simon/cert-manager-webhook-manitu
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Move everything to use the repo name in the helm chart

Browse Source
This commit is contained in:
Dennis Schmalacker 2020-06-16 10:31:34 +02:00
parent 53f99611e0
commit 0978435607
12 changed files with 128 additions and 125 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

0
deploy/hetzner-webhook/.helmignore → deploy/cert-manager-webhook-hetzner/.helmignore
View File

8
deploy/cert-manager-webhook-hetzner/Chart.yaml Normal file
View File

@ -0,0 +1,8 @@
apiVersion: v1
description: A Helm chart for the Hetzner DNS webhook for cert-manager
name: cert-manager-webhook-hetzner
version: 0.1.0
appVersion: 0.1.0
maintainers:
- name: mecodia GmbH
url: https://github.com/mecodia/cert-manager-webhook-hetzner

0
deploy/hetzner-webhook/templates/NOTES.txt → deploy/cert-manager-webhook-hetzner/templates/NOTES.txt
View File

22
deploy/hetzner-webhook/templates/_helpers.tpl → deploy/cert-manager-webhook-hetzner/templates/_helpers.tpl
View File

@ -2,7 +2,7 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "hetzner-webhook.name" -}}
{{- define "cert-manager-webhook-hetzner.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
@ -11,7 +11,7 @@ Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "hetzner-webhook.fullname" -}}
{{- define "cert-manager-webhook-hetzner.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
@ -27,22 +27,22 @@ If release name contains chart name it will be used as a full name.
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "hetzner-webhook.chart" -}}
{{- define "cert-manager-webhook-hetzner.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- define "hetzner-webhook.selfSignedIssuer" -}}
{{ printf "%s-selfsign" (include "hetzner-webhook.fullname" .) }}
{{- define "cert-manager-webhook-hetzner.selfSignedIssuer" -}}
{{ printf "%s-selfsign" (include "cert-manager-webhook-hetzner.fullname" .) }}
{{- end -}}
{{- define "hetzner-webhook.rootCAIssuer" -}}
{{ printf "%s-ca" (include "hetzner-webhook.fullname" .) }}
{{- define "cert-manager-webhook-hetzner.rootCAIssuer" -}}
{{ printf "%s-ca" (include "cert-manager-webhook-hetzner.fullname" .) }}
{{- end -}}
{{- define "hetzner-webhook.rootCACertificate" -}}
{{ printf "%s-ca" (include "hetzner-webhook.fullname" .) }}
{{- define "cert-manager-webhook-hetzner.rootCACertificate" -}}
{{ printf "%s-ca" (include "cert-manager-webhook-hetzner.fullname" .) }}
{{- end -}}
{{- define "hetzner-webhook.servingCertificate" -}}
{{ printf "%s-webhook-tls" (include "hetzner-webhook.fullname" .) }}
{{- define "cert-manager-webhook-hetzner.servingCertificate" -}}
{{ printf "%s-webhook-tls" (include "cert-manager-webhook-hetzner.fullname" .) }}
{{- end -}}

8
deploy/hetzner-webhook/templates/apiservice.yaml → deploy/cert-manager-webhook-hetzner/templates/apiservice.yaml
View File

@ -3,17 +3,17 @@ kind: APIService
metadata:
name: v1alpha1.{{ .Values.groupName }}
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
annotations:
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "hetzner-webhook.servingCertificate" . }}"
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "cert-manager-webhook-hetzner.servingCertificate" . }}"
spec:
group: {{ .Values.groupName }}
groupPriorityMinimum: 1000
versionPriority: 15
service:
name: {{ include "hetzner-webhook.fullname" . }}
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
namespace: {{ .Release.Namespace }}
version: v1alpha1

14
deploy/hetzner-webhook/templates/deployment.yaml → deploy/cert-manager-webhook-hetzner/templates/deployment.yaml
View File

@ -1,25 +1,25 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "hetzner-webhook.fullname" . }}
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
replicas: {{ .Values.replicaCount }}
selector:
matchLabels:
app: {{ include "hetzner-webhook.name" . }}
app: {{ include "cert-manager-webhook-hetzner.name" . }}
release: {{ .Release.Name }}
template:
metadata:
labels:
app: {{ include "hetzner-webhook.name" . }}
app: {{ include "cert-manager-webhook-hetzner.name" . }}
release: {{ .Release.Name }}
spec:
serviceAccountName: {{ include "hetzner-webhook.fullname" . }}
serviceAccountName: {{ include "cert-manager-webhook-hetzner.fullname" . }}
containers:
- name: {{ .Chart.Name }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@ -53,7 +53,7 @@ spec:
volumes:
- name: certs
secret:
secretName: {{ include "hetzner-webhook.servingCertificate" . }}
secretName: {{ include "cert-manager-webhook-hetzner.servingCertificate" . }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{ toYaml . | indent 8 }}

76
deploy/cert-manager-webhook-hetzner/templates/pki.yaml Normal file
View File

@ -0,0 +1,76 @@
---
# Create a selfsigned Issuer, in order to create a root CA certificate for
# signing webhook serving certificates
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
name: {{ include "cert-manager-webhook-hetzner.selfSignedIssuer" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
selfSigned: {}
---
# Generate a CA Certificate used to sign certificates for the webhook
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
name: {{ include "cert-manager-webhook-hetzner.rootCACertificate" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
secretName: {{ include "cert-manager-webhook-hetzner.rootCACertificate" . }}
duration: 43800h # 5y
issuerRef:
name: {{ include "cert-manager-webhook-hetzner.selfSignedIssuer" . }}
commonName: "ca.cert-manager-webhook-hetzner.cert-manager"
isCA: true
---
# Create an Issuer that uses the above generated CA certificate to issue certs
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
name: {{ include "cert-manager-webhook-hetzner.rootCAIssuer" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
ca:
secretName: {{ include "cert-manager-webhook-hetzner.rootCACertificate" . }}
---
# Finally, generate a serving certificate for the webhook to use
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
name: {{ include "cert-manager-webhook-hetzner.servingCertificate" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
secretName: {{ include "cert-manager-webhook-hetzner.servingCertificate" . }}
duration: 8760h # 1y
issuerRef:
name: {{ include "cert-manager-webhook-hetzner.rootCAIssuer" . }}
dnsNames:
- {{ include "cert-manager-webhook-hetzner.fullname" . }}
- {{ include "cert-manager-webhook-hetzner.fullname" . }}.{{ .Release.Namespace }}
- {{ include "cert-manager-webhook-hetzner.fullname" . }}.{{ .Release.Namespace }}.svc

36
deploy/hetzner-webhook/templates/rbac.yaml → deploy/cert-manager-webhook-hetzner/templates/rbac.yaml
View File

@ -1,10 +1,10 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "hetzner-webhook.fullname" . }}
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
---
@ -14,11 +14,11 @@ metadata:
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "hetzner-webhook.fullname" . }}:webhook-authentication-reader
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}:webhook-authentication-reader
namespace: kube-system
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
roleRef:
@ -28,7 +28,7 @@ roleRef:
subjects:
- apiGroup: ""
kind: ServiceAccount
name: {{ include "hetzner-webhook.fullname" . }}
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
namespace: {{ .Release.Namespace }}
---
# apiserver gets the auth-delegator role to delegate auth decisions to
@ -36,10 +36,10 @@ subjects:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ include "hetzner-webhook.fullname" . }}:auth-delegator
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}:auth-delegator
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
roleRef:
@ -49,17 +49,17 @@ roleRef:
subjects:
- apiGroup: ""
kind: ServiceAccount
name: {{ include "hetzner-webhook.fullname" . }}
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
namespace: {{ .Release.Namespace }}
---
# Grant cert-manager permission to validate using our apiserver
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "hetzner-webhook.fullname" . }}:domain-solver
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}:domain-solver
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
rules:
@ -73,16 +73,16 @@ rules:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ include "hetzner-webhook.fullname" . }}:domain-solver
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}:domain-solver
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ include "hetzner-webhook.fullname" . }}:domain-solver
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}:domain-solver
subjects:
- apiGroup: ""
kind: ServiceAccount

8
deploy/hetzner-webhook/templates/service.yaml → deploy/cert-manager-webhook-hetzner/templates/service.yaml
View File

@ -1,11 +1,11 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "hetzner-webhook.fullname" . }}
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
@ -16,5 +16,5 @@ spec:
protocol: TCP
name: https
selector:
app: {{ include "hetzner-webhook.name" . }}
app: {{ include "cert-manager-webhook-hetzner.name" . }}
release: {{ .Release.Name }}

0
deploy/hetzner-webhook/values.yaml → deploy/cert-manager-webhook-hetzner/values.yaml
View File

5
deploy/hetzner-webhook/Chart.yaml
View File

@ -1,5 +0,0 @@
apiVersion: v1
appVersion: "1.0"
description: A Helm chart for Kubernetes
name: hetzner-webhook
version: 0.1.0

76
deploy/hetzner-webhook/templates/pki.yaml
View File

@ -1,76 +0,0 @@
---
# Create a selfsigned Issuer, in order to create a root CA certificate for
# signing webhook serving certificates
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
name: {{ include "hetzner-webhook.selfSignedIssuer" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
selfSigned: {}
---
# Generate a CA Certificate used to sign certificates for the webhook
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
name: {{ include "hetzner-webhook.rootCACertificate" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
secretName: {{ include "hetzner-webhook.rootCACertificate" . }}
duration: 43800h # 5y
issuerRef:
name: {{ include "hetzner-webhook.selfSignedIssuer" . }}
commonName: "ca.hetzner-webhook.cert-manager"
isCA: true
---
# Create an Issuer that uses the above generated CA certificate to issue certs
apiVersion: cert-manager.io/v1alpha2
kind: Issuer
metadata:
name: {{ include "hetzner-webhook.rootCAIssuer" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
ca:
secretName: {{ include "hetzner-webhook.rootCACertificate" . }}
---
# Finally, generate a serving certificate for the webhook to use
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
name: {{ include "hetzner-webhook.servingCertificate" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
secretName: {{ include "hetzner-webhook.servingCertificate" . }}
duration: 8760h # 1y
issuerRef:
name: {{ include "hetzner-webhook.rootCAIssuer" . }}
dnsNames:
- {{ include "hetzner-webhook.fullname" . }}
- {{ include "hetzner-webhook.fullname" . }}.{{ .Release.Namespace }}
- {{ include "hetzner-webhook.fullname" . }}.{{ .Release.Namespace }}.svc