From d5e6373030598eef35aa884c717018e4314dfa40 Mon Sep 17 00:00:00 2001 From: Ishaan Mittal Date: Sat, 28 Dec 2024 02:31:26 +0530 Subject: [PATCH] update ca cert in cloud cost and aggregator too --- cost-analyzer/templates/_helpers.tpl | 14 +++++++ .../aggregator-cloud-cost-deployment.yaml | 41 ++++++++++++++++++ .../templates/aggregator-statefulset.yaml | 42 +++++++++++++++++++ 3 files changed, 97 insertions(+) diff --git a/cost-analyzer/templates/_helpers.tpl b/cost-analyzer/templates/_helpers.tpl index 67ff512f5..a62f7ef54 100755 --- a/cost-analyzer/templates/_helpers.tpl +++ b/cost-analyzer/templates/_helpers.tpl @@ -1011,6 +1011,13 @@ Begin Kubecost 2.0 templates - name: postgres-queries mountPath: /var/configs/integrations/postgres-queries {{- end }} + {{- if .Values.global.updateCaTrust.enabled }} + - name: ca-certs-secret + mountPath: {{ .Values.global.updateCaTrust.caCertsMountPath | quote }} + - name: ssl-path + mountPath: "/etc/pki/ca-trust/extracted" + readOnly: false + {{- end }} {{- /* Only adds extraVolumeMounts if aggregator is running as its own pod */}} {{- if and .Values.kubecostAggregator.extraVolumeMounts (eq (include "aggregator.deployMethod" .) "statefulset") }} {{- toYaml .Values.kubecostAggregator.extraVolumeMounts | nindent 4 }} @@ -1288,6 +1295,13 @@ Begin Kubecost 2.0 templates name: plugins-config readOnly: true {{- end }} + {{- if .Values.global.updateCaTrust.enabled }} + - name: ca-certs-secret + mountPath: {{ .Values.global.updateCaTrust.caCertsMountPath | quote }} + - name: ssl-path + mountPath: "/etc/pki/ca-trust/extracted" + readOnly: false + {{- end }} {{- /* Only adds extraVolumeMounts when cloudcosts is running as its own pod */}} {{- if and .Values.kubecostAggregator.cloudCost.extraVolumeMounts (eq (include "aggregator.deployMethod" .) "statefulset") }} {{- toYaml .Values.kubecostAggregator.cloudCost.extraVolumeMounts | nindent 4 }} diff --git a/cost-analyzer/templates/aggregator-cloud-cost-deployment.yaml b/cost-analyzer/templates/aggregator-cloud-cost-deployment.yaml index c862f9c34..a8461c0d2 100644 --- a/cost-analyzer/templates/aggregator-cloud-cost-deployment.yaml +++ b/cost-analyzer/templates/aggregator-cloud-cost-deployment.yaml @@ -124,6 +124,19 @@ spec: - name: tmp emptyDir: {} {{- end }} + {{- if .Values.global.updateCaTrust.enabled }} + - name: ca-certs-secret + {{- if .Values.global.updateCaTrust.caCertsSecret }} + secret: + defaultMode: 420 + secretName: {{ .Values.global.updateCaTrust.caCertsSecret }} + {{- else }} + configMap: + name: {{ .Values.global.updateCaTrust.caCertsConfig }} + {{- end }} + - name: ssl-path + emptyDir: {} + {{- end }} {{- if .Values.kubecostAggregator.cloudCost.extraVolumes }} {{- toYaml .Values.kubecostAggregator.cloudCost.extraVolumes | nindent 8 }} {{- end }} @@ -141,6 +154,34 @@ spec: - name: plugins-dir mountPath: {{ .Values.kubecostModel.plugins.folder }} {{- end }} + {{- if .Values.global.updateCaTrust.enabled }} + - name: update-ca-trust + image: {{ include "cost-model.image" . | trim | quote}} + {{- if .Values.kubecostModel.imagePullPolicy }} + imagePullPolicy: {{ .Values.kubecostModel.imagePullPolicy }} + {{- else }} + imagePullPolicy: Always + {{- end }} + {{- with .Values.global.updateCaTrust.securityContext }} + securityContext: {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.global.updateCaTrust.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + command: + - 'sh' + - '-c' + - > + mkdir -p /etc/pki/ca-trust/extracted/{edk2,java,openssl,pem}; + /usr/bin/update-ca-trust extract; + volumeMounts: + - name: ca-certs-secret + mountPath: {{ .Values.global.updateCaTrust.caCertsMountPath | quote }} + - name: ssl-path + mountPath: "/etc/pki/ca-trust/extracted" + readOnly: false + {{- end}} containers: {{- include "aggregator.cloudCost.containerTemplate" . | nindent 8 }} {{- if .Values.imagePullSecrets }} diff --git a/cost-analyzer/templates/aggregator-statefulset.yaml b/cost-analyzer/templates/aggregator-statefulset.yaml index 3432d13e6..2ccc0c502 100644 --- a/cost-analyzer/templates/aggregator-statefulset.yaml +++ b/cost-analyzer/templates/aggregator-statefulset.yaml @@ -181,9 +181,51 @@ spec: secret: secretName: kubecost-integrations-turbonomic {{- end }} + {{- if .Values.global.updateCaTrust.enabled }} + - name: ca-certs-secret + {{- if .Values.global.updateCaTrust.caCertsSecret }} + secret: + defaultMode: 420 + secretName: {{ .Values.global.updateCaTrust.caCertsSecret }} + {{- else }} + configMap: + name: {{ .Values.global.updateCaTrust.caCertsConfig }} + {{- end }} + - name: ssl-path + emptyDir: {} + {{- end }} {{- if .Values.kubecostAggregator.extraVolumes }} {{- toYaml .Values.kubecostAggregator.extraVolumes | nindent 8 }} {{- end }} + initContainers: + {{- if .Values.global.updateCaTrust.enabled }} + - name: update-ca-trust + image: {{ include "cost-model.image" . | trim | quote}} + {{- if .Values.kubecostModel.imagePullPolicy }} + imagePullPolicy: {{ .Values.kubecostModel.imagePullPolicy }} + {{- else }} + imagePullPolicy: Always + {{- end }} + {{- with .Values.global.updateCaTrust.securityContext }} + securityContext: {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.global.updateCaTrust.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + command: + - 'sh' + - '-c' + - > + mkdir -p /etc/pki/ca-trust/extracted/{edk2,java,openssl,pem}; + /usr/bin/update-ca-trust extract; + volumeMounts: + - name: ca-certs-secret + mountPath: {{ .Values.global.updateCaTrust.caCertsMountPath | quote }} + - name: ssl-path + mountPath: "/etc/pki/ca-trust/extracted" + readOnly: false + {{- end}} containers: {{- include "aggregator.containerTemplate" . | nindent 8 }}