feat: support StackState with self-signed certificates

README.md

@@ -20,6 +20,7 @@ You need to have a StackState service token. The following steps describe how to
 | `STEADYBIT_EXTENSION_SERVICE_TOKEN`                         | `stackstate.serviceToken`               | Stack State Service Token                                                                                               | yes      |         |
 | `STEADYBIT_EXTENSION_API_BASE_URL`                          | `stackstate.apiBaseUrl`                 | Stack State API Base URL (example: https://yourcompany.app.stackstate.io/api)                                           | yes      |         |
 | `STEADYBIT_EXTENSION_DISCOVERY_ATTRIBUTES_EXCLUDES_SERVICE` | `discovery.attributes.excludes.service` | List of Service Attributes which will be excluded during discovery. Checked by key equality and supporting trailing "*" | no       |         |
+| `STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY`                  | `stackstate.insecureSkipVerify`         | Skip TLS certificate verification when connecting to StackState. See [Importing your own certificates](#importing-your-own-certificates). | no       | `false` |
 
 
 Beyond the settings above, this extension supports the configuration common to all Steadybit
@@ -32,6 +33,44 @@ extensions:
 - [Group Matching](https://github.com/steadybit/discovery-kit/blob/main/docs/target-enrichment.md#group-matching) —
   tag discovered targets with a group, so enrichment rules only match within it.
 
+## Importing your own certificates
+
+If your StackState is served with a self-signed certificate, or one issued by a private CA, either trust the CA
+(recommended) or skip certificate verification.
+
+### Option 1: Mounting custom certificates
+
+Store the CA certificate (`*.crt`) in a config map:
+
+```shell
+kubectl create configmap -n steadybit-agent stackstate-self-signed-ca --from-file=./self-signed-ca.crt
+```
+
+Then mount it and add it to the trusted certificate directories:
+
+```yaml
+extraVolumeMounts:
+  - name: extra-certs
+    mountPath: /etc/ssl/extra-certs
+    readOnly: true
+extraVolumes:
+  - name: extra-certs
+    configMap:
+      name: stackstate-self-signed-ca
+extraEnv:
+  - name: SSL_CERT_DIR
+    value: /etc/ssl/extra-certs:/etc/ssl/certs
+```
+
+### Option 2: Skipping certificate verification
+
+Disables TLS certificate verification. Suitable for testing, not recommended for production.
+
+```yaml
+stackstate:
+  insecureSkipVerify: true
+```
+
 ## Installation
 
 ### Kubernetes

charts/steadybit-extension-stackstate/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: steadybit-extension-stackstate
 description: Steadybit stackstate extension Helm chart for Kubernetes.
-version: 1.1.40
+version: 1.1.41
 appVersion: v1.0.36
 home: https://www.steadybit.com/
 icon: https://steadybit-website-assets.s3.amazonaws.com/logo-symbol-transparent.png

charts/steadybit-extension-stackstate/templates/deployment.yaml

@@ -68,6 +68,8 @@ spec:
                   key: service-token
             - name: STEADYBIT_EXTENSION_API_BASE_URL
               value: {{ .Values.stackstate.apiBaseUrl }}
+            - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+              value: {{ .Values.stackstate.insecureSkipVerify | quote }}
             {{- with .Values.extraEnv }}
               {{- toYaml . | nindent 12 }}
             {{- end }}
@@ -77,6 +79,9 @@ spec:
           {{- end }}
           volumeMounts:
             {{- include "extensionlib.deployment.volumeMounts" (list .) | nindent 12 }}
+            {{- with .Values.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
           livenessProbe:
             initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
             periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
@@ -101,6 +106,9 @@ spec:
           {{- end }}
       volumes:
         {{- include "extensionlib.deployment.volumes" (list .) | nindent 8 }}
+        {{- with .Values.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       serviceAccountName: {{ .Values.serviceAccount.name }}
       {{- with .Values.nodeSelector }}
       nodeSelector:

charts/steadybit-extension-stackstate/tests/__snapshot__/deployment_test.yaml.snap

@@ -39,6 +39,8 @@ manifest should match snapshot using podAnnotations and Labels:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -123,6 +125,8 @@ manifest should match snapshot with TLS:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -171,6 +175,96 @@ manifest should match snapshot with TLS:
               secret:
                 optional: false
                 secretName: server-cert
+manifest should match snapshot with custom certificates and insecureSkipVerify:
+  1: |
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      labels:
+        steadybit.com/discovery-disabled: "true"
+        steadybit.com/extension: "true"
+      name: RELEASE-NAME-steadybit-extension-stackstate
+      namespace: NAMESPACE
+    spec:
+      replicas: 1
+      selector:
+        matchLabels:
+          app.kubernetes.io/instance: RELEASE-NAME
+          app.kubernetes.io/name: steadybit-extension-stackstate
+      template:
+        metadata:
+          annotations:
+            oneagent.dynatrace.com/injection: "false"
+          labels:
+            app.kubernetes.io/instance: RELEASE-NAME
+            app.kubernetes.io/name: steadybit-extension-stackstate
+            steadybit.com/discovery-disabled: "true"
+            steadybit.com/extension: "true"
+        spec:
+          containers:
+            - env:
+                - name: STEADYBIT_LOG_LEVEL
+                  value: INFO
+                - name: STEADYBIT_LOG_FORMAT
+                  value: text
+                - name: STEADYBIT_EXTENSION_SERVICE_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      key: service-token
+                      name: steadybit-extension-stackstate
+                - name: STEADYBIT_EXTENSION_API_BASE_URL
+                  value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "true"
+                - name: SSL_CERT_DIR
+                  value: /etc/ssl/extra-certs:/etc/ssl/certs
+              image: ghcr.io/steadybit/extension-stackstate:v0.0.0
+              imagePullPolicy: IfNotPresent
+              livenessProbe:
+                failureThreshold: 5
+                httpGet:
+                  path: /health/liveness
+                  port: 8084
+                initialDelaySeconds: 10
+                periodSeconds: 10
+                successThreshold: 1
+                timeoutSeconds: 5
+              name: extension
+              readinessProbe:
+                failureThreshold: 3
+                httpGet:
+                  path: /health/readiness
+                  port: 8084
+                initialDelaySeconds: 10
+                periodSeconds: 10
+                successThreshold: 1
+                timeoutSeconds: 1
+              resources:
+                limits:
+                  cpu: 200m
+                  memory: 128Mi
+                requests:
+                  cpu: 50m
+                  memory: 32Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                capabilities:
+                  drop:
+                    - ALL
+                readOnlyRootFilesystem: true
+              volumeMounts:
+                - mountPath: /etc/ssl/extra-certs
+                  name: extra-certs
+                  readOnly: true
+          securityContext:
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
+          serviceAccountName: steadybit-extension-stackstate
+          volumes:
+            - configMap:
+                name: stackstate-self-signed-ca
+              name: extra-certs
 manifest should match snapshot with custom image registry:
   1: |
     apiVersion: apps/v1
@@ -210,6 +304,8 @@ manifest should match snapshot with custom image registry:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: my-registry.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -290,6 +386,8 @@ manifest should match snapshot with env vars:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: https://stackstate.example.com
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -370,6 +468,8 @@ manifest should match snapshot with existing secret:
                       name: secret-stackstate-existing
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: https://stackstate.example.com
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -450,6 +550,8 @@ manifest should match snapshot with extra env vars:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
                 - name: FOO
                   value: bar
               envFrom:
@@ -539,6 +641,8 @@ manifest should match snapshot with extra labels:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -619,6 +723,8 @@ manifest should match snapshot with global image pull secrets:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -701,6 +807,8 @@ manifest should match snapshot with global image registry:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: corp-registry.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -781,6 +889,8 @@ manifest should match snapshot with global priority class:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -862,6 +972,8 @@ manifest should match snapshot with image pull secrets:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -944,6 +1056,8 @@ manifest should match snapshot with legacy image name containing registry:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -1030,6 +1144,8 @@ manifest should match snapshot with mutual TLS:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -1130,6 +1246,8 @@ manifest should match snapshot with mutual TLS using containerPaths:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -1210,6 +1328,8 @@ manifest should match snapshot with podSecurityContext:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -1291,6 +1411,8 @@ manifest should match snapshot with priority class:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:
@@ -1372,6 +1494,8 @@ manifest should match snapshot without TLS:
                       name: steadybit-extension-stackstate
                 - name: STEADYBIT_EXTENSION_API_BASE_URL
                   value: null
+                - name: STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY
+                  value: "false"
               image: ghcr.io/steadybit/extension-stackstate:v0.0.0
               imagePullPolicy: IfNotPresent
               livenessProbe:

charts/steadybit-extension-stackstate/tests/deployment_test.yaml

@@ -153,3 +153,20 @@ tests:
             - global-pull-secret
     asserts:
       - matchSnapshot: {}
+  - it: manifest should match snapshot with custom certificates and insecureSkipVerify
+    set:
+      stackstate:
+        insecureSkipVerify: true
+      extraVolumeMounts:
+        - name: extra-certs
+          mountPath: /etc/ssl/extra-certs
+          readOnly: true
+      extraVolumes:
+        - name: extra-certs
+          configMap:
+            name: stackstate-self-signed-ca
+      extraEnv:
+        - name: SSL_CERT_DIR
+          value: /etc/ssl/extra-certs:/etc/ssl/certs
+    asserts:
+      - matchSnapshot: {}

charts/steadybit-extension-stackstate/values.yaml

@@ -9,6 +9,8 @@ stackstate:
   apiBaseUrl: ""
   # stackstate.existingSecret -- If defined, will skip secret creation and instead assume that the referenced secret contains the keys api-token.
   existingSecret: null
+  # stackstate.insecureSkipVerify -- If true, the extension will skip TLS certificate verification when connecting to StackState (e.g. for self-signed certificates). Prefer mounting your CA, see README.
+  insecureSkipVerify: false
 
 image:
   # image.registry -- The container registry to use. Defaults to global.image.registry or ghcr.io.
@@ -140,6 +142,20 @@ extraEnv: []
 #    name: env-secrets
 extraEnvFrom: []
 
+# extraVolumeMounts -- Additional volumeMounts to add to the container, e.g. to mount custom CA certificates
+# extraVolumeMounts:
+#   - name: extra-certs
+#     mountPath: /etc/ssl/extra-certs
+#     readOnly: true
+extraVolumeMounts: []
+
+# extraVolumes -- Additional volumes to add to the pod
+# extraVolumes:
+#   - name: extra-certs
+#     configMap:
+#       name: stackstate-self-signed-ca
+extraVolumes: []
+
 discovery:
   # discovery.group -- Optional group identifier. When set, the extension adds steadybit.group=<value> to every discovered target. Used as an additional matcher in enrichment rules.
   group: ""