From e0505bbd09c4f8bf81fe583841c926e02cc82a8e Mon Sep 17 00:00:00 2001 From: James Munnelly Date: Thu, 13 Sep 2018 16:13:30 +0100 Subject: [PATCH] cert-manager: fast-forward to upstream 3945595b (#7644) * cert-manager: fast-forward to upstream bcffc635 * Update version numbers for v0.5.0 (jetstack/cert-manager#885) * added affinity and tolerations (jetstack/cert-manager#869) * Add validating webhook and webhook tls autoconfiguration (jetstack/cert-manager#478) * chart: annotate all CRDs with "crd-install" hook (jetstack/cert-manager#823) * helm chart: remove endpoints from rbac resources (jetstack/cert-manager#769) Signed-off-by: James Munnelly * Update image tag and add description Signed-off-by: James Munnelly --- stable/cert-manager/Chart.yaml | 4 +- stable/cert-manager/README.md | 12 +- stable/cert-manager/requirements.lock | 6 + stable/cert-manager/requirements.yaml | 6 + .../cert-manager/templates/00-namespace.yaml | 3 + .../templates/certificate-crd.yaml | 4 + .../templates/clusterissuer-crd.yaml | 4 + stable/cert-manager/templates/deployment.yaml | 8 + stable/cert-manager/templates/issuer-crd.yaml | 4 + stable/cert-manager/templates/rbac.yaml | 7 +- stable/cert-manager/values.yaml | 27 ++- stable/cert-manager/webhook/.helmignore | 21 +++ stable/cert-manager/webhook/Chart.yaml | 5 + .../cert-manager/webhook/templates/NOTES.txt | 0 .../webhook/templates/_helpers.tpl | 48 +++++ .../webhook/templates/apiservice.yaml | 17 ++ .../webhook/templates/ca-sync.yaml | 172 ++++++++++++++++++ .../webhook/templates/deployment.yaml | 65 +++++++ .../cert-manager/webhook/templates/pki.yaml | 74 ++++++++ .../cert-manager/webhook/templates/rbac.yaml | 68 +++++++ .../webhook/templates/service.yaml | 19 ++ .../webhook/templates/serviceaccount.yaml | 10 + .../webhook/templates/validating-webhook.yaml | 91 +++++++++ stable/cert-manager/webhook/values.yaml | 16 ++ 24 files changed, 680 insertions(+), 11 deletions(-) create mode 100644 stable/cert-manager/requirements.lock create mode 100644 stable/cert-manager/requirements.yaml create mode 100644 stable/cert-manager/webhook/.helmignore create mode 100644 stable/cert-manager/webhook/Chart.yaml create mode 100644 stable/cert-manager/webhook/templates/NOTES.txt create mode 100644 stable/cert-manager/webhook/templates/_helpers.tpl create mode 100644 stable/cert-manager/webhook/templates/apiservice.yaml create mode 100644 stable/cert-manager/webhook/templates/ca-sync.yaml create mode 100644 stable/cert-manager/webhook/templates/deployment.yaml create mode 100644 stable/cert-manager/webhook/templates/pki.yaml create mode 100644 stable/cert-manager/webhook/templates/rbac.yaml create mode 100644 stable/cert-manager/webhook/templates/service.yaml create mode 100644 stable/cert-manager/webhook/templates/serviceaccount.yaml create mode 100644 stable/cert-manager/webhook/templates/validating-webhook.yaml create mode 100644 stable/cert-manager/webhook/values.yaml diff --git a/stable/cert-manager/Chart.yaml b/stable/cert-manager/Chart.yaml index 9cae58a6f2..993663b8a8 100644 --- a/stable/cert-manager/Chart.yaml +++ b/stable/cert-manager/Chart.yaml @@ -1,6 +1,6 @@ name: cert-manager -version: v0.4.1 -appVersion: v0.4.1 +version: v0.5.0 +appVersion: v0.5.0 description: A Helm chart for cert-manager home: https://github.com/jetstack/cert-manager keywords: diff --git a/stable/cert-manager/README.md b/stable/cert-manager/README.md index 0ce6c8ab9f..41b678bb0a 100644 --- a/stable/cert-manager/README.md +++ b/stable/cert-manager/README.md @@ -54,7 +54,7 @@ The following table lists the configurable parameters of the cert-manager chart | Parameter | Description | Default | | --------- | ----------- | ------- | | `image.repository` | Image repository | `quay.io/jetstack/cert-manager-controller` | -| `image.tag` | Image tag | `v0.4.1` | +| `image.tag` | Image tag | `v0.5.0` | | `image.pullPolicy` | Image pull policy | `IfNotPresent` | | `replicaCount` | Number of cert-manager replicas | `1` | | `createCustomResource` | Create CRD/TPR with this release | `true` | @@ -66,7 +66,7 @@ The following table lists the configurable parameters of the cert-manager chart | `rbac.create` | If `true`, create and use RBAC resources | `true` | | `serviceAccount.create` | If `true`, create a new service account | `true` | | `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template | | -| `resources` | CPU/memory resource requests/limits | `requests: {cpu: 10m, memory: 32Mi}` | +| `resources` | CPU/memory resource requests/limits | | | `nodeSelector` | Node labels for pod assignment | `{}` | | `affinity` | Node affinity for pod assignment | `{}` | | `tolerations` | Node tolerations for pod assignment | `[]` | @@ -81,6 +81,14 @@ The following table lists the configurable parameters of the cert-manager chart | `http_proxy` | Value of the `HTTP_PROXY` environment variable in the cert-manager pod | | | `https_proxy` | Value of the `HTTPS_PROXY` environment variable in the cert-manager pod | | | `no_proxy` | Value of the `NO_PROXY` environment variable in the cert-manager pod | | +| `webhook.enabled` | Toggles whether the validating webhook component should be installed | `false` | +| `webhook.replicaCount` | Number of cert-manager webhook replicas | `1` | +| `webhook.podAnnotations` | Annotations to add to the webhook pods | `{}` | +| `webhook.extraArgs` | Optional flags for cert-manager webhook component | `[]` | +| `webhook.resources` | CPU/memory resource requests/limits for the webhook pods | | +| `webhook.image.repository` | Webhook image repository | `quay.io/jetstack/cert-manager-webhook` | +| `webhook.image.tag` | Webhook image tag | `v0.5.0` | +| `webhook.image.pullPolicy` | Webhook image pull policy | `IfNotPresent` | Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. diff --git a/stable/cert-manager/requirements.lock b/stable/cert-manager/requirements.lock new file mode 100644 index 0000000000..0c0d02838e --- /dev/null +++ b/stable/cert-manager/requirements.lock @@ -0,0 +1,6 @@ +dependencies: +- name: webhook + repository: file://webhook + version: v0.5.0 +digest: sha256:1a599fad18dc75842074c7ab10a66cebce521f27fa94ab6642d744479694200e +generated: 2018-09-10T15:39:26.405370694+01:00 diff --git a/stable/cert-manager/requirements.yaml b/stable/cert-manager/requirements.yaml new file mode 100644 index 0000000000..96b602bee0 --- /dev/null +++ b/stable/cert-manager/requirements.yaml @@ -0,0 +1,6 @@ +# requirements.yaml +dependencies: +- name: webhook + version: "v0.5.0" + repository: "file://webhook" + condition: webhook.enabled diff --git a/stable/cert-manager/templates/00-namespace.yaml b/stable/cert-manager/templates/00-namespace.yaml index 72c8a14b84..1502a59977 100644 --- a/stable/cert-manager/templates/00-namespace.yaml +++ b/stable/cert-manager/templates/00-namespace.yaml @@ -3,4 +3,7 @@ apiVersion: v1 kind: Namespace metadata: name: {{ .Release.Namespace | quote }} + labels: + name: {{ .Release.Namespace | quote }} + certmanager.k8s.io/disable-validation: "true" {{- end }} diff --git a/stable/cert-manager/templates/certificate-crd.yaml b/stable/cert-manager/templates/certificate-crd.yaml index 1024900bab..0657c4af51 100644 --- a/stable/cert-manager/templates/certificate-crd.yaml +++ b/stable/cert-manager/templates/certificate-crd.yaml @@ -3,6 +3,10 @@ apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: certificates.certmanager.k8s.io +{{- if semverCompare ">=2.10-0" .Capabilities.TillerVersion.SemVer }} + annotations: + "helm.sh/hook": crd-install +{{- end }} labels: app: {{ template "cert-manager.name" . }} chart: {{ template "cert-manager.chart" . }} diff --git a/stable/cert-manager/templates/clusterissuer-crd.yaml b/stable/cert-manager/templates/clusterissuer-crd.yaml index f2f6e57678..cfa67b9ae7 100644 --- a/stable/cert-manager/templates/clusterissuer-crd.yaml +++ b/stable/cert-manager/templates/clusterissuer-crd.yaml @@ -3,6 +3,10 @@ apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: clusterissuers.certmanager.k8s.io +{{- if semverCompare ">=2.10-0" .Capabilities.TillerVersion.SemVer }} + annotations: + "helm.sh/hook": crd-install +{{- end }} labels: app: {{ template "cert-manager.name" . }} chart: {{ template "cert-manager.chart" . }} diff --git a/stable/cert-manager/templates/deployment.yaml b/stable/cert-manager/templates/deployment.yaml index 5a48c79420..83f8012414 100644 --- a/stable/cert-manager/templates/deployment.yaml +++ b/stable/cert-manager/templates/deployment.yaml @@ -59,6 +59,14 @@ spec: {{- if .defaultACMEDNS01ChallengeProvider }} - --default-acme-issuer-dns01-provider-name={{ .defaultACMEDNS01ChallengeProvider }} {{- end }} + {{- end }} + {{- if .Values.affinity }} + affinity: +{{ toYaml .Values.affinity | indent 10 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | indent 10 }} {{- end }} env: - name: POD_NAMESPACE diff --git a/stable/cert-manager/templates/issuer-crd.yaml b/stable/cert-manager/templates/issuer-crd.yaml index eb43f2a7ba..5886676e5a 100644 --- a/stable/cert-manager/templates/issuer-crd.yaml +++ b/stable/cert-manager/templates/issuer-crd.yaml @@ -3,6 +3,10 @@ apiVersion: apiextensions.k8s.io/v1beta1 kind: CustomResourceDefinition metadata: name: issuers.certmanager.k8s.io +{{- if semverCompare ">=2.10-0" .Capabilities.TillerVersion.SemVer }} + annotations: + "helm.sh/hook": crd-install +{{- end }} labels: app: {{ template "cert-manager.name" . }} chart: {{ template "cert-manager.chart" . }} diff --git a/stable/cert-manager/templates/rbac.yaml b/stable/cert-manager/templates/rbac.yaml index 4c783ef394..d6503c8715 100644 --- a/stable/cert-manager/templates/rbac.yaml +++ b/stable/cert-manager/templates/rbac.yaml @@ -13,12 +13,7 @@ rules: resources: ["certificates", "issuers", "clusterissuers"] verbs: ["*"] - apiGroups: [""] - # TODO: remove endpoints once 0.4 is released. We include it here in case - # users use the 'master' version of the Helm chart with a 0.2.x release of - # cert-manager that still performs leader election with Endpoint resources. - # We advise users don't do this, but some will anyway and this will reduce - # friction. - resources: ["endpoints", "configmaps", "secrets", "events", "services", "pods"] + resources: ["configmaps", "secrets", "events", "services", "pods"] verbs: ["*"] - apiGroups: ["extensions"] resources: ["ingresses"] diff --git a/stable/cert-manager/values.yaml b/stable/cert-manager/values.yaml index 6b3be1567f..d7ab818984 100644 --- a/stable/cert-manager/values.yaml +++ b/stable/cert-manager/values.yaml @@ -5,7 +5,7 @@ replicaCount: 1 image: repository: quay.io/jetstack/cert-manager-controller - tag: v0.4.1 + tag: v0.5.0 pullPolicy: IfNotPresent createCustomResource: true @@ -69,6 +69,9 @@ ingressShim: {} # defaultACMEChallengeType: "" # defaultACMEDNS01ChallengeProvider: "" +webhook: + enabled: false + # This is used by the static manifest generator in order to create a static # namespace manifest for the namespace that cert-manager is being installed # within. It should **not** be used if you are using Helm for deployment. @@ -78,3 +81,25 @@ createNamespaceResource: false # http_proxy: "http://proxy:8080" # http_proxy: "http://proxy:8080" # no_proxy: 127.0.0.1,localhost + +# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#affinity-v1-core +# for example: +# affinity: +# nodeAffinity: +# requiredDuringSchedulingIgnoredDuringExecution: +# nodeSelectorTerms: +# - matchExpressions: +# - key: foo.bar.com/role +# operator: In +# values: +# - master +affinity: {} + +# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#toleration-v1-core +# for example: +# tolerations: +# - key: foo.bar.com/role +# operator: Equal +# value: master +# effect: NoSchedule +tolerations: [] diff --git a/stable/cert-manager/webhook/.helmignore b/stable/cert-manager/webhook/.helmignore new file mode 100644 index 0000000000..f0c1319444 --- /dev/null +++ b/stable/cert-manager/webhook/.helmignore @@ -0,0 +1,21 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj diff --git a/stable/cert-manager/webhook/Chart.yaml b/stable/cert-manager/webhook/Chart.yaml new file mode 100644 index 0000000000..1a0bcda86f --- /dev/null +++ b/stable/cert-manager/webhook/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +appVersion: "v0.5.0" +description: A Helm chart for deploying the cert-manager webhook component +name: webhook +version: "v0.5.0" diff --git a/stable/cert-manager/webhook/templates/NOTES.txt b/stable/cert-manager/webhook/templates/NOTES.txt new file mode 100644 index 0000000000..e69de29bb2 diff --git a/stable/cert-manager/webhook/templates/_helpers.tpl b/stable/cert-manager/webhook/templates/_helpers.tpl new file mode 100644 index 0000000000..c72a43690c --- /dev/null +++ b/stable/cert-manager/webhook/templates/_helpers.tpl @@ -0,0 +1,48 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "webhook.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "webhook.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "webhook.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "webhook.selfSignedIssuer" -}} +{{ printf "%s-selfsign" (include "webhook.fullname" .) }} +{{- end -}} + +{{- define "webhook.rootCAIssuer" -}} +{{ printf "%s-ca" (include "webhook.fullname" .) }} +{{- end -}} + +{{- define "webhook.rootCACertificate" -}} +{{ printf "%s-ca" (include "webhook.fullname" .) }} +{{- end -}} + +{{- define "webhook.servingCertificate" -}} +{{ printf "%s-webhook-tls" (include "webhook.fullname" .) }} +{{- end -}} diff --git a/stable/cert-manager/webhook/templates/apiservice.yaml b/stable/cert-manager/webhook/templates/apiservice.yaml new file mode 100644 index 0000000000..2028bc2d1e --- /dev/null +++ b/stable/cert-manager/webhook/templates/apiservice.yaml @@ -0,0 +1,17 @@ +apiVersion: apiregistration.k8s.io/v1beta1 +kind: APIService +metadata: + name: v1beta1.admission.certmanager.k8s.io + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + group: admission.certmanager.k8s.io + groupPriorityMinimum: 1000 + versionPriority: 15 + service: + name: {{ include "webhook.fullname" . }} + namespace: "{{ .Release.Namespace }}" + version: v1beta1 diff --git a/stable/cert-manager/webhook/templates/ca-sync.yaml b/stable/cert-manager/webhook/templates/ca-sync.yaml new file mode 100644 index 0000000000..88c43d50d5 --- /dev/null +++ b/stable/cert-manager/webhook/templates/ca-sync.yaml @@ -0,0 +1,172 @@ +## This file contains a CronJob that runs every 24h to automatically update the +## caBundle set on the APIService and ValidatingWebhookConfiguration resource. +## This allows us to store the CA bundle in a Secret resource which is +## generated by cert-manager's 'selfsigned' Issuer. +apiVersion: batch/v1beta1 +kind: CronJob +metadata: + name: {{ include "webhook.fullname" . }}-ca-sync + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + schedule: "* * */24 * *" + jobTemplate: + spec: + template: + metadata: + labels: + app: ca-helper + spec: + serviceAccountName: {{ include "webhook.fullname" . }}-ca-sync + restartPolicy: OnFailure + containers: + - name: ca-helper + image: quay.io/munnerz/apiextensions-ca-helper:v0.1.0 + imagePullPolicy: IfNotPresent + args: + - -config=/config/config + volumeMounts: + - name: config + mountPath: /config + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + volumes: + - name: config + configMap: + name: {{ include "webhook.fullname" . }}-ca-sync +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "webhook.fullname" . }}-ca-sync + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + template: + metadata: + labels: + app: ca-helper + spec: + serviceAccountName: {{ include "webhook.fullname" . }}-ca-sync + restartPolicy: OnFailure + containers: + - name: ca-helper + image: quay.io/munnerz/apiextensions-ca-helper:canary + imagePullPolicy: IfNotPresent + args: + - -config=/config/config + volumeMounts: + - name: config + mountPath: /config + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 100m + memory: 128Mi + volumes: + - name: config + configMap: + name: {{ include "webhook.fullname" . }}-ca-sync +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "webhook.fullname" . }}-ca-sync + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +data: + config: |- + { + "apiServices": [ + { + "name": "v1beta1.admission.certmanager.k8s.io", + "secret": { + "name": "{{ include "webhook.rootCACertificate" . }}", + "namespace": "{{ .Release.Namespace }}", + "key": "tls.crt" + } + } + ], + "validatingWebhookConfigurations": [ + { + "name": "{{ include "webhook.fullname" . }}", + "file": { + "path": "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" + } + } + ] + } +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "webhook.fullname" . }}-ca-sync + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: {{ include "webhook.fullname" . }}-ca-sync + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get"] + resourceNames: + - {{ include "webhook.rootCACertificate" . }} + - apiGroups: ["admissionregistration.k8s.io"] + resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"] + verbs: ["get", "update"] + resourceNames: + - {{ include "webhook.fullname" . }} + - apiGroups: ["apiregistration.k8s.io"] + resources: ["apiservices"] + verbs: ["get", "update"] + resourceNames: + - v1beta1.admission.certmanager.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: {{ include "webhook.fullname" . }}-ca-sync + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "webhook.fullname" . }}-ca-sync +subjects: + - name: {{ include "webhook.fullname" . }}-ca-sync + namespace: {{ .Release.Namespace }} + kind: ServiceAccount diff --git a/stable/cert-manager/webhook/templates/deployment.yaml b/stable/cert-manager/webhook/templates/deployment.yaml new file mode 100644 index 0000000000..e81ed606bb --- /dev/null +++ b/stable/cert-manager/webhook/templates/deployment.yaml @@ -0,0 +1,65 @@ +apiVersion: apps/v1beta1 +kind: Deployment +metadata: + name: {{ include "webhook.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ include "webhook.name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ include "webhook.name" . }} + release: {{ .Release.Name }} + annotations: + {{- if .Values.podAnnotations }} +{{ toYaml .Values.podAnnotations | indent 8 }} + {{- end }} + spec: + serviceAccountName: {{ include "webhook.fullname" . }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: + - --v=12 + - --tls-cert-file=/certs/tls.crt + - --tls-private-key-file=/certs/tls.key + - --disable-admission-plugins=NamespaceLifecycle,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,Initializers + {{- if .Values.extraArgs }} +{{ toYaml .Values.extraArgs | indent 10 }} + {{- end }} + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + resources: +{{ toYaml .Values.resources | indent 12 }} + volumeMounts: + - name: certs + mountPath: /certs + volumes: + - name: certs + secret: + secretName: {{ include "webhook.servingCertificate" . }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} diff --git a/stable/cert-manager/webhook/templates/pki.yaml b/stable/cert-manager/webhook/templates/pki.yaml new file mode 100644 index 0000000000..1654b29b56 --- /dev/null +++ b/stable/cert-manager/webhook/templates/pki.yaml @@ -0,0 +1,74 @@ +--- +# Create a selfsigned Issuer, in order to create a root CA certificate for +# signing webhook serving certificates +apiVersion: certmanager.k8s.io/v1alpha1 +kind: Issuer +metadata: + name: {{ include "webhook.selfSignedIssuer" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + selfsigned: {} + +--- + +# Generate a CA Certificate used to sign certificates for the webhook +apiVersion: certmanager.k8s.io/v1alpha1 +kind: Certificate +metadata: + name: {{ include "webhook.rootCACertificate" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + secretName: {{ include "webhook.rootCACertificate" . }} + issuerRef: + name: {{ include "webhook.selfSignedIssuer" . }} + commonName: "ca.webhook.cert-manager" + isCA: true + +--- + +# Create an Issuer that uses the above generated CA certificate to issue certs +apiVersion: certmanager.k8s.io/v1alpha1 +kind: Issuer +metadata: + name: {{ include "webhook.rootCAIssuer" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + ca: + secretName: {{ include "webhook.rootCACertificate" . }} + +--- + +# Finally, generate a serving certificate for the webhook to use +apiVersion: certmanager.k8s.io/v1alpha1 +kind: Certificate +metadata: + name: {{ include "webhook.servingCertificate" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + secretName: {{ include "webhook.servingCertificate" . }} + issuerRef: + name: {{ include "webhook.rootCAIssuer" . }} + dnsNames: + - {{ include "webhook.fullname" . }} + - {{ include "webhook.fullname" . }}.{{ .Release.Namespace }} + - {{ include "webhook.fullname" . }}.{{ .Release.Namespace }}.svc diff --git a/stable/cert-manager/webhook/templates/rbac.yaml b/stable/cert-manager/webhook/templates/rbac.yaml new file mode 100644 index 0000000000..5854af5817 --- /dev/null +++ b/stable/cert-manager/webhook/templates/rbac.yaml @@ -0,0 +1,68 @@ +### Webhook ### +--- +# apiserver gets the auth-delegator role to delegate auth decisions to +# the core apiserver +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: {{ include "webhook.fullname" . }}:auth-delegator + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator +subjects: +- apiGroup: "" + kind: ServiceAccount + name: {{ include "webhook.fullname" . }} + namespace: {{ .Release.Namespace }} + +--- + +# apiserver gets the ability to read authentication. This allows it to +# read the specific configmap that has the requestheader-* entries to +# api agg +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + name: {{ include "webhook.fullname" . }}:webhook-authentication-reader + namespace: kube-system + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: extension-apiserver-authentication-reader +subjects: +- apiGroup: "" + kind: ServiceAccount + name: {{ include "webhook.fullname" . }} + namespace: {{ .Release.Namespace }} + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "webhook.fullname" . }}:webhook-requester + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: +- apiGroups: + - admission.certmanager.k8s.io + resources: + - certificates + - issuers + - clusterissuers + verbs: + - create diff --git a/stable/cert-manager/webhook/templates/service.yaml b/stable/cert-manager/webhook/templates/service.yaml new file mode 100644 index 0000000000..88c487cc14 --- /dev/null +++ b/stable/cert-manager/webhook/templates/service.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "webhook.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: ClusterIP + ports: + - name: https + port: 443 + targetPort: 443 + selector: + app: {{ include "webhook.name" . }} + release: {{ .Release.Name }} diff --git a/stable/cert-manager/webhook/templates/serviceaccount.yaml b/stable/cert-manager/webhook/templates/serviceaccount.yaml new file mode 100644 index 0000000000..54dc9ba13c --- /dev/null +++ b/stable/cert-manager/webhook/templates/serviceaccount.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "webhook.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} diff --git a/stable/cert-manager/webhook/templates/validating-webhook.yaml b/stable/cert-manager/webhook/templates/validating-webhook.yaml new file mode 100644 index 0000000000..25112194c0 --- /dev/null +++ b/stable/cert-manager/webhook/templates/validating-webhook.yaml @@ -0,0 +1,91 @@ +apiVersion: admissionregistration.k8s.io/v1beta1 +kind: ValidatingWebhookConfiguration +metadata: + name: {{ include "webhook.fullname" . }} + labels: + app: {{ include "webhook.name" . }} + chart: {{ include "webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +webhooks: + - name: certificates.admission.certmanager.k8s.io + namespaceSelector: + matchExpressions: + - key: "certmanager.k8s.io/disable-validation" + operator: "NotIn" + values: + - "true" + - key: "name" + operator: "NotIn" + values: + - {{ .Release.Namespace }} + rules: + - apiGroups: + - "certmanager.k8s.io" + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - certificates + failurePolicy: Fail + clientConfig: + service: + name: kubernetes + namespace: default + path: /apis/admission.certmanager.k8s.io/v1beta1/certificates + - name: issuers.admission.certmanager.k8s.io + namespaceSelector: + matchExpressions: + - key: "certmanager.k8s.io/disable-validation" + operator: "NotIn" + values: + - "true" + - key: "name" + operator: "NotIn" + values: + - {{ .Release.Namespace }} + rules: + - apiGroups: + - "certmanager.k8s.io" + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - issuers + failurePolicy: Fail + clientConfig: + service: + name: kubernetes + namespace: default + path: /apis/admission.certmanager.k8s.io/v1beta1/issuers + - name: clusterissuers.admission.certmanager.k8s.io + namespaceSelector: + matchExpressions: + - key: "certmanager.k8s.io/disable-validation" + operator: "NotIn" + values: + - "true" + - key: "name" + operator: "NotIn" + values: + - {{ .Release.Namespace }} + rules: + - apiGroups: + - "certmanager.k8s.io" + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - clusterissuers + failurePolicy: Fail + clientConfig: + service: + name: kubernetes + namespace: default + path: /apis/admission.certmanager.k8s.io/v1beta1/clusterissuers diff --git a/stable/cert-manager/webhook/values.yaml b/stable/cert-manager/webhook/values.yaml new file mode 100644 index 0000000000..2c8d5b3c8a --- /dev/null +++ b/stable/cert-manager/webhook/values.yaml @@ -0,0 +1,16 @@ +replicaCount: 1 + +podAnnotations: {} + +# Optional additional arguments for webhook +extraArgs: [] + +resources: {} + # requests: + # cpu: 10m + # memory: 32Mi + +image: + repository: quay.io/jetstack/cert-manager-webhook + tag: v0.5.0 + pullPolicy: IfNotPresent