diff --git a/stable/kube-lego/.helmignore b/stable/kube-lego/.helmignore new file mode 100644 index 0000000000..f0c1319444 --- /dev/null +++ b/stable/kube-lego/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/stable/kube-lego/Chart.yaml b/stable/kube-lego/Chart.yaml new file mode 100644 index 0000000000..2a93c5634e --- /dev/null +++ b/stable/kube-lego/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +description: Automatically requests certificates from Let's Encrypt +name: kube-lego +version: 0.1.3 +keywords: + - kube-lego + - letsencrypt +sources: + - https://github.com/jetstack/kube-lego/tree/master/examples/nginx +maintainers: + - name: Jack Zampolin + email: jack.zampolin@gmail.com + - name: Michael Goodness + email: mgoodness@gmail.com +engine: gotpl diff --git a/stable/kube-lego/README.md b/stable/kube-lego/README.md new file mode 100644 index 0000000000..ab23ef1d93 --- /dev/null +++ b/stable/kube-lego/README.md @@ -0,0 +1,71 @@ +# kube-lego + +[kube-lego](https://github.com/jetstack/kube-lego) automatically requests certificates for Kubernetes Ingress resources from Let's Encrypt. + +## TL;DR; + +```console +$ helm install stable/kube-lego +``` + +## Introduction + +This chart bootstraps a kube-lego deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + - Kubernetes 1.4+ with Beta APIs enabled + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +$ helm install --name my-release stable/kube-lego +``` + +The command deploys kube-lego on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. + +> **Tip**: List all releases using `helm list` + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```console +$ helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Configuration + +The following tables lists the configurable parameters of the Prometheus chart and their default values. + +Parameter | Description | Default +--------- | ----------- | ------- +`global.hyperkube.image` | hyperkube container image repository (used when deleting kube-lego service) | `quay.io/coreos/hyperkube` +`global.hyperkube.tag` | hyperkube container image tag (used when deleting kube-lego service) | `v1.5.2_coreos.1` +`global.hyperkube.pullPolicy` | hyperkube container image pull policy (used when deleting kube-lego service) | `IfNotPresent` +`config.LEGO_EMAIL` | email address to use for registration with Let's Encrypt | none +`config.LEGO_URL` | Let's Encrypt API endpoint | `https://acme-staging.api.letsencrypt.org/directory` (staging) +`config.LEGO_PORT` | kube-lego port | `8080` +`image.repository` | kube-lego container image repository | `jetstack/kube-lego` +`image.tag` | kube-lego container image tag | `0.1.3` +`image.pullPolicy` | kube-lego container image pull policy | `IfNotPresent` +`resources` | kube-lego resource requests and limits (YAML) |`requests: {cpu: 20m, memory: 8Mi}` + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +$ helm install --name my-release \ + --set config.LEGO_EMAIL=you@domain.tld \ + stable/kube-lego +``` + +Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example, + +```console +$ helm install --name my-release -f values.yaml stable/kube-lego +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) diff --git a/stable/kube-lego/templates/NOTES.txt b/stable/kube-lego/templates/NOTES.txt new file mode 100644 index 0000000000..a0eba88cb2 --- /dev/null +++ b/stable/kube-lego/templates/NOTES.txt @@ -0,0 +1,27 @@ +This chart installs kube-lego to generate TLS certs for Ingresses. + +EXAMPLE INGRESS YAML: + +apiVersion: extensions/v1beta1 +kind: Ingress +metadata: + namespace: foo + annotations: + kubernetes.io/ingress.class: nginx + # Add to generate certificates for this ingress + kubernetes.io/tls-acme: 'true' +spec: + rules: + - host: www.example.com + http: + paths: + - backend: + serviceName: exampleService + servicePort: 80 + path: / + tls: + # With this configuration kube-lego will generate a secret in namespace foo called `example-tls` + # for the URL `www.example.com` + - hosts: + - "www.example.com" + secretName: example-tls diff --git a/stable/kube-lego/templates/_helpers.tpl b/stable/kube-lego/templates/_helpers.tpl new file mode 100644 index 0000000000..f0d83d2edb --- /dev/null +++ b/stable/kube-lego/templates/_helpers.tpl @@ -0,0 +1,16 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "fullname" -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/stable/kube-lego/templates/deployment.yaml b/stable/kube-lego/templates/deployment.yaml new file mode 100644 index 0000000000..9d8cc2498f --- /dev/null +++ b/stable/kube-lego/templates/deployment.yaml @@ -0,0 +1,44 @@ +apiVersion: extensions/v1beta1 +kind: Deployment +metadata: + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "fullname" . }} +spec: + replicas: 1 + template: + metadata: + labels: + app: {{ template "name" . }} + release: {{ .Release.Name }} + spec: + containers: + - name: {{ template "name" . }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + env: + - name: LEGO_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: LEGO_POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + {{- range $key, $value := .Values.config }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + ports: + - containerPort: {{ .Values.config.LEGO_PORT }} + readinessProbe: + httpGet: + path: /healthz + port: {{ .Values.config.LEGO_PORT }} + initialDelaySeconds: 5 + timeoutSeconds: 1 + resources: +{{ toYaml .Values.resources | indent 12 }} diff --git a/stable/kube-lego/values.yaml b/stable/kube-lego/values.yaml new file mode 100644 index 0000000000..a1a5902cfa --- /dev/null +++ b/stable/kube-lego/values.yaml @@ -0,0 +1,43 @@ +global: + ## hyperkube image to use when deleting kube-lego service + ## + hyperkube: + repository: quay.io/coreos/hyperkube + tag: v1.5.2_coreos.1 + pullPolicy: IfNotPresent + +## kube-lego configuration +## Ref: https://github.com/jetstack/kube-lego +## +config: + ## Email address to use for registration with Let's Encrypt + ## + LEGO_EMAIL: my@email.tld + + ## Let's Encrypt API endpoint + ## Production: https://acme-v01.api.letsencrypt.org/directory + ## Staging: https://acme-staging.api.letsencrypt.org/directory + ## + LEGO_URL: https://acme-staging.api.letsencrypt.org/directory + + ## kube-lego port + ## + LEGO_PORT: 8080 + +## kube-lego image +## +image: + repository: jetstack/kube-lego + tag: 0.1.3 + pullPolicy: IfNotPresent + +## kube-lego resource limits & requests +## Ref: https://kubernetes.io/docs/user-guide/compute-resources/ +## +resources: + # limits: + # cpu: 20m + # memory: 8Mi + requests: + cpu: 20m + memory: 8Mi