add wildcard certificates to anchor certs;

unify linkerd_version

Author: huehnerhose

anchor-cert.tf

@@ -1,5 +1,13 @@
 // Create trusted Anchor Certificate
 
+locals {
+  cert_domains = [
+    var.cluster_dns_name,
+    "*.${var.cluster_dns_name}",
+    "*.cluster.local"
+  ]
+}
+
 resource "tls_private_key" "trustanchor_key" {
   count       = var.external_trustanchor ? 0 : 1
   algorithm   = "ECDSA"
@@ -12,13 +20,9 @@ resource "tls_self_signed_cert" "trustanchor_cert" {
   validity_period_hours = 87600
   is_ca_certificate     = true
 
-  uris = [
-    var.cluster_dns_name
-  ]
+  uris = local.cert_domains
 
-  dns_names = [
-    var.cluster_dns_name
-  ]
+  dns_names = local.cert_domains
 
   subject {
     common_name = "root.linkerd.${var.cluster_dns_name}"
@@ -40,13 +44,9 @@ resource "tls_private_key" "issuer_key" {
 resource "tls_cert_request" "issuer_req" {
   private_key_pem = tls_private_key.issuer_key.private_key_pem
 
-  uris = [
-    var.cluster_dns_name
-  ]
+  uris = local.cert_domains
 
-  dns_names = [
-    var.cluster_dns_name
-  ]
+  dns_names = local.cert_domains
 
   subject {
     common_name = "identity.linkerd.${var.cluster_dns_name}"
@@ -58,7 +58,7 @@ resource "tls_locally_signed_cert" "issuer_cert" {
   ca_private_key_pem    = var.external_trustanchor ? var.trustanchor_key.private_key_pem : tls_private_key.trustanchor_key[0].private_key_pem
   ca_cert_pem           = var.external_trustanchor ? var.trustanchor_cert.cert_pem : tls_self_signed_cert.trustanchor_cert[0].cert_pem
   validity_period_hours = 8760
-  is_ca_certificate     = false
+  is_ca_certificate     = true
 
   allowed_uses = [
     "crl_signing",

install.tf

@@ -74,7 +74,7 @@ resource "helm_release" "linkerd-multicluster" {
   values = [
     templatefile("${path.module}/multicluster-values.yaml.tpl", {
       installNamespace               = var.multicluster_installNamespace
-      linkerdVersion                 = var.multicluster_linkerdVersion
+      linkerdVersion                 = var.linkerd_version
       namespace                      = var.multicluster_namespace
       proxyOutboundPort              = var.multicluster_proxyOutboundPort
       remoteMirrorServiceAccount     = var.multicluster_remoteMirrorServiceAccount

variables.tf

@@ -4,6 +4,11 @@ variable "cluster_dns_name" {
   default     = "cluster.local"
 }
 
+variable "linkerd_version" {
+  description = "linkerd version to be installed"
+  type        = string
+}
+
 variable "enable_linkerd_ha" {
   description = "Enable Linkerd HA Mode for production cluster if true"
   type        = bool

variables_multicluster.tf

@@ -59,11 +59,6 @@ variable "multicluster_installNamespace" {
   type        = string
   default     = "true"
 }
-variable "multicluster_linkerdVersion" {
-  description = "see https://artifacthub.io/packages/helm/linkerd2/linkerd-multicluster?modal=values"
-  type        = string
-  default     = "stable-2.11.1"
-}
 variable "multicluster_namespace" {
   description = "see https://artifacthub.io/packages/helm/linkerd2/linkerd-multicluster?modal=values"
   type        = string