mirror of
https://github.com/gitpod-io/gitpod.git
synced 2025-12-08 17:36:30 +00:00
72d9152a71
Fix cyclic import cycle Update altnames Update golden testdata, todo Update grpc opts Testing Remove blocking dial Only add TLS in ws cluster Conditional TLS Add comments
81 lines
2.2 KiB
Go
81 lines
2.2 KiB
Go
// Copyright (c) 2021 Gitpod GmbH. All rights reserved.
|
|
// Licensed under the GNU Affero General Public License (AGPL).
|
|
// See License.AGPL.txt in the project root for license information.
|
|
|
|
package wsmanager
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/gitpod-io/gitpod/installer/pkg/common"
|
|
|
|
certmanagerv1 "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1"
|
|
cmmeta "github.com/jetstack/cert-manager/pkg/apis/meta/v1"
|
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
)
|
|
|
|
func tlssecret(ctx *common.RenderContext) ([]runtime.Object, error) {
|
|
serverAltNames := []string{
|
|
fmt.Sprintf("gitpod.%s", ctx.Namespace),
|
|
fmt.Sprintf("%s.%s.svc", Component, ctx.Namespace),
|
|
Component,
|
|
fmt.Sprintf("%s-dev", Component),
|
|
}
|
|
clientAltNames := []string{
|
|
common.RegistryFacadeComponent,
|
|
common.ServerComponent,
|
|
common.WSManagerBridgeComponent,
|
|
common.WSProxyComponent,
|
|
common.ImageBuilderComponent,
|
|
Component,
|
|
}
|
|
|
|
issuer := common.CertManagerCAIssuer
|
|
|
|
return []runtime.Object{
|
|
&certmanagerv1.Certificate{
|
|
TypeMeta: common.TypeMetaCertificate,
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
Name: TLSSecretNameSecret,
|
|
Namespace: ctx.Namespace,
|
|
Labels: common.DefaultLabels(Component),
|
|
},
|
|
Spec: certmanagerv1.CertificateSpec{
|
|
Duration: common.InternalCertDuration,
|
|
SecretName: TLSSecretNameSecret,
|
|
DNSNames: serverAltNames,
|
|
IssuerRef: cmmeta.ObjectReference{
|
|
Name: issuer,
|
|
Kind: "Issuer",
|
|
Group: "cert-manager.io",
|
|
},
|
|
SecretTemplate: &certmanagerv1.CertificateSecretTemplate{
|
|
Labels: common.DefaultLabels(Component),
|
|
},
|
|
},
|
|
},
|
|
&certmanagerv1.Certificate{
|
|
TypeMeta: common.TypeMetaCertificate,
|
|
ObjectMeta: metav1.ObjectMeta{
|
|
Name: Component,
|
|
Namespace: ctx.Namespace,
|
|
Labels: common.DefaultLabels(Component),
|
|
},
|
|
Spec: certmanagerv1.CertificateSpec{
|
|
Duration: common.InternalCertDuration,
|
|
SecretName: TLSSecretNameClient,
|
|
DNSNames: clientAltNames,
|
|
IssuerRef: cmmeta.ObjectReference{
|
|
Name: issuer,
|
|
Kind: "Issuer",
|
|
Group: "cert-manager.io",
|
|
},
|
|
SecretTemplate: &certmanagerv1.CertificateSecretTemplate{
|
|
Labels: common.DefaultLabels(Component),
|
|
},
|
|
},
|
|
},
|
|
}, nil
|
|
}
|