add certnameOverride option

Author: kvaps

deploy/helm/kubernetes/templates/_helpers.tpl

@@ -23,6 +23,17 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
 {{- end -}}
 {{- end -}}
 
+{{/*
+Create a default certificate name.
+*/}}
+{{- define "kubernetes.certname" -}}
+{{- if .Values.certnameOverride -}}
+{{- .Values.certnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- template "kubernetes.fullname" . -}}
+{{- end -}}
+{{- end -}}
+
 {{/*
 Generate etcd servers list.
 */}}

deploy/helm/kubernetes/templates/apiserver-deployment.yaml

@@ -1,5 +1,6 @@
 {{- if .Values.apiServer.enabled }}
 {{- $fullName := include "kubernetes.fullname" . -}}
+{{- $certName := include "kubernetes.certname" . -}}
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -68,7 +69,7 @@ spec:
         - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
         - --proxy-client-cert-file=/pki/front-proxy-client/tls.crt
         - --proxy-client-key-file=/pki/front-proxy-client/tls.key
-        - --requestheader-allowed-names={{ $fullName }}-front-proxy-client
+        - --requestheader-allowed-names={{ $certName }}-front-proxy-client
         - --requestheader-client-ca-file=/pki/front-proxy-client/ca.crt
         - --requestheader-extra-headers-prefix=X-Remote-Extra-
         - --requestheader-group-headers=X-Remote-Group

deploy/helm/kubernetes/templates/etcd-certs.yaml

@@ -1,12 +1,13 @@
 {{- if .Values.etcd.enabled }}
 {{- $fullName := include "kubernetes.fullname" . -}}
+{{- $certName := include "kubernetes.certname" . -}}
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-etcd-ca"
 spec:
-  commonName: "{{ $fullName }}-etcd-ca"
+  commonName: "{{ $certName }}-etcd-ca"
   secretName: "{{ $fullName }}-pki-etcd-ca"
   duration: 87600h # 3650d
   renewBefore: 8760h # 365d
@@ -44,7 +45,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-etcd-peer"
 spec:
-  commonName: "{{ $fullName }}-etcd-peer"
+  commonName: "{{ $certName }}-etcd-peer"
   secretName: "{{ $fullName }}-pki-etcd-peer"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d
@@ -75,7 +76,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-etcd-server"
 spec:
-  commonName: "{{ $fullName }}-etcd-server"
+  commonName: "{{ $certName }}-etcd-server"
   secretName: "{{ $fullName }}-pki-etcd-server"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d
@@ -120,7 +121,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-etcd-healthcheck-client"
 spec:
-  commonName: "{{ $fullName }}-etcd-healthcheck-client"
+  commonName: "{{ $certName }}-etcd-healthcheck-client"
   secretName: "{{ $fullName }}-pki-etcd-healthcheck-client"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d
@@ -140,7 +141,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-apiserver-etcd-client"
 spec:
-  commonName: "{{ $fullName }}-apiserver-etcd-client"
+  commonName: "{{ $certName }}-apiserver-etcd-client"
   secretName: "{{ $fullName }}-pki-apiserver-etcd-client"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d

deploy/helm/kubernetes/templates/konnectivity-certs.yaml

@@ -1,12 +1,13 @@
 {{- if and .Values.konnectivityServer.enabled }}
 {{- $fullName := include "kubernetes.fullname" . -}}
+{{- $certName := include "kubernetes.certname" . -}}
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-konnectivity-ca"
 spec:
-  commonName: "{{ $fullName }}-konnectivity-ca"
+  commonName: "{{ $certName }}-konnectivity-ca"
   secretName: "{{ $fullName }}-pki-konnectivity-ca"
   duration: 87600h # 3650d
   renewBefore: 8760h # 365d
@@ -41,7 +42,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-konnectivity-server"
 spec:
-  commonName: "{{ $fullName }}-konnectivity-server"
+  commonName: "{{ $certName }}-konnectivity-server"
   secretName: "{{ $fullName }}-pki-konnectivity-server"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d
@@ -71,7 +72,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-konnectivity-client"
 spec:
-  commonName: "{{ $fullName }}-konnectivity-client"
+  commonName: "{{ $certName }}-konnectivity-client"
   secretName: "{{ $fullName }}-pki-konnectivity-client"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d

deploy/helm/kubernetes/templates/kubernetes-certs.yaml

@@ -1,11 +1,12 @@
 {{- $fullName := include "kubernetes.fullname" . -}}
+{{- $certName := include "kubernetes.certname" . -}}
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-ca"
 spec:
-  commonName: "{{ $fullName }}-ca"
+  commonName: "{{ $certName }}-ca"
   secretName: "{{ $fullName }}-pki-ca"
   duration: 87600h # 3650d
   renewBefore: 8760h # 365d
@@ -40,7 +41,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-apiserver"
 spec:
-  commonName: "{{ $fullName }}-apiserver"
+  commonName: "{{ $certName }}-apiserver"
   secretName: "{{ $fullName }}-pki-apiserver"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d
@@ -82,7 +83,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-apiserver-kubelet-client"
 spec:
-  commonName: "{{ $fullName }}-apiserver-kubelet-client"
+  commonName: "{{ $certName }}-apiserver-kubelet-client"
   secretName: "{{ $fullName }}-pki-apiserver-kubelet-client"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d

deploy/helm/kubernetes/templates/kubernetes-front-proxy-certs.yaml

@@ -1,12 +1,13 @@
 {{- if and .Values.apiServer.enabled }}
 {{- $fullName := include "kubernetes.fullname" . -}}
+{{- $certName := include "kubernetes.certname" . -}}
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-front-proxy-ca"
 spec:
-  commonName: "{{ $fullName }}-front-proxy-ca"
+  commonName: "{{ $certName }}-front-proxy-ca"
   secretName: "{{ $fullName }}-pki-front-proxy-ca"
   duration: 87600h # 3650d
   renewBefore: 8760h # 365d
@@ -35,7 +36,7 @@ kind: Certificate
 metadata:
   name: "{{ $fullName }}-pki-front-proxy-client"
 spec:
-  commonName: "{{ $fullName }}-front-proxy-client"
+  commonName: "{{ $certName }}-front-proxy-client"
   secretName: "{{ $fullName }}-pki-front-proxy-client"
   duration: 8760h # 365d
   renewBefore: 4380h # 178d