simon/cert-manager-webhook-manitu
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Change name

Browse Source
This commit is contained in:
Dennis Schmalacker
2021-03-10 17:27:26 +01:00
parent c4c1ecb6a4
commit a912042b6f
10 changed files with 398 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/cert-manager-webhook-hetzner/templates/NOTES.txt
View File
charts/cert-manager-webhook-hetzner/templates/_helpers.tpl
+48
View File
@@ -0,0 +1,48 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "cert-manager-webhook-hetzner.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "cert-manager-webhook-hetzner.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "cert-manager-webhook-hetzner.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- define "cert-manager-webhook-hetzner.selfSignedIssuer" -}}
{{ printf "%s-selfsign" (include "cert-manager-webhook-hetzner.fullname" .) }}
{{- end -}}
{{- define "cert-manager-webhook-hetzner.rootCAIssuer" -}}
{{ printf "%s-ca" (include "cert-manager-webhook-hetzner.fullname" .) }}
{{- end -}}
{{- define "cert-manager-webhook-hetzner.rootCACertificate" -}}
{{ printf "%s-ca" (include "cert-manager-webhook-hetzner.fullname" .) }}
{{- end -}}
{{- define "cert-manager-webhook-hetzner.servingCertificate" -}}
{{ printf "%s-webhook-tls" (include "cert-manager-webhook-hetzner.fullname" .) }}
{{- end -}}
charts/cert-manager-webhook-hetzner/templates/apiservice.yaml
+19
View File
@@ -0,0 +1,19 @@
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
name: v1alpha1.{{ .Values.groupName }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
annotations:
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "cert-manager-webhook-hetzner.servingCertificate" . }}"
spec:
group: {{ .Values.groupName }}
groupPriorityMinimum: 1000
versionPriority: 15
service:
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
namespace: {{ .Release.Namespace }}
version: v1alpha1
charts/cert-manager-webhook-hetzner/templates/deployment.yaml
+70
View File
@@ -0,0 +1,70 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
namespace: {{ .Release.Namespace }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
replicas: {{ .Values.replicaCount }}
selector:
matchLabels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
release: {{ .Release.Name }}
template:
metadata:
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
release: {{ .Release.Name }}
spec:
serviceAccountName: {{ include "cert-manager-webhook-hetzner.fullname" . }}
containers:
- name: {{ .Chart.Name }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
args:
- --tls-cert-file=/tls/tls.crt
- --tls-private-key-file=/tls/tls.key
- --secure-port=8443
env:
- name: GROUP_NAME
value: {{ .Values.groupName | quote }}
ports:
- name: https
containerPort: 8443
protocol: TCP
livenessProbe:
httpGet:
scheme: HTTPS
path: /healthz
port: 8443
readinessProbe:
httpGet:
scheme: HTTPS
path: /healthz
port: 8443
volumeMounts:
- name: certs
mountPath: /tls
readOnly: true
resources:
{{ toYaml .Values.resources | indent 12 }}
volumes:
- name: certs
secret:
secretName: {{ include "cert-manager-webhook-hetzner.servingCertificate" . }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
charts/cert-manager-webhook-hetzner/templates/pki.yaml
+76
View File
@@ -0,0 +1,76 @@
---
# Create a selfsigned Issuer, in order to create a root CA certificate for
# signing webhook serving certificates
apiVersion: cert-manager.io/v1alpha3
kind: Issuer
metadata:
name: {{ include "cert-manager-webhook-hetzner.selfSignedIssuer" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
selfSigned: {}
---
# Generate a CA Certificate used to sign certificates for the webhook
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
name: {{ include "cert-manager-webhook-hetzner.rootCACertificate" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
secretName: {{ include "cert-manager-webhook-hetzner.rootCACertificate" . }}
duration: 43800h # 5y
issuerRef:
name: {{ include "cert-manager-webhook-hetzner.selfSignedIssuer" . }}
commonName: "ca.cert-manager-webhook-hetzner.cert-manager"
isCA: true
---
# Create an Issuer that uses the above generated CA certificate to issue certs
apiVersion: cert-manager.io/v1alpha3
kind: Issuer
metadata:
name: {{ include "cert-manager-webhook-hetzner.rootCAIssuer" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
ca:
secretName: {{ include "cert-manager-webhook-hetzner.rootCACertificate" . }}
---
# Finally, generate a serving certificate for the webhook to use
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
name: {{ include "cert-manager-webhook-hetzner.servingCertificate" . }}
namespace: {{ .Release.Namespace | quote }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
secretName: {{ include "cert-manager-webhook-hetzner.servingCertificate" . }}
duration: 8760h # 1y
issuerRef:
name: {{ include "cert-manager-webhook-hetzner.rootCAIssuer" . }}
dnsNames:
- {{ include "cert-manager-webhook-hetzner.fullname" . }}
- {{ include "cert-manager-webhook-hetzner.fullname" . }}.{{ .Release.Namespace }}
- {{ include "cert-manager-webhook-hetzner.fullname" . }}.{{ .Release.Namespace }}.svc
charts/cert-manager-webhook-hetzner/templates/rbac.yaml
+91
View File
@@ -0,0 +1,91 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
namespace: {{ .Release.Namespace }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
---
# Grant the webhook permission to read the ConfigMap containing the Kubernetes
# apiserver's requestheader-ca-certificate.
# This ConfigMap is automatically created by the Kubernetes apiserver.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}:webhook-authentication-reader
namespace: kube-system
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: extension-apiserver-authentication-reader
subjects:
- apiGroup: ""
kind: ServiceAccount
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
namespace: {{ .Release.Namespace }}
---
# apiserver gets the auth-delegator role to delegate auth decisions to
# the core apiserver
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}:auth-delegator
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:auth-delegator
subjects:
- apiGroup: ""
kind: ServiceAccount
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
namespace: {{ .Release.Namespace }}
---
# Grant cert-manager permission to validate using our apiserver
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}:domain-solver
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
rules:
- apiGroups:
- {{ .Values.groupName }}
resources:
- '*'
verbs:
- 'create'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}:domain-solver
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}:domain-solver
subjects:
- apiGroup: ""
kind: ServiceAccount
name: {{ .Values.certManager.serviceAccountName }}
namespace: {{ .Release.Namespace }}
charts/cert-manager-webhook-hetzner/templates/service.yaml
+20
View File
@@ -0,0 +1,20 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "cert-manager-webhook-hetzner.fullname" . }}
namespace: {{ .Release.Namespace }}
labels:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
chart: {{ include "cert-manager-webhook-hetzner.chart" . }}
release: {{ .Release.Name }}
heritage: {{ .Release.Service }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: 8443
protocol: TCP
name: https
selector:
app: {{ include "cert-manager-webhook-hetzner.name" . }}
release: {{ .Release.Name }}