diff --git a/cmd/resource-annotator/config.go b/cmd/resource-annotator/config.go index 3c7991aaa..1f79bcf76 100644 --- a/cmd/resource-annotator/config.go +++ b/cmd/resource-annotator/config.go @@ -32,9 +32,9 @@ const ( // DefaultPort is the default port our HTTPS server listens on. DefaultPort = 8443 // DefaultCertFile is the default path to our TLS certificate file. - DefaultCertFile = "/etc/resource-annotator/certs.d/svc.crt" + DefaultCertFile = "/etc/resource-annotator/certs.d/tls.crt" // DefaultKeyFile is the default path to our TLS private key file. - DefaultKeyFile = "/etc/resource-annotator/certs.d/svc.key" + DefaultKeyFile = "/etc/resource-annotator/certs.d/tls.key" // EnvPort is the environment variable used to override the default port. EnvPort = "RESOURCE_ANNOTATOR_PORT" diff --git a/cmd/resource-annotator/webhook.go b/cmd/resource-annotator/webhook.go index eb8abce20..8577c87fe 100644 --- a/cmd/resource-annotator/webhook.go +++ b/cmd/resource-annotator/webhook.go @@ -65,7 +65,8 @@ type Webhook struct { } func NewWebhook(cfg *Config) (*Webhook, error) { - cert, err := tls.LoadX509KeyPair(cfg.CertFile, cfg.KeyFile) + // test loading the certificate/key pair + _, err := tls.LoadX509KeyPair(cfg.CertFile, cfg.KeyFile) if err != nil { return nil, fmt.Errorf("failed to load certificate: %w", err) } @@ -74,9 +75,8 @@ func NewWebhook(cfg *Config) (*Webhook, error) { Logger: logger.Get("webhook"), cfg: cfg, srv: &http.Server{ - Addr: ":" + strconv.FormatUint(uint64(cfg.Port), 10), - TLSConfig: &tls.Config{Certificates: []tls.Certificate{cert}}, - Handler: http.NewServeMux(), + Addr: ":" + strconv.FormatUint(uint64(cfg.Port), 10), + Handler: http.NewServeMux(), }, } @@ -86,7 +86,7 @@ func NewWebhook(cfg *Config) (*Webhook, error) { } func (w *Webhook) Run() error { - return w.srv.ListenAndServeTLS("", "") + return w.srv.ListenAndServeTLS(w.cfg.CertFile, w.cfg.KeyFile) } func (w *Webhook) handler(rw http.ResponseWriter, r *http.Request) { diff --git a/deployment/helm/resource-annotator/README.md b/deployment/helm/resource-annotator/README.md index 421176e6e..26b965e1b 100644 --- a/deployment/helm/resource-annotator/README.md +++ b/deployment/helm/resource-annotator/README.md @@ -15,15 +15,22 @@ to discover container resource requirements instead of estimating them. ## Installing the Chart +### Manually Generated HTTPS Certificate + Path to the chart: `resource-annotator` -At the moment the webhook does not you cert-manager. Instead you need -to generate a certificate for the webhook before instantiating it and -pass the certificate and its related key to helm. The below example -demonstrates how this can be done. +For setting up HTTPS access to the webhook, you can either provide a +certificate and private key yourself, or you can reference a cert- +manager certificate issuer. In the latter case the chart will submit +a certificate request to the issuer and set up annotations for cert- +manager to inject the resulting certificate. + +To install the chart with a manually created certificate using the +following commands: ```shell $ helm repo add nri-plugins https://containers.github.io/nri-plugins +# Create certificate manually. $ mkdir cert $ SVC=nri-resource-annotator; NS=kube-system $ openssl req -x509 -newkey rsa:2048 -sha256 -days 365 -nodes \ @@ -31,12 +38,69 @@ $ openssl req -x509 -newkey rsa:2048 -sha256 -days 365 -nodes \ -out ./cert/server-crt.pem \ -subj "/CN=$SVC.$NS.svc" \ -addext "subjectAltName=DNS:$SVC,DNS:$SVC.$NS,DNS:$SVC.$NS.svc" + +# Install chart injecting the generated certificate. $ helm -n $NS install nri-webhook nri-plugins/nri-resource-annotator \ --set service.secret.crt=$(base64 -w0 < ./cert/server-crt.pem) \ --set service.secret.key=$(base64 -w0 < ./cert/server-key.pem) ``` -This will set up everything for the resource annotator webhook. +This will set up everything for the resource annotator webhook using the +locally generated certificate for HTTPS access. + +### Using cert-manager for HTTPS Certificate Injection + +Alternatively, you use cert-manager to generate a certificate using +these commands: + +```shell +# Install cert-manager, if you don't have it yet. +$ helm install cert-manager oci://quay.io/jetstack/charts/cert-manager \ + --version v1.19.2 --namespace cert-manager --create-namespace \ + --set crds.enabled=true --set crds.keep=false + +# Bootstrap a local issuer for cert-manager if you don't have one yet. +$ kubectl apply -f - <