在 Helm 模板中检索 TLS CRT kubernetes secret 并将其写入另一个 pod

Question

我有一个 Kubernetes 集群，目前部署了 Elasticsearch。

Elasticsearch 协调器节点可通过 ClusterIP 通过 HTTPS 在服务后面访问。它使用自签名 TLS 证书。

我可以检索 CA 的值：

kubectl get secret \
    -n elasticsearch elasticsearch-coordinating-only-crt \
    -o jsonpath="{.data.ca\.crt}" | base64 -d
-----BEGIN CERTIFICATE-----
MIIDIjCCAgqgAwIBAgIRANkAx51S
...
...

我需要将其作为 ca.crt 提供给其他应用程序部署。

Note: The Elasticsearch deployment is an an elasticsearch Kubernetes namespace. New deployments will be in different namespaces.

这方面的一个示例是包含 kafka-connect-elasticsearch/ 接收器的 kafka 部署。 sink连接器使用的配置如：

apiVersion: v1
kind: ConfigMap
metadata:
  name: {{ include "kafka.fullname" . }}-connect
  labels: {{- include "common.labels.standard" . | nindent 4 }}
    app.kubernetes.io/component: connector
data:
  connect-standalone-custom.properties: |-
    bootstrap.servers={{ include "kafka.fullname" . }}-0.{{ include "kafka.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.service.port }}
    key.converter.schemas.enable=false
    value.converter.schemas.enable=false
    offset.storage.file.filename=/tmp/connect.offsets
    offset.flush.interval.ms=10000
    key.converter=org.apache.kafka.connect.json.JsonConverter
    value.converter=org.apache.kafka.connect.json.JsonConverter
    plugin.path=/usr/local/share/kafka/plugins
  elasticsearch.properties: |-
    name=elasticsearch-sink
    connector.class=io.confluent.connect.elasticsearch.ElasticsearchSinkConnector
    tasks.max=4
    topics=syslog,nginx
    key.ignore=true
    schema.ignore=true
    connection.url=https://elasticsearch-coordinating-only.elasticsearch:9200
    type.name=kafka-connect
    connection.username=elastic
    connection.password=xxxxxxxx
    elastic.security.protocol=SSL
    elastic.https.ssl.truststore.location=/etc/ssl/certs/elasticsearch-ca.crt
    elastic.https.ssl.truststore.type=PEM

注意elastic.https.ssl.truststore.location=/etc/ssl/certs/elasticsearch-ca.crt；这就是我需要放入基于 kafka 的容器中的文件。

使用 Helm 模板的最佳方式是什么？

目前我有一个https://github.com/bitnami/charts/tree/master/bitnami/kafka的分支。它在 templates/:

下添加了 3 个新模板

kafka-connect-elasticsearch-configmap.yaml
kafka-connect-svc.yaml
kafka-connect.yaml

configmap如上所示。 kafka-connect.yaml 部署如下所示：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "kafka.fullname" . }}-connect
  labels: {{- include "common.labels.standard" . | nindent 4 }}
    app.kubernetes.io/component: connector
spec:
  replicas: 1
  selector:
    matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
      app.kubernetes.io/component: connector
  template:
    metadata:
      labels: {{- include "common.labels.standard" . | nindent 8 }}
        app.kubernetes.io/component: connector
    spec:
      containers:
        - name: connect
          image: REDACTED.dkr.ecr.REDACTED.amazonaws.com/kafka-connect-elasticsearch
          imagePullPolicy: Always
          command:
            - /bin/bash
            - -ec
            - bin/connect-standalone.sh custom-config/connect-standalone-custom.properties custom-config/elasticsearch.properties
          ports:
            - name: connector
              containerPort: 8083
          volumeMounts:
            - name: configuration
              mountPath: /opt/bitnami/kafka/custom-config
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: configuration
          configMap:
            name: {{ include "kafka.fullname" . }}-connect

如何修改这些 Kafka Helm 图表以允许它们检索 kubectl get secret -n elasticsearch elasticsearch-coordinating-only-crt -o jsonpath="{.data.ca\.crt}" | base64 -d 的值并将其内容写入 /etc/ssl/certs/elasticsearch-ca.crt？

Answer 1

完成这项工作并在此过程中学到了一些东西：

秘密资源驻留在命名空间中。机密只能由同一命名空间中的 Pods 引用。 (ref)。因此，我转而使用 elasticsearch + kafka
秘密可以直接使用，如 https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets 中所述。这不是 Helm 特有的，而是 Kubernetes 的核心功能

在我的例子中是这样的：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "kafka.fullname" . }}-connect
  labels: {{- include "common.labels.standard" . | nindent 4 }}
    app.kubernetes.io/component: connector
spec:
  replicas: 1
  selector:
    matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }}
      app.kubernetes.io/component: connector
  template:
    metadata:
      labels: {{- include "common.labels.standard" . | nindent 8 }}
        app.kubernetes.io/component: connector
    spec:
      containers:
        - name: connect
          image: REDACTED.dkr.ecr.REDACTED.amazonaws.com/kafka-connect-elasticsearch
          imagePullPolicy: Always
          command:
            - /bin/bash
            - -ec
            - bin/connect-standalone.sh custom-config/connect-standalone-custom.properties custom-config/elasticsearch.properties
          ports:
            - name: connector
              containerPort: 8083
          volumeMounts:
            - name: configuration
              mountPath: /opt/bitnami/kafka/custom-config
            - name: ca
              mountPath: /etc/ssl/certs
              readOnly: true
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: configuration
          configMap:
            name: {{ include "kafka.fullname" . }}-connect
        - name: ca
          secret:
            secretName: elasticsearch-coordinating-only-crt

这会启动 kafka-connect pod 和运行，我可以验证证书也写在那里：

$ kubectl exec -it -n elasticsearch kafka-connect-c4f4d7dbd-wbxfq \
    -- ls -1 /etc/ssl/certs

ca.crt
tls.crt
tls.key

在 Helm 模板中检索 TLS CRT kubernetes secret 并将其写入另一个 pod

Retrieve and write TLS CRT kubernetes secret to another pod in Helm template

kubernetes

apache-kafka-connect

kubernetes-helm

kubernetes-secrets