feat: add support for external/existing certificate issuer (#2631)

helm/README.md

@@ -105,6 +105,11 @@ RustFS helm chart supports **standalone and distributed mode**. For standalone m
 | mtls.enabled | bool | `false` | Enable mtls betweens pods. |
 | mtls.clientCertPath | string | `/opt/tls/client_cert.pem` | The path for client cert. |
 | mtls.clientKeyPath | string | `/opt/tls/client_key.pem` | The path for client key. |
+| mtls.existingIssuerRef.enabled | bool | `false` | Enable to use external/existing certificate issuer.|
+| mtls.existingIssuerRef.name | string | `""` | The name of external/existing certificate issuer. |
+| mtls.existingIssuerRef.kind | string | `""` | The kind of external/existing certificate iss
+uer. `ClusterIssuer` or `Issuer`. |
+| mtls.existingIssuerRef.group | string | `""` | The group of external/existing certificate issuer. |
 | nameOverride | string | `""` |  |
 | nodeSelector | object | `{}` |  |
 | pdb.create | bool | `false` | Enable/disable a Pod Disruption Budget creation |

helm/rustfs/templates/cert-manager-mtls/01-ca-issuer.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.mtls.enabled }}
+{{- if and .Values.mtls.enabled (not .Values.mtls.existingIssuerRef.enabled) }}
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
@@ -6,3 +6,4 @@ metadata:
 spec:
   selfSigned: {}
 {{- end }}
+

helm/rustfs/templates/cert-manager-mtls/02-ca-cert.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.mtls.enabled }}
+{{- if and .Values.mtls.enabled (not .Values.mtls.existingIssuerRef.enabled) }}
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -11,4 +11,5 @@ spec:
   issuerRef:
     name: {{ include "rustfs.fullname" . }}-selfsigned-issuer
     kind: ClusterIssuer
-{{- end }}
+{{- end }}
+

helm/rustfs/templates/cert-manager-mtls/03-rustfs-issuer.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.mtls.enabled }}
+{{- if and .Values.mtls.enabled (not .Values.mtls.existingIssuerRef.enabled) }}
 apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
@@ -7,4 +7,5 @@ metadata:
 spec:
   ca:
     secretName: {{ include "rustfs.fullname" . }}-root-ca-secret
-{{- end }}
+{{- end }}
+

helm/rustfs/templates/cert-manager-mtls/04-server-cert.yaml

@@ -6,9 +6,16 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec:
   secretName: {{ include "rustfs.fullname" . }}-server-tls
+  {{- if .Values.mtls.existingIssuerRef.enabled }}
+  issuerRef:
+    name: {{ .Values.mtls.existingIssuerRef.name }}
+    kind: {{ .Values.mtls.existingIssuerRef.kind }}
+    group: {{ .Values.mtls.existingIssuerRef.group }}
+  {{- else }}
   issuerRef:
     name: {{ include "rustfs.fullname" . }}-ca-issuer
     kind: Issuer
+  {{- end }}
   commonName: {{ include "rustfs.fullname" . }}-cluster
   dnsNames:
     - "*.{{ include "rustfs.fullname" . }}-headless"
@@ -20,4 +27,4 @@ spec:
   {{- end }}
   usages:
     - server auth
-{{- end }}
+{{- end }}

helm/rustfs/templates/cert-manager-mtls/05-client-cert.yaml

@@ -6,10 +6,18 @@ metadata:
   namespace: {{ .Release.Namespace }}
 spec:
   secretName: {{ include "rustfs.fullname" . }}-client-tls
+  {{- if .Values.mtls.existingIssuerRef.enabled }}
+  issuerRef:
+    name: {{ .Values.mtls.existingIssuerRef.name }}
+    kind: {{ .Values.mtls.existingIssuerRef.kind }}
+    group: {{ .Values.mtls.existingIssuerRef.group }}
+  {{- else }}
   issuerRef:
     name: {{ include "rustfs.fullname" . }}-ca-issuer
     kind: Issuer
+  {{- end }}
   commonName: {{ include "rustfs.fullname" . }}-cluster
   usages:
     - client auth
 {{- end }}
+

helm/rustfs/values.yaml

@@ -230,6 +230,11 @@ mtls:
   enabled: false
   clientCertPath: "/opt/tls/client_cert.pem"
   clientKeyPath: "/opt/tls/client_key.pem"
+  existingIssuerRef:
+    enabled: false
+    name: ""
+    kind: ""
+    group: ""
 
 resources: {}
   # We usually recommend not to specify default resources and to leave this as a conscious