Skip to content

Commit c78344f

Browse files
ArnobKumarSahaArnobKumarSaha
authored
Add extra SANs for hosted gateway TLS certificate (#1296)
Signed-off-by: Arnob kumar saha <arnob@appscode.com>
1 parent 0fad0fa commit c78344f

6 files changed

Lines changed: 58 additions & 8 deletions

File tree

‎charts/ace/templates/gateway/route-main.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ spec:
2222
{{- if eq (include "ace.gateway.migrationActive" .) "true" }}
2323
- {{ include "ace.gateway.fqdn" . }}
2424
{{- end }}
25+
{{- if and (eq .Values.global.platform.deploymentType "Hosted") (eq .Values.global.platform.host "appscode.com") }}
26+
- "api.{{ .Values.global.platform.host }}"
27+
{{- end }}
2528
{{- end }}
2629
rules:
2730
- matches:

‎charts/opscenter-features/README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -157,10 +157,10 @@ The following table lists the configurable parameters of the `opscenter-features
157157
| helm.releases.cluster-manager-hub.version | | <code>"v2026.2.16"</code> |
158158
| helm.releases.cluster-manager-spoke.version | | <code>"v2026.2.16"</code> |
159159
| helm.releases.managed-serviceaccount-manager.version | | <code>"v2026.2.16"</code> |
160-
| helm.releases.cluster-proxy-manager.version | | <code>"v2026.2.16"</code> |
161-
| helm.releases.cluster-gateway-manager.version | | <code>"v2026.2.16"</code> |
160+
| helm.releases.cluster-proxy-manager.version | | <code>"v2026.6.26"</code> |
161+
| helm.releases.cluster-gateway-manager.version | | <code>"v2026.6.26"</code> |
162162
| helm.releases.cluster-auth-manager.version | | <code>"v2026.2.16"</code> |
163-
| helm.releases.cluster-profile-manager.version | | <code>"v2026.2.16"</code> |
163+
| helm.releases.cluster-profile-manager.version | | <code>"v2026.6.26"</code> |
164164
| helm.releases.hub-cluster-robot.version | | <code>"v2026.2.16"</code> |
165165
| helm.releases.fluxcd-manager.version | | <code>"v2026.2.16"</code> |
166166
| helm.releases.license-proxyserver-manager.version | | <code>"v2026.2.16"</code> |

‎charts/opscenter-features/values.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -231,13 +231,13 @@ helm:
231231
managed-serviceaccount-manager:
232232
version: "v2026.2.16"
233233
cluster-proxy-manager:
234-
version: "v2026.2.16"
234+
version: "v2026.6.26"
235235
cluster-gateway-manager:
236-
version: "v2026.2.16"
236+
version: "v2026.6.26"
237237
cluster-auth-manager:
238238
version: "v2026.2.16"
239239
cluster-profile-manager:
240-
version: "v2026.2.16"
240+
version: "v2026.6.26"
241241
hub-cluster-robot:
242242
version: "v2026.2.16"
243243
fluxcd-manager:

‎charts/service-gateway/templates/gateway-tls/certificate.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,11 @@ spec:
3131
{{- if eq .Values.infra.hostType "domain" }}
3232
dnsNames:
3333
- {{ include "gateway.domain" . }}
34+
{{- if and (eq (dig "mode" "" (.Values.gatewayClass.annotations | default dict)) "hosted") (eq .Values.infra.host "appscode.com") }}
35+
- "nats.{{ .Values.infra.host }}"
36+
- "api.{{ .Values.infra.host }}"
37+
- "api.byte.builders"
38+
{{- end }}
3439
commonName: {{ include "gateway.domain" . }}
3540
{{- end }}
3641
usages:

‎charts/service-gateway/templates/gateway-tls/issuer.yaml‎

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,45 @@ spec:
3030
name: {{ include "tenant.name" . }}-gw-acme-cred
3131
solvers:
3232
# An empty 'selector' means that this solver matches all domains
33-
{{- if (eq .Values.infra.tls.acme.solver "Ingress") }}
33+
{{- if eq (dig "mode" "" (.Values.gatewayClass.annotations | default dict)) "hosted" }}
34+
- selector: {}
35+
dns01:
36+
{{- if eq .Values.infra.dns.provider "cloudflare" }}
37+
cloudflare:
38+
apiTokenSecretRef:
39+
name: {{ include "tenant.name" . }}-gw-dns-cred
40+
key: CF_API_TOKEN
41+
{{- end }}
42+
{{- if eq .Values.infra.dns.provider "route53" }}
43+
route53:
44+
region: {{ .Values.infra.dns.auth.route53.AWS_REGION }}
45+
accessKeyIDSecretRef:
46+
name: {{ include "tenant.name" . }}-gw-dns-cred
47+
key: AWS_ACCESS_KEY_ID
48+
secretAccessKeySecretRef:
49+
name: {{ include "tenant.name" . }}-gw-dns-cred
50+
key: AWS_SECRET_ACCESS_KEY
51+
{{- end }}
52+
{{- if eq .Values.infra.dns.provider "cloudDNS" }}
53+
cloudDNS:
54+
project: {{ .Values.infra.dns.auth.cloudDNS.GOOGLE_PROJECT_ID }}
55+
serviceAccountSecretRef:
56+
name: {{ include "tenant.name" . }}-gw-dns-cred
57+
key: GOOGLE_SERVICE_ACCOUNT_JSON_KEY
58+
{{- end }}
59+
{{- if eq .Values.infra.dns.provider "azureDNS" }}
60+
azureDNS:
61+
clientID: {{ .Values.infra.dns.auth.azureDNS.servicePrincipalAppID }}
62+
clientSecretSecretRef:
63+
name: {{ include "tenant.name" . }}-gw-dns-cred
64+
key: SERVICE_PRINCIPAL_PASSWORD
65+
subscriptionID: {{ .Values.infra.dns.auth.azureDNS.subscriptionID }}
66+
tenantID: {{ .Values.infra.dns.auth.azureDNS.tenantID }}
67+
resourceGroupName: {{ .Values.infra.dns.auth.azureDNS.resourceGroupName }}
68+
hostedZoneName: {{ .Values.infra.dns.auth.azureDNS.hostedZoneName }}
69+
environment: {{ .Values.infra.dns.auth.azureDNS.environment | default "AzurePublicCloud" }}
70+
{{- end }}
71+
{{- else if (eq .Values.infra.tls.acme.solver "Ingress") }}
3472
- selector: {}
3573
http01:
3674
ingress:

‎charts/service-gateway/templates/gateway/gwclass.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,17 @@ spec:
7171
{{- end }}
7272

7373
envoyService:
74+
{{- $extraDomains := list }}
75+
{{- if and (eq (dig "mode" "" (.Values.gatewayClass.annotations | default dict)) "hosted") (eq .Values.infra.host "appscode.com") }}
76+
{{- $extraDomains = list (printf "nats.%s" .Values.infra.host) (printf "api.%s" .Values.infra.host) "api.byte.builders" }}
77+
{{- end }}
7478
{{- if or .Values.envoy.service.annotations (eq .Values.infra.hostType "domain") }}
7579
annotations:
7680
{{- with .Values.envoy.service.annotations }}
7781
{{- toYaml . | nindent 10 }}
7882
{{- end }}
7983
{{- if eq .Values.infra.hostType "domain" }}
80-
external-dns.alpha.kubernetes.io/hostname: {{ include "gateway.domain" . }}
84+
external-dns.alpha.kubernetes.io/hostname: {{ prepend $extraDomains (include "gateway.domain" .) | join "," }}
8185
{{- end }}
8286
{{- end }}
8387
externalTrafficPolicy: {{ .Values.envoy.service.externalTrafficPolicy }}

0 commit comments

Comments
 (0)