add option for ingress controller terminating ssl with its own cert

Signed-off-by: Kent Rancourt <[email protected]>

charts/kargo/templates/_helpers.tpl

@@ -91,6 +91,14 @@ app.kubernetes.io/component: management-controller
 app.kubernetes.io/component: webhooks-server
 {{- end -}}
 
+{{- define "kargo.api.baseURL" -}}
+{{- if or .Values.api.tls.enabled (and .Values.api.ingress.enabled (or .Values.api.ingress.tls.enabled .Values.api.ingress.tls.usesControllerCert)) -}}
+{{- printf "https://%s" .Values.api.host -}}
+{{- else -}}
+{{- printf "http://%s" .Values.api.host -}}
+{{- end -}}
+{{- end -}}
+
 {{- define "call-nested" }}
 {{- $dot := index . 0 }}
 {{- $subchart := index . 1 }}

charts/kargo/templates/api/configmap.yaml

@@ -24,11 +24,7 @@ data:
   PERMISSIVE_CORS_POLICY_ENABLED: {{ quote .Values.api.permissiveCORSPolicyEnabled }}
   {{- if .Values.api.adminAccount.enabled }}
   ADMIN_ACCOUNT_ENABLED: "true"
-  {{- if or .Values.api.tls.enabled (and .Values.api.ingress.enabled .Values.api.ingress.tls.enabled) }}
-  ADMIN_ACCOUNT_TOKEN_ISSUER: https://{{ .Values.api.host }}
-  {{- else }}
-  ADMIN_ACCOUNT_TOKEN_ISSUER: http://{{ .Values.api.host }}
-  {{- end }}
+  ADMIN_ACCOUNT_TOKEN_ISSUER: {{ include "kargo.api.baseURL" . }}
   ADMIN_ACCOUNT_TOKEN_AUDIENCE: {{ quote .Values.api.host }}
   ADMIN_ACCOUNT_TOKEN_TTL: {{ quote .Values.api.adminAccount.tokenTTL }}
   {{- end }}
@@ -41,11 +37,7 @@ data:
   GLOBAL_SERVICE_ACCOUNT_NAMESPACES: {{ .Release.Namespace }}
   {{- end }}
   {{- if .Values.api.oidc.dex.enabled }}
-  {{- if or .Values.api.tls.enabled (and .Values.api.ingress.enabled .Values.api.ingress.tls.enabled) }}
-  OIDC_ISSUER_URL: https://{{ .Values.api.host }}/dex
-  {{- else }}
-  OIDC_ISSUER_URL: http://{{ .Values.api.host }}/dex
-  {{- end }}
+  OIDC_ISSUER_URL: {{ include "kargo.api.baseURL" . }}/dex
   OIDC_CLIENT_ID: {{ quote .Values.api.host }}
   OIDC_CLI_CLIENT_ID: {{ .Values.api.host }}-cli
   DEX_ENABLED: "true"

charts/kargo/templates/controller/configmap.yaml

@@ -9,11 +9,7 @@ metadata:
     {{- include "kargo.controller.labels" . | nindent 4 }}
 data:
   {{- if .Values.api.enabled }}
-  {{- if or .Values.api.tls.enabled (and .Values.api.ingress.enabled .Values.api.ingress.tls.enabled) }}
-  API_SERVER_BASE_URL: https://{{ .Values.api.host }}
-  {{- else }}
-  API_SERVER_BASE_URL: http://{{ .Values.api.host }}
-  {{- end }}
+  API_SERVER_BASE_URL: {{ include "kargo.api.baseURL" . }}
   {{- end }}
   LOG_LEVEL: {{ quote .Values.controller.logLevel }}
   {{- if .Values.controller.shardName }}

charts/kargo/templates/dex-server/secret.yaml

@@ -10,11 +10,7 @@ metadata:
     {{- include "kargo.dexServer.labels" . | nindent 4 }}
 stringData:
   config.yaml: |-
-    {{- if or .Values.api.tls.enabled (and .Values.api.ingress.enabled .Values.api.ingress.tls.enabled) }}
-    issuer: https://{{ .Values.api.host }}/dex
-    {{- else }}
-    issuer: http://{{ .Values.api.host }}/dex
-    {{- end }}
+    issuer: {{ include "kargo.api.baseURL" . }}/dex
 
     storage:
       type: memory
@@ -35,11 +31,7 @@ stringData:
       public: true
       {{- if not (hasPrefix "localhost:" .Values.api.host) }}
       redirectURIs:
-      {{- if or .Values.api.tls.enabled (and .Values.api.ingress.enabled .Values.api.ingress.tls.enabled) }}
-      - https://{{ .Values.api.host }}/login
-      {{- else }}
-      - http://{{ .Values.api.host }}/login
-      {{- end }}
+      - {{ include "kargo.api.baseURL" . }}/login
       {{- end }}
     - id: {{ .Values.api.host }}-cli
       name: Kargo CLI

charts/kargo/values.yaml

@@ -155,17 +155,19 @@ api:
   permissiveCORSPolicyEnabled: false
 
   ingress:
-    ## @param api.ingress.enabled Whether to enable ingress. By default, this is disabled. Enabling ingress is advanced usage.
+    ## @param api.ingress.enabled Whether to enable ingress by creating an Ingress resource. By default, this is disabled. Enabling ingress is advanced usage.
     enabled: false
-    ## @param api.ingress.annotations Annotations specified by your ingress controller to customize the behavior of the ingress resource.
+    ## @param api.ingress.annotations Annotations specified by your ingress controller to customize the behavior of the Ingress resource.
     annotations: {}
       # kubernetes.io/ingress.class: nginx
-    ## @param api.ingress.ingressClassName From Kubernetes 1.18+, this field is supported if implemented by your ingress controller. When set, you do not need to add the ingress class as annotation.
+    ## @param api.ingress.ingressClassName If implemented by your ingress controller, specifies the ingress class. If your ingress controller does not support this, use the `kubernetes.io/ingress.class` annotation instead.
     ingressClassName:
     tls:
-      ## @param api.ingress.tls.enabled Whether to enable TLS for the ingress. All other settings in this section will be ignored when this is set to `false`.
+      ## @param api.ingress.tls.enabled Whether to associate a certificate with the Ingress resource.
       enabled: true
-      ## @param api.ingress.tls.selfSignedCert Whether to generate a self-signed certificate for use with the API server's Ingress resource. If `true`, `cert-manager` CRDs **must** be present in the cluster. Kargo will create and use its own namespaced issuer. If `false`, a cert secret named `kargo-api-ingress-cert` **must** be provided in the same namespace as Kargo.
+      ## @param api.ingress.tls.usesControllerCert Whether the ingress controller has been configured to terminate SSL using its own certificate instead of the certificate, if any, referenced by the Ingress resource. This is an uncommon configuration.
+      usesControllerCert: false
+      ## @param api.ingress.tls.selfSignedCert Whether to generate a self-signed certificate for use with the API server's Ingress resource. If `true`, `cert-manager` CRDs **must** be present in the cluster. Kargo will create and use its own namespaced issuer. If `false`, a cert secret named `kargo-api-ingress-cert` **must** be provided in the same namespace as Kargo. The value in this field has no effect if `api.ingress.tls.enabled` is `false`.
       selfSignedCert: true
     ## @param api.ingress.pathType You may want to use `Prefix` for some controllers (like AWS LoadBalancer Ingress controller), which don't support `/` as wildcard path when pathType is set to `ImplementationSpecific`
     pathType: ImplementationSpecific