Add preinstall hook to rancher chart

2024-12-12 09:31:48 +09:00
parent b298188ca3
commit 38438d89e1
7 changed files with 99 additions and 4 deletions
@@ -13,9 +13,9 @@ ingress:
    nginx.ingress.kubernetes.io/proxy-body-size: 10m

    # cert-manager 사용시
-    cert-manager.io/cluster-issuer: "selfsigned-issuer" 
-    cert-manager.io/duration: 8760h  
-    cert-manager.io/renew-before: 720h
+    # cert-manager.io/cluster-issuer: "selfsigned-issuer" 
+    # cert-manager.io/duration: 8760h  
+    # cert-manager.io/renew-before: 720h


 # 사설 인증서 사용시 true
@@ -38,3 +38,5 @@ resources:
 extraEnv:
 - name: TZ
  value: Asia/Seoul
+
+preinstallHook: true
@@ -0,0 +1,19 @@
+{{- if .Values.preinstallHook }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ .Values.ingress.tls.secretName }}
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "1" # Certificate 생성 후 실행되도록 우선순위 설정
+    "helm.sh/hook-delete-policy": before-hook-creation
+spec:
+  secretName: {{ .Values.ingress.tls.secretName }}
+  duration: 8750h
+  renewBefore: 720h
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+  dnsNames:
+    - {{ .Values.hostname }}
+{{- end }}
@@ -0,0 +1,31 @@
+{{- if .Values.preinstallHook }}
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: create-tls-ca-job
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "2" # Certificate 생성 후 실행되도록 우선순위 설정
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+spec:
+  backoffLimit: 4
+  template:
+    spec:
+      serviceAccountName: create-tls-ca-sa
+      containers:
+        - name: create-secret
+          image: bitnami/kubectl:latest
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - -c
+            - |
+              echo "Waiting for rancher-tls-secret to be created..."
+              while [ $(kubectl get secret {{ .Values.ingress.tls.secretName }} -n {{ .Release.Namespace }} --ignore-not-found | wc -l) -lt 2 ]; do
+                sleep 1
+              done
+              echo "Creating new secret with custom key..."
+              RANCHER_CA_CERT=$(kubectl get secret {{ .Values.ingress.tls.secretName }}  -o jsonpath='{.data.ca\.crt}' -n {{ .Release.Namespace }} | base64 -d)
+              kubectl create secret generic tls-ca --from-literal=cacerts\.pem="${RANCHER_CA_CERT}" -n {{ .Release.Namespace }}
+      restartPolicy: OnFailure
+{{- end }}
@@ -0,0 +1,14 @@
+{{- if .Values.preinstallHook }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: create-tls-ca-role
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "-2"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "update", "patch", "list"]
+{{- end }} 
@@ -0,0 +1,17 @@
+{{- if .Values.preinstallHook }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: create-tls-ca-rolebinding
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "-1"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+subjects:
+  - kind: ServiceAccount
+    name: create-tls-ca-sa
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: Role
+  name: create-tls-ca-role
+{{- end }} 
@@ -0,0 +1,10 @@
+{{- if .Values.preinstallHook }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: create-tls-ca-sa
+  annotations:
+    "helm.sh/hook": pre-install
+    "helm.sh/hook-weight": "-3"
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
+{{- end }}
@@ -197,3 +197,5 @@ webhook: ""
 # helm values to use when installing the fleet chart.
 # helm values set here will override all other global values used when installing the fleet chart.
 fleet: ""
+
+preinstallHook: false