wbsong111
33 lines
1.4 KiB
YAML
33 lines
1.4 KiB
YAML
{{- if .Values.preinstallHook }}
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: {{ template "rancher.fullname" . }}-create-tls-ca-job
|
|
labels: {{ include "rancher.labels" . | nindent 4 }}
|
|
annotations:
|
|
"helm.sh/hook": pre-install
|
|
"helm.sh/hook-weight": "2" # Certificate 생성 후 실행되도록 우선순위 설정
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
|
|
spec:
|
|
backoffLimit: 4
|
|
template:
|
|
spec:
|
|
serviceAccountName: {{ template "rancher.fullname" . }}-create-tls-ca-sa
|
|
containers:
|
|
- name: create-secret
|
|
image: bitnami/kubectl:latest
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
echo "Waiting for rancher-tls-secret to be created..."
|
|
while [ $(kubectl get secret {{ .Values.ingress.tls.secretName }} -n {{ .Release.Namespace }} --ignore-not-found | wc -l) -lt 2 ]; do
|
|
sleep 1
|
|
done
|
|
echo "Creating new secret with custom key..."
|
|
RANCHER_CA_CERT=$(kubectl get secret {{ .Values.ingress.tls.secretName }} -o jsonpath='{.data.ca\.crt}' -n {{ .Release.Namespace }} | base64 -d)
|
|
kubectl create secret generic tls-ca --from-literal=cacerts\.pem="${RANCHER_CA_CERT}" -n {{ .Release.Namespace }}
|
|
restartPolicy: OnFailure
|
|
{{- end }}
|