teleport icon indicating copy to clipboard operation
teleport copied to clipboard

[helm] Don't hard-code `.cluster.local` in the `teleport-cluster` chart

Open programmerq opened this issue 9 months ago • 0 comments

What would you like Teleport to do?

Kubernetes allows cluster administrators to choose a value other than cluster.local. This means that our chart's hard-coded use leads to failures on a Kubernetes cluster that doesn't use the default value.

https://github.com/gravitational/teleport/blob/master/examples/chart/teleport-cluster/templates/_helpers.tpl#L90

% grep -Ri 'serviceFQDN' .
./charts/teleport-operator/templates/_helpers.tpl:{{- $clusterAddr := include "teleport-cluster.auth.serviceFQDN" . -}}
./charts/teleport-operator/templates/_helpers.tpl:{{- define "teleport-cluster.auth.serviceFQDN" -}}{{- end }}
./templates/proxy/_config.common.tpl:  auth_server: "{{ include "teleport-cluster.auth.serviceFQDN" . }}:3025"
./templates/auth/_config.common.tpl:  public_addr: "{{ include "teleport-cluster.auth.serviceFQDN" . }}:3026"
./templates/_helpers.tpl:{{- define "teleport-cluster.auth.serviceFQDN" -}}

A common paradigm in the helm community is to include a clusterDomain value that defaults to cluster.local. An alternate approach would be to avoid using the FQDN and instead rely on the short DNS names (if feasible).

Here's an example in the bitnami etcd chart:

https://github.com/bitnami/charts/blob/main/bitnami/etcd/values.yaml#L49-L51 https://github.com/bitnami/charts/blob/main/bitnami/etcd/templates/statefulset.yaml#L182-L183

programmerq avatar May 02 '24 19:05 programmerq