forked from chaos-mesh/chaos-mesh
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Support cert-manager for certificate management (chaos-mesh#277)
- Loading branch information
Showing
9 changed files
with
255 additions
and
26 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,138 @@ | ||
| # Chaos Mesh | ||
|
|
||
| [Chaos Mesh](https://github.com/pingcap/chaos-mesh) is a cloud-native Chaos Engineering platform that orchestrates chaos on Kubernetes environments. | ||
|
|
||
| ## Introduction | ||
|
|
||
| This chart bootstraps a [Chaos Mesh](https://github.com/pingcap/chaos-mesh) deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. | ||
|
|
||
| ## Deploy | ||
|
|
||
| Before deploying Chaos Mesh, make sure you have installed the [Prerequisites](https://github.com/pingcap/chaos-mesh/blob/master/doc/deploy.md#prerequisites). And then follow the [deploy](https://github.com/pingcap/chaos-mesh/blob/master/doc/deploy.md) doc step by step. | ||
|
|
||
| ## Parameters | ||
|
|
||
| The following tables list the configurable parameters of the Chaos Mesh chart and their default values. | ||
|
|
||
| | Parameter | Description | Default | | ||
| |--------------------------------------------|----------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------| | ||
| | `clusterScoped` | whether chaos-mesh should manage kubernetes cluster wide chaos.Also see rbac.create and controllerManager.serviceAccount | `true` | | ||
| | `rbac.create` | | `true` | | ||
| | `enableProfiling` | A flag to enable pprof in controller-manager and chaos-daemon | `false` | | ||
| | `controllerManager.serviceAccount` | The serviceAccount for chaos-controller-manager | `chaos-controller-manager` | | ||
| | `controllerManager.replicaCount` | Replicas for chaos-controller-manager | `1` | | ||
| | `controllerManager.image` | docker image for chaos-controller-manager | `pingcap/chaos-mesh:latest` | | ||
| | `controllerManager.imagePullPolicy` | Image pull policy | `Always` | | ||
| | `controllerManager.nameOverride` | | | | ||
| | `controllerManager.fullnameOverride` | | | | ||
| | `controllerManager.service.type` | Kubernetes Service type | `ClusterIP` | | ||
| | `controllerManager.resources` | CPU/Memory resource requests/limits for chaos-controller-manager pod | `requests: { cpu: "250m", memory: "512Mi" }, limits:{ cpu: "500m", memory: "1024Mi" }` | | ||
| | `controllerManager.nodeSelector` | Node labels for chaos-controller-manager pod assignment | `{}` | | ||
| | `controllerManager.tolerations` | Toleration labels for chaos-controller-manager pod assignment | `[]` | | ||
| | `controllerManager.affinity` | Map of chaos-controller-manager node/pod affinities | `{}` | | ||
| | `controllerManager.podAnnotations` | Pod annotations of chaos-controller-manager | `{}`| | ||
| | `chaosDaemon.image` | docker image for chaos-daemon | `pingcap/chaos-mesh:latest` | | ||
| | `chaosDaemon.imagePullPolicy` | image pull policy | `Always` | | ||
| | `chaosDaemon.grpcPort` | The port which grpc server listens on | `31767` | | ||
| | `chaosDaemon.httpPort` | The port which http server listens on | `31766` | | ||
| | `chaosDaemon.podAnnotations` | Pod annotations of chaos-daemon | `{}` | | ||
| | `chaosDaemon.runtime` | Runtime specifies which container runtime to use. Currently we only supports docker and containerd. | `docker` | | ||
| | `chaosDaemon.socketPath` | Specifies the container runtime socket | `/var/run/docker.sock` | | ||
| | `dashboard.create` | Enable chaos-dashboard | `false` | | ||
| | `dashboard.serviceAccount` | The serviceAccount for chaos-dashboard | `chaos-dashboard` | | ||
| | `dashboard.image` | Docker image for chaos-dashboard | `pingcap/chaos-dashboard:latest` | | ||
| | `dashboard.imagePullPolicy` | Image pull policy | `Always` | | ||
| | `dashboard.nodeSelector` | Node labels for chaos-dashboard pod assignment | `{}` | | ||
| | `dashboard.tolerations` | Toleration labels for chaos-dashboard pod assignment | `[]` | | ||
| | `dashboard.affinity` | Map of chaos-dashboard node/pod affinities | `{}` | | ||
| | `dashboard.podAnnotations` | Deployment chaos-dashboard annotations | `{}` | | ||
| | `dashboard.resources` | CPU/Memory resource requests/limits for chaos-dashboard pod | `requests: { cpu: "250m", memory: "512Mi" }, limits:{ cpu: "500m", memory: "1024Mi" }` | | ||
| | `dashboard.volume.storage` | | `3Gi` | | ||
| | `dashboard.volume.storageClassName` | | `standard` | | ||
| | `prometheus.create` | Enable prometheus | `false` | | ||
| | `prometheus.serviceAccount` | The serviceAccount for prometheus | `prometheus` | | ||
| | `prometheus.image` | Docker image for prometheus | `prom/prometheus:v2.15.2` | | ||
| | `prometheus.imagePullPolicy` | Image pull policy | `IfNotPresent` | | ||
| | `prometheus.nodeSelector` | Node labels for prometheus pod assignment | `{}` | | ||
| | `prometheus.tolerations` | Toleration labels for prometheus pod assignment | `[]` | | ||
| | `prometheus.affinity` | Map of prometheus node/pod affinities | `{}` | | ||
| | `prometheus.podAnnotations` | Deployment prometheus annotations | `{}` | | ||
| | `prometheus.resources` | CPU/Memory resource requests/limits for prometheus pod | `requests: { cpu: "250m", memory: "512Mi" }, limits:{ cpu: "500m", memory: "1024Mi" }` | | ||
| | `prometheus.service.type` | Kubernetes Service type | `ClusterIP` | | ||
| | `prometheus.volume.storage` | | `2Gi` | | ||
| | `prometheus.volume.storageClassName` | | `standard` | | ||
| | `preJobs.podAnnotations` | | `{}` | | ||
| | `postJobs.podAnnotations` | | `{}` | | ||
| | `webhook.certManager.enabled` | Setup the webhook using cert-manager | `false` | | ||
| | `webhook.deleteSecret` | If true, will create a job to delete the secret. Otherwise, do nothing | `true` | | ||
| | `webhook.FailurePolicy` | Defines how unrecognized errors and timeout errors from the admission webhook are handled | `Ignore` | | ||
|
|
||
|
|
||
| Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, | ||
| ```console | ||
| # helm 2.X | ||
| helm install helm/chaos-mesh --name=chaos-mesh --namespace=chaos-testing --set dashboard.create=true | ||
| # helm 3.X | ||
| helm install chaos-mesh helm/chaos-mesh --namespace=chaos-testing --set dashboard.create=true | ||
| ``` | ||
|
|
||
| The above command enable the Chaos Dashboard. | ||
|
|
||
| Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, | ||
|
|
||
| ```console | ||
| # helm 2.X | ||
| helm install helm/chaos-mesh --name=chaos-mesh --namespace=chaos-testing -f values.yaml | ||
| # helm 3.X | ||
| helm install chaos-mesh helm/chaos-mesh --namespace=chaos-testing -f values.yaml | ||
| ``` | ||
|
|
||
| > **Tip**: You can use the default [values.yaml](values.yaml) | ||
| ## Configuration and installation details | ||
|
|
||
| ### Using cert-manager for certificate management | ||
|
|
||
| [Cert-manager](https://github.com/jetstack/cert-manager) may be the default in the K8s world for certificate management now.If you want to install Cert-manager using the [Helm](https://helm.sh) package manager, please refer to the [official documents](https://github.com/jetstack/cert-manager/tree/master/deploy/charts/cert-manager). | ||
|
|
||
| Example for deploy Cert-manager | ||
|
|
||
| ```bash | ||
| kubectl create namespace cert-manager | ||
| kubectl apply --validate=false -f https://raw.githubusercontent.com/jetstack/cert-manager/v0.13.1/deploy/manifests/00-crds.yaml | ||
| helm repo add jetstack https://charts.jetstack.io | ||
| helm repo update | ||
| helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v0.13.1 | ||
| ``` | ||
|
|
||
| In case you want to using Cert-manager for certificate management, you can use the `webhook.certManager.enabled` property. | ||
|
|
||
| ```yaml | ||
| webhook: | ||
| certManager: | ||
| enabled: true | ||
| ``` | ||
| The webhook's cert and the [MutatingAdmissionWebhook](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#mutatingadmissionwebhook)'s `caBundle` property will be managed by the [Certificate](https://cert-manager.io/docs/usage/certificate/) of Cert-manager. | ||
|
|
||
| In case your Cert-manager's option `enable-certificate-owner-ref` is true, it means that deleting a certificate resource will also delete its secret. You can set the `webhook.deleteSecret` property to `false`. | ||
|
|
||
| ```yaml | ||
| webhook: | ||
| certManager: | ||
| enabled: true | ||
| deleteSecret: false | ||
| ``` | ||
|
|
||
| Otherwise, when uninstalling Chaos Mesh, we will create a job to delete the secret. | ||
|
|
||
| The Cert-manager's option `enable-certificate-owner-ref` refer to the following: | ||
| > https://github.com/jetstack/cert-manager/issues/296 | ||
| > | ||
| > https://github.com/jetstack/cert-manager/pull/819 | ||
|
|
||
| You can install your Cert-manager looks like this. | ||
|
|
||
| ```bash | ||
| helm install cert-manager jetstack/cert-manager --namespace cert-manager --version v0.13.1 --set extraArgs={"--enable-certificate-owner-ref"="true"} | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| --- | ||
| apiVersion: admissionregistration.k8s.io/v1beta1 | ||
| kind: MutatingWebhookConfiguration | ||
| metadata: | ||
| name: {{ template "chaos-mesh.mutation" . }} | ||
| labels: | ||
| app.kubernetes.io/name: {{ template "chaos-mesh.name" . }} | ||
| app.kubernetes.io/managed-by: {{ .Release.Service }} | ||
| app.kubernetes.io/instance: {{ .Release.Name }} | ||
| app.kubernetes.io/component: admission-webhook | ||
| helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }} | ||
| {{- if .Values.webhook.certManager.enabled }} | ||
| annotations: | ||
| cert-manager.io/inject-ca-from: {{ printf "%s/%s" .Release.Namespace "chaos-mesh-cert" | quote }} | ||
| {{- end }} | ||
| webhooks: | ||
| - name: {{ template "chaos-mesh.webhook" . }} | ||
| clientConfig: | ||
| service: | ||
| name: {{ template "chaos-mesh.svc" . }} | ||
| namespace: {{ .Release.Namespace }} | ||
| path: "/inject-v1-pod" | ||
| rules: | ||
| - operations: [ "CREATE" ] | ||
| apiGroups: [""] | ||
| apiVersions: ["v1"] | ||
| resources: ["pods"] | ||
| namespaceSelector: | ||
| matchLabels: | ||
| admission-webhook: enabled | ||
| failurePolicy: {{ .Values.webhook.FailurePolicy }} | ||
|
|
||
| {{- if .Values.webhook.certManager.enabled }} | ||
| --- | ||
| apiVersion: cert-manager.io/v1alpha2 | ||
| kind: Issuer | ||
| metadata: | ||
| name: chaos-mesh-selfsigned | ||
| namespace: {{ .Release.Namespace }} | ||
| spec: | ||
| selfSigned: {} | ||
|
|
||
| --- | ||
| apiVersion: cert-manager.io/v1alpha2 | ||
| kind: Certificate | ||
| metadata: | ||
| name: chaos-mesh-cert | ||
| namespace: {{ .Release.Namespace }} | ||
| spec: | ||
| duration: 43800h #5year | ||
| dnsNames: | ||
| - {{ template "chaos-mesh.svc" . }} | ||
| - {{ template "chaos-mesh.svc" . }}.{{ .Release.Namespace }} | ||
| - {{ template "chaos-mesh.svc" . }}.{{ .Release.Namespace }}.svc | ||
| secretName: {{ template "chaos-mesh.certs" . }} | ||
| issuerRef: | ||
| name: chaos-mesh-selfsigned | ||
| {{- end }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters