Skip to content

Commit 016822d

Browse files
mloiseleurmloiseleur
authored
fix(certificateResolvers)!: 💥 🐛 use same syntax in Chart and in Traefik
1 parent ac83953 commit 016822d

File tree

9 files changed

+100
-36
lines changed

9 files changed

+100
-36
lines changed

‎EXAMPLES.md

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -331,14 +331,15 @@ Here is a more complete example, using also native Let's encrypt feature of Trae
331331
persistence:
332332
enabled: true
333333
size: 128Mi
334-
certResolvers:
334+
certificatesResolvers:
335335
letsencrypt:
336-
email: "{{ letsencrypt_email }}"
337-
#caServer: https://acme-v02.api.letsencrypt.org/directory # Production server
338-
caServer: https://acme-staging-v02.api.letsencrypt.org/directory # Staging server
339-
dnsChallenge:
340-
provider: azuredns
341-
storage: /data/acme.json
336+
acme:
337+
email: "{{ letsencrypt_email }}"
338+
#caServer: https://acme-v02.api.letsencrypt.org/directory # Production server
339+
caServer: https://acme-staging-v02.api.letsencrypt.org/directory # Staging server
340+
dnsChallenge:
341+
provider: azuredns
342+
storage: /data/acme.json
342343
env:
343344
- name: AZURE_CLIENT_ID
344345
value: "{{ azure_dns_challenge_application_id }}"
@@ -529,11 +530,12 @@ stringData:
529530
persistence:
530531
enabled: true
531532
storageClass: xxx
532-
certResolvers:
533+
certificatesResolvers:
533534
letsencrypt:
534-
dnsChallenge:
535-
provider: cloudflare
536-
storage: /data/acme.json
535+
acme:
536+
dnsChallenge:
537+
provider: cloudflare
538+
storage: /data/acme.json
537539
env:
538540
- name: CF_DNS_API_TOKEN
539541
valueFrom:
@@ -553,6 +555,9 @@ podSecurityContext:
553555
fsGroupChangePolicy: "OnRootMismatch"
554556
```
555557

558+
>[!NOTE]
559+
> With [Traefik Hub](https://traefik.io/traefik-hub/), certificates can be stored as a `Secret` on Kubernetes with `distributedAcme` resolver.
560+
556561
# Provide default certificate with cert-manager and CloudFlare DNS
557562

558563
Setup:

‎traefik/VALUES.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ Kubernetes: `>=1.22.0-0`
3232
| additionalVolumeMounts | list | `[]` | Additional volumeMounts to add to the Traefik container |
3333
| affinity | object | `{}` | on nodes where no other traefik pods are scheduled. It should be used when hostNetwork: true to prevent port conflicts |
3434
| autoscaling.enabled | bool | `false` | Create HorizontalPodAutoscaler object. See EXAMPLES.md for more details. |
35-
| certResolvers | object | `{}` | Certificates resolvers configuration. Ref: https://doc.traefik.io/traefik/https/acme/#certificate-resolvers See EXAMPLES.md for more details. |
35+
| certificatesResolvers | object | `{}` | Certificates resolvers configuration. Ref: https://doc.traefik.io/traefik/https/acme/#certificate-resolvers See EXAMPLES.md for more details. |
3636
| commonLabels | object | `{}` | Add additional label to all resources |
3737
| core.defaultRuleSyntax | string | `""` | Can be used to use globally v2 router syntax See https://doc.traefik.io/traefik/v3.0/migration/v2-to-v3/#new-v3-syntax-notable-changes |
3838
| deployment.additionalContainers | list | `[]` | Additional containers (e.g. for metric offloading sidecars) |
@@ -191,7 +191,7 @@ Kubernetes: `>=1.22.0-0`
191191
| nodeSelector | object | `{}` | nodeSelector is the simplest recommended form of node selection constraint. |
192192
| persistence.accessMode | string | `"ReadWriteOnce"` | |
193193
| persistence.annotations | object | `{}` | |
194-
| persistence.enabled | bool | `false` | Enable persistence using Persistent Volume Claims ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ It can be used to store TLS certificates, see `storage` in certResolvers |
194+
| persistence.enabled | bool | `false` | Enable persistence using Persistent Volume Claims ref: http://kubernetes.io/docs/user-guide/persistent-volumes/. It can be used to store TLS certificates along with `certificatesResolvers.<name>.acme.storage` option |
195195
| persistence.existingClaim | string | `""` | |
196196
| persistence.name | string | `"data"` | |
197197
| persistence.path | string | `"/data"` | |

‎traefik/templates/_helpers.tpl

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,3 +159,20 @@ Cert: {{ $cert.Cert | b64enc }}
159159
Key: {{ $cert.Key | b64enc }}
160160
{{- end -}}
161161
{{- end -}}
162+
163+
{{- define "traefik.yaml2CommandLineArgsRec" -}}
164+
{{- $path := .path -}}
165+
{{- range $key, $value := .content -}}
166+
{{- if kindIs "map" $value }}
167+
{{- include "traefik.yaml2CommandLineArgsRec" (dict "path" (printf "%s.%s" $path $key) "content" $value) -}}
168+
{{- else }}
169+
--{{ join "." (list $path $key)}}={{ join "," $value }}
170+
{{- end -}}
171+
{{- end -}}
172+
{{- end -}}
173+
174+
{{- define "traefik.yaml2CommandLineArgs" -}}
175+
{{- range ((regexSplit "\n" ((include "traefik.yaml2CommandLineArgsRec" (dict "path" .path "content" .content)) | trim) -1) | compact) -}}
176+
{{ printf "- \"%s\"\n" . }}
177+
{{- end -}}
178+
{{- end -}}

‎traefik/templates/_podtemplate.tpl

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -685,17 +685,7 @@
685685
{{- end }}
686686
{{- end }}
687687
{{- end }}
688-
{{- range $resolver, $config := $.Values.certResolvers }}
689-
{{- range $option, $setting := $config }}
690-
{{- if kindIs "map" $setting }}
691-
{{- range $field, $value := $setting }}
692-
- "--certificatesresolvers.{{ $resolver }}.acme.{{ $option }}.{{ $field }}={{ if kindIs "slice" $value }}{{ join "," $value }}{{ else }}{{ $value }}{{ end }}"
693-
{{- end }}
694-
{{- else }}
695-
- "--certificatesresolvers.{{ $resolver }}.acme.{{ $option }}={{ $setting }}"
696-
{{- end }}
697-
{{- end }}
698-
{{- end }}
688+
{{- include "traefik.yaml2CommandLineArgs" (dict "path" "certificatesresolvers" "content" $.Values.certificatesResolvers) | nindent 10 }}
699689
{{- with .Values.additionalArguments }}
700690
{{- range . }}
701691
- {{ . | quote }}

‎traefik/templates/requirements.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@
55
{{- end }}
66
{{- end }}
77

8+
{{- if .Values.certResolvers }}
9+
{{- fail "ERROR: certResolvers setting has been removed. See v33.0.0 Changelog." }}
10+
{{- end }}
11+
812
{{- if and .Values.hub.enabled (not (contains "traefik-hub" .Values.image.repository)) }}
913
{{- fail "ERROR: traefik-hub image is required when enabling Traefik Hub" -}}
1014
{{- end }}

‎traefik/tests/pod-config_test.yaml

Lines changed: 41 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -330,15 +330,16 @@ tests:
330330
content: "--experimental.kubernetesgateway"
331331
- it: should have the certificate resolver options applied
332332
set:
333-
certResolvers:
333+
certificatesResolvers:
334334
myAcmeResolver:
335-
email: [email protected]
336-
dnsChallenge:
337-
provider: myProvider
338-
resolvers:
339-
- 1.1.1.1
340-
- 8.8.8.8
341-
tlsChallenge: true
335+
acme:
336+
email: [email protected]
337+
dnsChallenge:
338+
provider: myProvider
339+
resolvers:
340+
- 1.1.1.1
341+
- 8.8.8.8
342+
tlsChallenge: true
342343
asserts:
343344
- contains:
344345
path: spec.template.spec.containers[0].args
@@ -352,6 +353,38 @@ tests:
352353
- contains:
353354
path: spec.template.spec.containers[0].args
354355
content: "--certificatesresolvers.myAcmeResolver.acme.tlsChallenge=true"
356+
357+
- it: should have the distributed acme resolver options applied
358+
set:
359+
certificatesResolvers:
360+
my-resolver:
361+
distributedAcme:
362+
email: [email protected]
363+
storage:
364+
kubernetes: true
365+
httpChallenge:
366+
entrypoint: "web"
367+
asserts:
368+
- contains:
369+
path: spec.template.spec.containers[0].args
370+
content: "--certificatesresolvers.my-resolver.distributedAcme.email=email@example.com"
371+
- contains:
372+
path: spec.template.spec.containers[0].args
373+
content: "--certificatesresolvers.my-resolver.distributedAcme.storage.kubernetes=true"
374+
- contains:
375+
path: spec.template.spec.containers[0].args
376+
content: "--certificatesresolvers.my-resolver.distributedAcme.httpChallenge.entrypoint=web"
377+
378+
- it: should have the tailscale resolver options applied
379+
set:
380+
certificatesResolvers:
381+
my-resolver:
382+
tailscale: true
383+
asserts:
384+
- contains:
385+
path: spec.template.spec.containers[0].args
386+
content: "--certificatesresolvers.my-resolver.tailscale=true"
387+
355388
- it: should have prometheus annotations with specified values
356389
set:
357390
ports:

‎traefik/tests/requirements-config_test.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,3 +87,18 @@ tests:
8787
asserts:
8888
- failedTemplate:
8989
errorMessage: "ERROR: Kubernetes Gateway provider requires ClusterRole. RBAC cannot be namespaced."
90+
- it: should fail when trying to use certResolvers
91+
set:
92+
certResolvers:
93+
myAcmeResolver:
94+
email: [email protected]
95+
dnsChallenge:
96+
provider: myProvider
97+
resolvers:
98+
- 1.1.1.1
99+
- 8.8.8.8
100+
tlsChallenge: true
101+
asserts:
102+
- failedTemplate:
103+
errorMessage: "ERROR: certResolvers setting has been removed. See v33.0.0 Changelog."
104+

‎traefik/values.schema.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
},
2323
"type": "object"
2424
},
25-
"certResolvers": {
25+
"certificatesResolvers": {
2626
"properties": {},
2727
"type": "object"
2828
},

‎traefik/values.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -774,8 +774,8 @@ autoscaling:
774774

775775
persistence:
776776
# -- Enable persistence using Persistent Volume Claims
777-
# ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
778-
# It can be used to store TLS certificates, see `storage` in certResolvers
777+
# ref: http://kubernetes.io/docs/user-guide/persistent-volumes/.
778+
# It can be used to store TLS certificates along with `certificatesResolvers.<name>.acme.storage` option
779779
enabled: false
780780
name: data
781781
existingClaim: ""
@@ -791,7 +791,7 @@ persistence:
791791
# -- Certificates resolvers configuration.
792792
# Ref: https://doc.traefik.io/traefik/https/acme/#certificate-resolvers
793793
# See EXAMPLES.md for more details.
794-
certResolvers: {}
794+
certificatesResolvers: {}
795795

796796
# -- If hostNetwork is true, runs traefik in the host network namespace
797797
# To prevent unschedulabel pods due to port collisions, if hostNetwork=true

0 commit comments

Comments
 (0)