diff --git a/deploy/hetzner-webhook/templates/_helpers.tpl b/deploy/hetzner-webhook/templates/_helpers.tpl index d3c474b..33e5aab 100644 --- a/deploy/hetzner-webhook/templates/_helpers.tpl +++ b/deploy/hetzner-webhook/templates/_helpers.tpl @@ -2,7 +2,7 @@ {{/* Expand the name of the chart. */}} -{{- define "example-webhook.name" -}} +{{- define "hetzner-webhook.name" -}} {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- end -}} @@ -11,7 +11,7 @@ Create a default fully qualified app name. We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). If release name contains chart name it will be used as a full name. */}} -{{- define "example-webhook.fullname" -}} +{{- define "hetzner-webhook.fullname" -}} {{- if .Values.fullnameOverride -}} {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} {{- else -}} @@ -27,22 +27,22 @@ If release name contains chart name it will be used as a full name. {{/* Create chart name and version as used by the chart label. */}} -{{- define "example-webhook.chart" -}} +{{- define "hetzner-webhook.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} {{- end -}} -{{- define "example-webhook.selfSignedIssuer" -}} -{{ printf "%s-selfsign" (include "example-webhook.fullname" .) }} +{{- define "hetzner-webhook.selfSignedIssuer" -}} +{{ printf "%s-selfsign" (include "hetzner-webhook.fullname" .) }} {{- end -}} -{{- define "example-webhook.rootCAIssuer" -}} -{{ printf "%s-ca" (include "example-webhook.fullname" .) }} +{{- define "hetzner-webhook.rootCAIssuer" -}} +{{ printf "%s-ca" (include "hetzner-webhook.fullname" .) }} {{- end -}} -{{- define "example-webhook.rootCACertificate" -}} -{{ printf "%s-ca" (include "example-webhook.fullname" .) }} +{{- define "hetzner-webhook.rootCACertificate" -}} +{{ printf "%s-ca" (include "hetzner-webhook.fullname" .) }} {{- end -}} -{{- define "example-webhook.servingCertificate" -}} -{{ printf "%s-webhook-tls" (include "example-webhook.fullname" .) }} +{{- define "hetzner-webhook.servingCertificate" -}} +{{ printf "%s-webhook-tls" (include "hetzner-webhook.fullname" .) }} {{- end -}} diff --git a/deploy/hetzner-webhook/templates/apiservice.yaml b/deploy/hetzner-webhook/templates/apiservice.yaml index 504ab91..a989ac1 100644 --- a/deploy/hetzner-webhook/templates/apiservice.yaml +++ b/deploy/hetzner-webhook/templates/apiservice.yaml @@ -1,19 +1,19 @@ -apiVersion: apiregistration.k8s.io/v1beta1 +apiVersion: apiregistration.k8s.io/v1 kind: APIService metadata: name: v1alpha1.{{ .Values.groupName }} labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} annotations: - certmanager.k8s.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "example-webhook.servingCertificate" . }}" + cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "hetzner-webhook.servingCertificate" . }}" spec: group: {{ .Values.groupName }} groupPriorityMinimum: 1000 versionPriority: 15 service: - name: {{ include "example-webhook.fullname" . }} + name: {{ include "hetzner-webhook.fullname" . }} namespace: {{ .Release.Namespace }} version: v1alpha1 diff --git a/deploy/hetzner-webhook/templates/deployment.yaml b/deploy/hetzner-webhook/templates/deployment.yaml index 23e9064..e14d321 100644 --- a/deploy/hetzner-webhook/templates/deployment.yaml +++ b/deploy/hetzner-webhook/templates/deployment.yaml @@ -1,25 +1,25 @@ -apiVersion: apps/v1beta2 +apiVersion: apps/v1 kind: Deployment metadata: - name: {{ include "example-webhook.fullname" . }} + name: {{ include "hetzner-webhook.fullname" . }} labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} spec: replicas: {{ .Values.replicaCount }} selector: matchLabels: - app: {{ include "example-webhook.name" . }} + app: {{ include "hetzner-webhook.name" . }} release: {{ .Release.Name }} template: metadata: labels: - app: {{ include "example-webhook.name" . }} + app: {{ include "hetzner-webhook.name" . }} release: {{ .Release.Name }} spec: - serviceAccountName: {{ include "example-webhook.fullname" . }} + serviceAccountName: {{ include "hetzner-webhook.fullname" . }} containers: - name: {{ .Chart.Name }} image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" @@ -53,7 +53,7 @@ spec: volumes: - name: certs secret: - secretName: {{ include "example-webhook.servingCertificate" . }} + secretName: {{ include "hetzner-webhook.servingCertificate" . }} {{- with .Values.nodeSelector }} nodeSelector: {{ toYaml . | indent 8 }} diff --git a/deploy/hetzner-webhook/templates/pki.yaml b/deploy/hetzner-webhook/templates/pki.yaml index 89b6a23..76260db 100644 --- a/deploy/hetzner-webhook/templates/pki.yaml +++ b/deploy/hetzner-webhook/templates/pki.yaml @@ -1,14 +1,14 @@ --- # Create a selfsigned Issuer, in order to create a root CA certificate for # signing webhook serving certificates -apiVersion: certmanager.k8s.io/v1alpha1 +apiVersion: cert-manager.io/v1alpha2 kind: Issuer metadata: - name: {{ include "example-webhook.selfSignedIssuer" . }} + name: {{ include "hetzner-webhook.selfSignedIssuer" . }} namespace: {{ .Release.Namespace | quote }} labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} spec: @@ -17,60 +17,60 @@ spec: --- # Generate a CA Certificate used to sign certificates for the webhook -apiVersion: certmanager.k8s.io/v1alpha1 +apiVersion: cert-manager.io/v1alpha2 kind: Certificate metadata: - name: {{ include "example-webhook.rootCACertificate" . }} + name: {{ include "hetzner-webhook.rootCACertificate" . }} namespace: {{ .Release.Namespace | quote }} labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} spec: - secretName: {{ include "example-webhook.rootCACertificate" . }} + secretName: {{ include "hetzner-webhook.rootCACertificate" . }} duration: 43800h # 5y issuerRef: - name: {{ include "example-webhook.selfSignedIssuer" . }} - commonName: "ca.example-webhook.cert-manager" + name: {{ include "hetzner-webhook.selfSignedIssuer" . }} + commonName: "ca.hetzner-webhook.cert-manager" isCA: true --- # Create an Issuer that uses the above generated CA certificate to issue certs -apiVersion: certmanager.k8s.io/v1alpha1 +apiVersion: cert-manager.io/v1alpha2 kind: Issuer metadata: - name: {{ include "example-webhook.rootCAIssuer" . }} + name: {{ include "hetzner-webhook.rootCAIssuer" . }} namespace: {{ .Release.Namespace | quote }} labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} spec: ca: - secretName: {{ include "example-webhook.rootCACertificate" . }} + secretName: {{ include "hetzner-webhook.rootCACertificate" . }} --- # Finally, generate a serving certificate for the webhook to use -apiVersion: certmanager.k8s.io/v1alpha1 +apiVersion: cert-manager.io/v1alpha2 kind: Certificate metadata: - name: {{ include "example-webhook.servingCertificate" . }} + name: {{ include "hetzner-webhook.servingCertificate" . }} namespace: {{ .Release.Namespace | quote }} labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} spec: - secretName: {{ include "example-webhook.servingCertificate" . }} + secretName: {{ include "hetzner-webhook.servingCertificate" . }} duration: 8760h # 1y issuerRef: - name: {{ include "example-webhook.rootCAIssuer" . }} + name: {{ include "hetzner-webhook.rootCAIssuer" . }} dnsNames: - - {{ include "example-webhook.fullname" . }} - - {{ include "example-webhook.fullname" . }}.{{ .Release.Namespace }} - - {{ include "example-webhook.fullname" . }}.{{ .Release.Namespace }}.svc + - {{ include "hetzner-webhook.fullname" . }} + - {{ include "hetzner-webhook.fullname" . }}.{{ .Release.Namespace }} + - {{ include "hetzner-webhook.fullname" . }}.{{ .Release.Namespace }}.svc diff --git a/deploy/hetzner-webhook/templates/rbac.yaml b/deploy/hetzner-webhook/templates/rbac.yaml index efec523..96b1fce 100644 --- a/deploy/hetzner-webhook/templates/rbac.yaml +++ b/deploy/hetzner-webhook/templates/rbac.yaml @@ -1,24 +1,24 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "example-webhook.fullname" . }} + name: {{ include "hetzner-webhook.fullname" . }} labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} --- # Grant the webhook permission to read the ConfigMap containing the Kubernetes # apiserver's requestheader-ca-certificate. # This ConfigMap is automatically created by the Kubernetes apiserver. -apiVersion: rbac.authorization.k8s.io/v1beta1 +apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: - name: {{ include "example-webhook.fullname" . }}:webhook-authentication-reader + name: {{ include "hetzner-webhook.fullname" . }}:webhook-authentication-reader namespace: kube-system labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} roleRef: @@ -28,18 +28,18 @@ roleRef: subjects: - apiGroup: "" kind: ServiceAccount - name: {{ include "example-webhook.fullname" . }} + name: {{ include "hetzner-webhook.fullname" . }} namespace: {{ .Release.Namespace }} --- # apiserver gets the auth-delegator role to delegate auth decisions to # the core apiserver -apiVersion: rbac.authorization.k8s.io/v1beta1 +apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ include "example-webhook.fullname" . }}:auth-delegator + name: {{ include "hetzner-webhook.fullname" . }}:auth-delegator labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} roleRef: @@ -49,17 +49,17 @@ roleRef: subjects: - apiGroup: "" kind: ServiceAccount - name: {{ include "example-webhook.fullname" . }} + name: {{ include "hetzner-webhook.fullname" . }} namespace: {{ .Release.Namespace }} --- # Grant cert-manager permission to validate using our apiserver -apiVersion: rbac.authorization.k8s.io/v1beta1 +apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: - name: {{ include "example-webhook.fullname" . }}:domain-solver + name: {{ include "hetzner-webhook.fullname" . }}:domain-solver labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} rules: @@ -70,19 +70,19 @@ rules: verbs: - 'create' --- -apiVersion: rbac.authorization.k8s.io/v1beta1 +apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: - name: {{ include "example-webhook.fullname" . }}:domain-solver + name: {{ include "hetzner-webhook.fullname" . }}:domain-solver labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole - name: {{ include "example-webhook.fullname" . }}:domain-solver + name: {{ include "hetzner-webhook.fullname" . }}:domain-solver subjects: - apiGroup: "" kind: ServiceAccount diff --git a/deploy/hetzner-webhook/templates/service.yaml b/deploy/hetzner-webhook/templates/service.yaml index 572089e..470f6b0 100644 --- a/deploy/hetzner-webhook/templates/service.yaml +++ b/deploy/hetzner-webhook/templates/service.yaml @@ -1,10 +1,11 @@ apiVersion: v1 kind: Service metadata: - name: {{ include "example-webhook.fullname" . }} + name: {{ include "hetzner-webhook.fullname" . }} + namespace: {{ .Release.Namespace | quote }} labels: - app: {{ include "example-webhook.name" . }} - chart: {{ include "example-webhook.chart" . }} + app: {{ include "hetzner-webhook.name" . }} + chart: {{ include "hetzner-webhook.chart" . }} release: {{ .Release.Name }} heritage: {{ .Release.Service }} spec: @@ -15,5 +16,5 @@ spec: protocol: TCP name: https selector: - app: {{ include "example-webhook.name" . }} + app: {{ include "hetzner-webhook.name" . }} release: {{ .Release.Name }} diff --git a/deploy/hetzner-webhook/values.yaml b/deploy/hetzner-webhook/values.yaml index ab3fb38..a30117f 100644 --- a/deploy/hetzner-webhook/values.yaml +++ b/deploy/hetzner-webhook/values.yaml @@ -1,6 +1,6 @@ # The GroupName here is used to identify your company or business unit that # created this webhook. -# For example, this may be "acme.mycompany.com". +# For hetzner, this may be "acme.mycompany.com". # This name will need to be referenced in each Issuer's `webhook` stanza to # inform cert-manager of where to send ChallengePayload resources in order to # solve the DNS01 challenge. @@ -15,10 +15,10 @@ certManager: image: repository: mecodia/cert-manager-webhook-hetzner tag: latest - pullPolicy: IfNotPresent + pullPolicy: Always -nameOverride: "" -fullnameOverride: "" +nameOverride: "webhook-hetzner" +fullnameOverride: "cert-manager-webhook-hetzner" service: type: ClusterIP