[NEW] kube-lego (#397)

* kube-lego v0.1.0

* Stand-alone chart for use with nginx or GCLB

* kube-lego v0.1.2

* env values in quotes

* kube-lego v0.1.3

* Delete kube-lego-nginx service on release deletion
* Updated 'app' label & container name
* Improved values documentation

* cleanup secret & ingress

* skip cleanup

stable/kube-lego/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

stable/kube-lego/Chart.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+description: Automatically requests certificates from Let's Encrypt
+name: kube-lego
+version: 0.1.3
+keywords:
+  - kube-lego
+  - letsencrypt
+sources:
+  - https://github.com/jetstack/kube-lego/tree/master/examples/nginx
+maintainers:
+  - name: Jack Zampolin
+    email: jack.zampolin@gmail.com
+  - name: Michael Goodness
+    email: mgoodness@gmail.com
+engine: gotpl

stable/kube-lego/README.md

@@ -0,0 +1,71 @@
+# kube-lego
+
+[kube-lego](https://github.com/jetstack/kube-lego) automatically requests certificates for Kubernetes Ingress resources from Let's Encrypt.
+
+## TL;DR;
+
+```console
+$ helm install stable/kube-lego
+```
+
+## Introduction
+
+This chart bootstraps a kube-lego deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
+
+## Prerequisites
+  - Kubernetes 1.4+ with Beta APIs enabled
+
+## Installing the Chart
+
+To install the chart with the release name `my-release`:
+
+```console
+$ helm install --name my-release stable/kube-lego
+```
+
+The command deploys kube-lego on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation.
+
+> **Tip**: List all releases using `helm list`
+
+## Uninstalling the Chart
+
+To uninstall/delete the `my-release` deployment:
+
+```console
+$ helm delete my-release
+```
+
+The command removes all the Kubernetes components associated with the chart and deletes the release.
+
+## Configuration
+
+The following tables lists the configurable parameters of the Prometheus chart and their default values.
+
+Parameter | Description | Default
+--------- | ----------- | -------
+`global.hyperkube.image` | hyperkube container image repository (used when deleting kube-lego service) | `quay.io/coreos/hyperkube`
+`global.hyperkube.tag` | hyperkube container image tag (used when deleting kube-lego service) | `v1.5.2_coreos.1`
+`global.hyperkube.pullPolicy` | hyperkube container image pull policy (used when deleting kube-lego service) | `IfNotPresent`
+`config.LEGO_EMAIL` | email address to use for registration with Let's Encrypt | none
+`config.LEGO_URL` | Let's Encrypt API endpoint | `https://acme-staging.api.letsencrypt.org/directory` (staging)
+`config.LEGO_PORT` | kube-lego port | `8080`
+`image.repository` | kube-lego container image repository | `jetstack/kube-lego`
+`image.tag` | kube-lego container image tag | `0.1.3`
+`image.pullPolicy` | kube-lego container image pull policy | `IfNotPresent`
+`resources` | kube-lego resource requests and limits (YAML) |`requests: {cpu: 20m, memory: 8Mi}`
+
+Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
+
+```console
+$ helm install --name my-release \
+  --set config.LEGO_EMAIL=you@domain.tld \
+    stable/kube-lego
+```
+
+Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
+
+```console
+$ helm install --name my-release -f values.yaml stable/kube-lego
+```
+
+> **Tip**: You can use the default [values.yaml](values.yaml)

stable/kube-lego/templates/NOTES.txt

@@ -0,0 +1,27 @@
+This chart installs kube-lego to generate TLS certs for Ingresses.
+
+EXAMPLE INGRESS YAML:
+
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  namespace: foo
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    # Add to generate certificates for this ingress
+    kubernetes.io/tls-acme: 'true'
+spec:
+  rules:
+    - host: www.example.com
+      http:
+        paths:
+          - backend:
+              serviceName: exampleService
+              servicePort: 80
+            path: /
+  tls:
+    # With this configuration kube-lego will generate a secret in namespace foo called `example-tls`
+    # for the URL `www.example.com`
+    - hosts:
+        - "www.example.com"
+      secretName: example-tls

stable/kube-lego/templates/_helpers.tpl

@@ -0,0 +1,16 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}

stable/kube-lego/templates/deployment.yaml

@@ -0,0 +1,44 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  labels:
+    app: {{ template "name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "fullname" . }}
+spec:
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: {{ template "name" . }}
+        release: {{ .Release.Name }}
+    spec:
+      containers:
+        - name: {{ template "name" . }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            - name: LEGO_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: LEGO_POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+          {{- range $key, $value := .Values.config }}
+            - name: {{ $key }}
+              value: "{{ $value }}"
+          {{- end }}
+          ports:
+            - containerPort: {{ .Values.config.LEGO_PORT }}
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: {{ .Values.config.LEGO_PORT }}
+            initialDelaySeconds: 5
+            timeoutSeconds: 1
+          resources:
+{{ toYaml .Values.resources | indent 12 }}

stable/kube-lego/values.yaml

@@ -0,0 +1,43 @@
+global:
+  ## hyperkube image to use when deleting kube-lego service
+  ##
+  hyperkube:
+    repository: quay.io/coreos/hyperkube
+    tag: v1.5.2_coreos.1
+    pullPolicy: IfNotPresent
+
+## kube-lego configuration
+## Ref: https://github.com/jetstack/kube-lego
+##
+config:
+  ## Email address to use for registration with Let's Encrypt
+  ##
+  LEGO_EMAIL: my@email.tld
+
+  ## Let's Encrypt API endpoint
+  ## Production: https://acme-v01.api.letsencrypt.org/directory
+  ## Staging: https://acme-staging.api.letsencrypt.org/directory
+  ##
+  LEGO_URL: https://acme-staging.api.letsencrypt.org/directory
+
+  ## kube-lego port
+  ##
+  LEGO_PORT: 8080
+
+## kube-lego image
+##
+image:
+  repository: jetstack/kube-lego
+  tag: 0.1.3
+  pullPolicy: IfNotPresent
+
+## kube-lego resource limits & requests
+## Ref: https://kubernetes.io/docs/user-guide/compute-resources/
+##
+resources:
+  # limits:
+  #   cpu: 20m
+  #   memory: 8Mi
+  requests:
+    cpu: 20m
+    memory: 8Mi