Add support for generating Hubble metrics certificates

Signed-off-by: Chance Zibolski <[email protected]>

cmd/certgen.go

@@ -87,6 +87,12 @@ func New() (*cobra.Command, error) {
 	flags.String(option.HubbleServerCertSecretName, defaults.HubbleServerCertSecretName, "Name of the K8s Secret where the Hubble server cert and key are stored in")
 	flags.String(option.HubbleServerCertSecretNamespace, "", "Overwrites the namespace of the K8s Secret where the Hubble server cert and key are stored in")
 
+	flags.Bool(option.HubbleMetricsServerCertGenerate, defaults.HubbleMetricsServerCertGenerate, "Generate and store Hubble metrics server certificate")
+	flags.String(option.HubbleMetricsServerCertCommonName, defaults.HubbleMetricsServerCertCommonName, "Hubble metrics server certificate common name")
+	flags.Duration(option.HubbleMetricsServerCertValidityDuration, defaults.HubbleMetricsServerCertValidityDuration, "Hubble metrics server certificate validity duration")
+	flags.String(option.HubbleMetricsServerCertSecretName, defaults.HubbleMetricsServerCertSecretName, "Name of the K8s Secret where the Hubble metrics server cert and key are stored in")
+	flags.String(option.HubbleMetricsServerCertSecretNamespace, "", "Overwrites the namespace of the K8s Secret where the Hubble metrics server cert and key are stored in")
+
 	// Extenal Workload certs
 	flags.String(option.CiliumNamespace, defaults.CiliumNamespace, "Namespace where the cert secrets and configmaps are stored in")
 
@@ -213,6 +219,22 @@ func generateCertificates() error {
 		}
 	}
 
+	var hubbleMetricsServerCert *generate.Cert
+	if option.Config.HubbleMetricsServerCertGenerate {
+		log.Info("Generating server certificates for Hubble")
+		hubbleMetricsServerCert = generate.NewCert(
+			option.Config.HubbleMetricsServerCertCommonName,
+			option.Config.HubbleMetricsServerCertValidityDuration,
+			defaults.HubbleMetricsServerCertUsage,
+			option.Config.HubbleMetricsServerCertSecretName,
+			option.Config.HubbleMetricsServerCertSecretNamespace,
+		)
+		err := hubbleMetricsServerCert.Generate(ciliumCA)
+		if err != nil {
+			return fmt.Errorf("failed to generate Hubble server cert: %w", err)
+		}
+	}
+
 	var hubbleRelayClientCert *generate.Cert
 	if option.Config.HubbleRelayClientCertGenerate {
 		log.Info("Generating client certificates for Hubble Relay")
@@ -323,6 +345,15 @@ func generateCertificates() error {
 		count++
 	}
 
+	if option.Config.HubbleMetricsServerCertGenerate {
+		ctx, cancel := context.WithTimeout(context.Background(), option.Config.K8sRequestTimeout)
+		defer cancel()
+		if err := hubbleMetricsServerCert.StoreAsSecret(ctx, k8sClient); err != nil {
+			return fmt.Errorf("failed to create secret for Hubble server cert: %w", err)
+		}
+		count++
+	}
+
 	if option.Config.HubbleRelayClientCertGenerate {
 		ctx, cancel := context.WithTimeout(context.Background(), option.Config.K8sRequestTimeout)
 		defer cancel()

internal/defaults/defaults.go

@@ -46,6 +46,19 @@ const (
 	// server certificate is written to.
 	HubbleServerCertSecretName = "hubble-server-certs" //#nosec
 
+	// HubbleMetricsServerCertGenerate can be set to true to generate and store a
+	// Hubble metrics server TLS certificate.
+	HubbleMetricsServerCertGenerate = false
+	// HubbleMetricsServerCertCommonName is the Hubble metrics server x509 certificate CN
+	// value (also used as DNS SAN).
+	HubbleMetricsServerCertCommonName = "default.hubble-metrics.cilium.io"
+	// HubbleMetricsServerCertValidityDuration represent how much time the Hubble
+	// server certificate generated by certgen is valid.
+	HubbleMetricsServerCertValidityDuration = 3 * 365 * 24 * time.Hour
+	// HubbleMetricsServerCertSecretName is the Kubernetes Secret in which the Hubble
+	// server certificate is written to.
+	HubbleMetricsServerCertSecretName = "hubble-metrics-server-certs" //#nosec
+
 	// HubbleRelayServerCertGenerate can be set to true to generate and store a
 	// Hubble Relay server TLS certificate.
 	HubbleRelayServerCertGenerate = false
@@ -130,6 +143,9 @@ var (
 	// HubbleServerCertUsage are the key usages for the Hubble server x509
 	// certificate.
 	HubbleServerCertUsage = []string{"signing", "key encipherment", "server auth"}
+	// HubbleMetricsServerCertUsage are the key usages for the Hubble metrics
+	// server x509 certificate.
+	HubbleMetricsServerCertUsage = []string{"signing", "key encipherment", "server auth"}
 	// HubbleRelayServerCertUsage are the key usages for the Hubble Relay
 	// server x509 certificate.
 	HubbleRelayServerCertUsage = []string{"signing", "key encipherment", "server auth"}

internal/option/config.go

@@ -69,6 +69,22 @@ const (
 	// Hubble server certificate Secret will be stored.
 	HubbleServerCertSecretNamespace = "hubble-server-cert-secret-namespace" //#nosec
 
+	// HubbleMetricsServerCertGenerate can be set to true to generate and store a
+	// Hubble metrics server TLS certificate.
+	HubbleMetricsServerCertGenerate = "hubble-metrics-server-cert-generate"
+	// HubbleMetricsServerCertCommonName is the Hubble metrics server x509 certificate CN
+	// value (also used as DNS SAN).
+	HubbleMetricsServerCertCommonName = "hubble-metrics-server-cert-common-name"
+	// HubbleMetricsServerCertValidityDuration represent how much time the Hubble
+	// server certificate generated by certgen is valid.
+	HubbleMetricsServerCertValidityDuration = "hubble-metrics-server-cert-validity-duration"
+	// HubbleMetricsServerCertSecretName is the Kubernetes Secret in which the Hubble
+	// server certificate is written to.
+	HubbleMetricsServerCertSecretName = "hubble-metrics-server-cert-secret-name" //#nosec
+	// HubbleMetricsServerCertSecretNamespace is the Kubernetes Namespace in which the
+	// Hubble metrics server certificate Secret will be stored.
+	HubbleMetricsServerCertSecretNamespace = "hubble-metrics-server-cert-secret-namespace" //#nosec
+
 	// HubbleRelayServerCertGenerate can be set to true to generate and store a
 	// Hubble Relay server TLS certificate.
 	HubbleRelayServerCertGenerate = "hubble-relay-server-cert-generate"
@@ -249,6 +265,22 @@ type CertGenConfig struct {
 	// Hubble server certificate Secret will be stored.
 	HubbleServerCertSecretNamespace string
 
+	// HubbleMetricsServerCertGenerate can be set to true to generate and store a
+	// Hubble metrics server TLS certificate.
+	HubbleMetricsServerCertGenerate bool
+	// HubbleMetricsServerCertCommonName is the Hubble metrics server x509 certificate CN
+	// value (also used as DNS SAN).
+	HubbleMetricsServerCertCommonName string
+	// HubbleMetricsServerCertValidityDuration represent how much time the Hubble
+	// server certificate generated by certgen is valid.
+	HubbleMetricsServerCertValidityDuration time.Duration
+	// HubbleMetricsServerCertSecretName is the Kubernetes Secret in which the Hubble
+	// server certificate is written to.
+	HubbleMetricsServerCertSecretName string
+	// HubbleMetricsServerCertSecretNamespace is the Kubernetes Namespace in which the
+	// Hubble metrics server certificate Secret will be stored.
+	HubbleMetricsServerCertSecretNamespace string
+
 	// ClustermeshApiserverServerCertGenerate can be set to true to generate
 	// and store a new Clustermesh API server TLS certificate.
 	ClustermeshApiserverServerCertGenerate bool
@@ -349,6 +381,12 @@ func (c *CertGenConfig) PopulateFrom(vp *viper.Viper) {
 	c.HubbleServerCertSecretName = vp.GetString(HubbleServerCertSecretName)
 	c.HubbleServerCertSecretNamespace = getStringWithFallback(vp, HubbleServerCertSecretNamespace, CiliumNamespace)
 
+	c.HubbleMetricsServerCertGenerate = vp.GetBool(HubbleMetricsServerCertGenerate)
+	c.HubbleMetricsServerCertCommonName = vp.GetString(HubbleMetricsServerCertCommonName)
+	c.HubbleMetricsServerCertValidityDuration = vp.GetDuration(HubbleMetricsServerCertValidityDuration)
+	c.HubbleMetricsServerCertSecretName = vp.GetString(HubbleMetricsServerCertSecretName)
+	c.HubbleMetricsServerCertSecretNamespace = getStringWithFallback(vp, HubbleMetricsServerCertSecretNamespace, CiliumNamespace)
+
 	c.CiliumNamespace = vp.GetString(CiliumNamespace)
 
 	c.ClustermeshApiserverServerCertGenerate = vp.GetBool(ClustermeshApiserverServerCertGenerate)