Support specifying TLS certs/key for webhook in helm chart (#2198)

Co-authored-by: Kishor Joshi <[email protected]>

Author: agaffney

helm/aws-load-balancer-controller/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 name: aws-load-balancer-controller
 description: AWS Load Balancer Controller Helm chart for Kubernetes
-version: 1.2.7
+version: 1.2.8
 appVersion: v2.2.4
 home: https://github.com/aws/eks-charts
 icon: https://raw.githubusercontent.com/aws/eks-charts/master/docs/logo/aws.png

helm/aws-load-balancer-controller/README.md

@@ -177,6 +177,9 @@ The default values set by the application itself can be confirmed [here](https:/
 | `logLevel`                                  | Set the controller log level - info, debug                                                               | None                                                                               |
 | `metricsBindAddr`                           | The address the metric endpoint binds to                                                                 | ""                                                                                 |
 | `webhookBindPort`                           | The TCP port the Webhook server binds to                                                                 | None                                                                               |
+| `webhookTLS.caCert`                         | TLS CA certificate for webhook (auto-generated if not provided)                                          | ""                                                                                 |
+| `webhookTLS.cert`                           | TLS certificate for webhook (auto-generated if not provided)                                             | ""                                                                                 |
+| `webhookTLS.key`                            | TLS private key for webhook (auto-generated if not provided)                                             | ""                                                                                 |
 | `serviceMaxConcurrentReconciles`            | Maximum number of concurrently running reconcile loops for service                                       | None                                                                               |
 | `targetgroupbindingMaxConcurrentReconciles` | Maximum number of concurrently running reconcile loops for targetGroupBinding                            | None                                                                               |
 | `targetgroupbindingMaxExponentialBackoffDelay` | Maximum duration of exponential backoff for targetGroupBinding reconcile failures                     | None                                                                               |

helm/aws-load-balancer-controller/templates/_helpers.tpl

@@ -75,7 +75,12 @@ Create the name of the service account to use
 {{/*
 Generate certificates for webhook
 */}}
-{{- define "aws-load-balancer-controller.gen-certs" -}}
+{{- define "aws-load-balancer-controller.webhook-certs" -}}
+{{- if (and .Values.webhookTLS.caCert .Values.webhookTLS.cert .Values.webhookTLS.key) -}}
+caCert: {{ .Values.webhookTLS.caCert | b64enc }}
+clientCert: {{ .Values.webhookTLS.cert | b64enc }}
+clientKey: {{ .Values.webhookTLS.key | b64enc }}
+{{- else -}}
 {{- $namePrefix := ( include "aws-load-balancer-controller.namePrefix" . ) -}}
 {{- $altNames := list ( printf "%s-%s.%s" $namePrefix "webhook-service" .Release.Namespace ) ( printf "%s-%s.%s.svc" $namePrefix "webhook-service" .Release.Namespace ) -}}
 {{- $ca := genCA "aws-load-balancer-controller-ca" 3650 -}}
@@ -84,6 +89,7 @@ caCert: {{ $ca.Cert | b64enc }}
 clientCert: {{ $cert.Cert | b64enc }}
 clientKey: {{ $cert.Key | b64enc }}
 {{- end -}}
+{{- end -}}
 
 {{/*
 Convert map to comma separated key=value string

helm/aws-load-balancer-controller/templates/webhook.yaml

@@ -1,4 +1,4 @@
-{{ $tls := fromYaml ( include "aws-load-balancer-controller.gen-certs" . ) }}
+{{ $tls := fromYaml ( include "aws-load-balancer-controller.webhook-certs" . ) }}
 ---
 {{- if .Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1" }}
 apiVersion: admissionregistration.k8s.io/v1

helm/aws-load-balancer-controller/values.yaml

@@ -117,6 +117,12 @@ metricsBindAddr: ""
 # The TCP port the Webhook server binds to. (default 9443)
 webhookBindPort:
 
+# webhookTLS specifies TLS cert/key for the webhook
+webhookTLS:
+  caCert:
+  cert:
+  key:
+
 # Maximum number of concurrently running reconcile loops for service (default 3)
 serviceMaxConcurrentReconciles: