Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

allow to use proxy https with replicated #615

Open
wants to merge 14 commits into
base: main
Choose a base branch
from
Open

allow to use proxy https with replicated #615

Show file tree
Hide file tree
Changes from 11 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
2e4895c
allow to use proxy https with replicated
alvarorm22 Sep 19, 2024
cb0c402
Merge branch 'main' of github.com:CartoDB/carto-selfhosted-helm into …
alvarorm22 Sep 20, 2024
478424b
fix repl privateCA function
alvarorm22 Sep 20, 2024
52ab388
increase kots min version
alvarorm22 Sep 23, 2024
fb18097
fix private ca configname
alvarorm22 Sep 23, 2024
fae0499
add PrivateCACert
alvarorm22 Sep 24, 2024
0a652c9
bump replicated to 1.0.0-beta.28
alvarorm22 Sep 24, 2024
1b488cd
bump replicated to 1.0.0-beta.28
alvarorm22 Sep 24, 2024
de5595b
Merge branch 'main' of github.com:CartoDB/carto-selfhosted-helm into …
alvarorm22 Sep 24, 2024
f09d965
increase kots version
alvarorm22 Sep 24, 2024
0a677d5
use private CA function in kots-config
alvarorm22 Sep 24, 2024
8c8fbdf
fix tenant-requirement-checker external proxy configmap reference
alvarorm22 Sep 25, 2024
c771816
fix commonChecks with proxy https
alvarorm22 Sep 25, 2024
8c898a7
fix tenant-requirement-checker https proxy ca
alvarorm22 Sep 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions chart/Chart.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,6 @@ dependencies:
version: 16.13.2
- name: replicated
repository: oci://registry.replicated.com/library
version: 1.0.0-beta.27
digest: sha256:9c862fa3c5cf653ba48808f102964cf52c6e0a78d6e1c08e97cddfb4b3fdef11
generated: "2024-08-21T09:58:10.6497+02:00"
version: 1.0.0-beta.28
digest: sha256:041f1be2e72b712ed2b717f6876592037e2ee3d09c0187a7233daed674cac386
generated: "2024-09-24T10:24:55.243047525+02:00"
2 changes: 1 addition & 1 deletion chart/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ dependencies:
version: 16.x.x
- name: replicated
repository: oci://registry.replicated.com/library
version: 1.0.0-beta.27
version: 1.0.0-beta.28
condition: replicated.enabled
description: CARTO Location Intelligence Platform. Unlock the power of spatial analysis in the cloud
engine: gotpl
Expand Down
21 changes: 11 additions & 10 deletions chart/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1561,16 +1561,17 @@ To install, upgrade or uninstall this chart, please refer to [the root README.md

### External proxy configuration

| Name | Description | Value |
| ------------------------------------- | ---------------------------------------------------------------------------------------- | ------- |
| `externalProxy.enabled` | Whether the APIs will use an external proxy or not | `false` |
| `externalProxy.host` | Proxy host | `""` |
| `externalProxy.port` | Proxy port | `""` |
| `externalProxy.type` | Proxy type. Only HTTP and HTTPS proxies are supported | `""` |
| `externalProxy.excludedDomains` | List of domains that should not be proxied | `[]` |
| `externalProxy.sslRejectUnauthorized` | Whether or not verify the HTTPS proxy SSL certificate | `true` |
| `externalProxy.sslCA` | CA for the proxy SSL certificate in case is self-signed or signed by a not well-known CA | `""` |
| `externalProxy.connectionString` | Connection string to the proxy | `""` |
| Name | Description | Value |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------- |
| `externalProxy.enabled` | Whether the APIs will use an external proxy or not | `false` |
| `externalProxy.host` | Proxy host | `""` |
| `externalProxy.port` | Proxy port | `""` |
| `externalProxy.type` | Proxy type. Only HTTP and HTTPS proxies are supported | `""` |
| `externalProxy.excludedDomains` | List of domains that should not be proxied | `[]` |
| `externalProxy.sslRejectUnauthorized` | Whether or not verify the HTTPS proxy SSL certificate | `true` |
| `externalProxy.sslCA` | CA for the proxy SSL certificate in case is self-signed or signed by a not well-known CA | `""` |
| `externalProxy.sslCAConfigmapName` | Configmap Name in which the CA for the proxy SSL certificate is stored, in case is self-signed or signed by a not well-known CA | `""` |
| `externalProxy.connectionString` | Connection string to the proxy | `""` |

### Upgrade Check pre hook parameters

Expand Down
8 changes: 4 additions & 4 deletions chart/templates/_commonChecks.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@ Return common collectors for preflights and support-bundle
- name: REDIS_TLS_CA__FILE_PATH
value: {{ include "carto.redis.configMapMountAbsolutePath" . }}
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: PROXY_SSL_CA__FILE_CONTENT
value: {{ .Values.externalProxy.sslCA | b64enc | quote }}
- name: PROXY_SSL_CA__FILE_PATH
Expand Down Expand Up @@ -120,7 +120,7 @@ Return common collectors for preflights and support-bundle
mountPath: {{ include "carto.redis.configMapMountDir" . }}
readOnly: false
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
mountPath: {{ include "carto.proxy.configMapMountDir" . }}
readOnly: false
Expand Down Expand Up @@ -168,7 +168,7 @@ Return common collectors for preflights and support-bundle
mountPath: {{ include "carto.redis.configMapMountDir" . }}
readOnly: true
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
mountPath: {{ include "carto.proxy.configMapMountDir" . }}
readOnly: true
Expand Down Expand Up @@ -197,7 +197,7 @@ Return common collectors for preflights and support-bundle
emptyDir:
sizeLimit: 8Mi
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
emptyDir:
sizeLimit: 1Mi
Expand Down
4 changes: 4 additions & 0 deletions chart/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1399,7 +1399,11 @@ Return the proxy connection string if the config does not include the complete U
Get the proxy config map name
*/}}
{{- define "carto.proxy.configMapName" -}}
{{- if .Values.externalProxy.sslCA -}}
{{- printf "%s-%s" .Release.Name "externalproxy" -}}
{{- else if .Values.externalProxy.sslCAConfigmapName -}}
{{- printf "%s" .Values.externalProxy.sslCAConfigmapName -}}
{{- end -}}
{{- end -}}

{{/*
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/cdn-invalidator-sub/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,7 @@ spec:
- name: gcp-default-service-account-key
mountPath: {{ include "carto.google.secretMountDir" . }}
readOnly: true
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
mountPath: {{ include "carto.proxy.configMapMountDir" . }}
readOnly: true
Expand All @@ -191,7 +191,7 @@ spec:
items:
- key: {{ include "carto.google.secretKey" . }}
path: {{ include "carto.google.secretMountFilename" . }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
configMap:
name: {{ include "carto.proxy.configMapName" . }}
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/import-api/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,7 +206,7 @@ spec:
mountPath: {{ include "carto.redis.configMapMountDir" . }}
readOnly: true
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
mountPath: {{ include "carto.proxy.configMapMountDir" . }}
readOnly: true
Expand Down Expand Up @@ -242,7 +242,7 @@ spec:
configMap:
name: {{ include "carto.redis.configMapName" . }}
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
configMap:
name: {{ include "carto.proxy.configMapName" . }}
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/import-worker/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ spec:
mountPath: {{ include "carto.postgresql.configMapMountDir" . }}
readOnly: true
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
mountPath: {{ include "carto.proxy.configMapMountDir" . }}
readOnly: true
Expand Down Expand Up @@ -220,7 +220,7 @@ spec:
configMap:
name: {{ include "carto.postgresql.configMapName" . }}
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
configMap:
name: {{ include "carto.proxy.configMapName" . }}
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/lds-api/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ spec:
mountPath: {{ include "carto.redis.configMapMountDir" . }}
readOnly: true
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
mountPath: {{ include "carto.proxy.configMapMountDir" . }}
readOnly: true
Expand Down Expand Up @@ -229,7 +229,7 @@ spec:
configMap:
name: {{ include "carto.redis.configMapName" . }}
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
configMap:
name: {{ include "carto.proxy.configMapName" . }}
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/maps-api/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,7 @@ spec:
mountPath: {{ include "carto.redis.configMapMountDir" . }}
readOnly: true
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
mountPath: {{ include "carto.proxy.configMapMountDir" . }}
readOnly: true
Expand Down Expand Up @@ -247,7 +247,7 @@ spec:
configMap:
name: {{ include "carto.redis.configMapName" . }}
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
configMap:
name: {{ include "carto.proxy.configMapName" . }}
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/sql-worker/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,7 +176,7 @@ spec:
mountPath: {{ include "carto.postgresql.configMapMountDir" . }}
readOnly: true
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
mountPath: {{ include "carto.proxy.configMapMountDir" . }}
readOnly: true
Expand Down Expand Up @@ -213,7 +213,7 @@ spec:
configMap:
name: {{ include "carto.postgresql.configMapName" . }}
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
configMap:
name: {{ include "carto.proxy.configMapName" . }}
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/workspace-api/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,7 +291,7 @@ spec:
mountPath: {{ include "carto.redis.configMapMountDir" . }}
readOnly: true
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
mountPath: {{ include "carto.proxy.configMapMountDir" . }}
readOnly: true
Expand Down Expand Up @@ -333,7 +333,7 @@ spec:
configMap:
name: {{ include "carto.redis.configMapName" . }}
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
configMap:
name: {{ include "carto.proxy.configMapName" . }}
Expand Down
4 changes: 2 additions & 2 deletions chart/templates/workspace-subscriber/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@ spec:
mountPath: {{ include "carto.redis.configMapMountDir" . }}
readOnly: true
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
mountPath: {{ include "carto.proxy.configMapMountDir" . }}
readOnly: true
Expand Down Expand Up @@ -213,7 +213,7 @@ spec:
configMap:
name: {{ include "carto.redis.configMapName" . }}
{{- end }}
{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
{{- if and .Values.externalProxy.enabled (or .Values.externalProxy.sslCA .Values.externalProxy.sslCAConfigmapName) }}
- name: proxy-ssl-ca
configMap:
name: {{ include "carto.proxy.configMapName" . }}
Expand Down
2 changes: 2 additions & 0 deletions chart/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4908,6 +4908,8 @@ externalProxy:
sslRejectUnauthorized: true
## @param externalProxy.sslCA CA for the proxy SSL certificate in case is self-signed or signed by a not well-known CA
sslCA: ""
## @param externalProxy.sslCAConfigmapName Configmap Name in which the CA for the proxy SSL certificate is stored, in case is self-signed or signed by a not well-known CA
sslCAConfigmapName: ""
## @param externalProxy.connectionString Connection string to the proxy
connectionString: ""

Expand Down
2 changes: 1 addition & 1 deletion manifests/kots-app.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ spec:
- deployment/carto-workspace-api
- deployment/carto-workspace-subscriber
- deployment/carto-workspace-www
minKotsVersion: 1.117.1
minKotsVersion: 1.117.3
additionalImages:
- gcr.io/carto-onprem-artifacts/tenant-requirements-checker:2024.4.17-rc.7
---
Expand Down
11 changes: 5 additions & 6 deletions manifests/kots-config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -654,19 +654,18 @@ spec:
when: '{{repl and (ConfigOptionEquals "externalProxyEnabled" "1") (not (empty HTTPProxy)) }}'
value: "repl{{ NoProxy }}"
readonly: true
- name: externalHttpsProxySslCa
title: Proxy SSL CA
when: '{{repl and (ConfigOptionEquals "externalProxyEnabled" "1") (ConfigOptionEquals "externalProxyType" "https") }}'
type: file
help_text: |-
If the proxy certificate is signed by a custom CA, such CA must be included here, but if it's signed by a well known CA, there is no need to add it here.
- name: externalHttpsProxySslCertificateCheck
title: SSL certificate checks
type: bool
when: '{{repl and (ConfigOptionEquals "externalProxyEnabled" "1") (ConfigOptionEquals "externalProxyType" "https") }}'
default: "0"
help_text: |-
Specify if CARTO Self-hosted should check if the proxy certificate is valid or not.
- name: externalProxyCAConfigmapName
hidden: true
type: text
value: 'repl{{ PrivateCACert }}'
readonly: true

## SSO
- name: ssoEnabled
Expand Down
3 changes: 1 addition & 2 deletions manifests/kots-helm.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -356,8 +356,7 @@ spec:
connectionString: '{{repl ConfigOption "externalProxyHost" }}'
excludedDomains: '{{repl ConfigOption "externalProxyExcludedDomains" }}'
sslRejectUnauthorized: repl{{ if ConfigOptionEquals "externalHttpsProxySslCertificateCheck" "0"}}falserepl{{ else }}truerepl{{ end }}
sslCA: |
repl{{ ConfigOptionData "externalHttpsProxySslCa" | nindent 12 }}
sslCAConfigmapName: '{{repl ConfigOption "externalProxyCAConfigmapName" }}'
- when: '{{repl ConfigOptionEquals "ssoEnabled" "1"}}'
recursiveMerge: true
values:
Expand Down
Loading