github-personal/cozystack
1
0
Fork 0
mirror of https://github.com/outbackdingo/cozystack.git synced 2026-01-28 02:18:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'aenix-io:main' into main

Browse Source
This commit is contained in:
klinch0
2025-01-21 16:31:57 +03:00
committed by GitHub
parent 2f0d0924a7 06afcf27a3
commit 81819661dc
37 changed files with 14095 additions and 1487 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
packages/apps/tenant/Chart.yaml
View File

@@ -4,4 +4,4 @@ description: Separated tenant namespace
icon: /logos/tenant.svg
type: application
version: 1.6.6
version: 1.6.7

6
packages/apps/tenant/templates/kubeconfig.yaml
View File

@@ -4,9 +4,13 @@
{{- if $k8sClientSecret }}
{{- $apiServerEndpoint := index $cozyConfig.data "api-server-endpoint" }}
{{- $managementKubeconfigEndpoint := default "" (get $cozyConfig.data "management-kubeconfig-endpoint") }}
{{- if and $managementKubeconfigEndpoint (ne $managementKubeconfigEndpoint "") }}
{{- $apiServerEndpoint = $managementKubeconfigEndpoint }}
{{- end }}
{{- $k8sClient := index $k8sClientSecret.data "client-secret-key" | b64dec }}
{{- $rootSaConfigMap := lookup "v1" "ConfigMap" "kube-system" "kube-root-ca.crt" }}
{{- $k8sCa := index $rootSaConfigMap.data "ca.crt" | b64enc }}
{{- $k8sCa := index $rootSaConfigMap.data "ca.crt" | b64enc }}
---
apiVersion: v1
kind: Secret

3
packages/apps/versions_map
View File

@@ -99,7 +99,8 @@ tenant 1.6.2 ccedc5fe
tenant 1.6.3 2057bb96
tenant 1.6.4 3c9e50a4
tenant 1.6.5 f1e11451
tenant 1.6.6 HEAD
tenant 1.6.6 d4634797
tenant 1.6.7 HEAD
virtual-machine 0.1.4 f2015d6
virtual-machine 0.1.5 7cd7de7
virtual-machine 0.2.0 5ca8823

4
packages/system/cert-manager-crds/charts/cert-manager/Chart.yaml
View File

@@ -6,7 +6,7 @@ annotations:
fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
apiVersion: v2
appVersion: v1.16.1
appVersion: v1.16.3
description: A Helm chart for cert-manager
home: https://cert-manager.io
icon: https://raw.githubusercontent.com/cert-manager/community/4d35a69437d21b76322157e6284be4cd64e6d2b7/logo/logo-small.png
@@ -23,4 +23,4 @@ maintainers:
name: cert-manager
sources:
- https://github.com/cert-manager/cert-manager
version: v1.16.1
version: v1.16.3

270
packages/system/cert-manager-crds/charts/cert-manager/README.md
View File

@@ -19,7 +19,7 @@ Before installing the chart, you must first install the cert-manager CustomResou
This is performed in a separate step to allow you to easily uninstall and reinstall cert-manager without deleting your installed custom resources.
```bash
$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.crds.yaml
$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.3/cert-manager.crds.yaml
```
To install the chart with the release name `cert-manager`:
@@ -29,7 +29,7 @@ To install the chart with the release name `cert-manager`:
$ helm repo add jetstack https://charts.jetstack.io --force-update
## Install the cert-manager helm chart
$ helm install cert-manager --namespace cert-manager --version v1.16.1 jetstack/cert-manager
$ helm install cert-manager --namespace cert-manager --version v1.16.3 jetstack/cert-manager
```
In order to begin issuing certificates, you will need to set up a ClusterIssuer
@@ -65,7 +65,7 @@ If you want to completely uninstall cert-manager from your cluster, you will als
delete the previously installed CustomResourceDefinition resources:
```console
$ kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.1/cert-manager.crds.yaml
$ kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.16.3/cert-manager.crds.yaml
```
## Configuration
@@ -79,8 +79,8 @@ $ kubectl delete -f https://github.com/cert-manager/cert-manager/releases/downlo
> []
> ```
Reference to one or more secrets to be used when pulling images. For more information, see [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/).
Reference to one or more secrets to be used when pulling images. For more information, see [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/).
For example:
```yaml
@@ -93,9 +93,9 @@ imagePullSecrets:
> {}
> ```
Labels to apply to all resources.
Please note that this does not add labels to the resources created dynamically by the controllers. For these resources, you have to add the labels in the template in the cert-manager custom resource: For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress. For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress).
For example, secretTemplate in CertificateSpec
Labels to apply to all resources.
Please note that this does not add labels to the resources created dynamically by the controllers. For these resources, you have to add the labels in the template in the cert-manager custom resource: For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress. For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress).
For example, secretTemplate in CertificateSpec
For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec).
#### **global.revisionHistoryLimit** ~ `number`
@@ -128,8 +128,8 @@ Aggregate ClusterRoles to Kubernetes default user-facing roles. For more informa
> false
> ```
Create PodSecurityPolicy for cert-manager.
Create PodSecurityPolicy for cert-manager.
Note that PodSecurityPolicy was deprecated in Kubernetes 1.21 and removed in Kubernetes 1.25.
#### **global.podSecurityPolicy.useAppArmor** ~ `bool`
> Default value:
@@ -184,7 +184,7 @@ This option decides if the CRDs should be installed as part of the Helm installa
> true
> ```
This option makes it so that the "helm.sh/resource-policy": keep annotation is added to the CRD. This will prevent Helm from uninstalling the CRD when the Helm release is uninstalled. WARNING: when the CRDs are removed, all cert-manager custom resources
This option makes it so that the "helm.sh/resource-policy": keep annotation is added to the CRD. This will prevent Helm from uninstalling the CRD when the Helm release is uninstalled. WARNING: when the CRDs are removed, all cert-manager custom resources
(Certificates, Issuers, ...) will be removed too by the garbage collector.
### Controller
@@ -194,12 +194,12 @@ This option makes it so that the "helm.sh/resource-policy": keep annotation is a
> 1
> ```
The number of replicas of the cert-manager controller to run.
The default is 1, but in production set this to 2 or 3 to provide high availability.
If `replicas > 1`, consider setting `podDisruptionBudget.enabled=true`.
The number of replicas of the cert-manager controller to run.
The default is 1, but in production set this to 2 or 3 to provide high availability.
If `replicas > 1`, consider setting `podDisruptionBudget.enabled=true`.
Note that cert-manager uses leader election to ensure that there can only be a single instance active at a time.
#### **strategy** ~ `object`
> Default value:
@@ -207,8 +207,8 @@ Note that cert-manager uses leader election to ensure that there can only be a s
> {}
> ```
Deployment update strategy for the cert-manager controller deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
Deployment update strategy for the cert-manager controller deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
For example:
```yaml
@@ -224,13 +224,13 @@ strategy:
> false
> ```
Enable or disable the PodDisruptionBudget resource.
This prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager
Enable or disable the PodDisruptionBudget resource.
This prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager
Pod is currently running.
#### **podDisruptionBudget.minAvailable** ~ `unknown`
This configures the minimum available pods for disruptions. It can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).
This configures the minimum available pods for disruptions. It can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).
It cannot be used if `maxUnavailable` is set.
@@ -311,7 +311,7 @@ Override the "cert-manager.name" value, which is used to annotate some of the re
Specifies whether a service account should be created.
#### **serviceAccount.name** ~ `string`
The name of the service account to use.
The name of the service account to use.
If not set and create is true, a name is generated using the fullname template.
#### **serviceAccount.annotations** ~ `object`
@@ -346,10 +346,10 @@ When this flag is enabled, secrets will be automatically removed when the certif
> {}
> ```
This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.
If `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.
This property is used to configure options for the controller pod. This allows setting options that would usually be provided using flags.
If `apiVersion` and `kind` are unspecified they default to the current latest version (currently `controller.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.
For example:
```yaml
@@ -412,7 +412,7 @@ Option to disable cert-manager's build-in auto-approver. The auto-approver appro
> - clusterissuers.cert-manager.io/*
> ```
List of signer names that cert-manager will approve by default. CertificateRequests referencing these signer names will be auto-approved by cert-manager. Defaults to just approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval, because eg. you are using approver-policy, you can enable 'disableAutoApproval'.
List of signer names that cert-manager will approve by default. CertificateRequests referencing these signer names will be auto-approved by cert-manager. Defaults to just approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval, because eg. you are using approver-policy, you can enable 'disableAutoApproval'.
ref: https://cert-manager.io/docs/concepts/certificaterequest/#approval
#### **extraArgs** ~ `array`
@@ -421,10 +421,10 @@ ref: https://cert-manager.io/docs/concepts/certificaterequest/#approval
> []
> ```
Additional command line flags to pass to cert-manager controller binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-controller:<version> --help`.
Use this flag to enable or disable arbitrary controllers. For example, to disable the CertificateRequests approver.
Additional command line flags to pass to cert-manager controller binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-controller:<version> --help`.
Use this flag to enable or disable arbitrary controllers. For example, to disable the CertificateRequests approver.
For example:
```yaml
@@ -437,7 +437,7 @@ extraArgs:
> []
> ```
Additional environment variables to pass to cert-manager controller binary.
Additional environment variables to pass to cert-manager controller binary.
For example:
```yaml
@@ -451,8 +451,8 @@ extraEnv:
> {}
> ```
Resources to provide to the cert-manager controller pod.
Resources to provide to the cert-manager controller pod.
For example:
```yaml
@@ -470,7 +470,7 @@ For more information, see [Resource Management for Pods and Containers](https://
> type: RuntimeDefault
> ```
Pod Security Context.
Pod Security Context.
For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
#### **containerSecurityContext** ~ `object`
@@ -532,7 +532,7 @@ Optionally set the IP families for the controller Service that should be support
#### **podDnsPolicy** ~ `string`
Pod DNS policy.
Pod DNS policy.
For more information, see [Pod's DNS Policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy).
#### **podDnsConfig** ~ `object`
@@ -552,8 +552,8 @@ Optional hostAliases for cert-manager-controller pods. May be useful when perfor
> kubernetes.io/os: linux
> ```
The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
This default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
#### **ingressShim.defaultIssuerName** ~ `string`
@@ -586,8 +586,8 @@ Configures the NO_PROXY environment variable where a HTTP proxy is required, but
> {}
> ```
A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
For example:
```yaml
@@ -607,8 +607,8 @@ affinity:
> []
> ```
A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
For example:
```yaml
@@ -624,8 +624,8 @@ tolerations:
> []
> ```
A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core
For example:
```yaml
@@ -649,9 +649,9 @@ topologySpreadConstraints:
> timeoutSeconds: 15
> ```
LivenessProbe settings for the controller container of the controller Pod.
This is enabled by default, in order to enable the clock-skew liveness probe that restarts the controller in case of a skew between the system clock and the monotonic clock. LivenessProbe durations and thresholds are based on those used for the Kubernetes controller-manager. For more information see the following on the
LivenessProbe settings for the controller container of the controller Pod.
This is enabled by default, in order to enable the clock-skew liveness probe that restarts the controller in case of a skew between the system clock and the monotonic clock. LivenessProbe durations and thresholds are based on those used for the Kubernetes controller-manager. For more information see the following on the
[Kubernetes GitHub repository](https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245)
#### **enableServiceLinks** ~ `bool`
@@ -669,8 +669,8 @@ enableServiceLinks indicates whether information about services should be inject
> true
> ```
Enable Prometheus monitoring for the cert-manager controller and webhook. If you use the Prometheus Operator, set prometheus.podmonitor.enabled or prometheus.servicemonitor.enabled, to create a PodMonitor or a
ServiceMonitor resource.
Enable Prometheus monitoring for the cert-manager controller and webhook. If you use the Prometheus Operator, set prometheus.podmonitor.enabled or prometheus.servicemonitor.enabled, to create a PodMonitor or a
ServiceMonitor resource.
Otherwise, 'prometheus.io' annotations are added to the cert-manager and cert-manager-webhook Deployments. Note that you can not enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in an error.
#### **prometheus.servicemonitor.enabled** ~ `bool`
> Default value:
@@ -745,8 +745,8 @@ Keep labels from scraped data, overriding server-side labels.
> {}
> ```
EndpointAdditionalProperties allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.
EndpointAdditionalProperties allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.
For example:
```yaml
@@ -826,8 +826,8 @@ Keep labels from scraped data, overriding server-side labels.
> {}
> ```
EndpointAdditionalProperties allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.
EndpointAdditionalProperties allows setting additional properties on the endpoint such as relabelings, metricRelabelings etc.
For example:
```yaml
@@ -858,10 +858,10 @@ endpointAdditionalProperties:
> 1
> ```
Number of replicas of the cert-manager webhook to run.
The default is 1, but in production set this to 2 or 3 to provide high availability.
Number of replicas of the cert-manager webhook to run.
The default is 1, but in production set this to 2 or 3 to provide high availability.
If `replicas > 1`, consider setting `webhook.podDisruptionBudget.enabled=true`.
#### **webhook.timeoutSeconds** ~ `number`
> Default value:
@@ -869,9 +869,9 @@ If `replicas > 1`, consider setting `webhook.podDisruptionBudget.enabled=true`.
> 30
> ```
The number of seconds the API server should wait for the webhook to respond before treating the call as a failure. The value must be between 1 and 30 seconds. For more information, see
[Validating webhook configuration v1](https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/).
The number of seconds the API server should wait for the webhook to respond before treating the call as a failure. The value must be between 1 and 30 seconds. For more information, see
[Validating webhook configuration v1](https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/).
The default is set to the maximum value of 30 seconds as users sometimes report that the connection between the K8S API server and the cert-manager webhook server times out. If *this* timeout is reached, the error message will be "context deadline exceeded", which doesn't help the user diagnose what phase of the HTTPS connection timed out. For example, it could be during DNS resolution, TCP connection, TLS negotiation, HTTP negotiation, or slow HTTP response from the webhook server. By setting this timeout to its maximum value the underlying timeout error message has more chance of being returned to the end user.
#### **webhook.config** ~ `object`
> Default value:
@@ -879,10 +879,10 @@ The default is set to the maximum value of 30 seconds as users sometimes report
> {}
> ```
This is used to configure options for the webhook pod. This allows setting options that would usually be provided using flags.
If `apiVersion` and `kind` are unspecified they default to the current latest version (currently `webhook.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.
This is used to configure options for the webhook pod. This allows setting options that would usually be provided using flags.
If `apiVersion` and `kind` are unspecified they default to the current latest version (currently `webhook.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.
For example:
```yaml
@@ -911,8 +911,8 @@ metricsTLSConfig:
> {}
> ```
The update strategy for the cert-manager webhook deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy)
The update strategy for the cert-manager webhook deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy)
For example:
```yaml
@@ -950,19 +950,19 @@ Container Security Context to be set on the webhook component container. For mor
> false
> ```
Enable or disable the PodDisruptionBudget resource.
This prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager
Enable or disable the PodDisruptionBudget resource.
This prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager
Pod is currently running.
#### **webhook.podDisruptionBudget.minAvailable** ~ `unknown`
This property configures the minimum available pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).
This property configures the minimum available pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).
It cannot be used if `maxUnavailable` is set.
#### **webhook.podDisruptionBudget.maxUnavailable** ~ `unknown`
This property configures the maximum unavailable pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).
This property configures the maximum unavailable pods for disruptions. Can either be set to an integer (e.g. 1) or a percentage value (e.g. 25%).
It cannot be used if `minAvailable` is set.
@@ -1019,7 +1019,7 @@ Additional command line flags to pass to cert-manager webhook binary. To see all
> []
> ```
Additional environment variables to pass to cert-manager webhook binary.
Additional environment variables to pass to cert-manager webhook binary.
For example:
```yaml
@@ -1040,8 +1040,8 @@ Comma separated list of feature gates that should be enabled on the webhook pod.
> {}
> ```
Resources to provide to the cert-manager webhook pod.
Resources to provide to the cert-manager webhook pod.
For example:
```yaml
@@ -1061,7 +1061,7 @@ For more information, see [Resource Management for Pods and Containers](https://
> timeoutSeconds: 1
> ```
Liveness probe values.
Liveness probe values.
For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).
#### **webhook.readinessProbe** ~ `object`
@@ -1074,7 +1074,7 @@ For more information, see [Container probes](https://kubernetes.io/docs/concepts
> timeoutSeconds: 1
> ```
Readiness probe values.
Readiness probe values.
For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes).
#### **webhook.nodeSelector** ~ `object`
@@ -1083,8 +1083,8 @@ For more information, see [Container probes](https://kubernetes.io/docs/concepts
> kubernetes.io/os: linux
> ```
The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
This default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
#### **webhook.affinity** ~ `object`
@@ -1093,8 +1093,8 @@ This default ensures that Pods are only scheduled to Linux nodes. It prevents Po
> {}
> ```
A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
For example:
```yaml
@@ -1114,8 +1114,8 @@ affinity:
> []
> ```
A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
For example:
```yaml
@@ -1131,8 +1131,8 @@ tolerations:
> []
> ```
A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
For example:
```yaml
@@ -1209,7 +1209,7 @@ Kubernetes imagePullPolicy on Deployment.
Specifies whether a service account should be created.
#### **webhook.serviceAccount.name** ~ `string`
The name of the service account to use.
The name of the service account to use.
If not set and create is true, a name is generated using the fullname template.
#### **webhook.serviceAccount.annotations** ~ `object`
@@ -1244,10 +1244,10 @@ The port that the webhook listens on for requests. In GKE private clusters, by d
> false
> ```
Specifies if the webhook should be started in hostNetwork mode.
Required for use in some managed kubernetes clusters (such as AWS EKS) with custom. CNI (such as calico), because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working
Specifies if the webhook should be started in hostNetwork mode.
Required for use in some managed kubernetes clusters (such as AWS EKS) with custom. CNI (such as calico), because control-plane managed by AWS cannot communicate with pods' IP CIDR and admission webhooks are not working
Since the default port for the webhook conflicts with kubelet on the host network, `webhook.securePort` should be changed to an available port if running in hostNetwork mode.
#### **webhook.serviceType** ~ `string`
> Default value:
@@ -1341,12 +1341,12 @@ Create the CA Injector deployment
> 1
> ```
The number of replicas of the cert-manager cainjector to run.
The default is 1, but in production set this to 2 or 3 to provide high availability.
If `replicas > 1`, consider setting `cainjector.podDisruptionBudget.enabled=true`.
The number of replicas of the cert-manager cainjector to run.
The default is 1, but in production set this to 2 or 3 to provide high availability.
If `replicas > 1`, consider setting `cainjector.podDisruptionBudget.enabled=true`.
Note that cert-manager uses leader election to ensure that there can only be a single instance active at a time.
#### **cainjector.config** ~ `object`
> Default value:
@@ -1354,10 +1354,10 @@ Note that cert-manager uses leader election to ensure that there can only be a s
> {}
> ```
This is used to configure options for the cainjector pod. It allows setting options that are usually provided via flags.
If `apiVersion` and `kind` are unspecified they default to the current latest version (currently `cainjector.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.
This is used to configure options for the cainjector pod. It allows setting options that are usually provided via flags.
If `apiVersion` and `kind` are unspecified they default to the current latest version (currently `cainjector.config.cert-manager.io/v1alpha1`). You can pin the version by specifying the `apiVersion` yourself.
For example:
```yaml
@@ -1383,8 +1383,8 @@ metricsTLSConfig:
> {}
> ```
Deployment update strategy for the cert-manager cainjector deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
Deployment update strategy for the cert-manager cainjector deployment. For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy).
For example:
```yaml
@@ -1422,21 +1422,21 @@ Container Security Context to be set on the cainjector component container. For
> false
> ```
Enable or disable the PodDisruptionBudget resource.
This prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager
Enable or disable the PodDisruptionBudget resource.
This prevents downtime during voluntary disruptions such as during a Node upgrade. For example, the PodDisruptionBudget will block `kubectl drain` if it is used on the Node where the only remaining cert-manager
Pod is currently running.
#### **cainjector.podDisruptionBudget.minAvailable** ~ `unknown`
`minAvailable` configures the minimum available pods for disruptions. It can either be set to
an integer (e.g. 1) or a percentage value (e.g. 25%).
`minAvailable` configures the minimum available pods for disruptions. It can either be set to
an integer (e.g. 1) or a percentage value (e.g. 25%).
Cannot be used if `maxUnavailable` is set.
#### **cainjector.podDisruptionBudget.maxUnavailable** ~ `unknown`
`maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to
an integer (e.g. 1) or a percentage value (e.g. 25%).
`maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to
an integer (e.g. 1) or a percentage value (e.g. 25%).
Cannot be used if `minAvailable` is set.
@@ -1465,7 +1465,7 @@ Additional command line flags to pass to cert-manager cainjector binary. To see
> []
> ```
Additional environment variables to pass to cert-manager cainjector binary.
Additional environment variables to pass to cert-manager cainjector binary.
For example:
```yaml
@@ -1486,8 +1486,8 @@ Comma separated list of feature gates that should be enabled on the cainjector p
> {}
> ```
Resources to provide to the cert-manager cainjector pod.
Resources to provide to the cert-manager cainjector pod.
For example:
```yaml
@@ -1503,8 +1503,8 @@ For more information, see [Resource Management for Pods and Containers](https://
> kubernetes.io/os: linux
> ```
The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
This default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
#### **cainjector.affinity** ~ `object`
@@ -1513,8 +1513,8 @@ This default ensures that Pods are only scheduled to Linux nodes. It prevents Po
> {}
> ```
A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
For example:
```yaml
@@ -1534,8 +1534,8 @@ affinity:
> []
> ```
A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
For example:
```yaml
@@ -1551,8 +1551,8 @@ tolerations:
> []
> ```
A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core).
For example:
```yaml
@@ -1615,7 +1615,7 @@ Kubernetes imagePullPolicy on Deployment.
Specifies whether a service account should be created.
#### **cainjector.serviceAccount.name** ~ `string`
The name of the service account to use.
The name of the service account to use.
If not set and create is true, a name is generated using the fullname template
#### **cainjector.serviceAccount.annotations** ~ `object`
@@ -1754,8 +1754,8 @@ Optional additional annotations to add to the startupapicheck Pods.
> - -v
> ```
Additional command line flags to pass to startupapicheck binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-startupapicheck:<version> --help`.
Additional command line flags to pass to startupapicheck binary. To see all available flags run `docker run quay.io/jetstack/cert-manager-startupapicheck:<version> --help`.
Verbose logging is enabled by default so that if startupapicheck fails, you can know what exactly caused the failure. Verbose logs include details of the webhook URL, IP address and TCP connect errors for example.
#### **startupapicheck.extraEnv** ~ `array`
@@ -1764,7 +1764,7 @@ Verbose logging is enabled by default so that if startupapicheck fails, you can
> []
> ```
Additional environment variables to pass to cert-manager startupapicheck binary.
Additional environment variables to pass to cert-manager startupapicheck binary.
For example:
```yaml
@@ -1778,8 +1778,8 @@ extraEnv:
> {}
> ```
Resources to provide to the cert-manager controller pod.
Resources to provide to the cert-manager controller pod.
For example:
```yaml
@@ -1795,8 +1795,8 @@ For more information, see [Resource Management for Pods and Containers](https://
> kubernetes.io/os: linux
> ```
The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with matching labels. For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/).
This default ensures that Pods are only scheduled to Linux nodes. It prevents Pods being scheduled to Windows nodes in a mixed OS cluster.
#### **startupapicheck.affinity** ~ `object`
@@ -1805,7 +1805,7 @@ This default ensures that Pods are only scheduled to Linux nodes. It prevents Po
> {}
> ```
A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core).
For example:
```yaml
@@ -1825,8 +1825,8 @@ affinity:
> []
> ```
A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core).
For example:
```yaml
@@ -1893,7 +1893,7 @@ Automounting API credentials for a particular pod.
Specifies whether a service account should be created.
#### **startupapicheck.serviceAccount.name** ~ `string`
The name of the service account to use.
The name of the service account to use.
If not set and create is true, a name is generated using the fullname template.
#### **startupapicheck.serviceAccount.annotations** ~ `object`
@@ -1945,8 +1945,8 @@ enableServiceLinks indicates whether information about services should be inject
> []
> ```
Create dynamic manifests via values.
Create dynamic manifests via values.
For example:
```yaml

12
packages/system/cert-manager/charts/cert-manager/Chart.yaml
View File

@@ -1,13 +1,15 @@
annotations:
artifacthub.io/category: security
artifacthub.io/license: Apache-2.0
artifacthub.io/prerelease: "false"
artifacthub.io/signKey: |
fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
apiVersion: v1
appVersion: v1.12.3
apiVersion: v2
appVersion: v1.16.3
description: A Helm chart for cert-manager
home: https://github.com/cert-manager/cert-manager
icon: https://raw.githubusercontent.com/cert-manager/cert-manager/d53c0b9270f8cd90d908460d69502694e1838f5f/logo/logo-small.png
home: https://cert-manager.io
icon: https://raw.githubusercontent.com/cert-manager/community/4d35a69437d21b76322157e6284be4cd64e6d2b7/logo/logo-small.png
keywords:
- cert-manager
- kube-lego
@@ -21,4 +23,4 @@ maintainers:
name: cert-manager
sources:
- https://github.com/cert-manager/cert-manager
version: v1.12.3
version: v1.16.3

2067
packages/system/cert-manager/charts/cert-manager/README.md
View File

File diff suppressed because it is too large Load Diff

3
packages/system/cert-manager/charts/cert-manager/templates/NOTES.txt
View File

@@ -1,3 +1,6 @@
{{- if .Values.installCRDs }}
⚠️ WARNING: `installCRDs` is deprecated, use `crds.enabled` instead.
{{- end }}
cert-manager {{ .Chart.AppVersion }} has been deployed successfully!
In order to begin issuing certificates, you will need to set up a ClusterIssuer

30
packages/system/cert-manager/charts/cert-manager/templates/_helpers.tpl
View File

@@ -152,7 +152,7 @@ Labels that should be added on each resource
*/}}
{{- define "labels" -}}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- if eq (default "helm" .Values.creator) "helm" }}
{{- if eq .Values.creator "helm" }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
helm.sh/chart: {{ include "chartName" . }}
{{- end -}}
@@ -172,3 +172,31 @@ https://github.com/helm/helm/issues/5358
{{- define "cert-manager.namespace" -}}
{{ .Values.namespace | default .Release.Namespace }}
{{- end -}}
{{/*
Util function for generating the image URL based on the provided options.
IMPORTANT: This function is standardized across all charts in the cert-manager GH organization.
Any changes to this function should also be made in cert-manager, trust-manager, approver-policy, ...
See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linked PRs.
*/}}
{{- define "image" -}}
{{- $defaultTag := index . 1 -}}
{{- with index . 0 -}}
{{- if .registry -}}{{ printf "%s/%s" .registry .repository }}{{- else -}}{{- .repository -}}{{- end -}}
{{- if .digest -}}{{ printf "@%s" .digest }}{{- else -}}{{ printf ":%s" (default $defaultTag .tag) }}{{- end -}}
{{- end }}
{{- end }}
{{/*
Check that the user has not set both .installCRDs and .crds.enabled or
set .installCRDs and disabled .crds.keep.
.installCRDs is deprecated and users should use .crds.enabled and .crds.keep instead.
*/}}
{{- define "cert-manager.crd-check" -}}
{{- if and (.Values.installCRDs) (.Values.crds.enabled) }}
{{- fail "ERROR: the deprecated .installCRDs option cannot be enabled at the same time as its replacement .crds.enabled" }}
{{- end }}
{{- if and (.Values.installCRDs) (not .Values.crds.keep) }}
{{- fail "ERROR: .crds.keep is not compatible with .installCRDs, please use .crds.enabled and .crds.keep instead" }}
{{- end }}
{{- end -}}

19
packages/system/cert-manager/charts/cert-manager/templates/cainjector-config.yaml Normal file
View File

@@ -0,0 +1,19 @@
{{- if .Values.cainjector.config -}}
{{- $config := .Values.cainjector.config -}}
{{- $_ := set $config "apiVersion" (default "cainjector.config.cert-manager.io/v1alpha1" $config.apiVersion) -}}
{{- $_ := set $config "kind" (default "CAInjectorConfiguration" $config.kind) -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "cainjector.fullname" . }}
namespace: {{ include "cert-manager.namespace" . }}
labels:
app: {{ include "cainjector.name" . }}
app.kubernetes.io/name: {{ include "cainjector.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "cainjector"
{{- include "labels" . | nindent 4 }}
data:
config.yaml: |
{{- $config | toYaml | nindent 4 }}
{{- end -}}

55
packages/system/cert-manager/charts/cert-manager/templates/cainjector-deployment.yaml
View File

@@ -16,6 +16,10 @@ metadata:
{{- end }}
spec:
replicas: {{ .Values.cainjector.replicaCount }}
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
{{- if not (has (quote .Values.global.revisionHistoryLimit) (list "" (quote ""))) }}
revisionHistoryLimit: {{ .Values.global.revisionHistoryLimit }}
{{- end }}
selector:
matchLabels:
app.kubernetes.io/name: {{ include "cainjector.name" . }}
@@ -40,11 +44,20 @@ spec:
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- if and .Values.prometheus.enabled (not (or .Values.prometheus.servicemonitor.enabled .Values.prometheus.podmonitor.enabled)) }}
{{- if not .Values.cainjector.podAnnotations }}
annotations:
{{- end }}
prometheus.io/path: "/metrics"
prometheus.io/scrape: 'true'
prometheus.io/port: '9402'
{{- end }}
spec:
serviceAccountName: {{ template "cainjector.serviceAccountName" . }}
{{- if hasKey .Values.cainjector "automountServiceAccountToken" }}
automountServiceAccountToken: {{ .Values.cainjector.automountServiceAccountToken }}
{{- end }}
enableServiceLinks: {{ .Values.cainjector.enableServiceLinks }}
{{- with .Values.global.priorityClassName }}
priorityClassName: {{ . | quote }}
{{- end }}
@@ -54,14 +67,16 @@ spec:
{{- end }}
containers:
- name: {{ .Chart.Name }}-cainjector
{{- with .Values.cainjector.image }}
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
{{- end }}
image: "{{ template "image" (tuple .Values.cainjector.image $.Chart.AppVersion) }}"
imagePullPolicy: {{ .Values.cainjector.image.pullPolicy }}
args:
{{- if .Values.global.logLevel }}
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
{{- if not (has (quote .Values.global.logLevel) (list "" (quote ""))) }}
- --v={{ .Values.global.logLevel }}
{{- end }}
{{- if .Values.cainjector.config }}
- --config=/var/cert-manager/config/config.yaml
{{- end }}
{{- with .Values.global.leaderElection }}
- --leader-election-namespace={{ .namespace }}
{{- if .leaseDuration }}
@@ -74,14 +89,29 @@ spec:
- --leader-election-retry-period={{ .retryPeriod }}
{{- end }}
{{- end }}
{{- with .Values.cainjector.featureGates}}
- --feature-gates={{ . }}
{{- end}}
{{- with .Values.cainjector.extraArgs }}
{{- toYaml . | nindent 10 }}
{{- end }}
{{- if not .Values.prometheus.enabled }}
- --metrics-listen-address=0
{{- end }}
{{- if .Values.prometheus.enabled }}
ports:
- containerPort: 9402
name: http-metrics
protocol: TCP
{{- end }}
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
{{- with .Values.cainjector.extraEnv }}
{{- toYaml . | nindent 10 }}
{{- end }}
{{- with .Values.cainjector.containerSecurityContext }}
securityContext:
{{- toYaml . | nindent 12 }}
@@ -90,9 +120,15 @@ spec:
resources:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.cainjector.volumeMounts }}
{{- if or .Values.cainjector.config .Values.cainjector.volumeMounts }}
volumeMounts:
{{- if .Values.cainjector.config }}
- name: config
mountPath: /var/cert-manager/config
{{- end }}
{{- with .Values.cainjector.volumeMounts }}
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
{{- with .Values.cainjector.nodeSelector }}
nodeSelector:
@@ -110,8 +146,15 @@ spec:
topologySpreadConstraints:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.cainjector.volumes }}
{{- if or .Values.cainjector.volumes .Values.cainjector.config }}
volumes:
{{- if .Values.cainjector.config }}
- name: config
configMap:
name: {{ include "cainjector.fullname" . }}
{{- end }}
{{ with .Values.cainjector.volumes }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
{{- end }}

11
packages/system/cert-manager/charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml
View File

@@ -17,10 +17,13 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "cainjector"
{{- with .Values.cainjector.podDisruptionBudget.minAvailable }}
minAvailable: {{ . }}
{{- if not (or (hasKey .Values.cainjector.podDisruptionBudget "minAvailable") (hasKey .Values.cainjector.podDisruptionBudget "maxUnavailable")) }}
minAvailable: 1 # Default value because minAvailable and maxUnavailable are not set
{{- end }}
{{- with .Values.cainjector.podDisruptionBudget.maxUnavailable }}
maxUnavailable: {{ . }}
{{- if hasKey .Values.cainjector.podDisruptionBudget "minAvailable" }}
minAvailable: {{ .Values.cainjector.podDisruptionBudget.minAvailable }}
{{- end }}
{{- if hasKey .Values.cainjector.podDisruptionBudget "maxUnavailable" }}
maxUnavailable: {{ .Values.cainjector.podDisruptionBudget.maxUnavailable }}
{{- end }}
{{- end }}

53
packages/system/cert-manager/charts/cert-manager/templates/cainjector-rbac.yaml
View File

@@ -101,3 +101,56 @@ subjects:
namespace: {{ include "cert-manager.namespace" . }}
{{- end }}
{{- end }}
{{- $certmanagerNamespace := include "cert-manager.namespace" . }}
{{- if (.Values.cainjector.config.metricsTLSConfig).dynamic }}
{{- if $certmanagerNamespace | eq .Values.cainjector.config.metricsTLSConfig.dynamic.secretNamespace }}
---
# Metrics server dynamic TLS serving certificate rules
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ template "cainjector.fullname" . }}:dynamic-serving
namespace: {{ include "cert-manager.namespace" . }}
labels:
app: {{ include "cainjector.name" . }}
app.kubernetes.io/name: {{ include "cainjector.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "cainjector"
{{- include "labels" . | nindent 4 }}
rules:
- apiGroups: [""]
resources: ["secrets"]
resourceNames:
# Allow cainjector to read and update the metrics CA Secret when dynamic TLS is
# enabled for the metrics server and if the Secret is configured to be in the
# same namespace as cert-manager.
- {{ .Values.cainjector.config.metricsTLSConfig.dynamic.secretName | quote }}
verbs: ["get", "list", "watch", "update"]
# It's not possible to grant CREATE permission on a single resourceName.
- apiGroups: [""]
resources: ["secrets"]
verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "cainjector.fullname" . }}:dynamic-serving
namespace: {{ include "cert-manager.namespace" . }}
labels:
app: {{ include "cainjector.name" . }}
app.kubernetes.io/name: {{ include "cainjector.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "cainjector"
{{- include "labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "cainjector.fullname" . }}:dynamic-serving
subjects:
- kind: ServiceAccount
name: {{ template "cainjector.serviceAccountName" . }}
namespace: {{ include "cert-manager.namespace" . }}
{{- end }}
{{- end }}

30
packages/system/cert-manager/charts/cert-manager/templates/cainjector-service.yaml Normal file
View File

@@ -0,0 +1,30 @@
{{- if and .Values.prometheus.enabled (not .Values.prometheus.podmonitor.enabled) }}
apiVersion: v1
kind: Service
metadata:
name: {{ template "cainjector.fullname" . }}
namespace: {{ include "cert-manager.namespace" . }}
{{- with .Values.cainjector.serviceAnnotations }}
annotations:
{{ toYaml . | indent 4 }}
{{- end }}
labels:
app: {{ include "cainjector.name" . }}
app.kubernetes.io/name: {{ include "cainjector.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "cainjector"
{{- include "labels" . | nindent 4 }}
{{- with .Values.cainjector.serviceLabels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
type: ClusterIP
ports:
- protocol: TCP
port: 9402
name: http-metrics
selector:
app.kubernetes.io/name: {{ include "cainjector.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "cainjector"
{{- end }}

19
packages/system/cert-manager/charts/cert-manager/templates/controller-config.yaml Normal file
View File

@@ -0,0 +1,19 @@
{{- if .Values.config -}}
{{- $config := .Values.config -}}
{{- $_ := set $config "apiVersion" (default "controller.config.cert-manager.io/v1alpha1" $config.apiVersion) -}}
{{- $_ := set $config "kind" (default "ControllerConfiguration" $config.kind) -}}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "cert-manager.fullname" . }}
namespace: {{ include "cert-manager.namespace" . }}
labels:
app: {{ include "cert-manager.name" . }}
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "controller"
{{- include "labels" . | nindent 4 }}
data:
config.yaml: |
{{- $config | toYaml | nindent 4 }}
{{- end -}}

9227
packages/system/cert-manager/charts/cert-manager/templates/crds.yaml
View File

File diff suppressed because it is too large Load Diff

41
packages/system/cert-manager/charts/cert-manager/templates/deployment.yaml
View File

@@ -15,6 +15,10 @@ metadata:
{{- end }}
spec:
replicas: {{ .Values.replicaCount }}
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
{{- if not (has (quote .Values.global.revisionHistoryLimit) (list "" (quote ""))) }}
revisionHistoryLimit: {{ .Values.global.revisionHistoryLimit }}
{{- end }}
selector:
matchLabels:
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
@@ -39,7 +43,7 @@ spec:
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- if and .Values.prometheus.enabled (not .Values.prometheus.servicemonitor.enabled) }}
{{- if and .Values.prometheus.enabled (not (or .Values.prometheus.servicemonitor.enabled .Values.prometheus.podmonitor.enabled)) }}
{{- if not .Values.podAnnotations }}
annotations:
{{- end }}
@@ -52,6 +56,7 @@ spec:
{{- if hasKey .Values "automountServiceAccountToken" }}
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
{{- end }}
enableServiceLinks: {{ .Values.enableServiceLinks }}
{{- with .Values.global.priorityClassName }}
priorityClassName: {{ . | quote }}
{{- end }}
@@ -59,20 +64,30 @@ spec:
securityContext:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.volumes }}
{{- if or .Values.volumes .Values.config}}
volumes:
{{- if .Values.config }}
- name: config
configMap:
name: {{ include "cert-manager.fullname" . }}
{{- end }}
{{ with .Values.volumes }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
containers:
- name: {{ .Chart.Name }}-controller
{{- with .Values.image }}
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
{{- end }}
image: "{{ template "image" (tuple .Values.image $.Chart.AppVersion) }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
args:
{{- if .Values.global.logLevel }}
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
{{- if not (has (quote .Values.global.logLevel) (list "" (quote ""))) }}
- --v={{ .Values.global.logLevel }}
{{- end }}
{{- if .Values.config }}
- --config=/var/cert-manager/config/config.yaml
{{- end }}
{{- $config := default .Values.config "" }}
{{- if .Values.clusterResourceNamespace }}
- --cluster-resource-namespace={{ .Values.clusterResourceNamespace }}
{{- else }}
@@ -122,6 +137,9 @@ spec:
{{- with .Values.dns01RecursiveNameservers }}
- --dns01-recursive-nameservers={{ . }}
{{- end }}
{{- if .Values.disableAutoApproval }}
- --controllers=-certificaterequests-approver
{{- end }}
ports:
- containerPort: 9402
name: http-metrics
@@ -133,9 +151,15 @@ spec:
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.volumeMounts }}
{{- if or .Values.config .Values.volumeMounts }}
volumeMounts:
{{- if .Values.config }}
- name: config
mountPath: /var/cert-manager/config
{{- end }}
{{- with .Values.volumeMounts }}
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
env:
- name: POD_NAMESPACE
@@ -202,3 +226,6 @@ spec:
dnsConfig:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.hostAliases }}
hostAliases: {{ toYaml . | nindent 8 }}
{{- end }}

4
packages/system/cert-manager/charts/cert-manager/templates/extras-objects.yaml Normal file
View File

@@ -0,0 +1,4 @@
{{ range .Values.extraObjects }}
---
{{ tpl . $ }}
{{ end }}

4
packages/system/cert-manager/charts/cert-manager/templates/networkpolicy-egress.yaml
View File

@@ -11,13 +11,9 @@ spec:
{{- end }}
podSelector:
matchLabels:
app: {{ include "webhook.name" . }}
app.kubernetes.io/name: {{ include "webhook.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "webhook"
{{- with .Values.webhook.podLabels }}
{{- toYaml . | nindent 6 }}
{{- end }}
policyTypes:
- Egress
{{- end }}

10
packages/system/cert-manager/charts/cert-manager/templates/networkpolicy-webhooks.yaml
View File

@@ -12,13 +12,9 @@ spec:
{{- end }}
podSelector:
matchLabels:
app: {{ include "webhook.name" . }}
app.kubernetes.io/name: {{ include "webhook.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "webhook"
{{- with .Values.webhook.podLabels }}
{{- toYaml . | nindent 6 }}
{{- end }}
app.kubernetes.io/name: {{ include "webhook.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "webhook"
policyTypes:
- Ingress

11
packages/system/cert-manager/charts/cert-manager/templates/poddisruptionbudget.yaml
View File

@@ -17,10 +17,13 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "controller"
{{- with .Values.podDisruptionBudget.minAvailable }}
minAvailable: {{ . }}
{{- if not (or (hasKey .Values.podDisruptionBudget "minAvailable") (hasKey .Values.podDisruptionBudget "maxUnavailable")) }}
minAvailable: 1 # Default value because minAvailable and maxUnavailable are not set
{{- end }}
{{- with .Values.podDisruptionBudget.maxUnavailable }}
maxUnavailable: {{ . }}
{{- if hasKey .Values.podDisruptionBudget "minAvailable" }}
minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
{{- end }}
{{- if hasKey .Values.podDisruptionBudget "maxUnavailable" }}
maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
{{- end }}
{{- end }}

63
packages/system/cert-manager/charts/cert-manager/templates/podmonitor.yaml Normal file
View File

@@ -0,0 +1,63 @@
{{- if and .Values.prometheus.enabled (and .Values.prometheus.podmonitor.enabled .Values.prometheus.servicemonitor.enabled) }}
{{- fail "Either .Values.prometheus.podmonitor.enabled or .Values.prometheus.servicemonitor.enabled can be enabled at a time, but not both." }}
{{- else if and .Values.prometheus.enabled .Values.prometheus.podmonitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: PodMonitor
metadata:
name: {{ template "cert-manager.fullname" . }}
{{- if .Values.prometheus.podmonitor.namespace }}
namespace: {{ .Values.prometheus.podmonitor.namespace }}
{{- else }}
namespace: {{ include "cert-manager.namespace" . }}
{{- end }}
labels:
app: {{ include "cert-manager.name" . }}
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "controller"
{{- include "labels" . | nindent 4 }}
prometheus: {{ .Values.prometheus.podmonitor.prometheusInstance }}
{{- with .Values.prometheus.podmonitor.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- if .Values.prometheus.podmonitor.annotations }}
annotations:
{{- with .Values.prometheus.podmonitor.annotations }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}
spec:
jobLabel: {{ template "cert-manager.fullname" . }}
selector:
matchExpressions:
- key: app.kubernetes.io/name
operator: In
values:
- {{ include "cainjector.name" . }}
- {{ template "cert-manager.name" . }}
- {{ include "webhook.name" . }}
- key: app.kubernetes.io/instance
operator: In
values:
- {{ .Release.Name }}
- key: app.kubernetes.io/component
operator: In
values:
- cainjector
- controller
- webhook
{{- if .Values.prometheus.podmonitor.namespace }}
namespaceSelector:
matchNames:
- {{ include "cert-manager.namespace" . }}
{{- end }}
podMetricsEndpoints:
- port: http-metrics
path: {{ .Values.prometheus.podmonitor.path }}
interval: {{ .Values.prometheus.podmonitor.interval }}
scrapeTimeout: {{ .Values.prometheus.podmonitor.scrapeTimeout }}
honorLabels: {{ .Values.prometheus.podmonitor.honorLabels }}
{{- with .Values.prometheus.podmonitor.endpointAdditionalProperties }}
{{- toYaml . | nindent 6 }}
{{- end }}
{{- end }}

81
packages/system/cert-manager/charts/cert-manager/templates/rbac.yaml
View File

@@ -39,13 +39,56 @@ roleRef:
kind: Role
name: {{ template "cert-manager.fullname" . }}:leaderelection
subjects:
- apiGroup: ""
kind: ServiceAccount
- kind: ServiceAccount
name: {{ template "cert-manager.serviceAccountName" . }}
namespace: {{ include "cert-manager.namespace" . }}
---
{{- if .Values.serviceAccount.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
namespace: {{ include "cert-manager.namespace" . }}
labels:
app: {{ include "cert-manager.name" . }}
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "controller"
{{- include "labels" . | nindent 4 }}
rules:
- apiGroups: [""]
resources: ["serviceaccounts/token"]
resourceNames: ["{{ template "cert-manager.serviceAccountName" . }}"]
verbs: ["create"]
---
# grant cert-manager permission to create tokens for the serviceaccount
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ include "cert-manager.fullname" . }}-{{ template "cert-manager.serviceAccountName" . }}-tokenrequest
namespace: {{ include "cert-manager.namespace" . }}
labels:
app: {{ include "cert-manager.name" . }}
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "controller"
{{- include "labels" . | nindent 4 }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "cert-manager.serviceAccountName" . }}-tokenrequest
subjects:
- kind: ServiceAccount
name: {{ template "cert-manager.serviceAccountName" . }}
namespace: {{ include "cert-manager.namespace" . }}
{{- end }}
---
# Issuer controller role
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
@@ -398,6 +441,26 @@ subjects:
namespace: {{ include "cert-manager.namespace" . }}
kind: ServiceAccount
{{- if .Values.global.rbac.aggregateClusterRoles }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ template "cert-manager.fullname" . }}-cluster-view
labels:
app: {{ include "cert-manager.name" . }}
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "controller"
{{- include "labels" . | nindent 4 }}
rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
rules:
- apiGroups: ["cert-manager.io"]
resources: ["clusterissuers"]
verbs: ["get", "list", "watch"]
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
@@ -414,6 +477,7 @@ metadata:
rbac.authorization.k8s.io/aggregate-to-view: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
{{- end }}
rules:
- apiGroups: ["cert-manager.io"]
@@ -453,6 +517,8 @@ rules:
---
{{- if not .Values.disableAutoApproval -}}
# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
@@ -468,7 +534,12 @@ rules:
- apiGroups: ["cert-manager.io"]
resources: ["signers"]
verbs: ["approve"]
resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
{{- with .Values.approveSignerNames }}
resourceNames:
{{- range . }}
- {{ . | quote }}
{{- end }}
{{- end }}
---
@@ -493,8 +564,10 @@ subjects:
---
{{- end -}}
# Permission to:
# - Update and sign CertificatSigningeRequests referencing cert-manager.io Issuers and ClusterIssuers
# - Update and sign CertificateSigningRequests referencing cert-manager.io Issuers and ClusterIssuers
# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole

8
packages/system/cert-manager/charts/cert-manager/templates/service.yaml
View File

@@ -1,4 +1,4 @@
{{- if .Values.prometheus.enabled }}
{{- if and .Values.prometheus.enabled (not .Values.prometheus.podmonitor.enabled) }}
apiVersion: v1
kind: Service
metadata:
@@ -19,6 +19,12 @@ metadata:
{{- end }}
spec:
type: ClusterIP
{{- if .Values.serviceIPFamilyPolicy }}
ipFamilyPolicy: {{ .Values.serviceIPFamilyPolicy }}
{{- end }}
{{- if .Values.serviceIPFamilies }}
ipFamilies: {{ .Values.serviceIPFamilies | toYaml | nindent 2 }}
{{- end }}
ports:
- protocol: TCP
port: 9402

2
packages/system/cert-manager/charts/cert-manager/templates/serviceaccount.yaml
View File

@@ -20,6 +20,6 @@ metadata:
app.kubernetes.io/component: "controller"
{{- include "labels" . | nindent 4 }}
{{- with .Values.serviceAccount.labels }}
{{ toYaml . | nindent 4 }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}

28
packages/system/cert-manager/charts/cert-manager/templates/servicemonitor.yaml
View File

@@ -1,4 +1,6 @@
{{- if and .Values.prometheus.enabled .Values.prometheus.servicemonitor.enabled }}
{{- if and .Values.prometheus.enabled (and .Values.prometheus.podmonitor.enabled .Values.prometheus.servicemonitor.enabled) }}
{{- fail "Either .Values.prometheus.podmonitor.enabled or .Values.prometheus.servicemonitor.enabled can be enabled at a time, but not both." }}
{{- else if and .Values.prometheus.enabled .Values.prometheus.servicemonitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
@@ -27,10 +29,23 @@ metadata:
spec:
jobLabel: {{ template "cert-manager.fullname" . }}
selector:
matchLabels:
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "controller"
matchExpressions:
- key: app.kubernetes.io/name
operator: In
values:
- {{ include "cainjector.name" . }}
- {{ template "cert-manager.name" . }}
- {{ include "webhook.name" . }}
- key: app.kubernetes.io/instance
operator: In
values:
- {{ .Release.Name }}
- key: app.kubernetes.io/component
operator: In
values:
- cainjector
- controller
- webhook
{{- if .Values.prometheus.servicemonitor.namespace }}
namespaceSelector:
matchNames:
@@ -42,4 +57,7 @@ spec:
interval: {{ .Values.prometheus.servicemonitor.interval }}
scrapeTimeout: {{ .Values.prometheus.servicemonitor.scrapeTimeout }}
honorLabels: {{ .Values.prometheus.servicemonitor.honorLabels }}
{{- with .Values.prometheus.servicemonitor.endpointAdditionalProperties }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}

13
packages/system/cert-manager/charts/cert-manager/templates/startupapicheck-job.yaml
View File

@@ -37,6 +37,7 @@ spec:
{{- if hasKey .Values.startupapicheck "automountServiceAccountToken" }}
automountServiceAccountToken: {{ .Values.startupapicheck.automountServiceAccountToken }}
{{- end }}
enableServiceLinks: {{ .Values.startupapicheck.enableServiceLinks }}
{{- with .Values.global.priorityClassName }}
priorityClassName: {{ . | quote }}
{{- end }}
@@ -46,9 +47,7 @@ spec:
{{- end }}
containers:
- name: {{ .Chart.Name }}-startupapicheck
{{- with .Values.startupapicheck.image }}
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
{{- end }}
image: "{{ template "image" (tuple .Values.startupapicheck.image $.Chart.AppVersion) }}"
imagePullPolicy: {{ .Values.startupapicheck.image.pullPolicy }}
args:
- check
@@ -61,6 +60,14 @@ spec:
securityContext:
{{- toYaml . | nindent 12 }}
{{- end }}
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
{{- with .Values.startupapicheck.extraEnv }}
{{- toYaml . | nindent 10 }}
{{- end }}
{{- with .Values.startupapicheck.resources }}
resources:
{{- toYaml . | nindent 12 }}

2
packages/system/cert-manager/charts/cert-manager/templates/startupapicheck-rbac.yaml
View File

@@ -18,7 +18,7 @@ metadata:
{{- end }}
rules:
- apiGroups: ["cert-manager.io"]
resources: ["certificates"]
resources: ["certificaterequests"]
verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1

16
packages/system/cert-manager/charts/cert-manager/templates/webhook-config.yaml
View File

@@ -1,12 +1,7 @@
{{- if .Values.webhook.config -}}
{{- if not .Values.webhook.config.apiVersion -}}
{{- fail "webhook.config.apiVersion must be set" -}}
{{- end -}}
{{- if not .Values.webhook.config.kind -}}
{{- fail "webhook.config.kind must be set" -}}
{{- end -}}
{{- end -}}
{{- $config := .Values.webhook.config -}}
{{- $_ := set $config "apiVersion" (default "webhook.config.cert-manager.io/v1alpha1" $config.apiVersion) -}}
{{- $_ := set $config "kind" (default "WebhookConfiguration" $config.kind) -}}
apiVersion: v1
kind: ConfigMap
metadata:
@@ -19,7 +14,6 @@ metadata:
app.kubernetes.io/component: "webhook"
{{- include "labels" . | nindent 4 }}
data:
{{- if .Values.webhook.config }}
config.yaml: |
{{ .Values.webhook.config | toYaml | nindent 4 }}
{{- end }}
{{- $config | toYaml | nindent 4 }}
{{- end -}}

46
packages/system/cert-manager/charts/cert-manager/templates/webhook-deployment.yaml
View File

@@ -15,6 +15,10 @@ metadata:
{{- end }}
spec:
replicas: {{ .Values.webhook.replicaCount }}
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
{{- if not (has (quote .Values.global.revisionHistoryLimit) (list "" (quote ""))) }}
revisionHistoryLimit: {{ .Values.global.revisionHistoryLimit }}
{{- end }}
selector:
matchLabels:
app.kubernetes.io/name: {{ include "webhook.name" . }}
@@ -39,11 +43,20 @@ spec:
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- if and .Values.prometheus.enabled (not (or .Values.prometheus.servicemonitor.enabled .Values.prometheus.podmonitor.enabled)) }}
{{- if not .Values.webhook.podAnnotations }}
annotations:
{{- end }}
prometheus.io/path: "/metrics"
prometheus.io/scrape: 'true'
prometheus.io/port: '9402'
{{- end }}
spec:
serviceAccountName: {{ template "webhook.serviceAccountName" . }}
{{- if hasKey .Values.webhook "automountServiceAccountToken" }}
automountServiceAccountToken: {{ .Values.webhook.automountServiceAccountToken }}
{{- end }}
enableServiceLinks: {{ .Values.webhook.enableServiceLinks }}
{{- with .Values.global.priorityClassName }}
priorityClassName: {{ . | quote }}
{{- end }}
@@ -54,14 +67,16 @@ spec:
{{- if .Values.webhook.hostNetwork }}
hostNetwork: true
{{- end }}
{{- if .Values.webhook.hostNetwork }}
dnsPolicy: ClusterFirstWithHostNet
{{- end }}
containers:
- name: {{ .Chart.Name }}-webhook
{{- with .Values.webhook.image }}
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
{{- end }}
image: "{{ template "image" (tuple .Values.webhook.image $.Chart.AppVersion) }}"
imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
args:
{{- if .Values.global.logLevel }}
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
{{- if not (has (quote .Values.global.logLevel) (list "" (quote ""))) }}
- --v={{ .Values.global.logLevel }}
{{- end }}
{{- if .Values.webhook.config }}
@@ -71,8 +86,8 @@ spec:
{{ if not $config.securePort -}}
- --secure-port={{ .Values.webhook.securePort }}
{{- end }}
{{- if .Values.featureGates }}
- --feature-gates={{ .Values.featureGates }}
{{- if .Values.webhook.featureGates }}
- --feature-gates={{ .Values.webhook.featureGates }}
{{- end }}
{{- $tlsConfig := default $config.tlsConfig "" }}
{{ if or (not $config.tlsConfig) (and (not $tlsConfig.dynamic) (not $tlsConfig.filesystem) ) -}}
@@ -88,6 +103,9 @@ spec:
{{- with .Values.webhook.extraArgs }}
{{- toYaml . | nindent 10 }}
{{- end }}
{{- if not .Values.prometheus.enabled }}
- --metrics-listen-address=0
{{- end }}
ports:
- name: https
protocol: TCP
@@ -105,6 +123,11 @@ spec:
{{- else }}
containerPort: 6080
{{- end }}
{{- if .Values.prometheus.enabled }}
- containerPort: 9402
name: http-metrics
protocol: TCP
{{- end }}
livenessProbe:
httpGet:
path: /livez
@@ -142,6 +165,9 @@ spec:
valueFrom:
fieldRef:
fieldPath: metadata.namespace
{{- with .Values.webhook.extraEnv }}
{{- toYaml . | nindent 10 }}
{{- end }}
{{- with .Values.webhook.resources }}
resources:
{{- toYaml . | nindent 12 }}
@@ -152,8 +178,8 @@ spec:
- name: config
mountPath: /var/cert-manager/config
{{- end }}
{{- if .Values.webhook.volumeMounts }}
{{- toYaml .Values.webhook.volumeMounts | nindent 12 }}
{{- with .Values.webhook.volumeMounts }}
{{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
{{- with .Values.webhook.nodeSelector }}
@@ -179,7 +205,7 @@ spec:
configMap:
name: {{ include "webhook.fullname" . }}
{{- end }}
{{- if .Values.webhook.volumes }}
{{- toYaml .Values.webhook.volumes | nindent 8 }}
{{- with .Values.webhook.volumes }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}

10
packages/system/cert-manager/charts/cert-manager/templates/webhook-mutating-webhook.yaml
View File

@@ -15,17 +15,19 @@ metadata:
{{- end }}
webhooks:
- name: webhook.cert-manager.io
{{- with .Values.webhook.mutatingWebhookConfiguration.namespaceSelector }}
namespaceSelector:
{{- toYaml . | nindent 6 }}
{{- end }}
rules:
- apiGroups:
- "cert-manager.io"
- "acme.cert-manager.io"
apiVersions:
- "v1"
operations:
- CREATE
- UPDATE
resources:
- "*/*"
- "certificaterequests"
admissionReviewVersions: ["v1"]
# This webhook only accepts v1 cert-manager resources.
# Equivalent matchPolicy ensures that non-v1 resource requests are sent to
@@ -43,4 +45,4 @@ webhooks:
name: {{ template "webhook.fullname" . }}
namespace: {{ include "cert-manager.namespace" . }}
path: /mutate
{{- end }}
{{- end }}

11
packages/system/cert-manager/charts/cert-manager/templates/webhook-poddisruptionbudget.yaml
View File

@@ -17,10 +17,13 @@ spec:
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/component: "webhook"
{{- with .Values.webhook.podDisruptionBudget.minAvailable }}
minAvailable: {{ . }}
{{- if not (or (hasKey .Values.webhook.podDisruptionBudget "minAvailable") (hasKey .Values.webhook.podDisruptionBudget "maxUnavailable")) }}
minAvailable: 1 # Default value because minAvailable and maxUnavailable are not set
{{- end }}
{{- with .Values.webhook.podDisruptionBudget.maxUnavailable }}
maxUnavailable: {{ . }}
{{- if hasKey .Values.webhook.podDisruptionBudget "minAvailable" }}
minAvailable: {{ .Values.webhook.podDisruptionBudget.minAvailable }}
{{- end }}
{{- if hasKey .Values.webhook.podDisruptionBudget "maxUnavailable" }}
maxUnavailable: {{ .Values.webhook.podDisruptionBudget.maxUnavailable }}
{{- end }}
{{- end }}

15
packages/system/cert-manager/charts/cert-manager/templates/webhook-rbac.yaml
View File

@@ -15,6 +15,15 @@ rules:
resources: ["secrets"]
resourceNames:
- '{{ template "webhook.fullname" . }}-ca'
{{- $certmanagerNamespace := include "cert-manager.namespace" . }}
{{- with (.Values.webhook.config.metricsTLSConfig).dynamic }}
{{- if $certmanagerNamespace | eq .secretNamespace }}
# Allow webhook to read and update the metrics CA Secret when dynamic TLS is
# enabled for the metrics server and if the Secret is configured to be in the
# same namespace as cert-manager.
- {{ .secretName | quote }}
{{- end }}
{{- end }}
verbs: ["get", "list", "watch", "update"]
# It's not possible to grant CREATE permission on a single resourceName.
- apiGroups: [""]
@@ -38,8 +47,7 @@ roleRef:
kind: Role
name: {{ template "webhook.fullname" . }}:dynamic-serving
subjects:
- apiGroup: ""
kind: ServiceAccount
- kind: ServiceAccount
name: {{ template "webhook.serviceAccountName" . }}
namespace: {{ include "cert-manager.namespace" . }}
@@ -76,8 +84,7 @@ roleRef:
kind: ClusterRole
name: {{ template "webhook.fullname" . }}:subjectaccessreviews
subjects:
- apiGroup: ""
kind: ServiceAccount
- kind: ServiceAccount
name: {{ template "webhook.serviceAccountName" . }}
namespace: {{ include "cert-manager.namespace" . }}
{{- end }}

12
packages/system/cert-manager/charts/cert-manager/templates/webhook-service.yaml
View File

@@ -18,6 +18,12 @@ metadata:
{{- end }}
spec:
type: {{ .Values.webhook.serviceType }}
{{- if .Values.webhook.serviceIPFamilyPolicy }}
ipFamilyPolicy: {{ .Values.webhook.serviceIPFamilyPolicy }}
{{- end }}
{{- if .Values.webhook.serviceIPFamilies }}
ipFamilies: {{ .Values.webhook.serviceIPFamilies | toYaml | nindent 2 }}
{{- end }}
{{- with .Values.webhook.loadBalancerIP }}
loadBalancerIP: {{ . }}
{{- end }}
@@ -26,6 +32,12 @@ spec:
port: 443
protocol: TCP
targetPort: "https"
{{- if and .Values.prometheus.enabled (not .Values.prometheus.podmonitor.enabled) }}
- name: metrics
port: 9402
protocol: TCP
targetPort: "http-metrics"
{{- end }}
selector:
app.kubernetes.io/name: {{ include "webhook.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}

12
packages/system/cert-manager/charts/cert-manager/templates/webhook-validating-webhook.yaml
View File

@@ -15,16 +15,10 @@ metadata:
{{- end }}
webhooks:
- name: webhook.cert-manager.io
{{- with .Values.webhook.validatingWebhookConfiguration.namespaceSelector }}
namespaceSelector:
matchExpressions:
- key: "cert-manager.io/disable-validation"
operator: "NotIn"
values:
- "true"
- key: "name"
operator: "NotIn"
values:
- {{ include "cert-manager.namespace" . }}
{{- toYaml . | nindent 6 }}
{{- end }}
rules:
- apiGroups:
- "cert-manager.io"

2135
packages/system/cert-manager/charts/cert-manager/values.schema.json Normal file
View File

File diff suppressed because it is too large Load Diff

1247
packages/system/cert-manager/charts/cert-manager/values.yaml
View File

File diff suppressed because it is too large Load Diff