Run hack/update-deploy-gen.sh

cert-manager · Apr 16, 2018 · 08860f4 · 08860f4
1 parent 2c14fee
commit 08860f4
Show file tree

Hide file tree

Showing 16 changed files with 566 additions and 1 deletion.
diff --git a/contrib/charts/cert-manager/values.yaml b/contrib/charts/cert-manager/values.yaml
@@ -65,6 +65,8 @@ ingressShim:
 webhook:
   enabled: true
 
+  replicaCount: 1
+
   caSecret: "ca-key-pair"
 
   podAnnotations: {}

diff --git a/contrib/manifests/cert-manager/rbac/deployment.yaml b/contrib/manifests/cert-manager/rbac/deployment.yaml
@@ -30,6 +30,11 @@ spec:
           imagePullPolicy: IfNotPresent
           args:
           - --cluster-resource-namespace=$(POD_NAMESPACE)
+          - --webhook-namespace=$(POD_NAMESPACE)
+          - --webhook-service-name=cert-manager-webhook
+          - --webhook-issuer-name=cert-manager-webhook
+          - --webhook-ca-secret=ca-key-pair
+          - --webhook-secret-name=cert-manager-webhook
           env:
           - name: POD_NAMESPACE
             valueFrom:

diff --git a/contrib/manifests/cert-manager/rbac/rbac.yaml b/contrib/manifests/cert-manager/rbac/rbac.yaml
@@ -41,4 +41,5 @@ roleRef:
 subjects:
   - name: cert-manager
     namespace: "cert-manager"
-    kind: ServiceAccount
+    kind: ServiceAccount
+---
diff --git a/contrib/manifests/cert-manager/rbac/serviceaccount.yaml b/contrib/manifests/cert-manager/rbac/serviceaccount.yaml
@@ -5,6 +5,17 @@ kind: ServiceAccount
 metadata:
   name: cert-manager
   namespace: "cert-manager"
+  labels:
+    app: cert-manager
+    chart: cert-manager-0.2.8
+    release: cert-manager
+    heritage: Tiller
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cert-manager-webhook
+  namespace: "cert-manager"
   labels:
     app: cert-manager
     chart: cert-manager-0.2.8

diff --git a/contrib/manifests/cert-manager/rbac/webhook-apiservice.yaml b/contrib/manifests/cert-manager/rbac/webhook-apiservice.yaml
@@ -0,0 +1,14 @@
+##---
+# Source: cert-manager/templates/webhook-apiservice.yaml
+apiVersion: apiregistration.k8s.io/v1beta1
+kind: APIService
+metadata:
+  name: v1beta1.admission.certmanager.k8s.io
+spec:
+  group: admission.certmanager.k8s.io
+  groupPriorityMinimum: 1000
+  versionPriority: 15
+  service:
+    name: cert-manager-webhook
+    namespace: "cert-manager"
+  version: v1beta1
diff --git a/contrib/manifests/cert-manager/rbac/webhook-ca-sync.yaml b/contrib/manifests/cert-manager/rbac/webhook-ca-sync.yaml
@@ -0,0 +1,100 @@
+##---
+# Source: cert-manager/templates/webhook-ca-sync.yaml
+apiVersion: batch/v1beta1
+kind: CronJob
+metadata:
+  name: cert-manager-ca-sync
+spec:
+  schedule: "* */1 * * *"
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: ca-helper
+        spec:
+          serviceAccountName: ca-helper-cronjob
+          restartPolicy: OnFailure
+          containers:
+          - name: ca-helper
+            image: quay.io/munnerz/apiextensions-ca-helper:canary
+            imagePullPolicy: Always
+            args:
+            - -config=/config/config
+            volumeMounts:
+            - name: config
+              mountPath: /config
+          volumes:
+          - name: config
+            configMap:
+              name: cert-manager-ca-sync
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cert-manager-ca-sync
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: cert-manager-ca-sync
+  labels:
+    app: ca-helper
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+    resourceNames:
+    - ca-key-pair
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
+    verbs: ["get", "update"]
+    resourceNames:
+    - cert-manager-validation
+  - apiGroups: ["apiregistration.k8s.io"]
+    resources: ["apiservices"]
+    verbs: ["get", "update"]
+    resourceNames:
+    - v1beta1.admission.certmanager.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: cert-manager-ca-sync
+  labels:
+    app: ca-helper
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ca-helper-cronjob
+subjects:
+  - name: ca-helper-cronjob
+    namespace: cert-manager
+    kind: ServiceAccount
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cert-manager-ca-sync
+data:
+  config: |-
+    {
+        "apiServices": [
+            {
+                "name": "v1beta1.admission.certmanager.k8s.io",
+                "secret": {
+                    "name": "ca-key-pair",
+                    "namespace": "cert-manager",
+                    "key": "tls.crt"
+                }
+            }
+        ],
+        "validatingWebhookConfigurations": [
+            {
+                "name": "cert-manager-validation",
+                "file": {
+                    "path": "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+                }
+            }
+        ]
+    }
diff --git a/contrib/manifests/cert-manager/rbac/webhook-deployment.yaml b/contrib/manifests/cert-manager/rbac/webhook-deployment.yaml
@@ -0,0 +1,50 @@
+##---
+# Source: cert-manager/templates/webhook-deployment.yaml
+apiVersion: apps/v1beta1
+kind: Deployment
+metadata:
+  name: cert-manager-webhook
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager
+    chart: cert-manager-0.2.8
+    release: cert-manager
+    heritage: Tiller
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cert-manager-webhook
+      release: cert-manager
+  template:
+    metadata:
+      labels:
+        app: cert-manager-webhook
+        release: cert-manager
+      annotations:
+    spec:
+      serviceAccountName: cert-manager-webhook
+      containers:
+        - name: cert-manager
+          image: "quay.io/jetstack/cert-manager-webhook:v0.2.4"
+          imagePullPolicy: IfNotPresent
+          args:
+          - --v=12
+          - --tls-cert-file=/certs/tls.crt
+          - --tls-private-key-file=/certs/tls.key
+          - --disable-admission-plugins=NamespaceLifecycle,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,Initializers
+          env:
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+          resources:
+            {}
+
+          volumeMounts:
+          - name: certs
+            mountPath: /certs
+      volumes:
+      - name: certs
+        secret:
+          secretName: cert-manager-webhook
diff --git a/contrib/manifests/cert-manager/rbac/webhook-rbac.yaml b/contrib/manifests/cert-manager/rbac/webhook-rbac.yaml
@@ -0,0 +1,55 @@
+##---
+# Source: cert-manager/templates/webhook-rbac.yaml
+### Webhook ###
+---
+# apiserver gets the auth-delegator role to delegate auth decisions to
+# the core apiserver
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: "cert-manager:webhook-auth-delegator"
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- apiGroup: ""
+  kind: ServiceAccount
+  name: "cert-manager-webhook"
+  namespace: "cert-manager"
+
+---
+
+# apiserver gets the ability to read authentication. This allows it to
+# read the specific configmap that has the requestheader-* entries to
+# api agg
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: "cert-manager:webhook-authentication-reader"
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+- apiGroup: ""
+  kind: ServiceAccount
+  name: "cert-manager-webhook"
+  namespace: "cert-manager"
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: "cert-manager:webhook-requester"
+rules:
+- apiGroups:
+  - admission.certmanager.k8s.io
+  resources:
+  - certificates
+  - issuers
+  - clusterissuers
+  verbs:
+  - create
diff --git a/contrib/manifests/cert-manager/rbac/webhook-service.yaml b/contrib/manifests/cert-manager/rbac/webhook-service.yaml
@@ -0,0 +1,21 @@
+##---
+# Source: cert-manager/templates/webhook-service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: cert-manager-webhook
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager
+    chart: cert-manager-0.2.8
+    release: cert-manager
+    heritage: Tiller
+spec:
+  type: ClusterIP
+  ports:
+  - name: https
+    port: 443
+    targetPort: 443
+  selector:
+    app: cert-manager-webhook
+    release: cert-manager
diff --git a/contrib/manifests/cert-manager/rbac/webhook.yaml b/contrib/manifests/cert-manager/rbac/webhook.yaml
@@ -0,0 +1,58 @@
+##---
+# Source: cert-manager/templates/webhook.yaml
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: cert-manager-validation
+webHooks:
+  - name: certificates.admission.certmanager.k8s.io
+    rules:
+      - apiGroups:
+          - "certmanager.k8s.io"
+        apiVersions:
+          - v1alpha1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - certificates
+    failurePolicy: Fail
+    clientConfig:
+      service:
+        name: kubernetes
+        namespace: default
+        path: /apis/admission.certmanager.k8s.io/v1beta1/certificates
+  - name: issuers.admission.certmanager.k8s.io
+    rules:
+      - apiGroups:
+          - "certmanager.k8s.io"
+        apiVersions:
+          - v1alpha1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - issuers
+    failurePolicy: Fail
+    clientConfig:
+      service:
+        name: kubernetes
+        namespace: default
+        path: /apis/admission.certmanager.k8s.io/v1beta1/issuers
+  - name: clusterissuers.admission.certmanager.k8s.io
+    rules:
+      - apiGroups:
+          - "certmanager.k8s.io"
+        apiVersions:
+          - v1alpha1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - clusterissuers
+    failurePolicy: Fail
+    clientConfig:
+      service:
+        name: kubernetes
+        namespace: default
+        path: /apis/admission.certmanager.k8s.io/v1beta1/clusterissuers
diff --git a/contrib/manifests/cert-manager/without-rbac/deployment.yaml b/contrib/manifests/cert-manager/without-rbac/deployment.yaml
@@ -30,6 +30,11 @@ spec:
           imagePullPolicy: IfNotPresent
           args:
           - --cluster-resource-namespace=$(POD_NAMESPACE)
+          - --webhook-namespace=$(POD_NAMESPACE)
+          - --webhook-service-name=cert-manager-webhook
+          - --webhook-issuer-name=cert-manager-webhook
+          - --webhook-ca-secret=ca-key-pair
+          - --webhook-secret-name=cert-manager-webhook
           env:
           - name: POD_NAMESPACE
             valueFrom:

diff --git a/contrib/manifests/cert-manager/without-rbac/webhook-apiservice.yaml b/contrib/manifests/cert-manager/without-rbac/webhook-apiservice.yaml
@@ -0,0 +1,14 @@
+##---
+# Source: cert-manager/templates/webhook-apiservice.yaml
+apiVersion: apiregistration.k8s.io/v1beta1
+kind: APIService
+metadata:
+  name: v1beta1.admission.certmanager.k8s.io
+spec:
+  group: admission.certmanager.k8s.io
+  groupPriorityMinimum: 1000
+  versionPriority: 15
+  service:
+    name: cert-manager-webhook
+    namespace: "cert-manager"
+  version: v1beta1