Update cert-manager
This commit is contained in:
Jonny Ervine
parent
b9ffae0ebb
commit
2438ac00fb
25
cert-manager-1.13.3/Chart.yaml
Normal file
25
cert-manager-1.13.3/Chart.yaml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
annotations:
|
||||||
|
artifacthub.io/license: Apache-2.0
|
||||||
|
artifacthub.io/prerelease: "false"
|
||||||
|
artifacthub.io/signKey: |
|
||||||
|
fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
|
||||||
|
url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
|
||||||
|
apiVersion: v1
|
||||||
|
appVersion: v1.13.3
|
||||||
|
description: A Helm chart for cert-manager
|
||||||
|
home: https://github.com/cert-manager/cert-manager
|
||||||
|
icon: https://raw.githubusercontent.com/cert-manager/cert-manager/d53c0b9270f8cd90d908460d69502694e1838f5f/logo/logo-small.png
|
||||||
|
keywords:
|
||||||
|
- cert-manager
|
||||||
|
- kube-lego
|
||||||
|
- letsencrypt
|
||||||
|
- tls
|
||||||
|
kubeVersion: '>= 1.22.0-0'
|
||||||
|
maintainers:
|
||||||
|
- email: cert-manager-maintainers@googlegroups.com
|
||||||
|
name: cert-manager-maintainers
|
||||||
|
url: https://cert-manager.io
|
||||||
|
name: cert-manager
|
||||||
|
sources:
|
||||||
|
- https://github.com/cert-manager/cert-manager
|
||||||
|
version: v1.13.3
|
||||||
276
cert-manager-1.13.3/README.md
Normal file
276
cert-manager-1.13.3/README.md
Normal file
@ -0,0 +1,276 @@
|
|||||||
|
# cert-manager
|
||||||
|
|
||||||
|
cert-manager is a Kubernetes addon to automate the management and issuance of
|
||||||
|
TLS certificates from various issuing sources.
|
||||||
|
|
||||||
|
It will ensure certificates are valid and up to date periodically, and attempt
|
||||||
|
to renew certificates at an appropriate time before expiry.
|
||||||
|
|
||||||
|
## Prerequisites
|
||||||
|
|
||||||
|
- Kubernetes 1.20+
|
||||||
|
|
||||||
|
## Installing the Chart
|
||||||
|
|
||||||
|
Full installation instructions, including details on how to configure extra
|
||||||
|
functionality in cert-manager can be found in the [installation docs](https://cert-manager.io/docs/installation/kubernetes/).
|
||||||
|
|
||||||
|
Before installing the chart, you must first install the cert-manager CustomResourceDefinition resources.
|
||||||
|
This is performed in a separate step to allow you to easily uninstall and reinstall cert-manager without deleting your installed custom resources.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cert-manager.crds.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
To install the chart with the release name `my-release`:
|
||||||
|
|
||||||
|
```console
|
||||||
|
## Add the Jetstack Helm repository
|
||||||
|
$ helm repo add jetstack https://charts.jetstack.io
|
||||||
|
|
||||||
|
## Install the cert-manager helm chart
|
||||||
|
$ helm install my-release --namespace cert-manager --version v1.13.3 jetstack/cert-manager
|
||||||
|
```
|
||||||
|
|
||||||
|
In order to begin issuing certificates, you will need to set up a ClusterIssuer
|
||||||
|
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
|
||||||
|
|
||||||
|
More information on the different types of issuers and how to configure them
|
||||||
|
can be found in [our documentation](https://cert-manager.io/docs/configuration/).
|
||||||
|
|
||||||
|
For information on how to configure cert-manager to automatically provision
|
||||||
|
Certificates for Ingress resources, take a look at the
|
||||||
|
[Securing Ingresses documentation](https://cert-manager.io/docs/usage/ingress/).
|
||||||
|
|
||||||
|
> **Tip**: List all releases using `helm list`
|
||||||
|
|
||||||
|
## Upgrading the Chart
|
||||||
|
|
||||||
|
Special considerations may be required when upgrading the Helm chart, and these
|
||||||
|
are documented in our full [upgrading guide](https://cert-manager.io/docs/installation/upgrading/).
|
||||||
|
|
||||||
|
**Please check here before performing upgrades!**
|
||||||
|
|
||||||
|
## Uninstalling the Chart
|
||||||
|
|
||||||
|
To uninstall/delete the `my-release` deployment:
|
||||||
|
|
||||||
|
```console
|
||||||
|
$ helm delete my-release
|
||||||
|
```
|
||||||
|
|
||||||
|
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||||
|
|
||||||
|
If you want to completely uninstall cert-manager from your cluster, you will also need to
|
||||||
|
delete the previously installed CustomResourceDefinition resources:
|
||||||
|
|
||||||
|
```console
|
||||||
|
$ kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cert-manager.crds.yaml
|
||||||
|
```
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
The following table lists the configurable parameters of the cert-manager chart and their default values.
|
||||||
|
|
||||||
|
| Parameter | Description | Default |
|
||||||
|
| --------- | ----------- | ------- |
|
||||||
|
| `global.imagePullSecrets` | Reference to one or more secrets to be used when pulling images | `[]` |
|
||||||
|
| `global.commonLabels` | Labels to apply to all resources | `{}` |
|
||||||
|
| `global.rbac.create` | If `true`, create and use RBAC resources (includes sub-charts) | `true` |
|
||||||
|
| `global.priorityClassName`| Priority class name for cert-manager and webhook pods | `""` |
|
||||||
|
| `global.podSecurityPolicy.enabled` | If `true`, create and use PodSecurityPolicy (includes sub-charts) | `false` |
|
||||||
|
| `global.podSecurityPolicy.useAppArmor` | If `true`, use Apparmor seccomp profile in PSP | `true` |
|
||||||
|
| `global.leaderElection.namespace` | Override the namespace used to store the ConfigMap for leader election | `kube-system` |
|
||||||
|
| `global.leaderElection.leaseDuration` | The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate | |
|
||||||
|
| `global.leaderElection.renewDeadline` | The interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration | |
|
||||||
|
| `global.leaderElection.retryPeriod` | The duration the clients should wait between attempting acquisition and renewal of a leadership | |
|
||||||
|
| `installCRDs` | If true, CRD resources will be installed as part of the Helm chart. If enabled, when uninstalling CRD resources will be deleted causing all installed custom resources to be DELETED | `false` |
|
||||||
|
| `image.repository` | Image repository | `quay.io/jetstack/cert-manager-controller` |
|
||||||
|
| `image.tag` | Image tag | `v1.13.3` |
|
||||||
|
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||||
|
| `replicaCount` | Number of cert-manager replicas | `1` |
|
||||||
|
| `clusterResourceNamespace` | Override the namespace used to store DNS provider credentials etc. for ClusterIssuer resources | Same namespace as cert-manager pod |
|
||||||
|
| `featureGates` | Set of comma-separated key=value pairs that describe feature gates on the controller. Some feature gates may also have to be enabled on other components, and can be set supplying the `feature-gate` flag to `<component>.extraArgs` | `` |
|
||||||
|
| `extraArgs` | Optional flags for cert-manager | `[]` |
|
||||||
|
| `extraEnv` | Optional environment variables for cert-manager | `[]` |
|
||||||
|
| `serviceAccount.create` | If `true`, create a new service account | `true` |
|
||||||
|
| `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template | |
|
||||||
|
| `serviceAccount.annotations` | Annotations to add to the service account | |
|
||||||
|
| `serviceAccount.automountServiceAccountToken` | Automount API credentials for the Service Account | `true` |
|
||||||
|
| `volumes` | Optional volumes for cert-manager | `[]` |
|
||||||
|
| `volumeMounts` | Optional volume mounts for cert-manager | `[]` |
|
||||||
|
| `resources` | CPU/memory resource requests/limits | `{}` |
|
||||||
|
| `securityContext` | Security context for the controller pod assignment | refer to [Default Security Contexts](#default-security-contexts) |
|
||||||
|
| `containerSecurityContext` | Security context to be set on the controller component container | refer to [Default Security Contexts](#default-security-contexts) |
|
||||||
|
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||||
|
| `affinity` | Node affinity for pod assignment | `{}` |
|
||||||
|
| `tolerations` | Node tolerations for pod assignment | `[]` |
|
||||||
|
| `topologySpreadConstraints` | Topology spread constraints for pod assignment | `[]` |
|
||||||
|
| `livenessProbe.enabled` | Enable or disable the liveness probe for the controller container in the controller Pod. See https://cert-manager.io/docs/installation/best-practice/ to learn about when you might want to enable this livenss probe. | `false` |
|
||||||
|
| `livenessProbe.initialDelaySeconds` | The liveness probe initial delay (in seconds) | `10` |
|
||||||
|
| `livenessProbe.periodSeconds` | The liveness probe period (in seconds) | `10` |
|
||||||
|
| `livenessProbe.timeoutSeconds` | The liveness probe timeout (in seconds) | `10` |
|
||||||
|
| `livenessProbe.periodSeconds` | The liveness probe period (in seconds) | `10` |
|
||||||
|
| `livenessProbe.successThreshold` | The liveness probe success threshold | `1` |
|
||||||
|
| `livenessProbe.failureThreshold` | The liveness probe failure threshold | `8` |
|
||||||
|
| `ingressShim.defaultIssuerName` | Optional default issuer to use for ingress resources | |
|
||||||
|
| `ingressShim.defaultIssuerKind` | Optional default issuer kind to use for ingress resources | |
|
||||||
|
| `ingressShim.defaultIssuerGroup` | Optional default issuer group to use for ingress resources | |
|
||||||
|
| `prometheus.enabled` | Enable Prometheus monitoring | `true` |
|
||||||
|
| `prometheus.servicemonitor.enabled` | Enable Prometheus Operator ServiceMonitor monitoring | `false` |
|
||||||
|
| `prometheus.servicemonitor.namespace` | Define namespace where to deploy the ServiceMonitor resource | (namespace where you are deploying) |
|
||||||
|
| `prometheus.servicemonitor.prometheusInstance` | Prometheus Instance definition | `default` |
|
||||||
|
| `prometheus.servicemonitor.targetPort` | Prometheus scrape port | `9402` |
|
||||||
|
| `prometheus.servicemonitor.path` | Prometheus scrape path | `/metrics` |
|
||||||
|
| `prometheus.servicemonitor.interval` | Prometheus scrape interval | `60s` |
|
||||||
|
| `prometheus.servicemonitor.labels` | Add custom labels to ServiceMonitor | |
|
||||||
|
| `prometheus.servicemonitor.scrapeTimeout` | Prometheus scrape timeout | `30s` |
|
||||||
|
| `prometheus.servicemonitor.honorLabels` | Enable label honoring for metrics scraped by Prometheus (see [Prometheus scrape config docs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config) for details). By setting `honorLabels` to `true`, Prometheus will prefer label contents given by cert-manager on conflicts. Can be used to remove the "exported_namespace" label for example. | `false` |
|
||||||
|
| `podAnnotations` | Annotations to add to the cert-manager pod | `{}` |
|
||||||
|
| `deploymentAnnotations` | Annotations to add to the cert-manager deployment | `{}` |
|
||||||
|
| `podDisruptionBudget.enabled` | Adds a PodDisruptionBudget for the cert-manager deployment | `false` |
|
||||||
|
| `podDisruptionBudget.minAvailable` | Configures the minimum available pods for voluntary disruptions. Cannot used if `maxUnavailable` is set. | `1` |
|
||||||
|
| `podDisruptionBudget.maxUnavailable` | Configures the maximum unavailable pods for voluntary disruptions. Cannot used if `minAvailable` is set. | |
|
||||||
|
| `podDnsPolicy` | Optional cert-manager pod [DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods-dns-policy) | |
|
||||||
|
| `podDnsConfig` | Optional cert-manager pod [DNS configurations](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods-dns-config) | |
|
||||||
|
| `podLabels` | Labels to add to the cert-manager pod | `{}` |
|
||||||
|
| `serviceLabels` | Labels to add to the cert-manager controller service | `{}` |
|
||||||
|
| `serviceAnnotations` | Annotations to add to the cert-manager service | `{}` |
|
||||||
|
| `http_proxy` | Value of the `HTTP_PROXY` environment variable in the cert-manager pod | |
|
||||||
|
| `https_proxy` | Value of the `HTTPS_PROXY` environment variable in the cert-manager pod | |
|
||||||
|
| `no_proxy` | Value of the `NO_PROXY` environment variable in the cert-manager pod | |
|
||||||
|
| `dns01RecursiveNameservers` | Comma separated string with host and port of the recursive nameservers cert-manager should query | `` |
|
||||||
|
| `dns01RecursiveNameserversOnly` | Forces cert-manager to only use the recursive nameservers for verification. | `false` |
|
||||||
|
| `enableCertificateOwnerRef` | When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted | `false` |
|
||||||
|
| `config` | ControllerConfiguration YAML used to configure flags for the controller. Generates a ConfigMap containing contents of the field. See `values.yaml` for example. | `{}` |
|
||||||
|
| `enableServiceLinks` | Indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. | `false` |
|
||||||
|
| `webhook.replicaCount` | Number of cert-manager webhook replicas | `1` |
|
||||||
|
| `webhook.timeoutSeconds` | Seconds the API server should wait the webhook to respond before treating the call as a failure. | `10` |
|
||||||
|
| `webhook.podAnnotations` | Annotations to add to the webhook pods | `{}` |
|
||||||
|
| `webhook.podLabels` | Labels to add to the cert-manager webhook pod | `{}` |
|
||||||
|
| `webhook.serviceLabels` | Labels to add to the cert-manager webhook service | `{}` |
|
||||||
|
| `webhook.deploymentAnnotations` | Annotations to add to the webhook deployment | `{}` |
|
||||||
|
| `webhook.podDisruptionBudget.enabled` | Adds a PodDisruptionBudget for the cert-manager deployment | `false` |
|
||||||
|
| `webhook.podDisruptionBudget.minAvailable` | Configures the minimum available pods for voluntary disruptions. Cannot used if `maxUnavailable` is set. | `1` |
|
||||||
|
| `webhook.podDisruptionBudget.maxUnavailable` | Configures the maximum unavailable pods for voluntary disruptions. Cannot used if `minAvailable` is set. | |
|
||||||
|
| `webhook.mutatingWebhookConfigurationAnnotations` | Annotations to add to the mutating webhook configuration | `{}` |
|
||||||
|
| `webhook.validatingWebhookConfigurationAnnotations` | Annotations to add to the validating webhook configuration | `{}` |
|
||||||
|
| `webhook.serviceAnnotations` | Annotations to add to the webhook service | `{}` |
|
||||||
|
| `webhook.config` | WebhookConfiguration YAML used to configure flags for the webhook. Generates a ConfigMap containing contents of the field. See `values.yaml` for example. | `{}` |
|
||||||
|
| `webhook.extraArgs` | Optional flags for cert-manager webhook component | `[]` |
|
||||||
|
| `webhook.serviceAccount.create` | If `true`, create a new service account for the webhook component | `true` |
|
||||||
|
| `webhook.serviceAccount.name` | Service account for the webhook component to be used. If not set and `webhook.serviceAccount.create` is `true`, a name is generated using the fullname template | |
|
||||||
|
| `webhook.serviceAccount.annotations` | Annotations to add to the service account for the webhook component | |
|
||||||
|
| `webhook.serviceAccount.automountServiceAccountToken` | Automount API credentials for the webhook Service Account | |
|
||||||
|
| `webhook.resources` | CPU/memory resource requests/limits for the webhook pods | `{}` |
|
||||||
|
| `webhook.nodeSelector` | Node labels for webhook pod assignment | `{}` |
|
||||||
|
| `webhook.networkPolicy.enabled` | Enable default network policies for webhooks egress and ingress traffic | `false` |
|
||||||
|
| `webhook.networkPolicy.ingress` | Sets ingress policy block. See NetworkPolicy documentation. See `values.yaml` for example. | `{}` |
|
||||||
|
| `webhook.networkPolicy.egress` | Sets ingress policy block. See NetworkPolicy documentation. See `values.yaml` for example. | `{}` |
|
||||||
|
| `webhook.affinity` | Node affinity for webhook pod assignment | `{}` |
|
||||||
|
| `webhook.tolerations` | Node tolerations for webhook pod assignment | `[]` |
|
||||||
|
| `webhook.topologySpreadConstraints` | Topology spread constraints for webhook pod assignment | `[]` |
|
||||||
|
| `webhook.image.repository` | Webhook image repository | `quay.io/jetstack/cert-manager-webhook` |
|
||||||
|
| `webhook.image.tag` | Webhook image tag | `v1.13.3` |
|
||||||
|
| `webhook.image.pullPolicy` | Webhook image pull policy | `IfNotPresent` |
|
||||||
|
| `webhook.securePort` | The port that the webhook should listen on for requests. | `10250` |
|
||||||
|
| `webhook.securityContext` | Security context for webhook pod assignment | refer to [Default Security Contexts](#default-security-contexts) |
|
||||||
|
| `webhook.containerSecurityContext` | Security context to be set on the webhook component container | refer to [Default Security Contexts](#default-security-contexts) |
|
||||||
|
| `webhook.hostNetwork` | If `true`, run the Webhook on the host network. | `false` |
|
||||||
|
| `webhook.serviceType` | The type of the `Service`. | `ClusterIP` |
|
||||||
|
| `webhook.loadBalancerIP` | The specific load balancer IP to use (when `serviceType` is `LoadBalancer`). | |
|
||||||
|
| `webhook.url.host` | The host to use to reach the webhook, instead of using internal cluster DNS for the service. | |
|
||||||
|
| `webhook.livenessProbe.failureThreshold` | The liveness probe failure threshold | `3` |
|
||||||
|
| `webhook.livenessProbe.initialDelaySeconds` | The liveness probe initial delay (in seconds) | `60` |
|
||||||
|
| `webhook.livenessProbe.periodSeconds` | The liveness probe period (in seconds) | `10` |
|
||||||
|
| `webhook.livenessProbe.successThreshold` | The liveness probe success threshold | `1` |
|
||||||
|
| `webhook.livenessProbe.timeoutSeconds` | The liveness probe timeout (in seconds) | `1` |
|
||||||
|
| `webhook.readinessProbe.failureThreshold` | The readiness probe failure threshold | `3` |
|
||||||
|
| `webhook.readinessProbe.initialDelaySeconds` | The readiness probe initial delay (in seconds) | `5` |
|
||||||
|
| `webhook.readinessProbe.periodSeconds` | The readiness probe period (in seconds) | `5` |
|
||||||
|
| `webhook.readinessProbe.successThreshold` | The readiness probe success threshold | `1` |
|
||||||
|
| `webhook.readinessProbe.timeoutSeconds` | The readiness probe timeout (in seconds) | `1` |
|
||||||
|
| `webhook.enableServiceLinks` | Indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. | `false` |
|
||||||
|
| `cainjector.enabled` | Toggles whether the cainjector component should be installed (required for the webhook component to work) | `true` |
|
||||||
|
| `cainjector.replicaCount` | Number of cert-manager cainjector replicas | `1` |
|
||||||
|
| `cainjector.podAnnotations` | Annotations to add to the cainjector pods | `{}` |
|
||||||
|
| `cainjector.podLabels` | Labels to add to the cert-manager cainjector pod | `{}` |
|
||||||
|
| `cainjector.deploymentAnnotations` | Annotations to add to the cainjector deployment | `{}` |
|
||||||
|
| `cainjector.podDisruptionBudget.enabled` | Adds a PodDisruptionBudget for the cert-manager deployment | `false` |
|
||||||
|
| `cainjector.podDisruptionBudget.minAvailable` | Configures the minimum available pods for voluntary disruptions. Cannot used if `maxUnavailable` is set. | `1` |
|
||||||
|
| `cainjector.podDisruptionBudget.maxUnavailable` | Configures the maximum unavailable pods for voluntary disruptions. Cannot used if `minAvailable` is set. | |
|
||||||
|
| `cainjector.extraArgs` | Optional flags for cert-manager cainjector component | `[]` |
|
||||||
|
| `cainjector.serviceAccount.create` | If `true`, create a new service account for the cainjector component | `true` |
|
||||||
|
| `cainjector.serviceAccount.name` | Service account for the cainjector component to be used. If not set and `cainjector.serviceAccount.create` is `true`, a name is generated using the fullname template | |
|
||||||
|
| `cainjector.serviceAccount.annotations` | Annotations to add to the service account for the cainjector component | |
|
||||||
|
| `cainjector.serviceAccount.automountServiceAccountToken` | Automount API credentials for the cainjector Service Account | `true` |
|
||||||
|
| `cainjector.resources` | CPU/memory resource requests/limits for the cainjector pods | `{}` |
|
||||||
|
| `cainjector.nodeSelector` | Node labels for cainjector pod assignment | `{}` |
|
||||||
|
| `cainjector.affinity` | Node affinity for cainjector pod assignment | `{}` |
|
||||||
|
| `cainjector.tolerations` | Node tolerations for cainjector pod assignment | `[]` |
|
||||||
|
| `cainjector.topologySpreadConstraints` | Topology spread constraints for cainjector pod assignment | `[]` |
|
||||||
|
| `cainjector.image.repository` | cainjector image repository | `quay.io/jetstack/cert-manager-cainjector` |
|
||||||
|
| `cainjector.image.tag` | cainjector image tag | `v1.13.3` |
|
||||||
|
| `cainjector.image.pullPolicy` | cainjector image pull policy | `IfNotPresent` |
|
||||||
|
| `cainjector.securityContext` | Security context for cainjector pod assignment | refer to [Default Security Contexts](#default-security-contexts) |
|
||||||
|
| `cainjector.containerSecurityContext` | Security context to be set on cainjector component container | refer to [Default Security Contexts](#default-security-contexts) |
|
||||||
|
| `cainjector.enableServiceLinks` | Indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. | `false` |
|
||||||
|
| `acmesolver.image.repository` | acmesolver image repository | `quay.io/jetstack/cert-manager-acmesolver` |
|
||||||
|
| `acmesolver.image.tag` | acmesolver image tag | `v1.13.3` |
|
||||||
|
| `acmesolver.image.pullPolicy` | acmesolver image pull policy | `IfNotPresent` |
|
||||||
|
| `startupapicheck.enabled` | Toggles whether the startupapicheck Job should be installed | `true` |
|
||||||
|
| `startupapicheck.securityContext` | Security context for startupapicheck pod assignment | refer to [Default Security Contexts](#default-security-contexts) |
|
||||||
|
| `startupapicheck.containerSecurityContext` | Security context to be set on startupapicheck component container | refer to [Default Security Contexts](#default-security-contexts) |
|
||||||
|
| `startupapicheck.timeout` | Timeout for 'kubectl check api' command | `1m` |
|
||||||
|
| `startupapicheck.backoffLimit` | Job backoffLimit | `4` |
|
||||||
|
| `startupapicheck.jobAnnotations` | Optional additional annotations to add to the startupapicheck Job | `{}` |
|
||||||
|
| `startupapicheck.podAnnotations` | Optional additional annotations to add to the startupapicheck Pods | `{}` |
|
||||||
|
| `startupapicheck.extraArgs` | Optional additional arguments for startupapicheck | `[]` |
|
||||||
|
| `startupapicheck.resources` | CPU/memory resource requests/limits for the startupapicheck pod | `{}` |
|
||||||
|
| `startupapicheck.nodeSelector` | Node labels for startupapicheck pod assignment | `{}` |
|
||||||
|
| `startupapicheck.affinity` | Node affinity for startupapicheck pod assignment | `{}` |
|
||||||
|
| `startupapicheck.tolerations` | Node tolerations for startupapicheck pod assignment | `[]` |
|
||||||
|
| `startupapicheck.podLabels` | Optional additional labels to add to the startupapicheck Pods | `{}` |
|
||||||
|
| `startupapicheck.image.repository` | startupapicheck image repository | `quay.io/jetstack/cert-manager-ctl` |
|
||||||
|
| `startupapicheck.image.tag` | startupapicheck image tag | `v1.13.3` |
|
||||||
|
| `startupapicheck.image.pullPolicy` | startupapicheck image pull policy | `IfNotPresent` |
|
||||||
|
| `startupapicheck.serviceAccount.create` | If `true`, create a new service account for the startupapicheck component | `true` |
|
||||||
|
| `startupapicheck.serviceAccount.name` | Service account for the startupapicheck component to be used. If not set and `startupapicheck.serviceAccount.create` is `true`, a name is generated using the fullname template | |
|
||||||
|
| `startupapicheck.serviceAccount.annotations` | Annotations to add to the service account for the startupapicheck component | |
|
||||||
|
| `startupapicheck.serviceAccount.automountServiceAccountToken` | Automount API credentials for the startupapicheck Service Account | `true` |
|
||||||
|
| `startupapicheck.enableServiceLinks` | Indicates whether information about services should be injected into pod's environment variables, matching the syntax of Docker links. | `false` |
|
||||||
|
| `maxConcurrentChallenges` | The maximum number of challenges that can be scheduled as 'processing' at once | `60` |
|
||||||
|
|
||||||
|
### Default Security Contexts
|
||||||
|
|
||||||
|
The default pod-level and container-level security contexts, below, adhere to the [restricted](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) Pod Security Standards policies.
|
||||||
|
|
||||||
|
Default pod-level securityContext:
|
||||||
|
```yaml
|
||||||
|
runAsNonRoot: true
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
```
|
||||||
|
|
||||||
|
Default containerSecurityContext:
|
||||||
|
```yaml
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
```
|
||||||
|
|
||||||
|
### Assigning Values
|
||||||
|
|
||||||
|
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
|
||||||
|
|
||||||
|
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
|
||||||
|
|
||||||
|
```console
|
||||||
|
$ helm install my-release -f values.yaml .
|
||||||
|
```
|
||||||
|
> **Tip**: You can use the default [values.yaml](https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml)
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
This chart is maintained at [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager/tree/master/deploy/charts/cert-manager).
|
||||||
15
cert-manager-1.13.3/templates/NOTES.txt
Normal file
15
cert-manager-1.13.3/templates/NOTES.txt
Normal file
@ -0,0 +1,15 @@
|
|||||||
|
cert-manager {{ .Chart.AppVersion }} has been deployed successfully!
|
||||||
|
|
||||||
|
In order to begin issuing certificates, you will need to set up a ClusterIssuer
|
||||||
|
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
|
||||||
|
|
||||||
|
More information on the different types of issuers and how to configure them
|
||||||
|
can be found in our documentation:
|
||||||
|
|
||||||
|
https://cert-manager.io/docs/configuration/
|
||||||
|
|
||||||
|
For information on how to configure cert-manager to automatically provision
|
||||||
|
Certificates for Ingress resources, take a look at the `ingress-shim`
|
||||||
|
documentation:
|
||||||
|
|
||||||
|
https://cert-manager.io/docs/usage/ingress/
|
||||||
174
cert-manager-1.13.3/templates/_helpers.tpl
Normal file
174
cert-manager-1.13.3/templates/_helpers.tpl
Normal file
@ -0,0 +1,174 @@
|
|||||||
|
{{/* vim: set filetype=mustache: */}}
|
||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
*/}}
|
||||||
|
{{- define "cert-manager.name" -}}
|
||||||
|
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
*/}}
|
||||||
|
{{- define "cert-manager.fullname" -}}
|
||||||
|
{{- if .Values.fullnameOverride -}}
|
||||||
|
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||||
|
{{- if contains $name .Release.Name -}}
|
||||||
|
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- else -}}
|
||||||
|
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "cert-manager.serviceAccountName" -}}
|
||||||
|
{{- if .Values.serviceAccount.create -}}
|
||||||
|
{{ default (include "cert-manager.fullname" .) .Values.serviceAccount.name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{ default "default" .Values.serviceAccount.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Webhook templates
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
Manually fix the 'app' and 'name' labels to 'webhook' to maintain
|
||||||
|
compatibility with the v0.9 deployment selector.
|
||||||
|
*/}}
|
||||||
|
{{- define "webhook.name" -}}
|
||||||
|
{{- printf "webhook" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "webhook.fullname" -}}
|
||||||
|
{{- $trimmedName := printf "%s" (include "cert-manager.fullname" .) | trunc 55 | trimSuffix "-" -}}
|
||||||
|
{{- printf "%s-webhook" $trimmedName | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- define "webhook.caRef" -}}
|
||||||
|
{{- template "cert-manager.namespace" }}/{{ template "webhook.fullname" . }}-ca
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "webhook.serviceAccountName" -}}
|
||||||
|
{{- if .Values.webhook.serviceAccount.create -}}
|
||||||
|
{{ default (include "webhook.fullname" .) .Values.webhook.serviceAccount.name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{ default "default" .Values.webhook.serviceAccount.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
cainjector templates
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
Manually fix the 'app' and 'name' labels to 'cainjector' to maintain
|
||||||
|
compatibility with the v0.9 deployment selector.
|
||||||
|
*/}}
|
||||||
|
{{- define "cainjector.name" -}}
|
||||||
|
{{- printf "cainjector" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "cainjector.fullname" -}}
|
||||||
|
{{- $trimmedName := printf "%s" (include "cert-manager.fullname" .) | trunc 52 | trimSuffix "-" -}}
|
||||||
|
{{- printf "%s-cainjector" $trimmedName | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "cainjector.serviceAccountName" -}}
|
||||||
|
{{- if .Values.cainjector.serviceAccount.create -}}
|
||||||
|
{{ default (include "cainjector.fullname" .) .Values.cainjector.serviceAccount.name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{ default "default" .Values.cainjector.serviceAccount.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
startupapicheck templates
|
||||||
|
*/}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Expand the name of the chart.
|
||||||
|
Manually fix the 'app' and 'name' labels to 'startupapicheck' to maintain
|
||||||
|
compatibility with the v0.9 deployment selector.
|
||||||
|
*/}}
|
||||||
|
{{- define "startupapicheck.name" -}}
|
||||||
|
{{- printf "startupapicheck" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create a default fully qualified app name.
|
||||||
|
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||||
|
If release name contains chart name it will be used as a full name.
|
||||||
|
*/}}
|
||||||
|
{{- define "startupapicheck.fullname" -}}
|
||||||
|
{{- $trimmedName := printf "%s" (include "cert-manager.fullname" .) | trunc 52 | trimSuffix "-" -}}
|
||||||
|
{{- printf "%s-startupapicheck" $trimmedName | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create the name of the service account to use
|
||||||
|
*/}}
|
||||||
|
{{- define "startupapicheck.serviceAccountName" -}}
|
||||||
|
{{- if .Values.startupapicheck.serviceAccount.create -}}
|
||||||
|
{{ default (include "startupapicheck.fullname" .) .Values.startupapicheck.serviceAccount.name }}
|
||||||
|
{{- else -}}
|
||||||
|
{{ default "default" .Values.startupapicheck.serviceAccount.name }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Create chart name and version as used by the chart label.
|
||||||
|
*/}}
|
||||||
|
{{- define "chartName" -}}
|
||||||
|
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Labels that should be added on each resource
|
||||||
|
*/}}
|
||||||
|
{{- define "labels" -}}
|
||||||
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
|
{{- if eq (default "helm" .Values.creator) "helm" }}
|
||||||
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
|
helm.sh/chart: {{ include "chartName" . }}
|
||||||
|
{{- end -}}
|
||||||
|
{{- if .Values.global.commonLabels}}
|
||||||
|
{{ toYaml .Values.global.commonLabels }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Namespace for all resources to be installed into
|
||||||
|
If not defined in values file then the helm release namespace is used
|
||||||
|
By default this is not set so the helm release namespace will be used
|
||||||
|
|
||||||
|
This gets around an problem within helm discussed here
|
||||||
|
https://github.com/helm/helm/issues/5358
|
||||||
|
*/}}
|
||||||
|
{{- define "cert-manager.namespace" -}}
|
||||||
|
{{ .Values.namespace | default .Release.Namespace }}
|
||||||
|
{{- end -}}
|
||||||
118
cert-manager-1.13.3/templates/cainjector-deployment.yaml
Normal file
118
cert-manager-1.13.3/templates/cainjector-deployment.yaml
Normal file
@ -0,0 +1,118 @@
|
|||||||
|
{{- if .Values.cainjector.enabled }}
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "cainjector.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.cainjector.deploymentAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
replicas: {{ .Values.cainjector.replicaCount }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- with .Values.cainjector.strategy }}
|
||||||
|
strategy:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 8 }}
|
||||||
|
{{- with .Values.cainjector.podLabels }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
serviceAccountName: {{ template "cainjector.serviceAccountName" . }}
|
||||||
|
{{- if hasKey .Values.cainjector "automountServiceAccountToken" }}
|
||||||
|
automountServiceAccountToken: {{ .Values.cainjector.automountServiceAccountToken }}
|
||||||
|
{{- end }}
|
||||||
|
enableServiceLinks: {{ .Values.cainjector.enableServiceLinks }}
|
||||||
|
{{- with .Values.global.priorityClassName }}
|
||||||
|
priorityClassName: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.securityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: {{ .Chart.Name }}-cainjector
|
||||||
|
{{- with .Values.cainjector.image }}
|
||||||
|
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
||||||
|
{{- end }}
|
||||||
|
imagePullPolicy: {{ .Values.cainjector.image.pullPolicy }}
|
||||||
|
args:
|
||||||
|
{{- if .Values.global.logLevel }}
|
||||||
|
- --v={{ .Values.global.logLevel }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.global.leaderElection }}
|
||||||
|
- --leader-election-namespace={{ .namespace }}
|
||||||
|
{{- if .leaseDuration }}
|
||||||
|
- --leader-election-lease-duration={{ .leaseDuration }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .renewDeadline }}
|
||||||
|
- --leader-election-renew-deadline={{ .renewDeadline }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .retryPeriod }}
|
||||||
|
- --leader-election-retry-period={{ .retryPeriod }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.extraArgs }}
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
{{- with .Values.cainjector.containerSecurityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.resources }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.volumeMounts }}
|
||||||
|
volumeMounts:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.topologySpreadConstraints }}
|
||||||
|
topologySpreadConstraints:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.volumes }}
|
||||||
|
volumes:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,29 @@
|
|||||||
|
{{- if .Values.cainjector.podDisruptionBudget.enabled }}
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: {{ include "cainjector.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
|
||||||
|
{{- if not (or (hasKey .Values.cainjector.podDisruptionBudget "minAvailable") (hasKey .Values.cainjector.podDisruptionBudget "maxUnavailable")) }}
|
||||||
|
minAvailable: 1 # Default value because minAvailable and maxUnavailable are not set
|
||||||
|
{{- end }}
|
||||||
|
{{- if hasKey .Values.cainjector.podDisruptionBudget "minAvailable" }}
|
||||||
|
minAvailable: {{ .Values.cainjector.podDisruptionBudget.minAvailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if hasKey .Values.cainjector.podDisruptionBudget "maxUnavailable" }}
|
||||||
|
maxUnavailable: {{ .Values.cainjector.podDisruptionBudget.maxUnavailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,20 @@
|
|||||||
|
{{- if .Values.cainjector.enabled }}
|
||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
kind: ClusterRole
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cainjector.fullname" . }}-psp
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ['policy']
|
||||||
|
resources: ['podsecuritypolicies']
|
||||||
|
verbs: ['use']
|
||||||
|
resourceNames:
|
||||||
|
- {{ template "cainjector.fullname" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,22 @@
|
|||||||
|
{{- if .Values.cainjector.enabled }}
|
||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cainjector.fullname" . }}-psp
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "cainjector.fullname" . }}-psp
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ template "cainjector.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
51
cert-manager-1.13.3/templates/cainjector-psp.yaml
Normal file
51
cert-manager-1.13.3/templates/cainjector-psp.yaml
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
{{- if .Values.cainjector.enabled }}
|
||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
apiVersion: policy/v1beta1
|
||||||
|
kind: PodSecurityPolicy
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cainjector.fullname" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
|
||||||
|
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||||
|
{{- if .Values.global.podSecurityPolicy.useAppArmor }}
|
||||||
|
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||||
|
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
privileged: false
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
allowedCapabilities: [] # default set of capabilities are implicitly allowed
|
||||||
|
volumes:
|
||||||
|
- 'configMap'
|
||||||
|
- 'emptyDir'
|
||||||
|
- 'projected'
|
||||||
|
- 'secret'
|
||||||
|
- 'downwardAPI'
|
||||||
|
hostNetwork: false
|
||||||
|
hostIPC: false
|
||||||
|
hostPID: false
|
||||||
|
runAsUser:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
seLinux:
|
||||||
|
rule: 'RunAsAny'
|
||||||
|
supplementalGroups:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
fsGroup:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
103
cert-manager-1.13.3/templates/cainjector-rbac.yaml
Normal file
103
cert-manager-1.13.3/templates/cainjector-rbac.yaml
Normal file
@ -0,0 +1,103 @@
|
|||||||
|
{{- if .Values.cainjector.enabled }}
|
||||||
|
{{- if .Values.global.rbac.create }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cainjector.fullname" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["get", "create", "update", "patch"]
|
||||||
|
- apiGroups: ["admissionregistration.k8s.io"]
|
||||||
|
resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
|
||||||
|
verbs: ["get", "list", "watch", "update", "patch"]
|
||||||
|
- apiGroups: ["apiregistration.k8s.io"]
|
||||||
|
resources: ["apiservices"]
|
||||||
|
verbs: ["get", "list", "watch", "update", "patch"]
|
||||||
|
- apiGroups: ["apiextensions.k8s.io"]
|
||||||
|
resources: ["customresourcedefinitions"]
|
||||||
|
verbs: ["get", "list", "watch", "update", "patch"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cainjector.fullname" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "cainjector.fullname" . }}
|
||||||
|
subjects:
|
||||||
|
- name: {{ template "cainjector.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
||||||
|
---
|
||||||
|
# leader election rules
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cainjector.fullname" . }}:leaderelection
|
||||||
|
namespace: {{ .Values.global.leaderElection.namespace }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
# Used for leader election by the controller
|
||||||
|
# cert-manager-cainjector-leader-election is used by the CertificateBased injector controller
|
||||||
|
# see cmd/cainjector/start.go#L113
|
||||||
|
# cert-manager-cainjector-leader-election-core is used by the SecretBased injector controller
|
||||||
|
# see cmd/cainjector/start.go#L137
|
||||||
|
- apiGroups: ["coordination.k8s.io"]
|
||||||
|
resources: ["leases"]
|
||||||
|
resourceNames: ["cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"]
|
||||||
|
verbs: ["get", "update", "patch"]
|
||||||
|
- apiGroups: ["coordination.k8s.io"]
|
||||||
|
resources: ["leases"]
|
||||||
|
verbs: ["create"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# grant cert-manager permission to manage the leaderelection configmap in the
|
||||||
|
# leader election namespace
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "cainjector.fullname" . }}:leaderelection
|
||||||
|
namespace: {{ .Values.global.leaderElection.namespace }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: {{ template "cainjector.fullname" . }}:leaderelection
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ template "cainjector.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
27
cert-manager-1.13.3/templates/cainjector-serviceaccount.yaml
Normal file
27
cert-manager-1.13.3/templates/cainjector-serviceaccount.yaml
Normal file
@ -0,0 +1,27 @@
|
|||||||
|
{{- if .Values.cainjector.enabled }}
|
||||||
|
{{- if .Values.cainjector.serviceAccount.create }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
automountServiceAccountToken: {{ .Values.cainjector.serviceAccount.automountServiceAccountToken }}
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cainjector.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- with .Values.cainjector.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.cainjector.serviceAccount.labels }}
|
||||||
|
{{ toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.global.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
25
cert-manager-1.13.3/templates/controller-config.yaml
Normal file
25
cert-manager-1.13.3/templates/controller-config.yaml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
{{- if .Values.config -}}
|
||||||
|
{{- if not .Values.config.apiVersion -}}
|
||||||
|
{{- fail "config.apiVersion must be set" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if not .Values.config.kind -}}
|
||||||
|
{{- fail "config.kind must be set" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "cert-manager.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
data:
|
||||||
|
{{- if .Values.config }}
|
||||||
|
config.yaml: |
|
||||||
|
{{ .Values.config | toYaml | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
4458
cert-manager-1.13.3/templates/crds.yaml
Normal file
4458
cert-manager-1.13.3/templates/crds.yaml
Normal file
File diff suppressed because it is too large
Load Diff
222
cert-manager-1.13.3/templates/deployment.yaml
Normal file
222
cert-manager-1.13.3/templates/deployment.yaml
Normal file
@ -0,0 +1,222 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ template "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.deploymentAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
replicas: {{ .Values.replicaCount }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- with .Values.strategy }}
|
||||||
|
strategy:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: {{ template "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 8 }}
|
||||||
|
{{- with .Values.podLabels }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and .Values.prometheus.enabled (not .Values.prometheus.servicemonitor.enabled) }}
|
||||||
|
{{- if not .Values.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- end }}
|
||||||
|
prometheus.io/path: "/metrics"
|
||||||
|
prometheus.io/scrape: 'true'
|
||||||
|
prometheus.io/port: '9402'
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
serviceAccountName: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
{{- if hasKey .Values "automountServiceAccountToken" }}
|
||||||
|
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||||
|
{{- end }}
|
||||||
|
enableServiceLinks: {{ .Values.enableServiceLinks }}
|
||||||
|
{{- with .Values.global.priorityClassName }}
|
||||||
|
priorityClassName: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.securityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.volumes .Values.config}}
|
||||||
|
volumes:
|
||||||
|
{{- if .Values.config }}
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "cert-manager.fullname" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{ with .Values.volumes }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: {{ .Chart.Name }}-controller
|
||||||
|
{{- with .Values.image }}
|
||||||
|
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
||||||
|
{{- end }}
|
||||||
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
|
args:
|
||||||
|
{{- if .Values.global.logLevel }}
|
||||||
|
- --v={{ .Values.global.logLevel }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.config }}
|
||||||
|
- --config=/var/cert-manager/config/config.yaml
|
||||||
|
{{- end }}
|
||||||
|
{{- $config := default .Values.config "" }}
|
||||||
|
{{- if .Values.clusterResourceNamespace }}
|
||||||
|
- --cluster-resource-namespace={{ .Values.clusterResourceNamespace }}
|
||||||
|
{{- else }}
|
||||||
|
- --cluster-resource-namespace=$(POD_NAMESPACE)
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.global.leaderElection }}
|
||||||
|
- --leader-election-namespace={{ .namespace }}
|
||||||
|
{{- if .leaseDuration }}
|
||||||
|
- --leader-election-lease-duration={{ .leaseDuration }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .renewDeadline }}
|
||||||
|
- --leader-election-renew-deadline={{ .renewDeadline }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .retryPeriod }}
|
||||||
|
- --leader-election-retry-period={{ .retryPeriod }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.acmesolver.image }}
|
||||||
|
- --acme-http01-solver-image={{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.extraArgs }}
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.ingressShim }}
|
||||||
|
{{- if .defaultIssuerName }}
|
||||||
|
- --default-issuer-name={{ .defaultIssuerName }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .defaultIssuerKind }}
|
||||||
|
- --default-issuer-kind={{ .defaultIssuerKind }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .defaultIssuerGroup }}
|
||||||
|
- --default-issuer-group={{ .defaultIssuerGroup }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.featureGates }}
|
||||||
|
- --feature-gates={{ .Values.featureGates }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.maxConcurrentChallenges }}
|
||||||
|
- --max-concurrent-challenges={{ .Values.maxConcurrentChallenges }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.enableCertificateOwnerRef }}
|
||||||
|
- --enable-certificate-owner-ref=true
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.dns01RecursiveNameserversOnly }}
|
||||||
|
- --dns01-recursive-nameservers-only=true
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.dns01RecursiveNameservers }}
|
||||||
|
- --dns01-recursive-nameservers={{ . }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- containerPort: 9402
|
||||||
|
name: http-metrics
|
||||||
|
protocol: TCP
|
||||||
|
- containerPort: 9403
|
||||||
|
name: http-healthz
|
||||||
|
protocol: TCP
|
||||||
|
{{- with .Values.containerSecurityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.config .Values.volumeMounts }}
|
||||||
|
volumeMounts:
|
||||||
|
{{- if .Values.config}}
|
||||||
|
- name: config
|
||||||
|
mountPath: /var/cert-manager/config
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.volumeMounts }}
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
{{- with .Values.extraEnv }}
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.http_proxy }}
|
||||||
|
- name: HTTP_PROXY
|
||||||
|
value: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.https_proxy }}
|
||||||
|
- name: HTTPS_PROXY
|
||||||
|
value: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.no_proxy }}
|
||||||
|
- name: NO_PROXY
|
||||||
|
value: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.resources }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{- with .Values.livenessProbe }}
|
||||||
|
{{- if .enabled }}
|
||||||
|
# LivenessProbe settings are based on those used for the Kubernetes
|
||||||
|
# controller-manager. See:
|
||||||
|
# https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
port: http-healthz
|
||||||
|
path: /livez
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: {{ .initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .timeoutSeconds }}
|
||||||
|
successThreshold: {{ .successThreshold }}
|
||||||
|
failureThreshold: {{ .failureThreshold }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.topologySpreadConstraints }}
|
||||||
|
topologySpreadConstraints:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.podDnsPolicy }}
|
||||||
|
dnsPolicy: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.podDnsConfig }}
|
||||||
|
dnsConfig:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
23
cert-manager-1.13.3/templates/networkpolicy-egress.yaml
Normal file
23
cert-manager-1.13.3/templates/networkpolicy-egress.yaml
Normal file
@ -0,0 +1,23 @@
|
|||||||
|
{{- if .Values.webhook.networkPolicy.enabled }}
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: {{ template "webhook.fullname" . }}-allow-egress
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
spec:
|
||||||
|
egress:
|
||||||
|
{{- with .Values.webhook.networkPolicy.egress }}
|
||||||
|
{{- toYaml . | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- with .Values.webhook.podLabels }}
|
||||||
|
{{- toYaml . | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
policyTypes:
|
||||||
|
- Egress
|
||||||
|
{{- end }}
|
||||||
25
cert-manager-1.13.3/templates/networkpolicy-webhooks.yaml
Normal file
25
cert-manager-1.13.3/templates/networkpolicy-webhooks.yaml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
{{- if .Values.webhook.networkPolicy.enabled }}
|
||||||
|
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: NetworkPolicy
|
||||||
|
metadata:
|
||||||
|
name: {{ template "webhook.fullname" . }}-allow-ingress
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
spec:
|
||||||
|
ingress:
|
||||||
|
{{- with .Values.webhook.networkPolicy.ingress }}
|
||||||
|
{{- toYaml . | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- with .Values.webhook.podLabels }}
|
||||||
|
{{- toYaml . | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
29
cert-manager-1.13.3/templates/poddisruptionbudget.yaml
Normal file
29
cert-manager-1.13.3/templates/poddisruptionbudget.yaml
Normal file
@ -0,0 +1,29 @@
|
|||||||
|
{{- if .Values.podDisruptionBudget.enabled }}
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: {{ include "cert-manager.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
|
||||||
|
{{- if not (or (hasKey .Values.podDisruptionBudget "minAvailable") (hasKey .Values.podDisruptionBudget "maxUnavailable")) }}
|
||||||
|
minAvailable: 1 # Default value because minAvailable and maxUnavailable are not set
|
||||||
|
{{- end }}
|
||||||
|
{{- if hasKey .Values.podDisruptionBudget "minAvailable" }}
|
||||||
|
minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if hasKey .Values.podDisruptionBudget "maxUnavailable" }}
|
||||||
|
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
18
cert-manager-1.13.3/templates/psp-clusterrole.yaml
Normal file
18
cert-manager-1.13.3/templates/psp-clusterrole.yaml
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
kind: ClusterRole
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-psp
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ['policy']
|
||||||
|
resources: ['podsecuritypolicies']
|
||||||
|
verbs: ['use']
|
||||||
|
resourceNames:
|
||||||
|
- {{ template "cert-manager.fullname" . }}
|
||||||
|
{{- end }}
|
||||||
20
cert-manager-1.13.3/templates/psp-clusterrolebinding.yaml
Normal file
20
cert-manager-1.13.3/templates/psp-clusterrolebinding.yaml
Normal file
@ -0,0 +1,20 @@
|
|||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-psp
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-psp
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
49
cert-manager-1.13.3/templates/psp.yaml
Normal file
49
cert-manager-1.13.3/templates/psp.yaml
Normal file
@ -0,0 +1,49 @@
|
|||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
apiVersion: policy/v1beta1
|
||||||
|
kind: PodSecurityPolicy
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
|
||||||
|
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||||
|
{{- if .Values.global.podSecurityPolicy.useAppArmor }}
|
||||||
|
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||||
|
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
privileged: false
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
allowedCapabilities: [] # default set of capabilities are implicitly allowed
|
||||||
|
volumes:
|
||||||
|
- 'configMap'
|
||||||
|
- 'emptyDir'
|
||||||
|
- 'projected'
|
||||||
|
- 'secret'
|
||||||
|
- 'downwardAPI'
|
||||||
|
hostNetwork: false
|
||||||
|
hostIPC: false
|
||||||
|
hostPID: false
|
||||||
|
runAsUser:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
seLinux:
|
||||||
|
rule: 'RunAsAny'
|
||||||
|
supplementalGroups:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
fsGroup:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
{{- end }}
|
||||||
565
cert-manager-1.13.3/templates/rbac.yaml
Normal file
565
cert-manager-1.13.3/templates/rbac.yaml
Normal file
@ -0,0 +1,565 @@
|
|||||||
|
{{- if .Values.global.rbac.create }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}:leaderelection
|
||||||
|
namespace: {{ .Values.global.leaderElection.namespace }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["coordination.k8s.io"]
|
||||||
|
resources: ["leases"]
|
||||||
|
resourceNames: ["cert-manager-controller"]
|
||||||
|
verbs: ["get", "update", "patch"]
|
||||||
|
- apiGroups: ["coordination.k8s.io"]
|
||||||
|
resources: ["leases"]
|
||||||
|
verbs: ["create"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# grant cert-manager permission to manage the leaderelection configmap in the
|
||||||
|
# leader election namespace
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "cert-manager.fullname" . }}:leaderelection
|
||||||
|
namespace: {{ .Values.global.leaderElection.namespace }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: {{ template "cert-manager.fullname" . }}:leaderelection
|
||||||
|
subjects:
|
||||||
|
- apiGroup: ""
|
||||||
|
kind: ServiceAccount
|
||||||
|
name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Issuer controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-issuers
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["issuers", "issuers/status"]
|
||||||
|
verbs: ["update", "patch"]
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["issuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
---
|
||||||
|
|
||||||
|
# ClusterIssuer controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-clusterissuers
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["clusterissuers", "clusterissuers/status"]
|
||||||
|
verbs: ["update", "patch"]
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["clusterissuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Certificates controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-certificates
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"]
|
||||||
|
verbs: ["update", "patch"]
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificaterequests", "clusterissuers", "issuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||||
|
# admission controller enabled:
|
||||||
|
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates/finalizers", "certificaterequests/finalizers"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["orders"]
|
||||||
|
verbs: ["create", "delete", "get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Orders controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-orders
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["orders", "orders/status"]
|
||||||
|
verbs: ["update", "patch"]
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["orders", "challenges"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["clusterissuers", "issuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["challenges"]
|
||||||
|
verbs: ["create", "delete"]
|
||||||
|
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||||
|
# admission controller enabled:
|
||||||
|
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["orders/finalizers"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Challenges controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-challenges
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
# Use to update challenge resource status
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["challenges", "challenges/status"]
|
||||||
|
verbs: ["update", "patch"]
|
||||||
|
# Used to watch challenge resources
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["challenges"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Used to watch challenges, issuer and clusterissuer resources
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["issuers", "clusterissuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Need to be able to retrieve ACME account private key to complete challenges
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Used to create events
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
# HTTP01 rules
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["pods", "services"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "delete"]
|
||||||
|
- apiGroups: ["networking.k8s.io"]
|
||||||
|
resources: ["ingresses"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "delete", "update"]
|
||||||
|
- apiGroups: [ "gateway.networking.k8s.io" ]
|
||||||
|
resources: [ "httproutes" ]
|
||||||
|
verbs: ["get", "list", "watch", "create", "delete", "update"]
|
||||||
|
# We require the ability to specify a custom hostname when we are creating
|
||||||
|
# new ingress resources.
|
||||||
|
# See: https://github.com/openshift/origin/blob/21f191775636f9acadb44fa42beeb4f75b255532/pkg/route/apiserver/admission/ingress_admission.go#L84-L148
|
||||||
|
- apiGroups: ["route.openshift.io"]
|
||||||
|
resources: ["routes/custom-host"]
|
||||||
|
verbs: ["create"]
|
||||||
|
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||||
|
# admission controller enabled:
|
||||||
|
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["challenges/finalizers"]
|
||||||
|
verbs: ["update"]
|
||||||
|
# DNS01 rules (duplicated above)
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# ingress-shim controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-ingress-shim
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificaterequests"]
|
||||||
|
verbs: ["create", "update", "delete"]
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["networking.k8s.io"]
|
||||||
|
resources: ["ingresses"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||||
|
# admission controller enabled:
|
||||||
|
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||||
|
- apiGroups: ["networking.k8s.io"]
|
||||||
|
resources: ["ingresses/finalizers"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: ["gateway.networking.k8s.io"]
|
||||||
|
resources: ["gateways", "httproutes"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["gateway.networking.k8s.io"]
|
||||||
|
resources: ["gateways/finalizers", "httproutes/finalizers"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-issuers
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-issuers
|
||||||
|
subjects:
|
||||||
|
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-clusterissuers
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-clusterissuers
|
||||||
|
subjects:
|
||||||
|
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-certificates
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-certificates
|
||||||
|
subjects:
|
||||||
|
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-orders
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-orders
|
||||||
|
subjects:
|
||||||
|
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-challenges
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-challenges
|
||||||
|
subjects:
|
||||||
|
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-ingress-shim
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-ingress-shim
|
||||||
|
subjects:
|
||||||
|
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
||||||
|
{{- if .Values.global.rbac.aggregateClusterRoles }}
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-cluster-view
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["clusterissuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
|
||||||
|
{{- end }}
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-view
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- if .Values.global.rbac.aggregateClusterRoles }}
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
|
||||||
|
{{- end }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificaterequests", "issuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["challenges", "orders"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-edit
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- if .Values.global.rbac.aggregateClusterRoles }}
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||||
|
{{- end }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificaterequests", "issuers"]
|
||||||
|
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates/status"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["challenges", "orders"]
|
||||||
|
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-approve:cert-manager-io
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cert-manager"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["signers"]
|
||||||
|
verbs: ["approve"]
|
||||||
|
resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-approve:cert-manager-io
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cert-manager"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-approve:cert-manager-io
|
||||||
|
subjects:
|
||||||
|
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Permission to:
|
||||||
|
# - Update and sign CertificatSigningeRequests referencing cert-manager.io Issuers and ClusterIssuers
|
||||||
|
# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-certificatesigningrequests
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cert-manager"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["certificates.k8s.io"]
|
||||||
|
resources: ["certificatesigningrequests"]
|
||||||
|
verbs: ["get", "list", "watch", "update"]
|
||||||
|
- apiGroups: ["certificates.k8s.io"]
|
||||||
|
resources: ["certificatesigningrequests/status"]
|
||||||
|
verbs: ["update", "patch"]
|
||||||
|
- apiGroups: ["certificates.k8s.io"]
|
||||||
|
resources: ["signers"]
|
||||||
|
resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
|
||||||
|
verbs: ["sign"]
|
||||||
|
- apiGroups: ["authorization.k8s.io"]
|
||||||
|
resources: ["subjectaccessreviews"]
|
||||||
|
verbs: ["create"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-certificatesigningrequests
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cert-manager"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "cert-manager.fullname" . }}-controller-certificatesigningrequests
|
||||||
|
subjects:
|
||||||
|
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
kind: ServiceAccount
|
||||||
|
{{- end }}
|
||||||
31
cert-manager-1.13.3/templates/service.yaml
Normal file
31
cert-manager-1.13.3/templates/service.yaml
Normal file
@ -0,0 +1,31 @@
|
|||||||
|
{{- if .Values.prometheus.enabled }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- with .Values.serviceAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{ toYaml . | indent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.serviceLabels }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 9402
|
||||||
|
name: tcp-prometheus-servicemonitor
|
||||||
|
targetPort: {{ .Values.prometheus.servicemonitor.targetPort }}
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- end }}
|
||||||
25
cert-manager-1.13.3/templates/serviceaccount.yaml
Normal file
25
cert-manager-1.13.3/templates/serviceaccount.yaml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
{{- with .Values.global.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
|
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- with .Values.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.serviceAccount.labels }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
48
cert-manager-1.13.3/templates/servicemonitor.yaml
Normal file
48
cert-manager-1.13.3/templates/servicemonitor.yaml
Normal file
@ -0,0 +1,48 @@
|
|||||||
|
{{- if and .Values.prometheus.enabled .Values.prometheus.servicemonitor.enabled }}
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: ServiceMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}
|
||||||
|
{{- if .Values.prometheus.servicemonitor.namespace }}
|
||||||
|
namespace: {{ .Values.prometheus.servicemonitor.namespace }}
|
||||||
|
{{- else }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
prometheus: {{ .Values.prometheus.servicemonitor.prometheusInstance }}
|
||||||
|
{{- with .Values.prometheus.servicemonitor.labels }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.servicemonitor.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- with .Values.prometheus.servicemonitor.annotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
jobLabel: {{ template "cert-manager.fullname" . }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- if .Values.prometheus.servicemonitor.namespace }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
endpoints:
|
||||||
|
- targetPort: {{ .Values.prometheus.servicemonitor.targetPort }}
|
||||||
|
path: {{ .Values.prometheus.servicemonitor.path }}
|
||||||
|
interval: {{ .Values.prometheus.servicemonitor.interval }}
|
||||||
|
scrapeTimeout: {{ .Values.prometheus.servicemonitor.scrapeTimeout }}
|
||||||
|
honorLabels: {{ .Values.prometheus.servicemonitor.honorLabels }}
|
||||||
|
{{- with .Values.prometheus.servicemonitor.endpointAdditionalProperties }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
89
cert-manager-1.13.3/templates/startupapicheck-job.yaml
Normal file
89
cert-manager-1.13.3/templates/startupapicheck-job.yaml
Normal file
@ -0,0 +1,89 @@
|
|||||||
|
{{- if .Values.startupapicheck.enabled }}
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
name: {{ include "startupapicheck.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "startupapicheck"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.startupapicheck.jobAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
backoffLimit: {{ .Values.startupapicheck.backoffLimit }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "startupapicheck"
|
||||||
|
{{- include "labels" . | nindent 8 }}
|
||||||
|
{{- with .Values.startupapicheck.podLabels }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.startupapicheck.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
serviceAccountName: {{ template "startupapicheck.serviceAccountName" . }}
|
||||||
|
{{- if hasKey .Values.startupapicheck "automountServiceAccountToken" }}
|
||||||
|
automountServiceAccountToken: {{ .Values.startupapicheck.automountServiceAccountToken }}
|
||||||
|
{{- end }}
|
||||||
|
enableServiceLinks: {{ .Values.startupapicheck.enableServiceLinks }}
|
||||||
|
{{- with .Values.global.priorityClassName }}
|
||||||
|
priorityClassName: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.startupapicheck.securityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: {{ .Chart.Name }}-startupapicheck
|
||||||
|
{{- with .Values.startupapicheck.image }}
|
||||||
|
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
||||||
|
{{- end }}
|
||||||
|
imagePullPolicy: {{ .Values.startupapicheck.image.pullPolicy }}
|
||||||
|
args:
|
||||||
|
- check
|
||||||
|
- api
|
||||||
|
- --wait={{ .Values.startupapicheck.timeout }}
|
||||||
|
{{- with .Values.startupapicheck.extraArgs }}
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.startupapicheck.containerSecurityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.startupapicheck.resources }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.startupapicheck.volumeMounts }}
|
||||||
|
volumeMounts:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.startupapicheck.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.startupapicheck.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.startupapicheck.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.startupapicheck.volumes }}
|
||||||
|
volumes:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,24 @@
|
|||||||
|
{{- if .Values.startupapicheck.enabled }}
|
||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
kind: ClusterRole
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ template "startupapicheck.fullname" . }}-psp
|
||||||
|
labels:
|
||||||
|
app: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "startupapicheck"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.startupapicheck.rbac.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ['policy']
|
||||||
|
resources: ['podsecuritypolicies']
|
||||||
|
verbs: ['use']
|
||||||
|
resourceNames:
|
||||||
|
- {{ template "startupapicheck.fullname" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,26 @@
|
|||||||
|
{{- if .Values.startupapicheck.enabled }}
|
||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "startupapicheck.fullname" . }}-psp
|
||||||
|
labels:
|
||||||
|
app: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "startupapicheck"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.startupapicheck.rbac.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "startupapicheck.fullname" . }}-psp
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ template "startupapicheck.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
51
cert-manager-1.13.3/templates/startupapicheck-psp.yaml
Normal file
51
cert-manager-1.13.3/templates/startupapicheck-psp.yaml
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
{{- if .Values.startupapicheck.enabled }}
|
||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
apiVersion: policy/v1beta1
|
||||||
|
kind: PodSecurityPolicy
|
||||||
|
metadata:
|
||||||
|
name: {{ template "startupapicheck.fullname" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "startupapicheck"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
|
||||||
|
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||||
|
{{- if .Values.global.podSecurityPolicy.useAppArmor }}
|
||||||
|
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||||
|
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.startupapicheck.rbac.annotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
privileged: false
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
allowedCapabilities: [] # default set of capabilities are implicitly allowed
|
||||||
|
volumes:
|
||||||
|
- 'projected'
|
||||||
|
- 'secret'
|
||||||
|
hostNetwork: false
|
||||||
|
hostIPC: false
|
||||||
|
hostPID: false
|
||||||
|
runAsUser:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
seLinux:
|
||||||
|
rule: 'RunAsAny'
|
||||||
|
supplementalGroups:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
fsGroup:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
48
cert-manager-1.13.3/templates/startupapicheck-rbac.yaml
Normal file
48
cert-manager-1.13.3/templates/startupapicheck-rbac.yaml
Normal file
@ -0,0 +1,48 @@
|
|||||||
|
{{- if .Values.startupapicheck.enabled }}
|
||||||
|
{{- if .Values.global.rbac.create }}
|
||||||
|
# create certificate role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ template "startupapicheck.fullname" . }}:create-cert
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "startupapicheck"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.startupapicheck.rbac.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates"]
|
||||||
|
verbs: ["create"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "startupapicheck.fullname" . }}:create-cert
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "startupapicheck"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.startupapicheck.rbac.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: {{ template "startupapicheck.fullname" . }}:create-cert
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ template "startupapicheck.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,27 @@
|
|||||||
|
{{- if .Values.startupapicheck.enabled }}
|
||||||
|
{{- if .Values.startupapicheck.serviceAccount.create }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
automountServiceAccountToken: {{ .Values.startupapicheck.serviceAccount.automountServiceAccountToken }}
|
||||||
|
metadata:
|
||||||
|
name: {{ template "startupapicheck.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- with .Values.startupapicheck.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "startupapicheck"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.startupapicheck.serviceAccount.labels }}
|
||||||
|
{{ toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.global.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
25
cert-manager-1.13.3/templates/webhook-config.yaml
Normal file
25
cert-manager-1.13.3/templates/webhook-config.yaml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
{{- if .Values.webhook.config -}}
|
||||||
|
{{- if not .Values.webhook.config.apiVersion -}}
|
||||||
|
{{- fail "webhook.config.apiVersion must be set" -}}
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
|
{{- if not .Values.webhook.config.kind -}}
|
||||||
|
{{- fail "webhook.config.kind must be set" -}}
|
||||||
|
{{- end -}}
|
||||||
|
{{- end -}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "webhook.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
data:
|
||||||
|
{{- if .Values.webhook.config }}
|
||||||
|
config.yaml: |
|
||||||
|
{{ .Values.webhook.config | toYaml | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
189
cert-manager-1.13.3/templates/webhook-deployment.yaml
Normal file
189
cert-manager-1.13.3/templates/webhook-deployment.yaml
Normal file
@ -0,0 +1,189 @@
|
|||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: {{ include "webhook.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.webhook.deploymentAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
replicas: {{ .Values.webhook.replicaCount }}
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- with .Values.webhook.strategy }}
|
||||||
|
strategy:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 8 }}
|
||||||
|
{{- with .Values.webhook.podLabels }}
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.webhook.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
serviceAccountName: {{ template "webhook.serviceAccountName" . }}
|
||||||
|
{{- if hasKey .Values.webhook "automountServiceAccountToken" }}
|
||||||
|
automountServiceAccountToken: {{ .Values.webhook.automountServiceAccountToken }}
|
||||||
|
{{- end }}
|
||||||
|
enableServiceLinks: {{ .Values.webhook.enableServiceLinks }}
|
||||||
|
{{- with .Values.global.priorityClassName }}
|
||||||
|
priorityClassName: {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.webhook.securityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.webhook.hostNetwork }}
|
||||||
|
hostNetwork: true
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.webhook.hostNetwork }}
|
||||||
|
dnsPolicy: ClusterFirstWithHostNet
|
||||||
|
{{- end }}
|
||||||
|
containers:
|
||||||
|
- name: {{ .Chart.Name }}-webhook
|
||||||
|
{{- with .Values.webhook.image }}
|
||||||
|
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
||||||
|
{{- end }}
|
||||||
|
imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
|
||||||
|
args:
|
||||||
|
{{- if .Values.global.logLevel }}
|
||||||
|
- --v={{ .Values.global.logLevel }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.webhook.config }}
|
||||||
|
- --config=/var/cert-manager/config/config.yaml
|
||||||
|
{{- end }}
|
||||||
|
{{- $config := default .Values.webhook.config "" }}
|
||||||
|
{{ if not $config.securePort -}}
|
||||||
|
- --secure-port={{ .Values.webhook.securePort }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.webhook.featureGates }}
|
||||||
|
- --feature-gates={{ .Values.webhook.featureGates }}
|
||||||
|
{{- end }}
|
||||||
|
{{- $tlsConfig := default $config.tlsConfig "" }}
|
||||||
|
{{ if or (not $config.tlsConfig) (and (not $tlsConfig.dynamic) (not $tlsConfig.filesystem) ) -}}
|
||||||
|
- --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
|
||||||
|
- --dynamic-serving-ca-secret-name={{ template "webhook.fullname" . }}-ca
|
||||||
|
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}
|
||||||
|
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}.$(POD_NAMESPACE)
|
||||||
|
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}.$(POD_NAMESPACE).svc
|
||||||
|
{{ if .Values.webhook.url.host }}
|
||||||
|
- --dynamic-serving-dns-names={{ .Values.webhook.url.host }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.webhook.extraArgs }}
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
protocol: TCP
|
||||||
|
{{- if $config.securePort }}
|
||||||
|
containerPort: {{ $config.securePort }}
|
||||||
|
{{- else if .Values.webhook.securePort }}
|
||||||
|
containerPort: {{ .Values.webhook.securePort }}
|
||||||
|
{{- else }}
|
||||||
|
containerPort: 6443
|
||||||
|
{{- end }}
|
||||||
|
- name: healthcheck
|
||||||
|
protocol: TCP
|
||||||
|
{{- if $config.healthzPort }}
|
||||||
|
containerPort: {{ $config.healthzPort }}
|
||||||
|
{{- else }}
|
||||||
|
containerPort: 6080
|
||||||
|
{{- end }}
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /livez
|
||||||
|
{{- if $config.healthzPort }}
|
||||||
|
port: {{ $config.healthzPort }}
|
||||||
|
{{- else }}
|
||||||
|
port: 6080
|
||||||
|
{{- end }}
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: {{ .Values.webhook.livenessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.webhook.livenessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.webhook.livenessProbe.timeoutSeconds }}
|
||||||
|
successThreshold: {{ .Values.webhook.livenessProbe.successThreshold }}
|
||||||
|
failureThreshold: {{ .Values.webhook.livenessProbe.failureThreshold }}
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
{{- if $config.healthzPort }}
|
||||||
|
port: {{ $config.healthzPort }}
|
||||||
|
{{- else }}
|
||||||
|
port: 6080
|
||||||
|
{{- end }}
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: {{ .Values.webhook.readinessProbe.initialDelaySeconds }}
|
||||||
|
periodSeconds: {{ .Values.webhook.readinessProbe.periodSeconds }}
|
||||||
|
timeoutSeconds: {{ .Values.webhook.readinessProbe.timeoutSeconds }}
|
||||||
|
successThreshold: {{ .Values.webhook.readinessProbe.successThreshold }}
|
||||||
|
failureThreshold: {{ .Values.webhook.readinessProbe.failureThreshold }}
|
||||||
|
{{- with .Values.webhook.containerSecurityContext }}
|
||||||
|
securityContext:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
{{- with .Values.webhook.resources }}
|
||||||
|
resources:
|
||||||
|
{{- toYaml . | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.webhook.config .Values.webhook.volumeMounts }}
|
||||||
|
volumeMounts:
|
||||||
|
{{- if .Values.webhook.config }}
|
||||||
|
- name: config
|
||||||
|
mountPath: /var/cert-manager/config
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.webhook.volumeMounts }}
|
||||||
|
{{- toYaml .Values.webhook.volumeMounts | nindent 12 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.webhook.nodeSelector }}
|
||||||
|
nodeSelector:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.webhook.affinity }}
|
||||||
|
affinity:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.webhook.tolerations }}
|
||||||
|
tolerations:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.webhook.topologySpreadConstraints }}
|
||||||
|
topologySpreadConstraints:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if or .Values.webhook.config .Values.webhook.volumes }}
|
||||||
|
volumes:
|
||||||
|
{{- if .Values.webhook.config }}
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "webhook.fullname" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.webhook.volumes }}
|
||||||
|
{{- toYaml .Values.webhook.volumes | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
46
cert-manager-1.13.3/templates/webhook-mutating-webhook.yaml
Normal file
46
cert-manager-1.13.3/templates/webhook-mutating-webhook.yaml
Normal file
@ -0,0 +1,46 @@
|
|||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: MutatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
name: {{ include "webhook.fullname" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from-secret: {{ printf "%s/%s-ca" (include "cert-manager.namespace" .) (include "webhook.fullname" .) | quote }}
|
||||||
|
{{- with .Values.webhook.mutatingWebhookConfigurationAnnotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
webhooks:
|
||||||
|
- name: webhook.cert-manager.io
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- "cert-manager.io"
|
||||||
|
- "acme.cert-manager.io"
|
||||||
|
apiVersions:
|
||||||
|
- "v1"
|
||||||
|
operations:
|
||||||
|
- CREATE
|
||||||
|
- UPDATE
|
||||||
|
resources:
|
||||||
|
- "*/*"
|
||||||
|
admissionReviewVersions: ["v1"]
|
||||||
|
# This webhook only accepts v1 cert-manager resources.
|
||||||
|
# Equivalent matchPolicy ensures that non-v1 resource requests are sent to
|
||||||
|
# this webhook (after the resources have been converted to v1).
|
||||||
|
matchPolicy: Equivalent
|
||||||
|
timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
|
||||||
|
failurePolicy: Fail
|
||||||
|
# Only include 'sideEffects' field in Kubernetes 1.12+
|
||||||
|
sideEffects: None
|
||||||
|
clientConfig:
|
||||||
|
{{- if .Values.webhook.url.host }}
|
||||||
|
url: https://{{ .Values.webhook.url.host }}/mutate
|
||||||
|
{{- else }}
|
||||||
|
service:
|
||||||
|
name: {{ template "webhook.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
path: /mutate
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,29 @@
|
|||||||
|
{{- if .Values.webhook.podDisruptionBudget.enabled }}
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: {{ include "webhook.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
spec:
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
|
||||||
|
{{- if not (or (hasKey .Values.webhook.podDisruptionBudget "minAvailable") (hasKey .Values.webhook.podDisruptionBudget "maxUnavailable")) }}
|
||||||
|
minAvailable: 1 # Default value because minAvailable and maxUnavailable are not set
|
||||||
|
{{- end }}
|
||||||
|
{{- if hasKey .Values.webhook.podDisruptionBudget "minAvailable" }}
|
||||||
|
minAvailable: {{ .Values.webhook.podDisruptionBudget.minAvailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if hasKey .Values.webhook.podDisruptionBudget "maxUnavailable" }}
|
||||||
|
maxUnavailable: {{ .Values.webhook.podDisruptionBudget.maxUnavailable }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
18
cert-manager-1.13.3/templates/webhook-psp-clusterrole.yaml
Normal file
18
cert-manager-1.13.3/templates/webhook-psp-clusterrole.yaml
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
kind: ClusterRole
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: {{ template "webhook.fullname" . }}-psp
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ['policy']
|
||||||
|
resources: ['podsecuritypolicies']
|
||||||
|
verbs: ['use']
|
||||||
|
resourceNames:
|
||||||
|
- {{ template "webhook.fullname" . }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,20 @@
|
|||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "webhook.fullname" . }}-psp
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "webhook.fullname" . }}-psp
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ template "webhook.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
54
cert-manager-1.13.3/templates/webhook-psp.yaml
Normal file
54
cert-manager-1.13.3/templates/webhook-psp.yaml
Normal file
@ -0,0 +1,54 @@
|
|||||||
|
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||||
|
apiVersion: policy/v1beta1
|
||||||
|
kind: PodSecurityPolicy
|
||||||
|
metadata:
|
||||||
|
name: {{ template "webhook.fullname" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
|
||||||
|
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||||
|
{{- if .Values.global.podSecurityPolicy.useAppArmor }}
|
||||||
|
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||||
|
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
privileged: false
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
allowedCapabilities: [] # default set of capabilities are implicitly allowed
|
||||||
|
volumes:
|
||||||
|
- 'configMap'
|
||||||
|
- 'emptyDir'
|
||||||
|
- 'projected'
|
||||||
|
- 'secret'
|
||||||
|
- 'downwardAPI'
|
||||||
|
hostNetwork: {{ .Values.webhook.hostNetwork }}
|
||||||
|
{{- if .Values.webhook.hostNetwork }}
|
||||||
|
hostPorts:
|
||||||
|
- max: {{ .Values.webhook.securePort }}
|
||||||
|
min: {{ .Values.webhook.securePort }}
|
||||||
|
{{- end }}
|
||||||
|
hostIPC: false
|
||||||
|
hostPID: false
|
||||||
|
runAsUser:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
seLinux:
|
||||||
|
rule: 'RunAsAny'
|
||||||
|
supplementalGroups:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
fsGroup:
|
||||||
|
rule: 'MustRunAs'
|
||||||
|
ranges:
|
||||||
|
- min: 1000
|
||||||
|
max: 1000
|
||||||
|
{{- end }}
|
||||||
83
cert-manager-1.13.3/templates/webhook-rbac.yaml
Normal file
83
cert-manager-1.13.3/templates/webhook-rbac.yaml
Normal file
@ -0,0 +1,83 @@
|
|||||||
|
{{- if .Values.global.rbac.create }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ template "webhook.fullname" . }}:dynamic-serving
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
resourceNames:
|
||||||
|
- '{{ template "webhook.fullname" . }}-ca'
|
||||||
|
verbs: ["get", "list", "watch", "update"]
|
||||||
|
# It's not possible to grant CREATE permission on a single resourceName.
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["create"]
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "webhook.fullname" . }}:dynamic-serving
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: {{ template "webhook.fullname" . }}:dynamic-serving
|
||||||
|
subjects:
|
||||||
|
- apiGroup: ""
|
||||||
|
kind: ServiceAccount
|
||||||
|
name: {{ template "webhook.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: {{ template "webhook.fullname" . }}:subjectaccessreviews
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["authorization.k8s.io"]
|
||||||
|
resources: ["subjectaccessreviews"]
|
||||||
|
verbs: ["create"]
|
||||||
|
---
|
||||||
|
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ template "webhook.fullname" . }}:subjectaccessreviews
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: {{ template "webhook.fullname" . }}:subjectaccessreviews
|
||||||
|
subjects:
|
||||||
|
- apiGroup: ""
|
||||||
|
kind: ServiceAccount
|
||||||
|
name: {{ template "webhook.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
32
cert-manager-1.13.3/templates/webhook-service.yaml
Normal file
32
cert-manager-1.13.3/templates/webhook-service.yaml
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ template "webhook.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- with .Values.webhook.serviceAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{ toYaml . | indent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.webhook.serviceLabels }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: {{ .Values.webhook.serviceType }}
|
||||||
|
{{- with .Values.webhook.loadBalancerIP }}
|
||||||
|
loadBalancerIP: {{ . }}
|
||||||
|
{{- end }}
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: 443
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: "https"
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
25
cert-manager-1.13.3/templates/webhook-serviceaccount.yaml
Normal file
25
cert-manager-1.13.3/templates/webhook-serviceaccount.yaml
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
{{- if .Values.webhook.serviceAccount.create }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
automountServiceAccountToken: {{ .Values.webhook.serviceAccount.automountServiceAccountToken }}
|
||||||
|
metadata:
|
||||||
|
name: {{ template "webhook.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- with .Values.webhook.serviceAccount.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.webhook.serviceAccount.labels }}
|
||||||
|
{{ toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.global.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -0,0 +1,51 @@
|
|||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: ValidatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
name: {{ include "webhook.fullname" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from-secret: {{ printf "%s/%s-ca" (include "cert-manager.namespace" .) (include "webhook.fullname" .) | quote}}
|
||||||
|
{{- with .Values.webhook.validatingWebhookConfigurationAnnotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
webhooks:
|
||||||
|
- name: webhook.cert-manager.io
|
||||||
|
namespaceSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: "cert-manager.io/disable-validation"
|
||||||
|
operator: "NotIn"
|
||||||
|
values:
|
||||||
|
- "true"
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- "cert-manager.io"
|
||||||
|
- "acme.cert-manager.io"
|
||||||
|
apiVersions:
|
||||||
|
- "v1"
|
||||||
|
operations:
|
||||||
|
- CREATE
|
||||||
|
- UPDATE
|
||||||
|
resources:
|
||||||
|
- "*/*"
|
||||||
|
admissionReviewVersions: ["v1"]
|
||||||
|
# This webhook only accepts v1 cert-manager resources.
|
||||||
|
# Equivalent matchPolicy ensures that non-v1 resource requests are sent to
|
||||||
|
# this webhook (after the resources have been converted to v1).
|
||||||
|
matchPolicy: Equivalent
|
||||||
|
timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
|
||||||
|
failurePolicy: Fail
|
||||||
|
sideEffects: None
|
||||||
|
clientConfig:
|
||||||
|
{{- if .Values.webhook.url.host }}
|
||||||
|
url: https://{{ .Values.webhook.url.host }}/validate
|
||||||
|
{{- else }}
|
||||||
|
service:
|
||||||
|
name: {{ template "webhook.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
path: /validate
|
||||||
|
{{- end }}
|
||||||
43
cert-manager-1.13.3/values.home.yaml
Normal file
43
cert-manager-1.13.3/values.home.yaml
Normal file
@ -0,0 +1,43 @@
|
|||||||
|
# Default values for cert-manager.
|
||||||
|
# This is a YAML-formatted file.
|
||||||
|
# Declare variables to be passed into your templates.
|
||||||
|
|
||||||
|
installCRDs: true
|
||||||
|
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 10m
|
||||||
|
memory: 32Mi
|
||||||
|
|
||||||
|
prometheus:
|
||||||
|
enabled: true
|
||||||
|
servicemonitor:
|
||||||
|
enabled: true
|
||||||
|
prometheusInstance: default
|
||||||
|
targetPort: 9402
|
||||||
|
path: /metrics
|
||||||
|
interval: 60s
|
||||||
|
scrapeTimeout: 30s
|
||||||
|
labels: {}
|
||||||
|
annotations: {}
|
||||||
|
honorLabels: false
|
||||||
|
endpointAdditionalProperties: {}
|
||||||
|
|
||||||
|
# LivenessProbe settings for the controller container of the controller Pod.
|
||||||
|
#
|
||||||
|
# Disabled by default, because the controller has a leader election mechanism
|
||||||
|
# which should cause it to exit if it is unable to renew its leader election
|
||||||
|
# record.
|
||||||
|
# LivenessProbe durations and thresholds are based on those used for the Kubernetes
|
||||||
|
# controller-manager. See:
|
||||||
|
# https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245
|
||||||
|
livenessProbe:
|
||||||
|
enabled: true
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
timeoutSeconds: 15
|
||||||
|
successThreshold: 1
|
||||||
|
failureThreshold: 8
|
||||||
|
|
||||||
|
startupapicheck:
|
||||||
|
enabled: false
|
||||||
737
cert-manager-1.13.3/values.yaml
Normal file
737
cert-manager-1.13.3/values.yaml
Normal file
@ -0,0 +1,737 @@
|
|||||||
|
# Default values for cert-manager.
|
||||||
|
# This is a YAML-formatted file.
|
||||||
|
# Declare variables to be passed into your templates.
|
||||||
|
global:
|
||||||
|
# Reference to one or more secrets to be used when pulling images
|
||||||
|
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||||
|
imagePullSecrets: []
|
||||||
|
# - name: "image-pull-secret"
|
||||||
|
|
||||||
|
# Labels to apply to all resources
|
||||||
|
# Please note that this does not add labels to the resources created dynamically by the controllers.
|
||||||
|
# For these resources, you have to add the labels in the template in the cert-manager custom resource:
|
||||||
|
# eg. podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress
|
||||||
|
# ref: https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress
|
||||||
|
# eg. secretTemplate in CertificateSpec
|
||||||
|
# ref: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
|
||||||
|
commonLabels: {}
|
||||||
|
# team_name: dev
|
||||||
|
|
||||||
|
# Optional priority class to be used for the cert-manager pods
|
||||||
|
priorityClassName: ""
|
||||||
|
rbac:
|
||||||
|
create: true
|
||||||
|
# Aggregate ClusterRoles to Kubernetes default user-facing roles. Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
|
||||||
|
aggregateClusterRoles: true
|
||||||
|
|
||||||
|
podSecurityPolicy:
|
||||||
|
enabled: false
|
||||||
|
useAppArmor: true
|
||||||
|
|
||||||
|
# Set the verbosity of cert-manager. Range of 0 - 6 with 6 being the most verbose.
|
||||||
|
logLevel: 2
|
||||||
|
|
||||||
|
leaderElection:
|
||||||
|
# Override the namespace used for the leader election lease
|
||||||
|
namespace: "kube-system"
|
||||||
|
|
||||||
|
# The duration that non-leader candidates will wait after observing a
|
||||||
|
# leadership renewal until attempting to acquire leadership of a led but
|
||||||
|
# unrenewed leader slot. This is effectively the maximum duration that a
|
||||||
|
# leader can be stopped before it is replaced by another candidate.
|
||||||
|
# leaseDuration: 60s
|
||||||
|
|
||||||
|
# The interval between attempts by the acting master to renew a leadership
|
||||||
|
# slot before it stops leading. This must be less than or equal to the
|
||||||
|
# lease duration.
|
||||||
|
# renewDeadline: 40s
|
||||||
|
|
||||||
|
# The duration the clients should wait between attempting acquisition and
|
||||||
|
# renewal of a leadership.
|
||||||
|
# retryPeriod: 15s
|
||||||
|
|
||||||
|
installCRDs: false
|
||||||
|
|
||||||
|
replicaCount: 1
|
||||||
|
|
||||||
|
strategy: {}
|
||||||
|
# type: RollingUpdate
|
||||||
|
# rollingUpdate:
|
||||||
|
# maxSurge: 0
|
||||||
|
# maxUnavailable: 1
|
||||||
|
|
||||||
|
podDisruptionBudget:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
# minAvailable and maxUnavailable can either be set to an integer (e.g. 1)
|
||||||
|
# or a percentage value (e.g. 25%)
|
||||||
|
# if neither minAvailable or maxUnavailable is set, we default to `minAvailable: 1`
|
||||||
|
# minAvailable: 1
|
||||||
|
# maxUnavailable: 1
|
||||||
|
|
||||||
|
# Comma separated list of feature gates that should be enabled on the
|
||||||
|
# controller pod.
|
||||||
|
featureGates: ""
|
||||||
|
|
||||||
|
# The maximum number of challenges that can be scheduled as 'processing' at once
|
||||||
|
maxConcurrentChallenges: 60
|
||||||
|
|
||||||
|
image:
|
||||||
|
repository: quay.io/jetstack/cert-manager-controller
|
||||||
|
# You can manage a registry with
|
||||||
|
# registry: quay.io
|
||||||
|
# repository: jetstack/cert-manager-controller
|
||||||
|
|
||||||
|
# Override the image tag to deploy by setting this variable.
|
||||||
|
# If no value is set, the chart's appVersion will be used.
|
||||||
|
# tag: canary
|
||||||
|
|
||||||
|
# Setting a digest will override any tag
|
||||||
|
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
|
||||||
|
# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer
|
||||||
|
# resources. By default, the same namespace as cert-manager is deployed within is
|
||||||
|
# used. This namespace will not be automatically created by the Helm chart.
|
||||||
|
clusterResourceNamespace: ""
|
||||||
|
|
||||||
|
# This namespace allows you to define where the services will be installed into
|
||||||
|
# if not set then they will use the namespace of the release
|
||||||
|
# This is helpful when installing cert manager as a chart dependency (sub chart)
|
||||||
|
namespace: ""
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
# Specifies whether a service account should be created
|
||||||
|
create: true
|
||||||
|
# The name of the service account to use.
|
||||||
|
# If not set and create is true, a name is generated using the fullname template
|
||||||
|
# name: ""
|
||||||
|
# Optional additional annotations to add to the controller's ServiceAccount
|
||||||
|
# annotations: {}
|
||||||
|
# Automount API credentials for a Service Account.
|
||||||
|
# Optional additional labels to add to the controller's ServiceAccount
|
||||||
|
# labels: {}
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
|
||||||
|
# Automounting API credentials for a particular pod
|
||||||
|
# automountServiceAccountToken: true
|
||||||
|
|
||||||
|
# When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted
|
||||||
|
enableCertificateOwnerRef: false
|
||||||
|
|
||||||
|
# Used to configure options for the controller pod.
|
||||||
|
# This allows setting options that'd usually be provided via flags.
|
||||||
|
# An APIVersion and Kind must be specified in your values.yaml file.
|
||||||
|
# Flags will override options that are set here.
|
||||||
|
config:
|
||||||
|
# apiVersion: controller.config.cert-manager.io/v1alpha1
|
||||||
|
# kind: ControllerConfiguration
|
||||||
|
# logging:
|
||||||
|
# verbosity: 2
|
||||||
|
# format: text
|
||||||
|
# leaderElectionConfig:
|
||||||
|
# namespace: kube-system
|
||||||
|
# kubernetesAPIQPS: 9000
|
||||||
|
# kubernetesAPIBurst: 9000
|
||||||
|
# numberOfConcurrentWorkers: 200
|
||||||
|
# featureGates:
|
||||||
|
# additionalCertificateOutputFormats: true
|
||||||
|
# experimentalCertificateSigningRequestControllers: true
|
||||||
|
# experimentalGatewayAPISupport: true
|
||||||
|
# serverSideApply: true
|
||||||
|
# literalCertificateSubject: true
|
||||||
|
# useCertificateRequestBasicConstraints: true
|
||||||
|
|
||||||
|
# Setting Nameservers for DNS01 Self Check
|
||||||
|
# See: https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check
|
||||||
|
|
||||||
|
# Comma separated string with host and port of the recursive nameservers cert-manager should query
|
||||||
|
dns01RecursiveNameservers: ""
|
||||||
|
|
||||||
|
# Forces cert-manager to only use the recursive nameservers for verification.
|
||||||
|
# Enabling this option could cause the DNS01 self check to take longer due to caching performed by the recursive nameservers
|
||||||
|
dns01RecursiveNameserversOnly: false
|
||||||
|
|
||||||
|
# Additional command line flags to pass to cert-manager controller binary.
|
||||||
|
# To see all available flags run docker run quay.io/jetstack/cert-manager-controller:<version> --help
|
||||||
|
extraArgs: []
|
||||||
|
# Use this flag to enable or disable arbitrary controllers, for example, disable the CertificiateRequests approver
|
||||||
|
# - --controllers=*,-certificaterequests-approver
|
||||||
|
|
||||||
|
extraEnv: []
|
||||||
|
# - name: SOME_VAR
|
||||||
|
# value: 'some value'
|
||||||
|
|
||||||
|
resources: {}
|
||||||
|
# requests:
|
||||||
|
# cpu: 10m
|
||||||
|
# memory: 32Mi
|
||||||
|
|
||||||
|
# Pod Security Context
|
||||||
|
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
|
||||||
|
# Container Security Context to be set on the controller component container
|
||||||
|
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
# readOnlyRootFilesystem: true
|
||||||
|
# runAsNonRoot: true
|
||||||
|
|
||||||
|
|
||||||
|
volumes: []
|
||||||
|
|
||||||
|
volumeMounts: []
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the controller Deployment
|
||||||
|
# deploymentAnnotations: {}
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the controller Pods
|
||||||
|
# podAnnotations: {}
|
||||||
|
|
||||||
|
podLabels: {}
|
||||||
|
|
||||||
|
# Optional annotations to add to the controller Service
|
||||||
|
# serviceAnnotations: {}
|
||||||
|
|
||||||
|
# Optional additional labels to add to the controller Service
|
||||||
|
# serviceLabels: {}
|
||||||
|
|
||||||
|
# Optional DNS settings, useful if you have a public and private DNS zone for
|
||||||
|
# the same domain on Route 53. What follows is an example of ensuring
|
||||||
|
# cert-manager can access an ingress or DNS TXT records at all times.
|
||||||
|
# NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
|
||||||
|
# the cluster to work.
|
||||||
|
# podDnsPolicy: "None"
|
||||||
|
# podDnsConfig:
|
||||||
|
# nameservers:
|
||||||
|
# - "1.1.1.1"
|
||||||
|
# - "8.8.8.8"
|
||||||
|
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
|
||||||
|
ingressShim: {}
|
||||||
|
# defaultIssuerName: ""
|
||||||
|
# defaultIssuerKind: ""
|
||||||
|
# defaultIssuerGroup: ""
|
||||||
|
|
||||||
|
prometheus:
|
||||||
|
enabled: true
|
||||||
|
servicemonitor:
|
||||||
|
enabled: false
|
||||||
|
prometheusInstance: default
|
||||||
|
targetPort: 9402
|
||||||
|
path: /metrics
|
||||||
|
interval: 60s
|
||||||
|
scrapeTimeout: 30s
|
||||||
|
labels: {}
|
||||||
|
annotations: {}
|
||||||
|
honorLabels: false
|
||||||
|
endpointAdditionalProperties: {}
|
||||||
|
|
||||||
|
# Use these variables to configure the HTTP_PROXY environment variables
|
||||||
|
# http_proxy: "http://proxy:8080"
|
||||||
|
# https_proxy: "https://proxy:8080"
|
||||||
|
# no_proxy: 127.0.0.1,localhost
|
||||||
|
|
||||||
|
# A Kubernetes Affinty, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core
|
||||||
|
# for example:
|
||||||
|
# affinity:
|
||||||
|
# nodeAffinity:
|
||||||
|
# requiredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
# nodeSelectorTerms:
|
||||||
|
# - matchExpressions:
|
||||||
|
# - key: foo.bar.com/role
|
||||||
|
# operator: In
|
||||||
|
# values:
|
||||||
|
# - master
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
# A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core
|
||||||
|
# for example:
|
||||||
|
# tolerations:
|
||||||
|
# - key: foo.bar.com/role
|
||||||
|
# operator: Equal
|
||||||
|
# value: master
|
||||||
|
# effect: NoSchedule
|
||||||
|
tolerations: []
|
||||||
|
|
||||||
|
# A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
|
||||||
|
# for example:
|
||||||
|
# topologySpreadConstraints:
|
||||||
|
# - maxSkew: 2
|
||||||
|
# topologyKey: topology.kubernetes.io/zone
|
||||||
|
# whenUnsatisfiable: ScheduleAnyway
|
||||||
|
# labelSelector:
|
||||||
|
# matchLabels:
|
||||||
|
# app.kubernetes.io/instance: cert-manager
|
||||||
|
# app.kubernetes.io/component: controller
|
||||||
|
topologySpreadConstraints: []
|
||||||
|
|
||||||
|
# LivenessProbe settings for the controller container of the controller Pod.
|
||||||
|
#
|
||||||
|
# Disabled by default, because the controller has a leader election mechanism
|
||||||
|
# which should cause it to exit if it is unable to renew its leader election
|
||||||
|
# record.
|
||||||
|
# LivenessProbe durations and thresholds are based on those used for the Kubernetes
|
||||||
|
# controller-manager. See:
|
||||||
|
# https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245
|
||||||
|
livenessProbe:
|
||||||
|
enabled: false
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
timeoutSeconds: 15
|
||||||
|
successThreshold: 1
|
||||||
|
failureThreshold: 8
|
||||||
|
|
||||||
|
# enableServiceLinks indicates whether information about services should be
|
||||||
|
# injected into pod's environment variables, matching the syntax of Docker
|
||||||
|
# links.
|
||||||
|
enableServiceLinks: false
|
||||||
|
|
||||||
|
webhook:
|
||||||
|
replicaCount: 1
|
||||||
|
timeoutSeconds: 10
|
||||||
|
|
||||||
|
# Used to configure options for the webhook pod.
|
||||||
|
# This allows setting options that'd usually be provided via flags.
|
||||||
|
# An APIVersion and Kind must be specified in your values.yaml file.
|
||||||
|
# Flags will override options that are set here.
|
||||||
|
config:
|
||||||
|
# apiVersion: webhook.config.cert-manager.io/v1alpha1
|
||||||
|
# kind: WebhookConfiguration
|
||||||
|
|
||||||
|
# The port that the webhook should listen on for requests.
|
||||||
|
# In GKE private clusters, by default kubernetes apiservers are allowed to
|
||||||
|
# talk to the cluster nodes only on 443 and 10250. so configuring
|
||||||
|
# securePort: 10250, will work out of the box without needing to add firewall
|
||||||
|
# rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000.
|
||||||
|
# This should be uncommented and set as a default by the chart once we graduate
|
||||||
|
# the apiVersion of WebhookConfiguration past v1alpha1.
|
||||||
|
# securePort: 10250
|
||||||
|
|
||||||
|
strategy: {}
|
||||||
|
# type: RollingUpdate
|
||||||
|
# rollingUpdate:
|
||||||
|
# maxSurge: 0
|
||||||
|
# maxUnavailable: 1
|
||||||
|
|
||||||
|
# Pod Security Context to be set on the webhook component Pod
|
||||||
|
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
|
||||||
|
podDisruptionBudget:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
# minAvailable and maxUnavailable can either be set to an integer (e.g. 1)
|
||||||
|
# or a percentage value (e.g. 25%)
|
||||||
|
# if neither minAvailable or maxUnavailable is set, we default to `minAvailable: 1`
|
||||||
|
# minAvailable: 1
|
||||||
|
# maxUnavailable: 1
|
||||||
|
|
||||||
|
# Container Security Context to be set on the webhook component container
|
||||||
|
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
# readOnlyRootFilesystem: true
|
||||||
|
# runAsNonRoot: true
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the webhook Deployment
|
||||||
|
# deploymentAnnotations: {}
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the webhook Pods
|
||||||
|
# podAnnotations: {}
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the webhook Service
|
||||||
|
# serviceAnnotations: {}
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the webhook MutatingWebhookConfiguration
|
||||||
|
# mutatingWebhookConfigurationAnnotations: {}
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the webhook ValidatingWebhookConfiguration
|
||||||
|
# validatingWebhookConfigurationAnnotations: {}
|
||||||
|
|
||||||
|
# Additional command line flags to pass to cert-manager webhook binary.
|
||||||
|
# To see all available flags run docker run quay.io/jetstack/cert-manager-webhook:<version> --help
|
||||||
|
extraArgs: []
|
||||||
|
# Path to a file containing a WebhookConfiguration object used to configure the webhook
|
||||||
|
# - --config=<path-to-config-file>
|
||||||
|
|
||||||
|
# Comma separated list of feature gates that should be enabled on the
|
||||||
|
# webhook pod.
|
||||||
|
featureGates: ""
|
||||||
|
|
||||||
|
resources: {}
|
||||||
|
# requests:
|
||||||
|
# cpu: 10m
|
||||||
|
# memory: 32Mi
|
||||||
|
|
||||||
|
## Liveness and readiness probe values
|
||||||
|
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
|
||||||
|
##
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
initialDelaySeconds: 60
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
tolerations: []
|
||||||
|
|
||||||
|
topologySpreadConstraints: []
|
||||||
|
|
||||||
|
# Optional additional labels to add to the Webhook Pods
|
||||||
|
podLabels: {}
|
||||||
|
|
||||||
|
# Optional additional labels to add to the Webhook Service
|
||||||
|
serviceLabels: {}
|
||||||
|
|
||||||
|
image:
|
||||||
|
repository: quay.io/jetstack/cert-manager-webhook
|
||||||
|
# You can manage a registry with
|
||||||
|
# registry: quay.io
|
||||||
|
# repository: jetstack/cert-manager-webhook
|
||||||
|
|
||||||
|
# Override the image tag to deploy by setting this variable.
|
||||||
|
# If no value is set, the chart's appVersion will be used.
|
||||||
|
# tag: canary
|
||||||
|
|
||||||
|
# Setting a digest will override any tag
|
||||||
|
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
|
||||||
|
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
# Specifies whether a service account should be created
|
||||||
|
create: true
|
||||||
|
# The name of the service account to use.
|
||||||
|
# If not set and create is true, a name is generated using the fullname template
|
||||||
|
# name: ""
|
||||||
|
# Optional additional annotations to add to the controller's ServiceAccount
|
||||||
|
# annotations: {}
|
||||||
|
# Optional additional labels to add to the webhook's ServiceAccount
|
||||||
|
# labels: {}
|
||||||
|
# Automount API credentials for a Service Account.
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
|
||||||
|
# Automounting API credentials for a particular pod
|
||||||
|
# automountServiceAccountToken: true
|
||||||
|
|
||||||
|
# The port that the webhook should listen on for requests.
|
||||||
|
# In GKE private clusters, by default kubernetes apiservers are allowed to
|
||||||
|
# talk to the cluster nodes only on 443 and 10250. so configuring
|
||||||
|
# securePort: 10250, will work out of the box without needing to add firewall
|
||||||
|
# rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000
|
||||||
|
securePort: 10250
|
||||||
|
|
||||||
|
# Specifies if the webhook should be started in hostNetwork mode.
|
||||||
|
#
|
||||||
|
# Required for use in some managed kubernetes clusters (such as AWS EKS) with custom
|
||||||
|
# CNI (such as calico), because control-plane managed by AWS cannot communicate
|
||||||
|
# with pods' IP CIDR and admission webhooks are not working
|
||||||
|
#
|
||||||
|
# Since the default port for the webhook conflicts with kubelet on the host
|
||||||
|
# network, `webhook.securePort` should be changed to an available port if
|
||||||
|
# running in hostNetwork mode.
|
||||||
|
hostNetwork: false
|
||||||
|
|
||||||
|
# Specifies how the service should be handled. Useful if you want to expose the
|
||||||
|
# webhook to outside of the cluster. In some cases, the control plane cannot
|
||||||
|
# reach internal services.
|
||||||
|
serviceType: ClusterIP
|
||||||
|
# loadBalancerIP:
|
||||||
|
|
||||||
|
# Overrides the mutating webhook and validating webhook so they reach the webhook
|
||||||
|
# service using the `url` field instead of a service.
|
||||||
|
url: {}
|
||||||
|
# host:
|
||||||
|
|
||||||
|
# Enables default network policies for webhooks.
|
||||||
|
networkPolicy:
|
||||||
|
enabled: false
|
||||||
|
ingress:
|
||||||
|
- from:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 0.0.0.0/0
|
||||||
|
egress:
|
||||||
|
- ports:
|
||||||
|
- port: 80
|
||||||
|
protocol: TCP
|
||||||
|
- port: 443
|
||||||
|
protocol: TCP
|
||||||
|
- port: 53
|
||||||
|
protocol: TCP
|
||||||
|
- port: 53
|
||||||
|
protocol: UDP
|
||||||
|
# On OpenShift and OKD, the Kubernetes API server listens on
|
||||||
|
# port 6443.
|
||||||
|
- port: 6443
|
||||||
|
protocol: TCP
|
||||||
|
to:
|
||||||
|
- ipBlock:
|
||||||
|
cidr: 0.0.0.0/0
|
||||||
|
|
||||||
|
volumes: []
|
||||||
|
volumeMounts: []
|
||||||
|
|
||||||
|
# enableServiceLinks indicates whether information about services should be
|
||||||
|
# injected into pod's environment variables, matching the syntax of Docker
|
||||||
|
# links.
|
||||||
|
enableServiceLinks: false
|
||||||
|
|
||||||
|
cainjector:
|
||||||
|
enabled: true
|
||||||
|
replicaCount: 1
|
||||||
|
|
||||||
|
strategy: {}
|
||||||
|
# type: RollingUpdate
|
||||||
|
# rollingUpdate:
|
||||||
|
# maxSurge: 0
|
||||||
|
# maxUnavailable: 1
|
||||||
|
|
||||||
|
# Pod Security Context to be set on the cainjector component Pod
|
||||||
|
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
|
||||||
|
podDisruptionBudget:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
# minAvailable and maxUnavailable can either be set to an integer (e.g. 1)
|
||||||
|
# or a percentage value (e.g. 25%)
|
||||||
|
# if neither minAvailable or maxUnavailable is set, we default to `minAvailable: 1`
|
||||||
|
# minAvailable: 1
|
||||||
|
# maxUnavailable: 1
|
||||||
|
|
||||||
|
# Container Security Context to be set on the cainjector component container
|
||||||
|
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
# readOnlyRootFilesystem: true
|
||||||
|
# runAsNonRoot: true
|
||||||
|
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the cainjector Deployment
|
||||||
|
# deploymentAnnotations: {}
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the cainjector Pods
|
||||||
|
# podAnnotations: {}
|
||||||
|
|
||||||
|
# Additional command line flags to pass to cert-manager cainjector binary.
|
||||||
|
# To see all available flags run docker run quay.io/jetstack/cert-manager-cainjector:<version> --help
|
||||||
|
extraArgs: []
|
||||||
|
# Enable profiling for cainjector
|
||||||
|
# - --enable-profiling=true
|
||||||
|
|
||||||
|
resources: {}
|
||||||
|
# requests:
|
||||||
|
# cpu: 10m
|
||||||
|
# memory: 32Mi
|
||||||
|
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
tolerations: []
|
||||||
|
|
||||||
|
topologySpreadConstraints: []
|
||||||
|
|
||||||
|
# Optional additional labels to add to the CA Injector Pods
|
||||||
|
podLabels: {}
|
||||||
|
|
||||||
|
image:
|
||||||
|
repository: quay.io/jetstack/cert-manager-cainjector
|
||||||
|
# You can manage a registry with
|
||||||
|
# registry: quay.io
|
||||||
|
# repository: jetstack/cert-manager-cainjector
|
||||||
|
|
||||||
|
# Override the image tag to deploy by setting this variable.
|
||||||
|
# If no value is set, the chart's appVersion will be used.
|
||||||
|
# tag: canary
|
||||||
|
|
||||||
|
# Setting a digest will override any tag
|
||||||
|
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
|
||||||
|
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
# Specifies whether a service account should be created
|
||||||
|
create: true
|
||||||
|
# The name of the service account to use.
|
||||||
|
# If not set and create is true, a name is generated using the fullname template
|
||||||
|
# name: ""
|
||||||
|
# Optional additional annotations to add to the controller's ServiceAccount
|
||||||
|
# annotations: {}
|
||||||
|
# Automount API credentials for a Service Account.
|
||||||
|
# Optional additional labels to add to the cainjector's ServiceAccount
|
||||||
|
# labels: {}
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
|
||||||
|
# Automounting API credentials for a particular pod
|
||||||
|
# automountServiceAccountToken: true
|
||||||
|
|
||||||
|
volumes: []
|
||||||
|
volumeMounts: []
|
||||||
|
|
||||||
|
# enableServiceLinks indicates whether information about services should be
|
||||||
|
# injected into pod's environment variables, matching the syntax of Docker
|
||||||
|
# links.
|
||||||
|
enableServiceLinks: false
|
||||||
|
|
||||||
|
acmesolver:
|
||||||
|
image:
|
||||||
|
repository: quay.io/jetstack/cert-manager-acmesolver
|
||||||
|
# You can manage a registry with
|
||||||
|
# registry: quay.io
|
||||||
|
# repository: jetstack/cert-manager-acmesolver
|
||||||
|
|
||||||
|
# Override the image tag to deploy by setting this variable.
|
||||||
|
# If no value is set, the chart's appVersion will be used.
|
||||||
|
# tag: canary
|
||||||
|
|
||||||
|
# Setting a digest will override any tag
|
||||||
|
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
|
||||||
|
|
||||||
|
# This startupapicheck is a Helm post-install hook that waits for the webhook
|
||||||
|
# endpoints to become available.
|
||||||
|
# The check is implemented using a Kubernetes Job- if you are injecting mesh
|
||||||
|
# sidecar proxies into cert-manager pods, you probably want to ensure that they
|
||||||
|
# are not injected into this Job's pod. Otherwise the installation may time out
|
||||||
|
# due to the Job never being completed because the sidecar proxy does not exit.
|
||||||
|
# See https://github.com/cert-manager/cert-manager/pull/4414 for context.
|
||||||
|
startupapicheck:
|
||||||
|
enabled: true
|
||||||
|
|
||||||
|
# Pod Security Context to be set on the startupapicheck component Pod
|
||||||
|
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||||
|
securityContext:
|
||||||
|
runAsNonRoot: true
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
|
||||||
|
# Container Security Context to be set on the controller component container
|
||||||
|
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||||
|
containerSecurityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
# readOnlyRootFilesystem: true
|
||||||
|
# runAsNonRoot: true
|
||||||
|
|
||||||
|
# Timeout for 'kubectl check api' command
|
||||||
|
timeout: 1m
|
||||||
|
|
||||||
|
# Job backoffLimit
|
||||||
|
backoffLimit: 4
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the startupapicheck Job
|
||||||
|
jobAnnotations:
|
||||||
|
helm.sh/hook: post-install
|
||||||
|
helm.sh/hook-weight: "1"
|
||||||
|
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the startupapicheck Pods
|
||||||
|
# podAnnotations: {}
|
||||||
|
|
||||||
|
# Additional command line flags to pass to startupapicheck binary.
|
||||||
|
# To see all available flags run docker run quay.io/jetstack/cert-manager-ctl:<version> --help
|
||||||
|
extraArgs: []
|
||||||
|
|
||||||
|
resources: {}
|
||||||
|
# requests:
|
||||||
|
# cpu: 10m
|
||||||
|
# memory: 32Mi
|
||||||
|
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
|
||||||
|
affinity: {}
|
||||||
|
|
||||||
|
tolerations: []
|
||||||
|
|
||||||
|
# Optional additional labels to add to the startupapicheck Pods
|
||||||
|
podLabels: {}
|
||||||
|
|
||||||
|
image:
|
||||||
|
repository: quay.io/jetstack/cert-manager-ctl
|
||||||
|
# You can manage a registry with
|
||||||
|
# registry: quay.io
|
||||||
|
# repository: jetstack/cert-manager-ctl
|
||||||
|
|
||||||
|
# Override the image tag to deploy by setting this variable.
|
||||||
|
# If no value is set, the chart's appVersion will be used.
|
||||||
|
# tag: canary
|
||||||
|
|
||||||
|
# Setting a digest will override any tag
|
||||||
|
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
|
||||||
|
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
|
||||||
|
rbac:
|
||||||
|
# annotations for the startup API Check job RBAC and PSP resources
|
||||||
|
annotations:
|
||||||
|
helm.sh/hook: post-install
|
||||||
|
helm.sh/hook-weight: "-5"
|
||||||
|
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||||
|
|
||||||
|
# Automounting API credentials for a particular pod
|
||||||
|
# automountServiceAccountToken: true
|
||||||
|
|
||||||
|
serviceAccount:
|
||||||
|
# Specifies whether a service account should be created
|
||||||
|
create: true
|
||||||
|
|
||||||
|
# The name of the service account to use.
|
||||||
|
# If not set and create is true, a name is generated using the fullname template
|
||||||
|
# name: ""
|
||||||
|
|
||||||
|
# Optional additional annotations to add to the Job's ServiceAccount
|
||||||
|
annotations:
|
||||||
|
helm.sh/hook: post-install
|
||||||
|
helm.sh/hook-weight: "-5"
|
||||||
|
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||||
|
|
||||||
|
# Automount API credentials for a Service Account.
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
|
||||||
|
# Optional additional labels to add to the startupapicheck's ServiceAccount
|
||||||
|
# labels: {}
|
||||||
|
|
||||||
|
volumes: []
|
||||||
|
volumeMounts: []
|
||||||
|
|
||||||
|
# enableServiceLinks indicates whether information about services should be
|
||||||
|
# injected into pod's environment variables, matching the syntax of Docker
|
||||||
|
# links.
|
||||||
|
enableServiceLinks: false
|
||||||
@ -1,14 +1,15 @@
|
|||||||
annotations:
|
annotations:
|
||||||
|
artifacthub.io/category: security
|
||||||
artifacthub.io/license: Apache-2.0
|
artifacthub.io/license: Apache-2.0
|
||||||
artifacthub.io/prerelease: "false"
|
artifacthub.io/prerelease: "false"
|
||||||
artifacthub.io/signKey: |
|
artifacthub.io/signKey: |
|
||||||
fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
|
fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
|
||||||
url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
|
url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
|
||||||
apiVersion: v1
|
apiVersion: v2
|
||||||
appVersion: v1.13.3
|
appVersion: v1.17.2
|
||||||
description: A Helm chart for cert-manager
|
description: A Helm chart for cert-manager
|
||||||
home: https://github.com/cert-manager/cert-manager
|
home: https://cert-manager.io
|
||||||
icon: https://raw.githubusercontent.com/cert-manager/cert-manager/d53c0b9270f8cd90d908460d69502694e1838f5f/logo/logo-small.png
|
icon: https://raw.githubusercontent.com/cert-manager/community/4d35a69437d21b76322157e6284be4cd64e6d2b7/logo/logo-small.png
|
||||||
keywords:
|
keywords:
|
||||||
- cert-manager
|
- cert-manager
|
||||||
- kube-lego
|
- kube-lego
|
||||||
@ -22,4 +23,4 @@ maintainers:
|
|||||||
name: cert-manager
|
name: cert-manager
|
||||||
sources:
|
sources:
|
||||||
- https://github.com/cert-manager/cert-manager
|
- https://github.com/cert-manager/cert-manager
|
||||||
version: v1.13.3
|
version: v1.17.2
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
@ -1,3 +1,6 @@
|
|||||||
|
{{- if .Values.installCRDs }}
|
||||||
|
⚠️ WARNING: `installCRDs` is deprecated, use `crds.enabled` instead.
|
||||||
|
{{- end }}
|
||||||
cert-manager {{ .Chart.AppVersion }} has been deployed successfully!
|
cert-manager {{ .Chart.AppVersion }} has been deployed successfully!
|
||||||
|
|
||||||
In order to begin issuing certificates, you will need to set up a ClusterIssuer
|
In order to begin issuing certificates, you will need to set up a ClusterIssuer
|
||||||
|
|||||||
@ -152,7 +152,7 @@ Labels that should be added on each resource
|
|||||||
*/}}
|
*/}}
|
||||||
{{- define "labels" -}}
|
{{- define "labels" -}}
|
||||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||||
{{- if eq (default "helm" .Values.creator) "helm" }}
|
{{- if eq .Values.creator "helm" }}
|
||||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||||
helm.sh/chart: {{ include "chartName" . }}
|
helm.sh/chart: {{ include "chartName" . }}
|
||||||
{{- end -}}
|
{{- end -}}
|
||||||
@ -172,3 +172,31 @@ https://github.com/helm/helm/issues/5358
|
|||||||
{{- define "cert-manager.namespace" -}}
|
{{- define "cert-manager.namespace" -}}
|
||||||
{{ .Values.namespace | default .Release.Namespace }}
|
{{ .Values.namespace | default .Release.Namespace }}
|
||||||
{{- end -}}
|
{{- end -}}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Util function for generating the image URL based on the provided options.
|
||||||
|
IMPORTANT: This function is standardized across all charts in the cert-manager GH organization.
|
||||||
|
Any changes to this function should also be made in cert-manager, trust-manager, approver-policy, ...
|
||||||
|
See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linked PRs.
|
||||||
|
*/}}
|
||||||
|
{{- define "image" -}}
|
||||||
|
{{- $defaultTag := index . 1 -}}
|
||||||
|
{{- with index . 0 -}}
|
||||||
|
{{- if .registry -}}{{ printf "%s/%s" .registry .repository }}{{- else -}}{{- .repository -}}{{- end -}}
|
||||||
|
{{- if .digest -}}{{ printf "@%s" .digest }}{{- else -}}{{ printf ":%s" (default $defaultTag .tag) }}{{- end -}}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
{{/*
|
||||||
|
Check that the user has not set both .installCRDs and .crds.enabled or
|
||||||
|
set .installCRDs and disabled .crds.keep.
|
||||||
|
.installCRDs is deprecated and users should use .crds.enabled and .crds.keep instead.
|
||||||
|
*/}}
|
||||||
|
{{- define "cert-manager.crd-check" -}}
|
||||||
|
{{- if and (.Values.installCRDs) (.Values.crds.enabled) }}
|
||||||
|
{{- fail "ERROR: the deprecated .installCRDs option cannot be enabled at the same time as its replacement .crds.enabled" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if and (.Values.installCRDs) (not .Values.crds.keep) }}
|
||||||
|
{{- fail "ERROR: .crds.keep is not compatible with .installCRDs, please use .crds.enabled and .crds.keep instead" }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end -}}
|
||||||
|
|||||||
19
cert-manager/templates/cainjector-config.yaml
Normal file
19
cert-manager/templates/cainjector-config.yaml
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
{{- if .Values.cainjector.config -}}
|
||||||
|
{{- $config := .Values.cainjector.config -}}
|
||||||
|
{{- $_ := set $config "apiVersion" (default "cainjector.config.cert-manager.io/v1alpha1" $config.apiVersion) -}}
|
||||||
|
{{- $_ := set $config "kind" (default "CAInjectorConfiguration" $config.kind) -}}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
name: {{ include "cainjector.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
data:
|
||||||
|
config.yaml: |
|
||||||
|
{{- $config | toYaml | nindent 4 }}
|
||||||
|
{{- end -}}
|
||||||
@ -16,6 +16,10 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
replicas: {{ .Values.cainjector.replicaCount }}
|
replicas: {{ .Values.cainjector.replicaCount }}
|
||||||
|
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
|
||||||
|
{{- if not (has (quote .Values.global.revisionHistoryLimit) (list "" (quote ""))) }}
|
||||||
|
revisionHistoryLimit: {{ .Values.global.revisionHistoryLimit }}
|
||||||
|
{{- end }}
|
||||||
selector:
|
selector:
|
||||||
matchLabels:
|
matchLabels:
|
||||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
@ -40,7 +44,21 @@ spec:
|
|||||||
annotations:
|
annotations:
|
||||||
{{- toYaml . | nindent 8 }}
|
{{- toYaml . | nindent 8 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if and .Values.prometheus.enabled (not (or .Values.prometheus.servicemonitor.enabled .Values.prometheus.podmonitor.enabled)) }}
|
||||||
|
{{- if not .Values.cainjector.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- end }}
|
||||||
|
prometheus.io/path: "/metrics"
|
||||||
|
prometheus.io/scrape: 'true'
|
||||||
|
prometheus.io/port: '9402'
|
||||||
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
|
{{- if not .Values.cainjector.serviceAccount.create }}
|
||||||
|
{{- with .Values.global.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
serviceAccountName: {{ template "cainjector.serviceAccountName" . }}
|
serviceAccountName: {{ template "cainjector.serviceAccountName" . }}
|
||||||
{{- if hasKey .Values.cainjector "automountServiceAccountToken" }}
|
{{- if hasKey .Values.cainjector "automountServiceAccountToken" }}
|
||||||
automountServiceAccountToken: {{ .Values.cainjector.automountServiceAccountToken }}
|
automountServiceAccountToken: {{ .Values.cainjector.automountServiceAccountToken }}
|
||||||
@ -55,14 +73,16 @@ spec:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
containers:
|
containers:
|
||||||
- name: {{ .Chart.Name }}-cainjector
|
- name: {{ .Chart.Name }}-cainjector
|
||||||
{{- with .Values.cainjector.image }}
|
image: "{{ template "image" (tuple .Values.cainjector.image $.Chart.AppVersion) }}"
|
||||||
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
|
||||||
{{- end }}
|
|
||||||
imagePullPolicy: {{ .Values.cainjector.image.pullPolicy }}
|
imagePullPolicy: {{ .Values.cainjector.image.pullPolicy }}
|
||||||
args:
|
args:
|
||||||
{{- if .Values.global.logLevel }}
|
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
|
||||||
|
{{- if not (has (quote .Values.global.logLevel) (list "" (quote ""))) }}
|
||||||
- --v={{ .Values.global.logLevel }}
|
- --v={{ .Values.global.logLevel }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if .Values.cainjector.config }}
|
||||||
|
- --config=/var/cert-manager/config/config.yaml
|
||||||
|
{{- end }}
|
||||||
{{- with .Values.global.leaderElection }}
|
{{- with .Values.global.leaderElection }}
|
||||||
- --leader-election-namespace={{ .namespace }}
|
- --leader-election-namespace={{ .namespace }}
|
||||||
{{- if .leaseDuration }}
|
{{- if .leaseDuration }}
|
||||||
@ -75,14 +95,29 @@ spec:
|
|||||||
- --leader-election-retry-period={{ .retryPeriod }}
|
- --leader-election-retry-period={{ .retryPeriod }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.featureGates}}
|
||||||
|
- --feature-gates={{ . }}
|
||||||
|
{{- end}}
|
||||||
{{- with .Values.cainjector.extraArgs }}
|
{{- with .Values.cainjector.extraArgs }}
|
||||||
{{- toYaml . | nindent 10 }}
|
{{- toYaml . | nindent 10 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if not .Values.prometheus.enabled }}
|
||||||
|
- --metrics-listen-address=0
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.enabled }}
|
||||||
|
ports:
|
||||||
|
- containerPort: 9402
|
||||||
|
name: http-metrics
|
||||||
|
protocol: TCP
|
||||||
|
{{- end }}
|
||||||
env:
|
env:
|
||||||
- name: POD_NAMESPACE
|
- name: POD_NAMESPACE
|
||||||
valueFrom:
|
valueFrom:
|
||||||
fieldRef:
|
fieldRef:
|
||||||
fieldPath: metadata.namespace
|
fieldPath: metadata.namespace
|
||||||
|
{{- with .Values.cainjector.extraEnv }}
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
{{- with .Values.cainjector.containerSecurityContext }}
|
{{- with .Values.cainjector.containerSecurityContext }}
|
||||||
securityContext:
|
securityContext:
|
||||||
{{- toYaml . | nindent 12 }}
|
{{- toYaml . | nindent 12 }}
|
||||||
@ -91,10 +126,16 @@ spec:
|
|||||||
resources:
|
resources:
|
||||||
{{- toYaml . | nindent 12 }}
|
{{- toYaml . | nindent 12 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- with .Values.cainjector.volumeMounts }}
|
{{- if or .Values.cainjector.config .Values.cainjector.volumeMounts }}
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
|
{{- if .Values.cainjector.config }}
|
||||||
|
- name: config
|
||||||
|
mountPath: /var/cert-manager/config
|
||||||
|
{{- end }}
|
||||||
|
{{- with .Values.cainjector.volumeMounts }}
|
||||||
{{- toYaml . | nindent 12 }}
|
{{- toYaml . | nindent 12 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- with .Values.cainjector.nodeSelector }}
|
{{- with .Values.cainjector.nodeSelector }}
|
||||||
nodeSelector:
|
nodeSelector:
|
||||||
{{- toYaml . | nindent 8 }}
|
{{- toYaml . | nindent 8 }}
|
||||||
@ -111,8 +152,15 @@ spec:
|
|||||||
topologySpreadConstraints:
|
topologySpreadConstraints:
|
||||||
{{- toYaml . | nindent 8 }}
|
{{- toYaml . | nindent 8 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- with .Values.cainjector.volumes }}
|
{{- if or .Values.cainjector.volumes .Values.cainjector.config }}
|
||||||
volumes:
|
volumes:
|
||||||
|
{{- if .Values.cainjector.config }}
|
||||||
|
- name: config
|
||||||
|
configMap:
|
||||||
|
name: {{ include "cainjector.fullname" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{ with .Values.cainjector.volumes }}
|
||||||
{{- toYaml . | nindent 8 }}
|
{{- toYaml . | nindent 8 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@ -101,3 +101,56 @@ subjects:
|
|||||||
namespace: {{ include "cert-manager.namespace" . }}
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- $certmanagerNamespace := include "cert-manager.namespace" . }}
|
||||||
|
{{- if (.Values.cainjector.config.metricsTLSConfig).dynamic }}
|
||||||
|
{{- if $certmanagerNamespace | eq .Values.cainjector.config.metricsTLSConfig.dynamic.secretNamespace }}
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Metrics server dynamic TLS serving certificate rules
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cainjector.fullname" . }}:dynamic-serving
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
resourceNames:
|
||||||
|
# Allow cainjector to read and update the metrics CA Secret when dynamic TLS is
|
||||||
|
# enabled for the metrics server and if the Secret is configured to be in the
|
||||||
|
# same namespace as cert-manager.
|
||||||
|
- {{ .Values.cainjector.config.metricsTLSConfig.dynamic.secretName | quote }}
|
||||||
|
verbs: ["get", "list", "watch", "update"]
|
||||||
|
# It's not possible to grant CREATE permission on a single resourceName.
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["create"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "cainjector.fullname" . }}:dynamic-serving
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: {{ template "cainjector.fullname" . }}:dynamic-serving
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ template "cainjector.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|||||||
32
cert-manager/templates/cainjector-service.yaml
Normal file
32
cert-manager/templates/cainjector-service.yaml
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
{{- if .Values.cainjector.enabled }}
|
||||||
|
{{- if and .Values.prometheus.enabled (not .Values.prometheus.podmonitor.enabled) }}
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cainjector.fullname" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- with .Values.cainjector.serviceAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{ toYaml . | indent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
{{- with .Values.cainjector.serviceLabels }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 9402
|
||||||
|
name: http-metrics
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -1,12 +1,7 @@
|
|||||||
{{- if .Values.config -}}
|
{{- if .Values.config -}}
|
||||||
{{- if not .Values.config.apiVersion -}}
|
{{- $config := .Values.config -}}
|
||||||
{{- fail "config.apiVersion must be set" -}}
|
{{- $_ := set $config "apiVersion" (default "controller.config.cert-manager.io/v1alpha1" $config.apiVersion) -}}
|
||||||
{{- end -}}
|
{{- $_ := set $config "kind" (default "ControllerConfiguration" $config.kind) -}}
|
||||||
|
|
||||||
{{- if not .Values.config.kind -}}
|
|
||||||
{{- fail "config.kind must be set" -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: ConfigMap
|
kind: ConfigMap
|
||||||
metadata:
|
metadata:
|
||||||
@ -19,7 +14,6 @@ metadata:
|
|||||||
app.kubernetes.io/component: "controller"
|
app.kubernetes.io/component: "controller"
|
||||||
{{- include "labels" . | nindent 4 }}
|
{{- include "labels" . | nindent 4 }}
|
||||||
data:
|
data:
|
||||||
{{- if .Values.config }}
|
|
||||||
config.yaml: |
|
config.yaml: |
|
||||||
{{ .Values.config | toYaml | nindent 4 }}
|
{{- $config | toYaml | nindent 4 }}
|
||||||
{{- end }}
|
{{- end -}}
|
||||||
File diff suppressed because it is too large
Load Diff
@ -15,6 +15,10 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
replicas: {{ .Values.replicaCount }}
|
replicas: {{ .Values.replicaCount }}
|
||||||
|
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
|
||||||
|
{{- if not (has (quote .Values.global.revisionHistoryLimit) (list "" (quote ""))) }}
|
||||||
|
revisionHistoryLimit: {{ .Values.global.revisionHistoryLimit }}
|
||||||
|
{{- end }}
|
||||||
selector:
|
selector:
|
||||||
matchLabels:
|
matchLabels:
|
||||||
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
|
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
|
||||||
@ -39,7 +43,7 @@ spec:
|
|||||||
annotations:
|
annotations:
|
||||||
{{- toYaml . | nindent 8 }}
|
{{- toYaml . | nindent 8 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if and .Values.prometheus.enabled (not .Values.prometheus.servicemonitor.enabled) }}
|
{{- if and .Values.prometheus.enabled (not (or .Values.prometheus.servicemonitor.enabled .Values.prometheus.podmonitor.enabled)) }}
|
||||||
{{- if not .Values.podAnnotations }}
|
{{- if not .Values.podAnnotations }}
|
||||||
annotations:
|
annotations:
|
||||||
{{- end }}
|
{{- end }}
|
||||||
@ -48,6 +52,12 @@ spec:
|
|||||||
prometheus.io/port: '9402'
|
prometheus.io/port: '9402'
|
||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
|
{{- if not .Values.serviceAccount.create }}
|
||||||
|
{{- with .Values.global.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
serviceAccountName: {{ template "cert-manager.serviceAccountName" . }}
|
serviceAccountName: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
{{- if hasKey .Values "automountServiceAccountToken" }}
|
{{- if hasKey .Values "automountServiceAccountToken" }}
|
||||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||||
@ -73,12 +83,11 @@ spec:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
containers:
|
containers:
|
||||||
- name: {{ .Chart.Name }}-controller
|
- name: {{ .Chart.Name }}-controller
|
||||||
{{- with .Values.image }}
|
image: "{{ template "image" (tuple .Values.image $.Chart.AppVersion) }}"
|
||||||
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
|
||||||
{{- end }}
|
|
||||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||||
args:
|
args:
|
||||||
{{- if .Values.global.logLevel }}
|
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
|
||||||
|
{{- if not (has (quote .Values.global.logLevel) (list "" (quote ""))) }}
|
||||||
- --v={{ .Values.global.logLevel }}
|
- --v={{ .Values.global.logLevel }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if .Values.config }}
|
{{- if .Values.config }}
|
||||||
@ -134,6 +143,9 @@ spec:
|
|||||||
{{- with .Values.dns01RecursiveNameservers }}
|
{{- with .Values.dns01RecursiveNameservers }}
|
||||||
- --dns01-recursive-nameservers={{ . }}
|
- --dns01-recursive-nameservers={{ . }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if .Values.disableAutoApproval }}
|
||||||
|
- --controllers=-certificaterequests-approver
|
||||||
|
{{- end }}
|
||||||
ports:
|
ports:
|
||||||
- containerPort: 9402
|
- containerPort: 9402
|
||||||
name: http-metrics
|
name: http-metrics
|
||||||
@ -147,7 +159,7 @@ spec:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if or .Values.config .Values.volumeMounts }}
|
{{- if or .Values.config .Values.volumeMounts }}
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
{{- if .Values.config}}
|
{{- if .Values.config }}
|
||||||
- name: config
|
- name: config
|
||||||
mountPath: /var/cert-manager/config
|
mountPath: /var/cert-manager/config
|
||||||
{{- end }}
|
{{- end }}
|
||||||
@ -220,3 +232,6 @@ spec:
|
|||||||
dnsConfig:
|
dnsConfig:
|
||||||
{{- toYaml . | nindent 8 }}
|
{{- toYaml . | nindent 8 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- with .Values.hostAliases }}
|
||||||
|
hostAliases: {{ toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
4
cert-manager/templates/extras-objects.yaml
Normal file
4
cert-manager/templates/extras-objects.yaml
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
{{ range .Values.extraObjects }}
|
||||||
|
---
|
||||||
|
{{ tpl . $ }}
|
||||||
|
{{ end }}
|
||||||
@ -11,13 +11,9 @@ spec:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
podSelector:
|
podSelector:
|
||||||
matchLabels:
|
matchLabels:
|
||||||
app: {{ include "webhook.name" . }}
|
|
||||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
app.kubernetes.io/component: "webhook"
|
app.kubernetes.io/component: "webhook"
|
||||||
{{- with .Values.webhook.podLabels }}
|
|
||||||
{{- toYaml . | nindent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
policyTypes:
|
policyTypes:
|
||||||
- Egress
|
- Egress
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@ -12,13 +12,9 @@ spec:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
podSelector:
|
podSelector:
|
||||||
matchLabels:
|
matchLabels:
|
||||||
app: {{ include "webhook.name" . }}
|
|
||||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
app.kubernetes.io/component: "webhook"
|
app.kubernetes.io/component: "webhook"
|
||||||
{{- with .Values.webhook.podLabels }}
|
|
||||||
{{- toYaml . | nindent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
policyTypes:
|
policyTypes:
|
||||||
- Ingress
|
- Ingress
|
||||||
|
|
||||||
|
|||||||
63
cert-manager/templates/podmonitor.yaml
Normal file
63
cert-manager/templates/podmonitor.yaml
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
{{- if and .Values.prometheus.enabled (and .Values.prometheus.podmonitor.enabled .Values.prometheus.servicemonitor.enabled) }}
|
||||||
|
{{- fail "Either .Values.prometheus.podmonitor.enabled or .Values.prometheus.servicemonitor.enabled can be enabled at a time, but not both." }}
|
||||||
|
{{- else if and .Values.prometheus.enabled .Values.prometheus.podmonitor.enabled }}
|
||||||
|
apiVersion: monitoring.coreos.com/v1
|
||||||
|
kind: PodMonitor
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.fullname" . }}
|
||||||
|
{{- if .Values.prometheus.podmonitor.namespace }}
|
||||||
|
namespace: {{ .Values.prometheus.podmonitor.namespace }}
|
||||||
|
{{- else }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
prometheus: {{ .Values.prometheus.podmonitor.prometheusInstance }}
|
||||||
|
{{- with .Values.prometheus.podmonitor.labels }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.podmonitor.annotations }}
|
||||||
|
annotations:
|
||||||
|
{{- with .Values.prometheus.podmonitor.annotations }}
|
||||||
|
{{- toYaml . | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
spec:
|
||||||
|
jobLabel: {{ template "cert-manager.fullname" . }}
|
||||||
|
selector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: app.kubernetes.io/name
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- {{ include "cainjector.name" . }}
|
||||||
|
- {{ template "cert-manager.name" . }}
|
||||||
|
- {{ include "webhook.name" . }}
|
||||||
|
- key: app.kubernetes.io/instance
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- {{ .Release.Name }}
|
||||||
|
- key: app.kubernetes.io/component
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- cainjector
|
||||||
|
- controller
|
||||||
|
- webhook
|
||||||
|
{{- if .Values.prometheus.podmonitor.namespace }}
|
||||||
|
namespaceSelector:
|
||||||
|
matchNames:
|
||||||
|
- {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
podMetricsEndpoints:
|
||||||
|
- port: http-metrics
|
||||||
|
path: {{ .Values.prometheus.podmonitor.path }}
|
||||||
|
interval: {{ .Values.prometheus.podmonitor.interval }}
|
||||||
|
scrapeTimeout: {{ .Values.prometheus.podmonitor.scrapeTimeout }}
|
||||||
|
honorLabels: {{ .Values.prometheus.podmonitor.honorLabels }}
|
||||||
|
{{- with .Values.prometheus.podmonitor.endpointAdditionalProperties }}
|
||||||
|
{{- toYaml . | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
@ -39,13 +39,56 @@ roleRef:
|
|||||||
kind: Role
|
kind: Role
|
||||||
name: {{ template "cert-manager.fullname" . }}:leaderelection
|
name: {{ template "cert-manager.fullname" . }}:leaderelection
|
||||||
subjects:
|
subjects:
|
||||||
- apiGroup: ""
|
- kind: ServiceAccount
|
||||||
kind: ServiceAccount
|
|
||||||
name: {{ template "cert-manager.serviceAccountName" . }}
|
name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
namespace: {{ include "cert-manager.namespace" . }}
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
{{- if .Values.serviceAccount.create }}
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["serviceaccounts/token"]
|
||||||
|
resourceNames: ["{{ template "cert-manager.serviceAccountName" . }}"]
|
||||||
|
verbs: ["create"]
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# grant cert-manager permission to create tokens for the serviceaccount
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: {{ include "cert-manager.fullname" . }}-{{ template "cert-manager.serviceAccountName" . }}-tokenrequest
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
labels:
|
||||||
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||||
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
{{- include "labels" . | nindent 4 }}
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: {{ template "cert-manager.serviceAccountName" . }}
|
||||||
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
# Issuer controller role
|
# Issuer controller role
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
kind: ClusterRole
|
kind: ClusterRole
|
||||||
@ -474,6 +517,8 @@ rules:
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
{{- if not .Values.disableAutoApproval -}}
|
||||||
|
|
||||||
# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers
|
# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
kind: ClusterRole
|
kind: ClusterRole
|
||||||
@ -489,7 +534,12 @@ rules:
|
|||||||
- apiGroups: ["cert-manager.io"]
|
- apiGroups: ["cert-manager.io"]
|
||||||
resources: ["signers"]
|
resources: ["signers"]
|
||||||
verbs: ["approve"]
|
verbs: ["approve"]
|
||||||
resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
|
{{- with .Values.approveSignerNames }}
|
||||||
|
resourceNames:
|
||||||
|
{{- range . }}
|
||||||
|
- {{ . | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
@ -514,8 +564,10 @@ subjects:
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
{{- end -}}
|
||||||
|
|
||||||
# Permission to:
|
# Permission to:
|
||||||
# - Update and sign CertificatSigningeRequests referencing cert-manager.io Issuers and ClusterIssuers
|
# - Update and sign CertificateSigningRequests referencing cert-manager.io Issuers and ClusterIssuers
|
||||||
# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers
|
# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
kind: ClusterRole
|
kind: ClusterRole
|
||||||
|
|||||||
@ -1,4 +1,4 @@
|
|||||||
{{- if .Values.prometheus.enabled }}
|
{{- if and .Values.prometheus.enabled (not .Values.prometheus.podmonitor.enabled) }}
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Service
|
kind: Service
|
||||||
metadata:
|
metadata:
|
||||||
@ -19,6 +19,12 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
type: ClusterIP
|
type: ClusterIP
|
||||||
|
{{- if .Values.serviceIPFamilyPolicy }}
|
||||||
|
ipFamilyPolicy: {{ .Values.serviceIPFamilyPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.serviceIPFamilies }}
|
||||||
|
ipFamilies: {{ .Values.serviceIPFamilies | toYaml | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
ports:
|
ports:
|
||||||
- protocol: TCP
|
- protocol: TCP
|
||||||
port: 9402
|
port: 9402
|
||||||
|
|||||||
@ -11,7 +11,9 @@ metadata:
|
|||||||
namespace: {{ include "cert-manager.namespace" . }}
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
{{- with .Values.serviceAccount.annotations }}
|
{{- with .Values.serviceAccount.annotations }}
|
||||||
annotations:
|
annotations:
|
||||||
{{- toYaml . | nindent 4 }}
|
{{- range $k, $v := . }}
|
||||||
|
{{- printf "%s: %s" (tpl $k $) (tpl $v $) | nindent 4 }}
|
||||||
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
labels:
|
labels:
|
||||||
app: {{ include "cert-manager.name" . }}
|
app: {{ include "cert-manager.name" . }}
|
||||||
|
|||||||
@ -1,4 +1,6 @@
|
|||||||
{{- if and .Values.prometheus.enabled .Values.prometheus.servicemonitor.enabled }}
|
{{- if and .Values.prometheus.enabled (and .Values.prometheus.podmonitor.enabled .Values.prometheus.servicemonitor.enabled) }}
|
||||||
|
{{- fail "Either .Values.prometheus.podmonitor.enabled or .Values.prometheus.servicemonitor.enabled can be enabled at a time, but not both." }}
|
||||||
|
{{- else if and .Values.prometheus.enabled .Values.prometheus.servicemonitor.enabled }}
|
||||||
apiVersion: monitoring.coreos.com/v1
|
apiVersion: monitoring.coreos.com/v1
|
||||||
kind: ServiceMonitor
|
kind: ServiceMonitor
|
||||||
metadata:
|
metadata:
|
||||||
@ -27,10 +29,23 @@ metadata:
|
|||||||
spec:
|
spec:
|
||||||
jobLabel: {{ template "cert-manager.fullname" . }}
|
jobLabel: {{ template "cert-manager.fullname" . }}
|
||||||
selector:
|
selector:
|
||||||
matchLabels:
|
matchExpressions:
|
||||||
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
|
- key: app.kubernetes.io/name
|
||||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
operator: In
|
||||||
app.kubernetes.io/component: "controller"
|
values:
|
||||||
|
- {{ include "cainjector.name" . }}
|
||||||
|
- {{ template "cert-manager.name" . }}
|
||||||
|
- {{ include "webhook.name" . }}
|
||||||
|
- key: app.kubernetes.io/instance
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- {{ .Release.Name }}
|
||||||
|
- key: app.kubernetes.io/component
|
||||||
|
operator: In
|
||||||
|
values:
|
||||||
|
- cainjector
|
||||||
|
- controller
|
||||||
|
- webhook
|
||||||
{{- if .Values.prometheus.servicemonitor.namespace }}
|
{{- if .Values.prometheus.servicemonitor.namespace }}
|
||||||
namespaceSelector:
|
namespaceSelector:
|
||||||
matchNames:
|
matchNames:
|
||||||
|
|||||||
@ -47,9 +47,7 @@ spec:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
containers:
|
containers:
|
||||||
- name: {{ .Chart.Name }}-startupapicheck
|
- name: {{ .Chart.Name }}-startupapicheck
|
||||||
{{- with .Values.startupapicheck.image }}
|
image: "{{ template "image" (tuple .Values.startupapicheck.image $.Chart.AppVersion) }}"
|
||||||
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
|
||||||
{{- end }}
|
|
||||||
imagePullPolicy: {{ .Values.startupapicheck.image.pullPolicy }}
|
imagePullPolicy: {{ .Values.startupapicheck.image.pullPolicy }}
|
||||||
args:
|
args:
|
||||||
- check
|
- check
|
||||||
@ -62,6 +60,14 @@ spec:
|
|||||||
securityContext:
|
securityContext:
|
||||||
{{- toYaml . | nindent 12 }}
|
{{- toYaml . | nindent 12 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
{{- with .Values.startupapicheck.extraEnv }}
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
{{- with .Values.startupapicheck.resources }}
|
{{- with .Values.startupapicheck.resources }}
|
||||||
resources:
|
resources:
|
||||||
{{- toYaml . | nindent 12 }}
|
{{- toYaml . | nindent 12 }}
|
||||||
|
|||||||
@ -18,7 +18,7 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
rules:
|
rules:
|
||||||
- apiGroups: ["cert-manager.io"]
|
- apiGroups: ["cert-manager.io"]
|
||||||
resources: ["certificates"]
|
resources: ["certificaterequests"]
|
||||||
verbs: ["create"]
|
verbs: ["create"]
|
||||||
---
|
---
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
|||||||
@ -1,12 +1,7 @@
|
|||||||
{{- if .Values.webhook.config -}}
|
{{- if .Values.webhook.config -}}
|
||||||
{{- if not .Values.webhook.config.apiVersion -}}
|
{{- $config := .Values.webhook.config -}}
|
||||||
{{- fail "webhook.config.apiVersion must be set" -}}
|
{{- $_ := set $config "apiVersion" (default "webhook.config.cert-manager.io/v1alpha1" $config.apiVersion) -}}
|
||||||
{{- end -}}
|
{{- $_ := set $config "kind" (default "WebhookConfiguration" $config.kind) -}}
|
||||||
|
|
||||||
{{- if not .Values.webhook.config.kind -}}
|
|
||||||
{{- fail "webhook.config.kind must be set" -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: ConfigMap
|
kind: ConfigMap
|
||||||
metadata:
|
metadata:
|
||||||
@ -19,7 +14,6 @@ metadata:
|
|||||||
app.kubernetes.io/component: "webhook"
|
app.kubernetes.io/component: "webhook"
|
||||||
{{- include "labels" . | nindent 4 }}
|
{{- include "labels" . | nindent 4 }}
|
||||||
data:
|
data:
|
||||||
{{- if .Values.webhook.config }}
|
|
||||||
config.yaml: |
|
config.yaml: |
|
||||||
{{ .Values.webhook.config | toYaml | nindent 4 }}
|
{{- $config | toYaml | nindent 4 }}
|
||||||
{{- end }}
|
{{- end -}}
|
||||||
@ -15,6 +15,10 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
replicas: {{ .Values.webhook.replicaCount }}
|
replicas: {{ .Values.webhook.replicaCount }}
|
||||||
|
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
|
||||||
|
{{- if not (has (quote .Values.global.revisionHistoryLimit) (list "" (quote ""))) }}
|
||||||
|
revisionHistoryLimit: {{ .Values.global.revisionHistoryLimit }}
|
||||||
|
{{- end }}
|
||||||
selector:
|
selector:
|
||||||
matchLabels:
|
matchLabels:
|
||||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
@ -39,7 +43,21 @@ spec:
|
|||||||
annotations:
|
annotations:
|
||||||
{{- toYaml . | nindent 8 }}
|
{{- toYaml . | nindent 8 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if and .Values.prometheus.enabled (not (or .Values.prometheus.servicemonitor.enabled .Values.prometheus.podmonitor.enabled)) }}
|
||||||
|
{{- if not .Values.webhook.podAnnotations }}
|
||||||
|
annotations:
|
||||||
|
{{- end }}
|
||||||
|
prometheus.io/path: "/metrics"
|
||||||
|
prometheus.io/scrape: 'true'
|
||||||
|
prometheus.io/port: '9402'
|
||||||
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
|
{{- if not .Values.webhook.serviceAccount.create }}
|
||||||
|
{{- with .Values.global.imagePullSecrets }}
|
||||||
|
imagePullSecrets:
|
||||||
|
{{- toYaml . | nindent 8 }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
serviceAccountName: {{ template "webhook.serviceAccountName" . }}
|
serviceAccountName: {{ template "webhook.serviceAccountName" . }}
|
||||||
{{- if hasKey .Values.webhook "automountServiceAccountToken" }}
|
{{- if hasKey .Values.webhook "automountServiceAccountToken" }}
|
||||||
automountServiceAccountToken: {{ .Values.webhook.automountServiceAccountToken }}
|
automountServiceAccountToken: {{ .Values.webhook.automountServiceAccountToken }}
|
||||||
@ -60,12 +78,11 @@ spec:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
containers:
|
containers:
|
||||||
- name: {{ .Chart.Name }}-webhook
|
- name: {{ .Chart.Name }}-webhook
|
||||||
{{- with .Values.webhook.image }}
|
image: "{{ template "image" (tuple .Values.webhook.image $.Chart.AppVersion) }}"
|
||||||
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
|
||||||
{{- end }}
|
|
||||||
imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
|
imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
|
||||||
args:
|
args:
|
||||||
{{- if .Values.global.logLevel }}
|
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
|
||||||
|
{{- if not (has (quote .Values.global.logLevel) (list "" (quote ""))) }}
|
||||||
- --v={{ .Values.global.logLevel }}
|
- --v={{ .Values.global.logLevel }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if .Values.webhook.config }}
|
{{- if .Values.webhook.config }}
|
||||||
@ -92,6 +109,9 @@ spec:
|
|||||||
{{- with .Values.webhook.extraArgs }}
|
{{- with .Values.webhook.extraArgs }}
|
||||||
{{- toYaml . | nindent 10 }}
|
{{- toYaml . | nindent 10 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if not .Values.prometheus.enabled }}
|
||||||
|
- --metrics-listen-address=0
|
||||||
|
{{- end }}
|
||||||
ports:
|
ports:
|
||||||
- name: https
|
- name: https
|
||||||
protocol: TCP
|
protocol: TCP
|
||||||
@ -109,6 +129,11 @@ spec:
|
|||||||
{{- else }}
|
{{- else }}
|
||||||
containerPort: 6080
|
containerPort: 6080
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
{{- if .Values.prometheus.enabled }}
|
||||||
|
- containerPort: 9402
|
||||||
|
name: http-metrics
|
||||||
|
protocol: TCP
|
||||||
|
{{- end }}
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
httpGet:
|
httpGet:
|
||||||
path: /livez
|
path: /livez
|
||||||
@ -146,6 +171,9 @@ spec:
|
|||||||
valueFrom:
|
valueFrom:
|
||||||
fieldRef:
|
fieldRef:
|
||||||
fieldPath: metadata.namespace
|
fieldPath: metadata.namespace
|
||||||
|
{{- with .Values.webhook.extraEnv }}
|
||||||
|
{{- toYaml . | nindent 10 }}
|
||||||
|
{{- end }}
|
||||||
{{- with .Values.webhook.resources }}
|
{{- with .Values.webhook.resources }}
|
||||||
resources:
|
resources:
|
||||||
{{- toYaml . | nindent 12 }}
|
{{- toYaml . | nindent 12 }}
|
||||||
@ -156,8 +184,8 @@ spec:
|
|||||||
- name: config
|
- name: config
|
||||||
mountPath: /var/cert-manager/config
|
mountPath: /var/cert-manager/config
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if .Values.webhook.volumeMounts }}
|
{{- with .Values.webhook.volumeMounts }}
|
||||||
{{- toYaml .Values.webhook.volumeMounts | nindent 12 }}
|
{{- toYaml . | nindent 12 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- with .Values.webhook.nodeSelector }}
|
{{- with .Values.webhook.nodeSelector }}
|
||||||
@ -183,7 +211,7 @@ spec:
|
|||||||
configMap:
|
configMap:
|
||||||
name: {{ include "webhook.fullname" . }}
|
name: {{ include "webhook.fullname" . }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- if .Values.webhook.volumes }}
|
{{- with .Values.webhook.volumes }}
|
||||||
{{- toYaml .Values.webhook.volumes | nindent 8 }}
|
{{- toYaml . | nindent 8 }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@ -15,17 +15,19 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
webhooks:
|
webhooks:
|
||||||
- name: webhook.cert-manager.io
|
- name: webhook.cert-manager.io
|
||||||
|
{{- with .Values.webhook.mutatingWebhookConfiguration.namespaceSelector }}
|
||||||
|
namespaceSelector:
|
||||||
|
{{- toYaml . | nindent 6 }}
|
||||||
|
{{- end }}
|
||||||
rules:
|
rules:
|
||||||
- apiGroups:
|
- apiGroups:
|
||||||
- "cert-manager.io"
|
- "cert-manager.io"
|
||||||
- "acme.cert-manager.io"
|
|
||||||
apiVersions:
|
apiVersions:
|
||||||
- "v1"
|
- "v1"
|
||||||
operations:
|
operations:
|
||||||
- CREATE
|
- CREATE
|
||||||
- UPDATE
|
|
||||||
resources:
|
resources:
|
||||||
- "*/*"
|
- "certificaterequests"
|
||||||
admissionReviewVersions: ["v1"]
|
admissionReviewVersions: ["v1"]
|
||||||
# This webhook only accepts v1 cert-manager resources.
|
# This webhook only accepts v1 cert-manager resources.
|
||||||
# Equivalent matchPolicy ensures that non-v1 resource requests are sent to
|
# Equivalent matchPolicy ensures that non-v1 resource requests are sent to
|
||||||
|
|||||||
@ -15,6 +15,15 @@ rules:
|
|||||||
resources: ["secrets"]
|
resources: ["secrets"]
|
||||||
resourceNames:
|
resourceNames:
|
||||||
- '{{ template "webhook.fullname" . }}-ca'
|
- '{{ template "webhook.fullname" . }}-ca'
|
||||||
|
{{- $certmanagerNamespace := include "cert-manager.namespace" . }}
|
||||||
|
{{- with (.Values.webhook.config.metricsTLSConfig).dynamic }}
|
||||||
|
{{- if $certmanagerNamespace | eq .secretNamespace }}
|
||||||
|
# Allow webhook to read and update the metrics CA Secret when dynamic TLS is
|
||||||
|
# enabled for the metrics server and if the Secret is configured to be in the
|
||||||
|
# same namespace as cert-manager.
|
||||||
|
- {{ .secretName | quote }}
|
||||||
|
{{- end }}
|
||||||
|
{{- end }}
|
||||||
verbs: ["get", "list", "watch", "update"]
|
verbs: ["get", "list", "watch", "update"]
|
||||||
# It's not possible to grant CREATE permission on a single resourceName.
|
# It's not possible to grant CREATE permission on a single resourceName.
|
||||||
- apiGroups: [""]
|
- apiGroups: [""]
|
||||||
@ -38,8 +47,7 @@ roleRef:
|
|||||||
kind: Role
|
kind: Role
|
||||||
name: {{ template "webhook.fullname" . }}:dynamic-serving
|
name: {{ template "webhook.fullname" . }}:dynamic-serving
|
||||||
subjects:
|
subjects:
|
||||||
- apiGroup: ""
|
- kind: ServiceAccount
|
||||||
kind: ServiceAccount
|
|
||||||
name: {{ template "webhook.serviceAccountName" . }}
|
name: {{ template "webhook.serviceAccountName" . }}
|
||||||
namespace: {{ include "cert-manager.namespace" . }}
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
|
|
||||||
@ -76,8 +84,7 @@ roleRef:
|
|||||||
kind: ClusterRole
|
kind: ClusterRole
|
||||||
name: {{ template "webhook.fullname" . }}:subjectaccessreviews
|
name: {{ template "webhook.fullname" . }}:subjectaccessreviews
|
||||||
subjects:
|
subjects:
|
||||||
- apiGroup: ""
|
- kind: ServiceAccount
|
||||||
kind: ServiceAccount
|
|
||||||
name: {{ template "webhook.serviceAccountName" . }}
|
name: {{ template "webhook.serviceAccountName" . }}
|
||||||
namespace: {{ include "cert-manager.namespace" . }}
|
namespace: {{ include "cert-manager.namespace" . }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
|
|||||||
@ -18,6 +18,12 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
spec:
|
spec:
|
||||||
type: {{ .Values.webhook.serviceType }}
|
type: {{ .Values.webhook.serviceType }}
|
||||||
|
{{- if .Values.webhook.serviceIPFamilyPolicy }}
|
||||||
|
ipFamilyPolicy: {{ .Values.webhook.serviceIPFamilyPolicy }}
|
||||||
|
{{- end }}
|
||||||
|
{{- if .Values.webhook.serviceIPFamilies }}
|
||||||
|
ipFamilies: {{ .Values.webhook.serviceIPFamilies | toYaml | nindent 2 }}
|
||||||
|
{{- end }}
|
||||||
{{- with .Values.webhook.loadBalancerIP }}
|
{{- with .Values.webhook.loadBalancerIP }}
|
||||||
loadBalancerIP: {{ . }}
|
loadBalancerIP: {{ . }}
|
||||||
{{- end }}
|
{{- end }}
|
||||||
@ -26,6 +32,12 @@ spec:
|
|||||||
port: 443
|
port: 443
|
||||||
protocol: TCP
|
protocol: TCP
|
||||||
targetPort: "https"
|
targetPort: "https"
|
||||||
|
{{- if and .Values.prometheus.enabled (not .Values.prometheus.podmonitor.enabled) }}
|
||||||
|
- name: metrics
|
||||||
|
port: 9402
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: "http-metrics"
|
||||||
|
{{- end }}
|
||||||
selector:
|
selector:
|
||||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||||
|
|||||||
@ -15,12 +15,10 @@ metadata:
|
|||||||
{{- end }}
|
{{- end }}
|
||||||
webhooks:
|
webhooks:
|
||||||
- name: webhook.cert-manager.io
|
- name: webhook.cert-manager.io
|
||||||
|
{{- with .Values.webhook.validatingWebhookConfiguration.namespaceSelector }}
|
||||||
namespaceSelector:
|
namespaceSelector:
|
||||||
matchExpressions:
|
{{- toYaml . | nindent 6 }}
|
||||||
- key: "cert-manager.io/disable-validation"
|
{{- end }}
|
||||||
operator: "NotIn"
|
|
||||||
values:
|
|
||||||
- "true"
|
|
||||||
rules:
|
rules:
|
||||||
- apiGroups:
|
- apiGroups:
|
||||||
- "cert-manager.io"
|
- "cert-manager.io"
|
||||||
|
|||||||
@ -1,8 +1,14 @@
|
|||||||
# Default values for cert-manager.
|
crds:
|
||||||
# This is a YAML-formatted file.
|
# This option decides if the CRDs should be installed
|
||||||
# Declare variables to be passed into your templates.
|
# as part of the Helm installation.
|
||||||
|
enabled: true
|
||||||
|
|
||||||
installCRDs: true
|
# This option makes it so that the "helm.sh/resource-policy": keep
|
||||||
|
# annotation is added to the CRD. This will prevent Helm from uninstalling
|
||||||
|
# the CRD when the Helm release is uninstalled.
|
||||||
|
# WARNING: when the CRDs are removed, all cert-manager custom resources
|
||||||
|
# (Certificates, Issuers, ...) will be removed too by the garbage collector.
|
||||||
|
keep: true
|
||||||
|
|
||||||
resources:
|
resources:
|
||||||
requests:
|
requests:
|
||||||
@ -23,14 +29,6 @@ prometheus:
|
|||||||
honorLabels: false
|
honorLabels: false
|
||||||
endpointAdditionalProperties: {}
|
endpointAdditionalProperties: {}
|
||||||
|
|
||||||
# LivenessProbe settings for the controller container of the controller Pod.
|
|
||||||
#
|
|
||||||
# Disabled by default, because the controller has a leader election mechanism
|
|
||||||
# which should cause it to exit if it is unable to renew its leader election
|
|
||||||
# record.
|
|
||||||
# LivenessProbe durations and thresholds are based on those used for the Kubernetes
|
|
||||||
# controller-manager. See:
|
|
||||||
# https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245
|
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
enabled: true
|
enabled: true
|
||||||
initialDelaySeconds: 10
|
initialDelaySeconds: 10
|
||||||
|
|||||||
2135
cert-manager/values.schema.json
Normal file
2135
cert-manager/values.schema.json
Normal file
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user