Merge pull request #8616 from mindrunner/helm_ssl_support
feat(helm): add ssl support for helm chart
This commit is contained in:
JianBo He
GitHub
commit
2203852ad9
|
|
@ -1,11 +1,14 @@
|
|||
# Introduction
|
||||
|
||||
This chart bootstraps an emqx deployment on a Kubernetes cluster using the Helm package manager.
|
||||
|
||||
# Prerequisites
|
||||
|
||||
+ Kubernetes 1.6+
|
||||
+ Helm
|
||||
|
||||
# Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-emqx`:
|
||||
|
||||
+ From github
|
||||
|
|
@ -23,24 +26,27 @@ To install the chart with the release name `my-emqx`:
|
|||
> If you want to install an unstable version, you need to add `--devel` when you execute the `helm install` command.
|
||||
|
||||
# Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `my-emqx` deployment:
|
||||
|
||||
```
|
||||
$ helm del my-emqx
|
||||
```
|
||||
|
||||
# Configuration
|
||||
|
||||
The following table lists the configurable parameters of the emqx chart and their default values.
|
||||
|
||||
| Parameter | Description | Default Value |
|
||||
| --- | --- | --- |
|
||||
|--------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------|
|
||||
| `replicaCount` | It is recommended to have odd number of nodes in a cluster, otherwise the emqx cluster cannot be automatically healed in case of net-split. | 3 |
|
||||
| `image.repository` | EMQX Image name | emqx/emqx |
|
||||
| `image.pullPolicy` | The image pull policy | IfNotPresent |
|
||||
| `image.pullSecrets ` | The image pull secrets | `[]` (does not add image pull secrets to deployed pods) |
|
||||
| `envFromSecret` | The name pull a secret in the same kubernetes namespace which contains values that will be added to the environment | nil |
|
||||
| `recreatePods` | Forces the recreation of pods during upgrades, which can be useful to always apply the most recent configuration. | false |
|
||||
`podAnnotations ` | Annotations for pod | `{}`
|
||||
`podManagementPolicy`| To redeploy a chart with existing PVC(s), the value must be set to Parallel to avoid deadlock | `Parallel`
|
||||
| `podAnnotations ` | Annotations for pod | `{}` |
|
||||
| `podManagementPolicy` | To redeploy a chart with existing PVC(s), the value must be set to Parallel to avoid deadlock | `Parallel` |
|
||||
| `persistence.enabled` | Enable EMQX persistence using PVC | false |
|
||||
| `persistence.storageClass` | Storage class of backing PVC | `nil` (uses alpha storage class annotation) |
|
||||
| `persistence.existingClaim` | EMQX data Persistent Volume existing claim name, evaluated as a template | "" |
|
||||
|
|
@ -71,7 +77,7 @@ The following table lists the configurable parameters of the emqx chart and thei
|
|||
| `ingress.dashboard.enabled` | Enable ingress for EMQX Dashboard | false |
|
||||
| `ingress.dashboard.ingressClassName` | Set the ingress class for EMQX Dashboard | |
|
||||
| `ingress.dashboard.path` | Ingress path for EMQX Dashboard | / |
|
||||
| `ingress.dashboard.pathType` | Ingress pathType for EMQX Dashboard | `ImplementationSpecific`
|
||||
| `ingress.dashboard.pathType` | Ingress pathType for EMQX Dashboard | `ImplementationSpecific` |
|
||||
| `ingress.dashboard.hosts` | Ingress hosts for EMQX Mgmt API | dashboard.emqx.local |
|
||||
| `ingress.dashboard.tls` | Ingress tls for EMQX Mgmt API | [] |
|
||||
| `ingress.dashboard.annotations` | Ingress annotations for EMQX Mgmt API | {} |
|
||||
|
|
@ -83,10 +89,33 @@ The following table lists the configurable parameters of the emqx chart and thei
|
|||
| `ingress.mgmt.annotations` | Ingress annotations for EMQX Mgmt API | {} |
|
||||
| `metrics.enable` | If set to true, [prometheus-operator](https://github.com/prometheus-operator/prometheus-operator) needs to be installed, and emqx_prometheus needs to enable | false |
|
||||
| `metrics.type` | Now we only supported "prometheus" | "prometheus" |
|
||||
| `ssl.enabled` | Enable SSL support | false |
|
||||
| `ssl.useExisting` | Use existing certificate or let cert-manager generate one | false |
|
||||
| `ssl.existingName` | Name of existing certificate | emqx-tls |
|
||||
| `ssl.dnsnames` | DNS name(s) for certificate to be generated | {} |
|
||||
| `ssl.issuer.name` | Issuer name for certificate generation | letsencrypt-dns |
|
||||
| `ssl.issuer.kind` | Issuer kind for certificate generation | ClusterIssuer |
|
||||
|
||||
## EMQX specific settings
|
||||
The following table lists the configurable [EMQX](https://www.emqx.io/)-specific parameters of the chart and their default values.
|
||||
|
||||
The following table lists the configurable [EMQX](https://www.emqx.io/)-specific parameters of the chart and their
|
||||
default values.
|
||||
Parameter | Description | Default Value
|
||||
--- | --- | ---
|
||||
`emqxConfig` | Map of [configuration](https://www.emqx.io/docs/en/latest/configuration/configuration.html) items expressed as [environment variables](https://www.emqx.io/docs/en/v4.3/configuration/environment-variable.html) (prefix can be omitted) or using the configuration files [namespaced dotted notation](https://www.emqx.io/docs/en/latest/configuration/configuration.html) | `nil`
|
||||
`emqxConfig` | Map of [configuration](https://www.emqx.io/docs/en/latest/configuration/configuration.html) items
|
||||
expressed as [environment variables](https://www.emqx.io/docs/en/v4.3/configuration/environment-variable.html) (prefix
|
||||
can be omitted) or using the configuration
|
||||
files [namespaced dotted notation](https://www.emqx.io/docs/en/latest/configuration/configuration.html) | `nil`
|
||||
`emqxLicenseSecretName` | Name of the secret that holds the license information | `nil`
|
||||
|
||||
## SSL settings
|
||||
`cert-manager` generates secrets with certificate data using the keys `tls.crt` and `tls.key`. The helm chart always mounts those keys as files to `/tmp/ssl/`
|
||||
which needs to explicitly configured by either changing the emqx config file or by passing the following environment variables:
|
||||
|
||||
```
|
||||
EMQX_LISTENERS__SSL__DEFAULT__SSL_OPTIONS__CERTFILE: /tmp/ssl/tls.crt
|
||||
EMQX_LISTENERS__SSL__DEFAULT__SSL_OPTIONS__KEYFILE: /tmp/ssl/tls.key
|
||||
```
|
||||
|
||||
If you chose to use an existing certificate, make sure, you update the filenames accordingly.
|
||||
|
||||
|
|
|
|||
|
|
@ -53,6 +53,11 @@ spec:
|
|||
{{- end }}
|
||||
spec:
|
||||
volumes:
|
||||
{{- if .Values.ssl.enabled }}
|
||||
- name: ssl-cert
|
||||
secret:
|
||||
secretName: {{ include "emqx.fullname" . }}-tls
|
||||
{{- end }}
|
||||
{{- if not .Values.persistence.enabled }}
|
||||
- name: emqx-data
|
||||
emptyDir: {}
|
||||
|
|
@ -124,12 +129,17 @@ spec:
|
|||
volumeMounts:
|
||||
- name: emqx-data
|
||||
mountPath: "/opt/emqx/data"
|
||||
{{- if .Values.ssl.enabled }}
|
||||
- name: ssl-cert
|
||||
mountPath: /tmp/ssl
|
||||
readOnly: true
|
||||
{{- end}}
|
||||
{{ if .Values.emqxLicenseSecretName }}
|
||||
- name: emqx-license
|
||||
mountPath: "/opt/emqx/etc/emqx.lic"
|
||||
subPath: "emqx.lic"
|
||||
readOnly: true
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /api/v5/status
|
||||
|
|
|
|||
|
|
@ -0,0 +1,16 @@
|
|||
{{- if and (.Values.ssl.enable) (not .Values.ssl.useExisting) -}}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ include "emqx.fullname" . }}-tls
|
||||
spec:
|
||||
secretName: {{ include "emqx.fullname" . }}-tls
|
||||
issuerRef:
|
||||
name: {{ default "letsencrypt-staging" .Values.ssl.issuer.name }}
|
||||
kind: {{ default "ClusterIssuer" .Values.ssl.issuer.kind }}
|
||||
dnsNames:
|
||||
{{- range .Values.ssl.dnsnames }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
|
@ -203,3 +203,12 @@ containerSecurityContext:
|
|||
metrics:
|
||||
enabled: false
|
||||
type: prometheus
|
||||
|
||||
ssl:
|
||||
enabled: false
|
||||
useExisting: false
|
||||
existingName: emqx-tls
|
||||
dnsnames: {}
|
||||
issuer:
|
||||
name: letsencrypt-dns
|
||||
kind: ClusterIssuer
|
||||
|
|
|
|||
Loading…
Reference in New Issue