chore: Simplify cert-manager certs and support existingIssuer

Signed-off-by: Marco Kilchhofer <[email protected]>
kedacore · May 15, 2023 · 84d5c43 · 84d5c43
1 parent 0c6ab99
commit 84d5c43
Show file tree

Hide file tree

Showing 8 changed files with 18 additions and 53 deletions.
diff --git a/keda/README.md b/keda/README.md
@@ -215,8 +215,9 @@ their default values.
 | `certificates.secretName`                                  | Secret name to be mounted with KEDA TLS certificates | `kedaorg-certs` |
 | `certificates.mountPath`                                   | Path where KEDA TLS certificates are mounted | `/certs` |
 | `certificates.certManager.enabled`                         | Enables Cert-manager for certificate management | `false` |
-| `certificates.certManager.generateCA`                      | Generates a self-signed CA with Cert-manager | `true` |
-| `certificates.certManager.caSecretName`                    | Secret name where the CA is stored (generatedby cert-manager or user given) | `kedaorg-ca` |
+| `certificates.certManager.existingIssuer.enabled`          | Use an existing cert-manager issuer | `false` |
+| `certificates.certManager.existingIssuer.kind`             | Kind of the existing cert-manager issuer | `ClusterIssuer` |
+| `certificates.certManager.existingIssuer.name`             | Name of the existing cert-manager issuer | `""` |
 | `certificates.certManager.secretTemplate`                  | [Labels or annotations to add to the secret generated](https://cert-manager.io/docs/usage/certificate/#creating-certificate-resources) by cert-manager | `{}` |
 
 

diff --git a/keda/templates/40-cert-manager-self-issuer.yaml b/keda/templates/40-cert-manager-self-issuer.yaml
diff --git a/keda/templates/41-cert-manager-self-ca.yaml b/keda/templates/41-cert-manager-self-ca.yaml
diff --git a/keda/templates/42-cert-manager-keda-issuer.yaml b/keda/templates/42-cert-manager-keda-issuer.yaml
@@ -1,4 +1,4 @@
-{{- if .Values.certificates.certManager.enabled }}
+{{- if and .Values.certificates.certManager.enabled (not .Values.certificates.certManager.existingIssuer.enabled) }}
 apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
@@ -7,6 +7,5 @@ metadata:
   name: {{ .Values.operator.name }}-issuer
   namespace: {{ .Release.Namespace }}
 spec:
-  ca:
-    secretName: {{ .Values.certificates.certManager.caSecretName }}
-{{- end }}
+  selfSigned: {}
+{{- end }}
diff --git a/keda/templates/43-cert-manager-keda-tls-certificate.yaml b/keda/templates/43-cert-manager-keda-tls-certificate.yaml
@@ -28,7 +28,12 @@ spec:
   duration: 8760h0m0s # 1 year
   renewBefore: 5840h0m0s # 8 months
   issuerRef:
+    {{- if .Values.certificates.certManager.existingIssuer.enabled }}
+    name: {{ .Values.certificates.certManager.existingIssuer.name }}
+    kind: {{ .Values.certificates.certManager.existingIssuer.kind }}
+    {{- else }}
     name: {{ .Values.operator.name }}-issuer
     kind: Issuer
+    {{- end }}
     group: cert-manager.io
 {{- end }}
diff --git a/keda/templates/metrics-server/apiservice.yaml b/keda/templates/metrics-server/apiservice.yaml
@@ -3,11 +3,7 @@ kind: APIService
 metadata:
   annotations:
     {{- if .Values.certificates.certManager.enabled }}
-    {{- if .Values.certificates.certManager.generateCA }}
-    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.operator.name }}-ca
-    {{- else }}
-    cert-manager.io/inject-ca-from-secret: {{ .Release.Namespace }}/{{ .Values.certificates.certManager.caSecretName }}
-    {{- end }}
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.operator.name }}-tls-certificates
     {{- end }}
     {{- if .Values.additionalAnnotations }}
     {{- toYaml .Values.additionalAnnotations | nindent 4 }}

diff --git a/keda/templates/webhooks/validatingconfiguration.yaml b/keda/templates/webhooks/validatingconfiguration.yaml
@@ -4,11 +4,7 @@ kind: ValidatingWebhookConfiguration
 metadata:
   annotations:
     {{- if .Values.certificates.certManager.enabled }}
-    {{- if .Values.certificates.certManager.generateCA }}
-    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.operator.name }}-ca
-    {{- else }}
-    cert-manager.io/inject-ca-from-secret: {{ .Release.Namespace }}/{{ .Values.certificates.certManager.caSecretName }}
-    {{- end }}
+    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ .Values.operator.name }}-tls-certificates
     {{- end }}
     {{- if .Values.additionalAnnotations }}
     {{- toYaml .Values.additionalAnnotations | nindent 4 }}

diff --git a/keda/values.yaml b/keda/values.yaml
@@ -451,17 +451,18 @@ certificates:
   mountPath: /certs
   certManager:
     enabled: false
-    # If generateCA is false, the secret with the CA
-    # has to be annotated with 'cert-manager.io/allow-direct-injection: "true"'
-    generateCA: true
-    caSecretName: "kedaorg-ca"
     # Add labels/annotations to secrets created by Certificate resources
     secretTemplate: {}
       # annotations:
       #   my-secret-annotation-1: "foo"
       #   my-secret-annotation-2: "bar"
       # labels:
       #   my-secret-label: foo
+    # Use an existing cert-manager issuer.
+    existingIssuer:
+      enabled: false
+      kind: ClusterIssuer
+      name: ""
 
 permissions:
   metricServer: