mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-13 01:39:01 +00:00
shankar0123
52248be717
Breaking change release. Plaintext HTTP listener removed. The certctl control plane now terminates TLS 1.3 on :8443 via http.Server.ListenAndServeTLS. No CERTCTL_TLS_ENABLED=false escape hatch. No dual-listener mode. One-step cutover per docs/upgrade-to-tls.md. Server - cmd/server/tls.go: certHolder with SIGHUP hot-reload + atomic cert swap, buildServerTLSConfig (TLS 1.3 min, GetCertificate callback), preflightServerTLS validation - cmd/server/main.go: ListenAndServeTLS in place of ListenAndServe, watchSIGHUP wiring, cert/key path config threading - tls_test.go: 418-line regression coverage of reload, preflight, callback behavior, SAN validation Config - CERTCTL_TLS_CERT_PATH / CERTCTL_TLS_KEY_PATH (required) - Plaintext rejection: agents/CLI/MCP pre-flight-fail on http:// URLs with a pointer to docs/upgrade-to-tls.md Agents, CLI, MCP - All three pre-flight-reject http:// URLs with fail-loud diagnostic - CERTCTL_SERVER_CA_BUNDLE_PATH for private-CA trust - CERTCTL_SERVER_TLS_INSECURE_SKIP_VERIFY for dev-only bypass (loud warning on startup) - install-agent.sh emits both vars as commented template lines docker-compose - certctl-tls-init sidecar generates SAN-valid self-signed cert into deploy/test/certs/ on first boot - All demo-stack curls pin against ca.crt with --cacert Helm chart - Three TLS provisioning modes, exactly one required: - server.tls.existingSecret (operator-supplied) - server.tls.certManager.enabled (cert-manager integration) - server.tls.selfSigned.enabled (eval only — not for production) - server-certificate.yaml template for cert-manager mode - helm install without a TLS source fails at template render with a pointer to docs/tls.md CI - .github/workflows/ci.yml Helm Chart Validation step renders the chart in both existingSecret and cert-manager modes, plus an inverse guard-regression test that asserts helm template MUST refuse to render when no TLS source is configured. Previously the single `helm template` invocation hit the certctl.tls.required fail-loud guard and exit-1'd CI. Four invocations now: lint (existingSecret), template (existingSecret), template (cert-manager), template (no args — must fail). Integration tests - deploy/test/integration_test.go stands up the Compose stack over HTTPS, extracts the CA bundle, and exercises every certctl API over https://localhost:8443 - All 34 integration subtests green (per Phase 8 local CI-parity) Documentation - New: docs/tls.md (provisioning patterns, rotation, SIGHUP reload) - New: docs/upgrade-to-tls.md (one-step cutover, no-downgrade warnings, fleet-roll sequencing) - CHANGELOG.md: v2.2.0 "HTTPS Everywhere — The Irony" entry (file heading unchanged; release tag is v2.0.47) - All curls in docs/, examples/, deploy/helm/ guides use https://localhost:8443 --cacert Verification - grep -rn "ListenAndServe[^T]" cmd/ internal/ → 0 hits - grep -rn "\"http://" cmd/ internal/ → 2 benign hits (Caddy admin API default, SSRF doc comment) — zero certctl endpoints - Tasks #197–#206 (Phases 0–8) all closed in the tracker Files: 65 changed, 3489 insertions, 372 deletions (pre-CI-fix).
182 lines
5.9 KiB
YAML
182 lines
5.9 KiB
YAML
{{- if .Values.agent.enabled }}
|
|
{{- include "certctl.tls.required" . }}
|
|
{{- if eq .Values.agent.kind "DaemonSet" }}
|
|
apiVersion: apps/v1
|
|
kind: DaemonSet
|
|
metadata:
|
|
name: {{ include "certctl.fullname" . }}-agent
|
|
labels:
|
|
{{- include "certctl.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: agent
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
{{- include "certctl.agentSelectorLabels" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "certctl.agentSelectorLabels" . | nindent 8 }}
|
|
spec:
|
|
serviceAccountName: {{ include "certctl.serviceAccountName" . }}
|
|
securityContext:
|
|
{{- toYaml .Values.agent.securityContext | nindent 8 }}
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.agent.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.agent.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.agent.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: agent
|
|
image: {{ include "certctl.agentImage" . }}
|
|
imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
|
|
env:
|
|
- name: CERTCTL_SERVER_URL
|
|
value: {{ include "certctl.serverURL" . }}
|
|
- name: CERTCTL_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "certctl.fullname" . }}-server
|
|
key: api-key
|
|
- name: CERTCTL_AGENT_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: CERTCTL_KEY_DIR
|
|
value: {{ .Values.agent.keyDir }}
|
|
- name: CERTCTL_SERVER_CA_BUNDLE_PATH
|
|
value: "{{ .Values.server.tls.mountPath }}/ca.crt"
|
|
{{- if .Values.agent.discoveryDirs }}
|
|
- name: CERTCTL_DISCOVERY_DIRS
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ include "certctl.fullname" . }}-agent
|
|
key: discovery-dirs
|
|
{{- end }}
|
|
{{- with .Values.agent.env }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
resources:
|
|
{{- toYaml .Values.agent.resources | nindent 12 }}
|
|
volumeMounts:
|
|
- name: agent-keys
|
|
mountPath: {{ .Values.agent.keyDir }}
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
- name: server-tls
|
|
mountPath: {{ .Values.server.tls.mountPath }}
|
|
readOnly: true
|
|
volumes:
|
|
- name: agent-keys
|
|
emptyDir:
|
|
sizeLimit: 1Gi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
- name: server-tls
|
|
secret:
|
|
secretName: {{ include "certctl.tls.secretName" . }}
|
|
defaultMode: 0400
|
|
{{- else if eq .Values.agent.kind "Deployment" }}
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "certctl.fullname" . }}-agent
|
|
labels:
|
|
{{- include "certctl.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: agent
|
|
spec:
|
|
replicas: {{ .Values.agent.replicas }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "certctl.agentSelectorLabels" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "certctl.agentSelectorLabels" . | nindent 8 }}
|
|
spec:
|
|
serviceAccountName: {{ include "certctl.serviceAccountName" . }}
|
|
securityContext:
|
|
{{- toYaml .Values.agent.securityContext | nindent 8 }}
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.agent.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.agent.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.agent.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: agent
|
|
image: {{ include "certctl.agentImage" . }}
|
|
imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
|
|
env:
|
|
- name: CERTCTL_SERVER_URL
|
|
value: {{ include "certctl.serverURL" . }}
|
|
- name: CERTCTL_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "certctl.fullname" . }}-server
|
|
key: api-key
|
|
- name: CERTCTL_AGENT_NAME
|
|
{{- if .Values.agent.name }}
|
|
value: {{ .Values.agent.name | quote }}
|
|
{{- else }}
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
{{- end }}
|
|
- name: CERTCTL_KEY_DIR
|
|
value: {{ .Values.agent.keyDir }}
|
|
- name: CERTCTL_SERVER_CA_BUNDLE_PATH
|
|
value: "{{ .Values.server.tls.mountPath }}/ca.crt"
|
|
{{- if .Values.agent.discoveryDirs }}
|
|
- name: CERTCTL_DISCOVERY_DIRS
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ include "certctl.fullname" . }}-agent
|
|
key: discovery-dirs
|
|
{{- end }}
|
|
{{- with .Values.agent.env }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
resources:
|
|
{{- toYaml .Values.agent.resources | nindent 12 }}
|
|
volumeMounts:
|
|
- name: agent-keys
|
|
mountPath: {{ .Values.agent.keyDir }}
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
- name: server-tls
|
|
mountPath: {{ .Values.server.tls.mountPath }}
|
|
readOnly: true
|
|
volumes:
|
|
- name: agent-keys
|
|
emptyDir:
|
|
sizeLimit: 1Gi
|
|
- name: tmp
|
|
emptyDir: {}
|
|
- name: server-tls
|
|
secret:
|
|
secretName: {{ include "certctl.tls.secretName" . }}
|
|
defaultMode: 0400
|
|
{{- end }}
|
|
{{- end }}
|