feat: support multiple certificates in coder server and helm (#4150)

helm/templates/NOTES.txt

@@ -0,0 +1,8 @@
+{{- if .Values.coder.tls.secretName }}
+
+WARN: coder.tls.secretName is deprecated and will be removed in a future
+      release. Please use coder.tls.secretNames instead.
+{{- end }}
+
+Enjoy Coder! Please create an issue at https://github.com/coder/coder if you run
+into any problems! :)

helm/templates/_helpers.tpl

@@ -37,7 +37,7 @@ Coder Docker image URI
 */}}
 {{- define "coder.image" -}}
 {{- if and (eq .Values.coder.image.tag "") (eq .Chart.AppVersion "0.1.0") -}}
-{{ fail "You must specify coder.image.tag if you're installing the Helm chart directly from Git." }}
+{{ fail "You must specify the coder.image.tag value if you're installing the Helm chart directly from Git." }}
 {{- end -}}
 {{ .Values.coder.image.repo }}:{{ .Values.coder.image.tag | default (printf "v%v" .Chart.AppVersion) }}
 {{- end }}
@@ -46,7 +46,7 @@ Coder Docker image URI
 Coder listen port (must be > 1024)
 */}}
 {{- define "coder.port" }}
-{{- if .Values.coder.tls.secretName -}}
+{{- if or .Values.coder.tls.secretNames .Values.coder.tls.secretName -}}
 8443
 {{- else -}}
 8080
@@ -57,7 +57,7 @@ Coder listen port (must be > 1024)
 Coder service port
 */}}
 {{- define "coder.servicePort" }}
-{{- if .Values.coder.tls.secretName -}}
+{{- if or .Values.coder.tls.secretNames .Values.coder.tls.secretName -}}
 443
 {{- else -}}
 80
@@ -68,7 +68,7 @@ Coder service port
 Port name
 */}}
 {{- define "coder.portName" }}
-{{- if .Values.coder.tls.secretName -}}
+{{- if or .Values.coder.tls.secretNames .Values.coder.tls.secretName -}}
 https
 {{- else -}}
 http
@@ -81,3 +81,73 @@ Scheme
 {{- define "coder.scheme" }}
 {{- include "coder.portName" . | upper -}}
 {{- end }}
+
+{{/*
+Coder volume definitions.
+*/}}
+{{- define "coder.volumes" }}
+{{- if or .Values.coder.tls.secretNames .Values.coder.tls.secretName }}
+volumes:
+{{ range $secretName := .Values.coder.tls.secretNames -}}
+- name: "tls-{{ $secretName }}"
+  secret:
+    secretName: {{ $secretName | quote }}
+{{ end -}}
+{{- if .Values.coder.tls.secretName -}}
+- name: "tls-{{ .Values.coder.tls.secretName }}"
+  secret:
+    secretName: {{ .Values.coder.tls.secretName | quote }}
+{{- end }}
+{{- else }}
+volumes: {{ if and (not .Values.coder.tls.secretNames) (not .Values.coder.tls.secretName) }}[]{{ end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Coder volume mounts.
+*/}}
+{{- define "coder.volumeMounts" }}
+{{- if or .Values.coder.tls.secretNames .Values.coder.tls.secretName }}
+volumeMounts:
+{{ range $secretName := .Values.coder.tls.secretNames -}}
+- name: "tls-{{ $secretName }}"
+  mountPath: "/etc/ssl/certs/coder/{{ $secretName }}"
+  readOnly: true
+{{ end }}
+{{- if .Values.coder.tls.secretName -}}
+- name: "tls-{{ .Values.coder.tls.secretName }}"
+  mountPath: "/etc/ssl/certs/coder/{{ .Values.coder.tls.secretName }}"
+  readOnly: true
+{{- end }}
+{{- else }}
+volumeMounts: []
+{{- end }}
+{{- end }}
+
+{{/*
+Coder TLS environment variables.
+*/}}
+{{- define "coder.tlsEnv" }}
+{{- if or .Values.coder.tls.secretNames .Values.coder.tls.secretName }}
+- name: CODER_TLS_ENABLE
+  value: "true"
+- name: CODER_TLS_CERT_FILE
+  value: "{{ range $idx, $secretName := .Values.coder.tls.secretNames -}}{{ if $idx }},{{ end }}/etc/ssl/certs/coder/{{ $secretName }}/tls.crt{{- end }}{{ if .Values.coder.tls.secretName -}}/etc/ssl/certs/coder/{{ .Values.coder.tls.secretName }}/tls.crt{{- end }}"
+- name: CODER_TLS_KEY_FILE
+  value: "{{ range $idx, $secretName := .Values.coder.tls.secretNames -}}{{ if $idx }},{{ end }}/etc/ssl/certs/coder/{{ $secretName }}/tls.key{{- end }}{{ if .Values.coder.tls.secretName -}}/etc/ssl/certs/coder/{{ .Values.coder.tls.secretName }}/tls.key{{- end }}"
+{{- end }}
+{{- end }}
+
+{{/*
+Fail on fully deprecated values or deprecated value combinations. This is
+included at the top of coder.yaml.
+*/}}
+{{- define "coder.verifyDeprecated" }}
+{{/*
+Deprecated value coder.tls.secretName should not be used alongside new value
+coder.tls.secretName.
+*/}}
+{{- if and .Values.coder.tls.secretName .Values.coder.tls.secretNames }}
+{{ fail "You must specify either coder.tls.secretName or coder.tls.secretNames, not both." }}
+{{- end }}
+{{- end }}

helm/templates/coder.yaml

@@ -1,3 +1,4 @@
+{{- include "coder.verifyDeprecated" . -}}
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -37,14 +38,7 @@ spec:
           env:
             - name: CODER_ADDRESS
               value: "0.0.0.0:{{ include "coder.port" . }}"
-            {{- if .Values.coder.tls.secretName }}
-            - name: CODER_TLS_ENABLE
-              value: "true"
-            - name: CODER_TLS_CERT_FILE
-              value: /etc/ssl/certs/coder/tls.crt
-            - name: CODER_TLS_KEY_FILE
-              value: /etc/ssl/certs/coder/tls.key
-            {{- end }}
+            {{- include "coder.tlsEnv" . | nindent 12 }}
             {{- with .Values.coder.env -}}
             {{ toYaml . | nindent 12 }}
             {{- end }}
@@ -62,16 +56,6 @@ spec:
               path: /api/v2/buildinfo
               port: {{ include "coder.portName" . | quote }}
               scheme: {{ include "coder.scheme" . | quote }}
-          {{- if .Values.coder.tls.secretName }}
-          volumeMounts:
-            - name: tls
-              mountPath: /etc/ssl/certs/coder
-              readOnly: true
-          {{- end }}
+          {{- include "coder.volumeMounts" . | nindent 10 }}
 
-      {{- if .Values.coder.tls.secretName }}
-      volumes:
-        - name: tls
-          secret:
-            secretName: {{ .Values.coder.tls.secretName | quote }}
-      {{- end }}
+      {{- include "coder.volumes" . | nindent 6 }}

helm/values.yaml

@@ -47,12 +47,15 @@ coder:
 
   # coder.tls -- The TLS configuration for Coder.
   tls:
-    # coder.tls.secretName -- The name of the secret containing the TLS
-    # certificate. The secret should exist in the same namespace as the Helm
-    # deployment and should be of type "kubernetes.io/tls". The secret will be
-    # automatically mounted into the pod if specified, and the correct
+    # coder.tls.secretNames -- A list of TLS server certificate secrets to mount
+    # into the Coder pod. The secrets should exist in the same namespace as the
+    # Helm deployment and should be of type "kubernetes.io/tls". The secrets
+    # will be automatically mounted into the pod if specified, and the correct
     # "CODER_TLS_*" environment variables will be set for you.
-    secretName: ""
+    secretNames: []
+    # coder.tls.secretName -- Deprecated. Use `coder.tls.secretNames` instead.
+    # This will be removed in a future release.
+    # secretName: ""
 
   # coder.resources -- The resources to request for Coder. These are optional
   # and are not set by default.