Skip to content

charts: document that Kubernetes 1.37+ needs no certificate feature gates #177

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
younsl wants to merge 1 commit into
base: main
Choose a base branch
from
+18 −11
Open

charts: document that Kubernetes 1.37+ needs no certificate feature gates #177

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions charts/substrate-podcert/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,10 @@ of the application release. It issues service DNS and pod identity certificates
and publishes their cluster trust bundles. It does not require PostgreSQL or
a certificate issued by itself.

The cluster must enable `ClusterTrustBundle`, `ClusterTrustBundleProjection`,
and `PodCertificateRequest`, including the `certificates.k8s.io/v1beta1` API.
The cluster must serve Pod Certificates and Cluster Trust Bundles. Kubernetes
1.37 and later serve them at `certificates.k8s.io/v1` by default. On earlier
versions, enable `ClusterTrustBundle`, `ClusterTrustBundleProjection`, and
`PodCertificateRequest`, including the `certificates.k8s.io/v1beta1` API.
Create `service-dns-ca-pool`, `pod-identity-ca-pool`, and `postgres-ca-pool`
Secrets in the controller's namespace before installation. Each Secret must
contain a signing pool in its `pool` key. The existing setup command creates
Expand Down
7 changes: 5 additions & 2 deletions charts/substrate/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,12 @@

Helm chart for installing Agent Substrate.

The chart uses mTLS and requires a prepared PostgreSQL database. It requires the
The chart uses mTLS and requires a prepared PostgreSQL database. It also
requires Pod Certificates and Cluster Trust Bundles. Kubernetes 1.37 and later
serve them at `certificates.k8s.io/v1` by default, with no feature gates or
`--runtime-config` changes. On earlier versions, enable the
`ClusterTrustBundle`, `ClusterTrustBundleProjection`, and
`PodCertificateRequest` feature gates plus the `certificates.k8s.io/v1beta1`
`PodCertificateRequest` feature gates and the `certificates.k8s.io/v1beta1`
API.

Install the [certificate controller](../substrate-podcert/README.md) as a separate
Expand Down
10 changes: 5 additions & 5 deletions charts/substrate/templates/NOTES.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
substrate {{ .Chart.AppVersion }} installed with mTLS and PostgreSQL

REQUIRED Kubernetes feature gates:
- ClusterTrustBundle
- ClusterTrustBundleProjection
- PodCertificateRequest
The certificates.k8s.io/v1beta1 API must also be enabled.
REQUIRED: Pod Certificates and Cluster Trust Bundles.
- Kubernetes 1.37 and later: served at certificates.k8s.io/v1 by default.
- Earlier versions: enable the ClusterTrustBundle,
ClusterTrustBundleProjection, and PodCertificateRequest feature gates
and the certificates.k8s.io/v1beta1 API.
6 changes: 4 additions & 2 deletions charts/substrate/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,10 @@

# Default values for the substrate chart.
#
# The chart requires ClusterTrustBundle, ClusterTrustBundleProjection,
# PodCertificateRequest, and the certificates.k8s.io/v1beta1 API.
# The chart requires Pod Certificates and Cluster Trust Bundles, served at
# certificates.k8s.io/v1 by default on Kubernetes 1.37 and later. Earlier
# versions need the ClusterTrustBundle, ClusterTrustBundleProjection, and
# PodCertificateRequest feature gates and the certificates.k8s.io/v1beta1 API.

# Set to true to have the chart create the release namespace.
# Off by default — most helm workflows expect the namespace to already exist
Expand Down