cilium: Fix the configuration of tls for hubble kubernetes-sigs#9880

okaufmann · Mar 16, 2023 · 521204a · 521204a
1 parent 349c890
commit 521204a
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 4 deletions.
diff --git a/roles/network_plugin/cilium/templates/hubble/config.yml.j2 b/roles/network_plugin/cilium/templates/hubble/config.yml.j2
@@ -1,3 +1,4 @@
+#jinja2: trim_blocks:False
 ---
 # Source: cilium/templates/hubble-relay-configmap.yaml
 apiVersion: v1
@@ -15,6 +16,8 @@ data:
     sort-buffer-drain-timeout:
     tls-client-cert-file: /var/lib/hubble-relay/tls/client.crt
     tls-client-key-file: /var/lib/hubble-relay/tls/client.key
+    tls-server-cert-file: /var/lib/hubble-relay/tls/server.crt
+    tls-server-key-file: /var/lib/hubble-relay/tls/server.key
     tls-hubble-server-ca-files: /var/lib/hubble-relay/tls/hubble-server-ca.crt
     disable-server-tls: {% if cilium_hubble_tls_generate %}false{% else %}true{% endif %}
     disable-client-tls: {% if cilium_hubble_tls_generate %}false{% else %}true{% endif %}

diff --git a/roles/network_plugin/cilium/templates/hubble/deploy.yml.j2 b/roles/network_plugin/cilium/templates/hubble/deploy.yml.j2
@@ -79,15 +79,19 @@ spec:
           - secret:
               name: hubble-relay-client-certs
               items:
+                - key: ca.crt
+                  path: hubble-server-ca.crt
                 - key: tls.crt
                   path: client.crt
                 - key: tls.key
                   path: client.key
-          - configMap:
-              name: hubble-ca-cert
+          - secret:
+              name: hubble-server-certs
               items:
-                - key: ca.crt
-                  path: hubble-server-ca.crt
+                - key: tls.crt
+                  path: server.crt
+                - key: tls.key
+                  path: server.key
         name: tls
 ---
 # Source: cilium/templates/hubble-ui/deployment.yaml