github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge pull request #6581 from dokku/tls-handling

Browse Source 
Fix issues in tls handling when deploying via k3s
This commit is contained in:
Jose Diaz-Gonzalez
2024-02-12 16:38:39 -05:00
committed by GitHub
parent 3c5f95ff18 abbc13cb85
commit 91151cf375
7 changed files with 76 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/deployment/schedulers/k3s.md
View File

@@ -243,7 +243,7 @@ dokku scheduler-k3s:set --global letsencrypt-email-prod automated@dokku.sh
dokku scheduler-k3s:set --global letsencrypt-email-stag automated@dokku.sh
```
After enabling and rebuilding, all apps with an `https` port mapping that utilize the related letsencrypt server will be automatically updated to enable ssl. All http requests will then be redirected to https.
After enabling and rebuilding, all apps with an `http:80` port mapping will have a corresponding `https:443` added and ssl will be automatically enabled. All http requests will then be redirected to https.
### Customizing the letsencrypt server

20
plugins/scheduler-k3s/functions.go
View File

@@ -149,16 +149,18 @@ func applyClusterIssuers(ctx context.Context) error {
clusterIssuerValues := ClusterIssuerValues{
ClusterIssuers: map[string]ClusterIssuer{
"letsencrypt-stag": {
Email: letsencryptEmailStag,
Enabled: letsencryptEmailStag != "",
Name: "letsencrypt-stag",
Server: "https://acme-staging-v02.api.letsencrypt.org/directory",
Email: letsencryptEmailStag,
Enabled: letsencryptEmailStag != "",
IngressClass: getGlobalIngressClass(),
Name: "letsencrypt-stag",
Server: "https://acme-staging-v02.api.letsencrypt.org/directory",
},
"letsencrypt-prod": {
Email: letsencryptEmailProd,
Enabled: letsencryptEmailProd != "",
Name: "letsencrypt-prod",
Server: "https://acme-v02.api.letsencrypt.org/directory",
Email: letsencryptEmailProd,
Enabled: letsencryptEmailProd != "",
IngressClass: getGlobalIngressClass(),
Name: "letsencrypt-prod",
Server: "https://acme-v02.api.letsencrypt.org/directory",
},
},
}
@@ -496,7 +498,7 @@ func getComputedImagePullSecrets(appName string) string {
}
func getGlobalIngressClass() string {
return common.PropertyGetDefault("scheduler-k3s", "global", "ingress-class", DefaultIngressClass)
return common.PropertyGetDefault("scheduler-k3s", "--global", "ingress-class", DefaultIngressClass)
}
func getIngressAnnotations(appName string, processType string) (map[string]string, error) {

11
plugins/scheduler-k3s/template.go
View File

@@ -161,12 +161,11 @@ type ProcessCron struct {
}
type ProcessPortMap struct {
ContainerPort int32 `yaml:"container_port"`
HostPort int32 `yaml:"host_port"`
Scheme string `yaml:"scheme"`
Protocol PortmapProtocol `yaml:"protocol"`
Name string `yaml:"name"`
RedirectToHttps bool `yaml:"redirect_to_https"`
ContainerPort int32 `yaml:"container_port"`
HostPort int32 `yaml:"host_port"`
Scheme string `yaml:"scheme"`
Protocol PortmapProtocol `yaml:"protocol"`
Name string `yaml:"name"`
}
type PortmapProtocol string

7
plugins/scheduler-k3s/templates/chart/deployment.yaml
View File

@@ -1,5 +1,9 @@
{{- $processName := "PROCESS_NAME" }}
{{- $config := index .Values.processes "PROCESS_NAME" }}
{{- $mappings := dict }}
{{- range $pdx, $port_map := $config.web.port_maps }}
{{- $mappings := set $mappings $port_map.name "true" }}
{{- end }}
---
apiVersion: apps/v1
kind: Deployment
@@ -76,6 +80,9 @@ spec:
{{- if eq $processName "web" }}
ports:
{{- range $pdx, $port_map := $config.web.port_maps }}
{{- if and (eq $port_map.scheme "https") (hasKey $mappings (printf "http-80-%.0f" $port_map.container_port)) }}
{{- continue }}
{{- end }}
- containerPort: {{ $port_map.container_port }}
name: {{ $port_map.name }}
protocol: {{ $port_map.protocol }}

16
plugins/scheduler-k3s/templates/chart/ingress-route.yaml
View File

@@ -1,7 +1,14 @@
{{- $processName := "PROCESS_NAME" }}
{{- $config := index .Values.processes "PROCESS_NAME" }}
{{- if and $config.web.domains (eq $.Values.global.network.ingress_class "traefik") }}
{{- $mappings := dict }}
{{- range $pdx, $port_map := $config.web.port_maps }}
{{- $mappings := set $mappings $port_map.name "true" }}
{{- end }}
{{- range $pdx, $port_map := $config.web.port_maps }}
{{- if and (eq $port_map.scheme "https") (hasKey $mappings (printf "http-80-%.0f" $port_map.container_port)) }}
{{- continue }}
{{- end }}
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
@@ -26,16 +33,15 @@ metadata:
namespace: {{ $.Values.global.namespace }}
spec:
entryPoints:
{{- if and $config.web.tls.enabled (eq $port_map.scheme "https") }}
{{- if $config.web.tls.enabled }}
- websecure
{{- else }}
- web
{{- end }}
- web
routes:
{{- range $ddx, $domain := $config.web.domains }}
- kind: Rule
match: Host(`{{ $domain }}`)
{{- if and $config.web.tls.enabled (and (eq $port_map.scheme "http") $port_map.redirect_to_https) }}
{{- if $config.web.tls.enabled }}
middlewares:
- name: {{ $.Values.global.app_name}}-{{ $processName }}-redirect-to-https
namespace: {{ $.Values.global.namespace }}
@@ -47,7 +53,7 @@ spec:
port: {{ $port_map.name }}
scheme: http
{{- end }}
{{- if and $config.web.tls.enabled (eq $port_map.scheme "https") }}
{{- if $config.web.tls.enabled }}
tls:
secretName: tls-{{ $.Values.global.app_name }}-{{ $processName }}
{{- end }}

12
plugins/scheduler-k3s/templates/chart/ingress.yaml
View File

@@ -1,7 +1,14 @@
{{- $processName := "PROCESS_NAME" }}
{{- $config := index .Values.processes "PROCESS_NAME" }}
{{- if and $config.web.domains (eq $.Values.global.network.ingress_class "nginx") }}
{{- $mappings := dict }}
{{- range $pdx, $port_map := $config.web.port_maps }}
{{- $mappings := set $mappings $port_map.name "true" }}
{{- end }}
{{- range $pdx, $port_map := $config.web.port_maps }}
{{- if and (eq $port_map.scheme "https") (hasKey $mappings (printf "http-80-%.0f" $port_map.container_port)) }}
{{- continue }}
{{- end }}
---
apiVersion: networking.k8s.io/v1
kind: Ingress
@@ -18,6 +25,9 @@ metadata:
{{ $k }}: {{ $v | quote }}
{{- end }}
{{- end }}
{{- if $config.web.tls.enabled }}
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
{{- end }}
labels:
app.kubernetes.io/instance: {{ $.Values.global.app_name }}-{{ $processName }}
app.kubernetes.io/name: {{ $processName }}
@@ -26,7 +36,7 @@ metadata:
namespace: {{ $.Values.global.namespace }}
spec:
ingressClassName: nginx
{{- if and $config.web.tls.enabled (eq $port_map.scheme "https") }}
{{- if $config.web.tls.enabled }}
tls:
- hosts:
{{- range $ddx, $domain := $config.web.domains }}

41
plugins/scheduler-k3s/triggers.go
View File

@@ -351,7 +351,7 @@ func TriggerSchedulerDeploy(scheduler string, appName string, imageTag string) e
},
Namespace: namespace,
Network: GlobalNetwork{
IngressClass: common.PropertyGetDefault("scheduler-k3s", "--global", "ingress-class", DefaultIngressClass),
IngressClass: getGlobalIngressClass(),
PrimaryPort: primaryPort,
},
Secrets: map[string]string{},
@@ -417,20 +417,39 @@ func TriggerSchedulerDeploy(scheduler string, appName string, imageTag string) e
protocol = PortmapProtocol_UDP
}
redirecToHttps := false
if _, ok := portMaps[fmt.Sprintf("https-443-%d", portMap.ContainerPort)]; ok && portMap.Scheme == "http" {
redirecToHttps = true
}
processValues.Web.PortMaps = append(processValues.Web.PortMaps, ProcessPortMap{
ContainerPort: portMap.ContainerPort,
HostPort: portMap.HostPort,
Name: portMap.String(),
Protocol: protocol,
RedirectToHttps: redirecToHttps,
Scheme: portMap.Scheme,
ContainerPort: portMap.ContainerPort,
HostPort: portMap.HostPort,
Name: portMap.String(),
Protocol: protocol,
Scheme: portMap.Scheme,
})
}
for _, portMap := range processValues.Web.PortMaps {
_, httpOk := portMaps[fmt.Sprintf("http-80-%d", portMap.ContainerPort)]
_, httpsOk := portMaps[fmt.Sprintf("https-443-%d", portMap.ContainerPort)]
if portMap.Scheme == "http" && !httpsOk && tlsEnabled {
processValues.Web.PortMaps = append(processValues.Web.PortMaps, ProcessPortMap{
ContainerPort: portMap.ContainerPort,
HostPort: 443,
Name: fmt.Sprintf("https-443-%d", portMap.ContainerPort),
Protocol: PortmapProtocol_TCP,
Scheme: "https",
})
}
if portMap.Scheme == "https" && !httpOk {
processValues.Web.PortMaps = append(processValues.Web.PortMaps, ProcessPortMap{
ContainerPort: portMap.ContainerPort,
HostPort: 80,
Name: fmt.Sprintf("http-80-%d", portMap.ContainerPort),
Protocol: PortmapProtocol_TCP,
Scheme: "http",
})
}
}
sort.Sort(NameSorter(processValues.Web.PortMaps))
sort.Strings(processValues.Web.Domains)
}