stack_orchestrator/deploy/k8s/cluster_info.py

@@ -101,7 +101,7 @@ class ClusterInfo:
         )
         return service
 
-    def get_ingress(self, use_tls=False):
+    def get_ingress(self, use_tls=False, certificate=None, cluster_issuer="letsencrypt-prod"):
         # No ingress for a deployment that has no http-proxy defined, for now
         http_proxy_info_list = self.spec.get_http_proxy()
         ingress = None
@@ -112,10 +112,16 @@ class ClusterInfo:
                 print(f"http-proxy: {http_proxy_info}")
             # TODO: good enough parsing for webapp deployment for now
             host_name = http_proxy_info["host-name"]
+
+            tls_hosts = [host_name],
+            tls_secret_name = f"{self.app_name}-tls"
+            if certificate:
+                tls_hosts = certificate["spec"]["dnsNames"]
+                tls_secret_name = certificate["spec"]["secretName"]
             rules = []
             tls = [client.V1IngressTLS(
-                hosts=[host_name],
-                secret_name=f"{self.app_name}-tls"
+                hosts=tls_hosts,
+                secret_name=tls_secret_name
             )] if use_tls else None
             paths = []
             for route in http_proxy_info["routes"]:
@@ -147,13 +153,17 @@ class ClusterInfo:
                 tls=tls,
                 rules=rules
             )
+
+            ingress_annotations = {
+                "kubernetes.io/ingress.class": "nginx",
+            }
+            if not certificate:
+                ingress_annotations["cert-manager.io/cluster-issuer"] = cluster_issuer
+
             ingress = client.V1Ingress(
                 metadata=client.V1ObjectMeta(
                     name=f"{self.app_name}-ingress",
-                    annotations={
-                        "kubernetes.io/ingress.class": "nginx",
-                        "cert-manager.io/cluster-issuer": "letsencrypt-prod"
-                    }
+                    annotations=ingress_annotations
                 ),
                 spec=spec
             )

stack_orchestrator/deploy/k8s/deploy_k8s.py

@@ -170,14 +170,37 @@ class K8sDeployer(Deployer):
                 print(f"{service_resp}")
 
     def _find_certificate_for_host_name(self, host_name):
-        all_certificates = self.custom_obj_api.get_namespaced_custom_object(
+        all_certificates = self.custom_obj_api.list_namespaced_custom_object(
             group="cert-manager.io",
             version="v1",
             namespace=self.k8s_namespace,
             plural="certificates"
         )
-        for cert in all_certificates:
-            print(cert)
+
+        host_parts = host_name.split(".", 1)
+        host_as_wild = None
+        if len(host_parts) == 2:
+            host_as_wild = f"*.{host_parts[1]}"
+
+        now = datetime.utcnow().replace(tzinfo=timezone.utc)
+        fmt = "%Y-%m-%dT%H:%M:%S%z"
+
+        # Walk over all the configured certificates.
+        for cert in all_certificates["items"]:
+            dns = cert["spec"]["dnsNames"]
+            # Check for an exact hostname match or a wildcard match.
+            if host_name in dns or host_as_wild in dns:
+                status = cert.get("status", {})
+                # Check the certificate date.
+                if "notAfter" in status and "notBefore" in status:
+                    before = datetime.strptime(status["notBefore"], fmt)
+                    after = datetime.strptime(status["notAfter"], fmt)
+                    if before < now < after:
+                        # Check the status is Ready
+                        for condition in status.get("conditions", []):
+                            if "True" == condition.get("status") and "Ready" == condition.get("type"):
+                                return cert
+        return None
 
     def up(self, detach, services):
         if not opts.o.dry_run:
@@ -199,8 +222,11 @@ class K8sDeployer(Deployer):
         self._create_volume_data()
         self._create_deployment()
 
+        use_tls = not self.is_kind()
+        certificate = self._find_certificate_for_host_name(self.spec.get_http_proxy()[0]["host-name"]) if use_tls else None
+
         # Note: at present we don't support tls for kind (and enabling tls causes errors)
-        ingress: client.V1Ingress = self.cluster_info.get_ingress(use_tls=not self.is_kind())
+        ingress: client.V1Ingress = self.cluster_info.get_ingress(use_tls=use_tls, certificate=certificate)
         if ingress:
             if opts.o.debug:
                 print(f"Sending this ingress: {ingress}")
@@ -333,7 +359,6 @@ class K8sDeployer(Deployer):
 
     def status(self):
         self.connect_api()
-        self._find_certificate_for_host_name("foo")
         # Call whatever API we need to get the running container list
         all_pods = self.core_api.list_pod_for_all_namespaces(watch=False)
         pods = []

stack_orchestrator/deploy/spec.py

@@ -27,7 +27,9 @@ class ResourceLimits:
     memory: int = None
     storage: int = None
 
-    def __init__(self, obj={}):
+    def __init__(self, obj=None):
+        if obj is None:
+            obj = {}
         if "cpus" in obj:
             self.cpus = float(obj["cpus"])
         if "memory" in obj:
@@ -50,7 +52,9 @@ class Resources:
     limits: ResourceLimits = None
     reservations: ResourceLimits = None
 
-    def __init__(self, obj={}):
+    def __init__(self, obj=None):
+        if obj is None:
+            obj = {}
         if "reservations" in obj:
             self.reservations = ResourceLimits(obj["reservations"])
         if "limits" in obj:
@@ -72,7 +76,9 @@ class Spec:
     obj: typing.Any
     file_path: Path
 
-    def __init__(self, file_path: Path = None, obj={}) -> None:
+    def __init__(self, file_path: Path = None, obj=None) -> None:
+        if obj is None:
+            obj = {}
         self.file_path = file_path
         self.obj = obj
 
@@ -91,49 +97,41 @@ class Spec:
             self.file_path = file_path
 
     def get_image_registry(self):
-        return (self.obj[constants.image_registry_key]
-                if self.obj and constants.image_registry_key in self.obj
-                else None)
+        return self.obj.get(constants.image_registry_key)
 
     def get_volumes(self):
-        return (self.obj["volumes"]
-                if self.obj and "volumes" in self.obj
-                else {})
+        return self.obj.get(constants.volumes_key, {})
 
     def get_configmaps(self):
-        return (self.obj["configmaps"]
-                if self.obj and "configmaps" in self.obj
-                else {})
+        return self.obj.get(constants.configmaps_key, {})
 
     def get_container_resources(self):
-        return Resources(self.obj.get("resources", {}).get("containers", {}))
+        return Resources(self.obj.get(constants.resources_key, {}).get("containers", {}))
 
     def get_volume_resources(self):
-        return Resources(self.obj.get("resources", {}).get("volumes", {}))
+        return Resources(self.obj.get(constants.resources_key, {}).get(constants.volumes_key, {}))
 
     def get_http_proxy(self):
-        return (self.obj[constants.network_key][constants.http_proxy_key]
-                if self.obj and constants.network_key in self.obj
-                and constants.http_proxy_key in self.obj[constants.network_key]
-                else None)
+        return self.obj.get(constants.network_key, {}).get(constants.http_proxy_key, [])
 
     def get_annotations(self):
-        return self.obj.get("annotations", {})
+        return self.obj.get(constants.annotations_key, {})
 
     def get_labels(self):
-        return self.obj.get("labels", {})
+        return self.obj.get(constants.labels_key, {})
 
     def get_privileged(self):
-        return "true" == str(self.obj.get("security", {}).get("privileged", "false")).lower()
+        return "true" == str(self.obj.get(constants.security_key, {}).get("privileged", "false")).lower()
 
     def get_capabilities(self):
-        return self.obj.get("security", {}).get("capabilities", [])
+        return self.obj.get(constants.security_key, {}).get("capabilities", [])
 
     def get_deployment_type(self):
-        return self.obj[constants.deploy_to_key]
+        return self.obj.get(constants.deploy_to_key)
 
     def is_kubernetes_deployment(self):
-        return self.get_deployment_type() in [constants.k8s_kind_deploy_type, constants.k8s_deploy_type]
+        return self.get_deployment_type() in [constants.k8s_kind_deploy_type,
+                                              constants.k8s_deploy_type]
 
     def is_kind_deployment(self):
         return self.get_deployment_type() in [constants.k8s_kind_deploy_type]