diff --git a/charts/portainer-agent/templates/deployment.yaml b/charts/portainer-agent/templates/deployment.yaml index 9eed7c6..c5b4e7e 100644 --- a/charts/portainer-agent/templates/deployment.yaml +++ b/charts/portainer-agent/templates/deployment.yaml @@ -32,6 +32,11 @@ spec: image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy }} args: + {{- if .Values.mtls.existingSecret }} + - "--mtlscacert=/certs/mtls/mtlsca.crt" + - "--mtlscert=/certs/mtls/mtlscert.crt" + - "--mtlskey=/certs/mtls/mtlskey.key" + {{- end }} {{- range .Values.feature.flags }} - {{ . | squote }} {{- end }} @@ -54,7 +59,7 @@ spec: - name: EDGE_KEY value: {{ .Values.edge.key | quote }} - name: EDGE_INSECURE_POLL - value: "1" + value: "{{ if .Values.edge.insecurePoll }}1{{ else }}0{{ end }}" {{- else if eq .Values.deploymentMode "edge-async" }} - name: EDGE value: "1" @@ -65,17 +70,29 @@ spec: - name: EDGE_KEY value: {{ .Values.edge.key | quote }} - name: EDGE_INSECURE_POLL - value: "1" + value: "{{ if .Values.edge.insecurePoll }}1{{ else }}0{{ end }}" {{- end }} {{- with .Values.extraEnv }} {{- toYaml . | nindent 12 }} {{- end }} + {{- if .Values.mtls.existingSecret }} + volumeMounts: + - name: mtlscerts + mountPath: /certs/mtls + readOnly: true + {{- end }} ports: - name: http containerPort: {{ .Values.service.port }} protocol: TCP resources: {{- toYaml .Values.resources | nindent 12 }} + {{- if .Values.mtls.existingSecret }} + volumes: + - name: mtlscerts + secret: + secretName: {{ .Values.mtls.existingSecret }} + {{- end }} {{- with .Values.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/portainer-agent/values.yaml b/charts/portainer-agent/values.yaml index 4df6183..f309a6a 100644 --- a/charts/portainer-agent/values.yaml +++ b/charts/portainer-agent/values.yaml @@ -33,6 +33,9 @@ edge: id: "" # Edge key from Portainer key: "" + # Skip TLS verification when polling the Portainer server + # Set to false when using properly signed certificates or mTLS + insecurePoll: true # Service configuration service: @@ -140,4 +143,9 @@ imagePullSecrets: [] # - name: regcred nameOverride: "" -fullnameOverride: "" \ No newline at end of file +fullnameOverride: "" + +# mTLS configuration for edge agent communication +mtls: + enable: false + existingSecret: "" \ No newline at end of file