simon/cert-manager-webhook-manitu
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Use correct names and api definitions

Browse Source
This commit is contained in:
Dennis Schmalacker 2020-06-15 15:35:31 +02:00
parent 178b5660e5
commit e317cded5c
7 changed files with 80 additions and 79 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
deploy/hetzner-webhook/templates/_helpers.tpl
View File

@ -2,7 +2,7 @@
{{/* {{/*
Expand the name of the chart. Expand the name of the chart.
*/}} */}}
{{- define "example-webhook.name" -}} {{- define "hetzner-webhook.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}} {{- end -}}
@ -11,7 +11,7 @@ Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name. If release name contains chart name it will be used as a full name.
*/}} */}}
{{- define "example-webhook.fullname" -}} {{- define "hetzner-webhook.fullname" -}}
{{- if .Values.fullnameOverride -}} {{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}} {{- else -}}
@ -27,22 +27,22 @@ If release name contains chart name it will be used as a full name.
{{/* {{/*
Create chart name and version as used by the chart label. Create chart name and version as used by the chart label.
*/}} */}}
{{- define "example-webhook.chart" -}} {{- define "hetzner-webhook.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}} {{- end -}}
{{- define "example-webhook.selfSignedIssuer" -}} {{- define "hetzner-webhook.selfSignedIssuer" -}}
{{ printf "%s-selfsign" (include "example-webhook.fullname" .) }} {{ printf "%s-selfsign" (include "hetzner-webhook.fullname" .) }}
{{- end -}} {{- end -}}
{{- define "example-webhook.rootCAIssuer" -}} {{- define "hetzner-webhook.rootCAIssuer" -}}
{{ printf "%s-ca" (include "example-webhook.fullname" .) }} {{ printf "%s-ca" (include "hetzner-webhook.fullname" .) }}
{{- end -}} {{- end -}}
{{- define "example-webhook.rootCACertificate" -}} {{- define "hetzner-webhook.rootCACertificate" -}}
{{ printf "%s-ca" (include "example-webhook.fullname" .) }} {{ printf "%s-ca" (include "hetzner-webhook.fullname" .) }}
{{- end -}} {{- end -}}
{{- define "example-webhook.servingCertificate" -}} {{- define "hetzner-webhook.servingCertificate" -}}
{{ printf "%s-webhook-tls" (include "example-webhook.fullname" .) }} {{ printf "%s-webhook-tls" (include "hetzner-webhook.fullname" .) }}
{{- end -}} {{- end -}}

10
deploy/hetzner-webhook/templates/apiservice.yaml
View File

@ -1,19 +1,19 @@
apiVersion: apiregistration.k8s.io/v1beta1 apiVersion: apiregistration.k8s.io/v1
kind: APIService kind: APIService
metadata: metadata:
name: v1alpha1.{{ .Values.groupName }} name: v1alpha1.{{ .Values.groupName }}
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
annotations: annotations:
certmanager.k8s.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "example-webhook.servingCertificate" . }}" cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "hetzner-webhook.servingCertificate" . }}"
spec: spec:
group: {{ .Values.groupName }} group: {{ .Values.groupName }}
groupPriorityMinimum: 1000 groupPriorityMinimum: 1000
versionPriority: 15 versionPriority: 15
service: service:
name: {{ include "example-webhook.fullname" . }} name: {{ include "hetzner-webhook.fullname" . }}
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
version: v1alpha1 version: v1alpha1

16
deploy/hetzner-webhook/templates/deployment.yaml
View File

@ -1,25 +1,25 @@
apiVersion: apps/v1beta2 apiVersion: apps/v1
kind: Deployment kind: Deployment
metadata: metadata:
name: {{ include "example-webhook.fullname" . }} name: {{ include "hetzner-webhook.fullname" . }}
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
spec: spec:
replicas: {{ .Values.replicaCount }} replicas: {{ .Values.replicaCount }}
selector: selector:
matchLabels: matchLabels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
template: template:
metadata: metadata:
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
spec: spec:
serviceAccountName: {{ include "example-webhook.fullname" . }} serviceAccountName: {{ include "hetzner-webhook.fullname" . }}
containers: containers:
- name: {{ .Chart.Name }} - name: {{ .Chart.Name }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@ -53,7 +53,7 @@ spec:
volumes: volumes:
- name: certs - name: certs
secret: secret:
secretName: {{ include "example-webhook.servingCertificate" . }} secretName: {{ include "hetzner-webhook.servingCertificate" . }}
{{- with .Values.nodeSelector }} {{- with .Values.nodeSelector }}
nodeSelector: nodeSelector:
{{ toYaml . | indent 8 }} {{ toYaml . | indent 8 }}

50
deploy/hetzner-webhook/templates/pki.yaml
View File

@ -1,14 +1,14 @@
--- ---
# Create a selfsigned Issuer, in order to create a root CA certificate for # Create a selfsigned Issuer, in order to create a root CA certificate for
# signing webhook serving certificates # signing webhook serving certificates
apiVersion: certmanager.k8s.io/v1alpha1 apiVersion: cert-manager.io/v1alpha2
kind: Issuer kind: Issuer
metadata: metadata:
name: {{ include "example-webhook.selfSignedIssuer" . }} name: {{ include "hetzner-webhook.selfSignedIssuer" . }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ .Release.Namespace | quote }}
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
spec: spec:
@ -17,60 +17,60 @@ spec:
--- ---
# Generate a CA Certificate used to sign certificates for the webhook # Generate a CA Certificate used to sign certificates for the webhook
apiVersion: certmanager.k8s.io/v1alpha1 apiVersion: cert-manager.io/v1alpha2
kind: Certificate kind: Certificate
metadata: metadata:
name: {{ include "example-webhook.rootCACertificate" . }} name: {{ include "hetzner-webhook.rootCACertificate" . }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ .Release.Namespace | quote }}
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
spec: spec:
secretName: {{ include "example-webhook.rootCACertificate" . }} secretName: {{ include "hetzner-webhook.rootCACertificate" . }}
duration: 43800h # 5y duration: 43800h # 5y
issuerRef: issuerRef:
name: {{ include "example-webhook.selfSignedIssuer" . }} name: {{ include "hetzner-webhook.selfSignedIssuer" . }}
commonName: "ca.example-webhook.cert-manager" commonName: "ca.hetzner-webhook.cert-manager"
isCA: true isCA: true
--- ---
# Create an Issuer that uses the above generated CA certificate to issue certs # Create an Issuer that uses the above generated CA certificate to issue certs
apiVersion: certmanager.k8s.io/v1alpha1 apiVersion: cert-manager.io/v1alpha2
kind: Issuer kind: Issuer
metadata: metadata:
name: {{ include "example-webhook.rootCAIssuer" . }} name: {{ include "hetzner-webhook.rootCAIssuer" . }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ .Release.Namespace | quote }}
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
spec: spec:
ca: ca:
secretName: {{ include "example-webhook.rootCACertificate" . }} secretName: {{ include "hetzner-webhook.rootCACertificate" . }}
--- ---
# Finally, generate a serving certificate for the webhook to use # Finally, generate a serving certificate for the webhook to use
apiVersion: certmanager.k8s.io/v1alpha1 apiVersion: cert-manager.io/v1alpha2
kind: Certificate kind: Certificate
metadata: metadata:
name: {{ include "example-webhook.servingCertificate" . }} name: {{ include "hetzner-webhook.servingCertificate" . }}
namespace: {{ .Release.Namespace | quote }} namespace: {{ .Release.Namespace | quote }}
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
spec: spec:
secretName: {{ include "example-webhook.servingCertificate" . }} secretName: {{ include "hetzner-webhook.servingCertificate" . }}
duration: 8760h # 1y duration: 8760h # 1y
issuerRef: issuerRef:
name: {{ include "example-webhook.rootCAIssuer" . }} name: {{ include "hetzner-webhook.rootCAIssuer" . }}
dnsNames: dnsNames:
- {{ include "example-webhook.fullname" . }} - {{ include "hetzner-webhook.fullname" . }}
- {{ include "example-webhook.fullname" . }}.{{ .Release.Namespace }} - {{ include "hetzner-webhook.fullname" . }}.{{ .Release.Namespace }}
- {{ include "example-webhook.fullname" . }}.{{ .Release.Namespace }}.svc - {{ include "hetzner-webhook.fullname" . }}.{{ .Release.Namespace }}.svc

44
deploy/hetzner-webhook/templates/rbac.yaml
View File

@ -1,24 +1,24 @@
apiVersion: v1 apiVersion: v1
kind: ServiceAccount kind: ServiceAccount
metadata: metadata:
name: {{ include "example-webhook.fullname" . }} name: {{ include "hetzner-webhook.fullname" . }}
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
--- ---
# Grant the webhook permission to read the ConfigMap containing the Kubernetes # Grant the webhook permission to read the ConfigMap containing the Kubernetes
# apiserver's requestheader-ca-certificate. # apiserver's requestheader-ca-certificate.
# This ConfigMap is automatically created by the Kubernetes apiserver. # This ConfigMap is automatically created by the Kubernetes apiserver.
apiVersion: rbac.authorization.k8s.io/v1beta1 apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding kind: RoleBinding
metadata: metadata:
name: {{ include "example-webhook.fullname" . }}:webhook-authentication-reader name: {{ include "hetzner-webhook.fullname" . }}:webhook-authentication-reader
namespace: kube-system namespace: kube-system
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
roleRef: roleRef:
@ -28,18 +28,18 @@ roleRef:
subjects: subjects:
- apiGroup: "" - apiGroup: ""
kind: ServiceAccount kind: ServiceAccount
name: {{ include "example-webhook.fullname" . }} name: {{ include "hetzner-webhook.fullname" . }}
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
--- ---
# apiserver gets the auth-delegator role to delegate auth decisions to # apiserver gets the auth-delegator role to delegate auth decisions to
# the core apiserver # the core apiserver
apiVersion: rbac.authorization.k8s.io/v1beta1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
metadata: metadata:
name: {{ include "example-webhook.fullname" . }}:auth-delegator name: {{ include "hetzner-webhook.fullname" . }}:auth-delegator
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
roleRef: roleRef:
@ -49,17 +49,17 @@ roleRef:
subjects: subjects:
- apiGroup: "" - apiGroup: ""
kind: ServiceAccount kind: ServiceAccount
name: {{ include "example-webhook.fullname" . }} name: {{ include "hetzner-webhook.fullname" . }}
namespace: {{ .Release.Namespace }} namespace: {{ .Release.Namespace }}
--- ---
# Grant cert-manager permission to validate using our apiserver # Grant cert-manager permission to validate using our apiserver
apiVersion: rbac.authorization.k8s.io/v1beta1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole kind: ClusterRole
metadata: metadata:
name: {{ include "example-webhook.fullname" . }}:domain-solver name: {{ include "hetzner-webhook.fullname" . }}:domain-solver
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
rules: rules:
@ -70,19 +70,19 @@ rules:
verbs: verbs:
- 'create' - 'create'
--- ---
apiVersion: rbac.authorization.k8s.io/v1beta1 apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding kind: ClusterRoleBinding
metadata: metadata:
name: {{ include "example-webhook.fullname" . }}:domain-solver name: {{ include "hetzner-webhook.fullname" . }}:domain-solver
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
roleRef: roleRef:
apiGroup: rbac.authorization.k8s.io apiGroup: rbac.authorization.k8s.io
kind: ClusterRole kind: ClusterRole
name: {{ include "example-webhook.fullname" . }}:domain-solver name: {{ include "hetzner-webhook.fullname" . }}:domain-solver
subjects: subjects:
- apiGroup: "" - apiGroup: ""
kind: ServiceAccount kind: ServiceAccount

9
deploy/hetzner-webhook/templates/service.yaml
View File

@ -1,10 +1,11 @@
apiVersion: v1 apiVersion: v1
kind: Service kind: Service
metadata: metadata:
name: {{ include "example-webhook.fullname" . }} name: {{ include "hetzner-webhook.fullname" . }}
namespace: {{ .Release.Namespace | quote }}
labels: labels:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
chart: {{ include "example-webhook.chart" . }} chart: {{ include "hetzner-webhook.chart" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}
heritage: {{ .Release.Service }} heritage: {{ .Release.Service }}
spec: spec:
@ -15,5 +16,5 @@ spec:
protocol: TCP protocol: TCP
name: https name: https
selector: selector:
app: {{ include "example-webhook.name" . }} app: {{ include "hetzner-webhook.name" . }}
release: {{ .Release.Name }} release: {{ .Release.Name }}

8
deploy/hetzner-webhook/values.yaml
View File

@ -1,6 +1,6 @@
# The GroupName here is used to identify your company or business unit that # The GroupName here is used to identify your company or business unit that
# created this webhook. # created this webhook.
# For example, this may be "acme.mycompany.com". # For hetzner, this may be "acme.mycompany.com".
# This name will need to be referenced in each Issuer's `webhook` stanza to # This name will need to be referenced in each Issuer's `webhook` stanza to
# inform cert-manager of where to send ChallengePayload resources in order to # inform cert-manager of where to send ChallengePayload resources in order to
# solve the DNS01 challenge. # solve the DNS01 challenge.
@ -15,10 +15,10 @@ certManager:
image: image:
repository: mecodia/cert-manager-webhook-hetzner repository: mecodia/cert-manager-webhook-hetzner
tag: latest tag: latest
pullPolicy: IfNotPresent pullPolicy: Always
nameOverride: "" nameOverride: "webhook-hetzner"
fullnameOverride: "" fullnameOverride: "cert-manager-webhook-hetzner"
service: service:
type: ClusterIP type: ClusterIP