Adding https support on OpenShift

Chart.yaml

@@ -6,5 +6,5 @@ description: |-
   and maintained by your friends at Equinix Metal
 
 type: application
-version: 0.1.35
+version: 0.1.35-os-2
 appVersion: 2.7.2

templates/_helpers.tpl

@@ -108,4 +108,18 @@ Get krakend templates directory path
 */}}
 {{- define "krakend.templatesDir" -}}
 {{- printf "%s/templates" (include "krakend.FilesDir" .) -}}
+{{- end }}
+
+{{/*
+Get krakend tls cert directory path
+*/}}
+{{- define "krakend.tlsCertDir" -}}
+{{- printf "%s/tls" (include "krakend.FilesDir" .) -}}
+{{- end }}
+
+{{/*
+Get krakend tls CA directory path
+*/}}
+{{- define "krakend.tlsCADir" -}}
+{{- printf "%s/tlsCA" (include "krakend.FilesDir" .) -}}
 {{- end }}

templates/cm-additional-trust.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.openshift.trustSignerCA }}
+# This ConfigMap is used to get access to the OpenShift service signer CA
+# see https://docs.openshift.com/container-platform/4.8/security/certificates/service-serving-certificate.html#add-service-certificate-configmap_service-serving-certificate
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: {{ include "krakend.fullname" . }}-additional-trust
+  annotations:
+    service.beta.openshift.io/inject-cabundle: 'true'
+{{- end }}

templates/deployment.yaml

@@ -110,6 +110,12 @@ spec:
               mountPath: {{ include "krakend.settingsDir" . }}
             - name: templates
               mountPath: {{ include "krakend.templatesDir" . }}
+            {{- if .Values.openshift.trustSignerCA }}
+            - name: service-cert-ca
+              mountPath: {{ include "krakend.tlsCADir" . }}
+            - name: service-cert
+              mountPath: {{ include "krakend.tlsCertDir" . }}
+            {{- end }}
             {{- end }}
             {{- with .Values.extraVolumeMounts }}
             {{- toYaml . | nindent 12 }}
@@ -150,6 +156,14 @@ spec:
         - name: templates
           configMap:
             name: {{ include "krakend.fullname" . }}-templates
+        {{- if .Values.openshift.trustSignerCA }}
+        - name: service-cert-ca
+          configMap:
+            name: {{ include "krakend.fullname" . }}-additional-trust
+        - name: service-cert
+          secret:
+            secretName: {{ include "krakend.fullname" . }}-service-cert
+        {{- end }}
         {{- end }}
         {{- with .Values.extraVolumes }}
         {{- toYaml . | nindent 8 }}

templates/route.yaml

@@ -0,0 +1,21 @@
+{{- if and .Values.openshift .Values.openshift.route.contextPath }}
+kind: Route
+apiVersion: route.openshift.io/v1
+metadata:
+  name: {{ include "krakend.fullname" . }}-route
+spec:
+  {{- if .Values.openshift.route.host }}
+  host: {{ .Values.openshift.route.host }}
+  {{- end }}
+  path: {{ .Values.openshift.route.contextPath }}
+  to:
+    kind: Service
+    name: {{ include "krakend.fullname" . }}
+    weight: 100
+  port:
+    targetPort: http
+  tls:
+    termination: reencrypt
+    insecureEdgeTerminationPolicy: Redirect
+  wildcardPolicy: None
+{{ end }}

templates/service.yaml

@@ -4,11 +4,14 @@ metadata:
   name: {{ include "krakend.fullname" . }}
   labels:
     {{- include "krakend.labels" . | nindent 4 }}
-  {{- if .Values.service.annotations }}
+  {{- if coalesce .Values.service.annotations .Values.openshift.trustSignerCA }}
   annotations:
     {{- range $key, $value := .Values.service.annotations }}
     {{ $key }}: {{ tpl $value $ | quote }}
     {{- end }}
+    {{- if .Values.openshift.trustSignerCA }}
+    service.beta.openshift.io/serving-cert-secret-name: {{ include "krakend.fullname" . }}-service-cert
+    {{- end}}
   {{- end }}
 spec:
   {{- if .Values.service.externalTrafficPolicy }}

values.schema.json

@@ -451,6 +451,14 @@
         },
         "topologySpreadConstraints": {
             "type": "array"
+        },
+        "openshift": {
+          "type": "object",
+          "properties": {
+            "trustSignerCA": {
+              "type": "boolean"
+            }
+          }
         }
     }
 }

values.yaml

@@ -235,12 +235,14 @@ livenessProbe:
   httpGet:
     path: /__health
     port: http
+    scheme: HTTPS
 
 # -- (object) The readinessProbe to use for the krakend pod
 readinessProbe:
   httpGet:
     path: /__health
     port: http
+    scheme: HTTPS
 
 # -- (object) podDisruptionBudget allows you to define minumum and maximum available pods
 podDisruptionBudget:
@@ -266,6 +268,9 @@ serviceMonitor:
   # -- prometheus metrics port exposed by krakend
   targetPort: 9091
 
+openshift:
+  trustSignerCA: false
+
 # -- (object) The networkPolicies configures ingress NetworkPolicies for your application
 networkPolicies:
   # -- (bool) Set to true to create NetworkPolicies for your application