konk.fullname" . }}-etcd-ca
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "konk.labels" . | nindent 4 }}
+spec:
+ ca:
+   secretName: {{ include "konk.fullname" . }}-etcd-ca
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "konk.fullname" . }}-etcd-cert
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "konk.labels" . | nindent 4 }}
+spec:
+  secretName: {{ include "konk.fullname" . }}-etcd-cert
+  commonName: {{ include "konk.fullname" . }}
+  dnsNames:
+  - {{ include "konk.fullname" . }}-etcd-headless
+  issuerRef:
+    name: {{ include "konk.fullname" . }}-etcd-ca
+    kind: Issuer
+  revisionHistoryLimit: 1
+...

helm-charts/konk/templates/etcd.yaml

@@ -16,8 +16,8 @@ spec:
       enableAuthentication: true
       secureTransport: true
       existingSecret: {{ include "konk.fullname" $ }}-etcd-cert
-      certFilename: server.crt
-      certKeyFilename: server.key
+      certFilename: tls.crt
+      certKeyFilename: tls.key
   {{- if $.Values.space.enabled }}
   global:
     imagePullSecrets:

helm-charts/konk/templates/init.yaml

@@ -20,25 +20,16 @@ spec:
         app.kubernetes.io/component: init
     spec:
       serviceAccountName: {{ include "konk.serviceAccountName" . }}
-      containers:
+      initContainers:
       - name: provision
         securityContext:
           {{- toYaml .Values.kind.securityContext | nindent 10 }}
         image: "{{ .Values.kind.image.repository }}:{{ .Values.kind.image.tag | default .Chart.AppVersion }}"
         imagePullPolicy: {{ .Values.kind.image.pullPolicy }}
         command:
           - bash
-          - "-c"
         args:
-          - |
-            set -e
-            while true
-            do
-              date
-              /scripts/provision.sh
-              touch /tmp/ready
-              sleep 90d
-            done
+          - /scripts/provision.sh
         env:
           {{- with .Values.certManager.namespace }}
           - name: CERT_MANAGER_NAMESPACE
@@ -56,17 +47,21 @@ spec:
             value: {{ .Release.Name }}
           - name: SCOPE
             value: {{ .Values.scope }}
-        readinessProbe:
-          exec:
-            command:
-            - cat
-            - /tmp/ready
         resources:
           {{- toYaml .Values.kind.resources | nindent 10 }}
         volumeMounts:
         - mountPath: /scripts/
           name: scripts
           readOnly: true
+      containers:
+      - name: done
+        securityContext:
+          {{- toYaml .Values.kind.securityContext | nindent 10 }}
+        image: "{{ .Values.kind.image.repository }}:{{ .Values.kind.image.tag | default .Chart.AppVersion }}"
+        imagePullPolicy: {{ .Values.kind.image.pullPolicy }}
+        command:
+          - sleep
+          - infinity
       volumes:
       - name: scripts
         configMap: