Update to version 0.11.0
This commit is contained in:
parent
29a85200b6
commit
202b4c9dc4
56 changed files with 11781 additions and 1428 deletions
|
|
@ -1,8 +1,8 @@
|
|||
my_context: flamykubekube
|
||||
ingress_domain: "local.dataminem.net"
|
||||
my_context: local
|
||||
ingress_domain: "local"
|
||||
#ingress_whitelist:
|
||||
# - 10.96.0.0/12
|
||||
# - 10.244.0.0/16
|
||||
# - 192.168.140.0/24
|
||||
|
||||
certmanager_version: 0.9.0
|
||||
certmanager_version: "0.11.0"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
galaxy_info:
|
||||
author: Adrien Reslinger
|
||||
description: Install cert manager to a cluster
|
||||
company: Flaminem
|
||||
min_ansible_version: 2.6
|
||||
description: Install cert manager to a kubernetes cluster
|
||||
company: Personnal
|
||||
min_ansible_version: 2.8
|
||||
galaxy_tags: []
|
||||
|
||||
|
|
|
|||
|
|
@ -5,60 +5,18 @@
|
|||
|
||||
- name: Cert Manager setup
|
||||
block:
|
||||
# - name: namespace
|
||||
# k8s:
|
||||
# context: "{{ my_context }}"
|
||||
# state: present
|
||||
# name: cert-manager
|
||||
# api_version: v1
|
||||
# kind: Namespace
|
||||
# tags: certmanager
|
||||
|
||||
- name: Cert Manager files
|
||||
- name: namespace
|
||||
k8s:
|
||||
state: present
|
||||
context: "{{ my_context }}"
|
||||
resource_definition: "{{ lookup('template', item) | from_yaml }}"
|
||||
with_items:
|
||||
- "cert-manager-crd-crt-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crd-crtreq-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crd-challenges-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crd-clusterissuers-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crd-issuers-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crd-orders-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-ns-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-sa-cainjector-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-sa-webhook-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-sa-certmanager-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-cr-cainjector-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crb-cainjector-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-cr-certmanager-leaderelection-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-cr-certmanager-controlerissuers-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-cr-certmanager-controlerclusterissuers-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-cr-certmanager-certificates-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-cr-certmanager-orders-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-cr-certmanager-challenges-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-cr-certmanager-ingressshim-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crb-certmanager-leaderelection-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crb-certmanager-controlerissuers-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crb-certmanager-controlerclusterissuers-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crb-certmanager-certificates-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crb-certmanager-orders-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crb-certmanager-challenges-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crb-certmanager-ingressshim-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-cr-certmanager-view-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-cr-certmanager-edit-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-crb-certmanager-webhook-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-rb-certmanager-webhook-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-cr-certmanager-webhook-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-svc-webhook-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-dp-cainjector-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-dp-webhook-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-dp-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-apiservice-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-issuer-webhookselfsign-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-certificat-webhookca-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-issuer-webhookca-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-certificat-webhook-{{ certmanager_version }}.yaml"
|
||||
- "cert-manager-validatewebhook-{{ certmanager_version }}.yaml"
|
||||
state: present
|
||||
name: cert-manager
|
||||
api_version: v1
|
||||
kind: Namespace
|
||||
tags: certmanager
|
||||
|
||||
- name: install / uninstall version 0.11.0
|
||||
include_tasks: "version_0.11.0.yml"
|
||||
when:
|
||||
- certmanager_version == "0.11.0"
|
||||
# - certmanager_version == 0.11.0 or certmanager_actual_version.stdout == 0.11.0
|
||||
tags: certmanager
|
||||
|
|
|
|||
59
tasks/version_0.11.0.yml
Normal file
59
tasks/version_0.11.0.yml
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
---
|
||||
- set_fact:
|
||||
certmanager_0_11_0_state: "present"
|
||||
when:
|
||||
- certmanager_version == "0.11.0"
|
||||
|
||||
- set_fact:
|
||||
certmanager_0_11_0_state: "absent"
|
||||
when:
|
||||
- certmanager_version != "0.11.0"
|
||||
|
||||
- name: Cert Manager files
|
||||
k8s:
|
||||
state: "{{ certmanager_0_11_0_state }}"
|
||||
context: "{{ my_context }}"
|
||||
resource_definition: "{{ lookup('template', item) | from_yaml }}"
|
||||
with_items:
|
||||
- "0.11.0/challenges.acme.cert-manager.io-CustomResourceDefinition.yaml"
|
||||
- "0.11.0/orders.acme.cert-manager.io-CustomResourceDefinition.yaml"
|
||||
- "0.11.0/certificaterequests.cert-manager.io-CustomResourceDefinition.yaml"
|
||||
- "0.11.0/certificates.cert-manager.io-CustomResourceDefinition.yaml"
|
||||
- "0.11.0/clusterissuers.cert-manager.io-CustomResourceDefinition.yaml"
|
||||
- "0.11.0/issuers.cert-manager.io-CustomResourceDefinition.yaml"
|
||||
# - "0.11.0/cert-manager-Namespace.yaml"
|
||||
- "0.11.0/cert-manager-cainjector-ServiceAccount.yaml"
|
||||
- "0.11.0/cert-manager-ServiceAccount.yaml"
|
||||
- "0.11.0/cert-manager-webhook-ServiceAccount.yaml"
|
||||
- "0.11.0/cert-manager-cainjector-ClusterRole.yaml"
|
||||
- "0.11.0/cert-manager-cainjector-ClusterRoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-cainjector:leaderelection-Role.yaml"
|
||||
- "0.11.0/cert-manager-cainjector:leaderelection-RoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-webhook:auth-delegator-ClusterRoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-webhook:webhook-authentication-reader-RoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-webhook:webhook-requester-ClusterRole.yaml"
|
||||
- "0.11.0/cert-manager:leaderelection-Role.yaml"
|
||||
- "0.11.0/cert-manager:leaderelection-RoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-controller-issuers-ClusterRole.yaml"
|
||||
- "0.11.0/cert-manager-controller-clusterissuers-ClusterRole.yaml"
|
||||
- "0.11.0/cert-manager-controller-certificates-ClusterRole.yaml"
|
||||
- "0.11.0/cert-manager-controller-orders-ClusterRole.yaml"
|
||||
- "0.11.0/cert-manager-controller-challenges-ClusterRole.yaml"
|
||||
- "0.11.0/cert-manager-controller-ingress-shim-ClusterRole.yaml"
|
||||
- "0.11.0/cert-manager-leaderelection-ClusterRoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-controller-issuers-ClusterRoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-controller-clusterissuers-ClusterRoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-controller-certificates-ClusterRoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-controller-orders-ClusterRoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-controller-challenges-ClusterRoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-controller-ingress-shim-ClusterRoleBinding.yaml"
|
||||
- "0.11.0/cert-manager-view-ClusterRole.yaml"
|
||||
- "0.11.0/cert-manager-edit-ClusterRole.yaml"
|
||||
- "0.11.0/cert-manager-Service.yaml"
|
||||
- "0.11.0/cert-manager-webhook-Service.yaml"
|
||||
- "0.11.0/cert-manager-cainjector-Deployment.yaml"
|
||||
- "0.11.0/cert-manager-Deployment.yaml"
|
||||
- "0.11.0/cert-manager-webhook-Deployment.yaml"
|
||||
- "0.11.0/v1beta1.webhook.cert-manager.io-APIService.yaml"
|
||||
- "0.11.0/cert-manager-webhook-MutatingWebhookConfiguration.yaml"
|
||||
- "0.11.0/cert-manager-webhook-ValidatingWebhookConfiguration.yaml"
|
||||
|
|
@ -9,7 +9,7 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
|
|
@ -25,7 +25,7 @@ spec:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
annotations:
|
||||
prometheus.io/path: "/metrics"
|
||||
prometheus.io/scrape: 'true'
|
||||
|
|
@ -34,12 +34,16 @@ spec:
|
|||
serviceAccountName: cert-manager
|
||||
containers:
|
||||
- name: cert-manager
|
||||
image: "quay.io/jetstack/cert-manager-controller:v0.9.0"
|
||||
image: "quay.io/jetstack/cert-manager-controller:v0.11.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --v=2
|
||||
- --cluster-resource-namespace=$(POD_NAMESPACE)
|
||||
- --leader-election-namespace=$(POD_NAMESPACE)
|
||||
- --leader-election-namespace=kube-system
|
||||
- --webhook-namespace=$(POD_NAMESPACE)
|
||||
- --webhook-ca-secret=cert-manager-webhook-ca
|
||||
- --webhook-serving-secret=cert-manager-webhook-tls
|
||||
- --webhook-dns-names=cert-manager-webhook,cert-manager-webhook.cert-manager,cert-manager-webhook.cert-manager.svc
|
||||
ports:
|
||||
- containerPort: 9402
|
||||
env:
|
||||
|
|
@ -51,3 +55,5 @@ spec:
|
|||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
|
||||
|
||||
|
|
@ -2,5 +2,4 @@ apiVersion: v1
|
|||
kind: Namespace
|
||||
metadata:
|
||||
name: cert-manager
|
||||
labels:
|
||||
certmanager.k8s.io/disable-validation: "true"
|
||||
|
||||
23
templates/0.11.0/cert-manager-Service.yaml
Normal file
23
templates/0.11.0/cert-manager-Service.yaml
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
# Source: cert-manager/templates/service.yaml
|
||||
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: "cert-manager"
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9402
|
||||
targetPort: 9402
|
||||
selector:
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
|
||||
|
|
@ -4,9 +4,11 @@ kind: ServiceAccount
|
|||
metadata:
|
||||
name: cert-manager
|
||||
namespace: "cert-manager"
|
||||
annotations:
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
|
||||
|
|
@ -8,16 +8,16 @@ metadata:
|
|||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cainjector-v0.9.0
|
||||
helm.sh/chart: cainjector-v0.11.0
|
||||
rules:
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "events"]
|
||||
resources: ["events"]
|
||||
verbs: ["get", "create", "update", "patch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
|
||||
|
|
@ -7,7 +7,7 @@ metadata:
|
|||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cainjector-v0.9.0
|
||||
helm.sh/chart: cainjector-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
|
|
@ -16,3 +16,4 @@ subjects:
|
|||
- name: cert-manager-cainjector
|
||||
namespace: "cert-manager"
|
||||
kind: ServiceAccount
|
||||
|
||||
|
|
@ -9,7 +9,7 @@ metadata:
|
|||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cainjector-v0.9.0
|
||||
helm.sh/chart: cainjector-v0.11.0
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
|
|
@ -25,17 +25,17 @@ spec:
|
|||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cainjector-v0.9.0
|
||||
helm.sh/chart: cainjector-v0.11.0
|
||||
annotations:
|
||||
spec:
|
||||
serviceAccountName: cert-manager-cainjector
|
||||
containers:
|
||||
- name: cainjector
|
||||
image: "quay.io/jetstack/cert-manager-cainjector:v0.9.0"
|
||||
image: "quay.io/jetstack/cert-manager-cainjector:v0.11.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --v=2
|
||||
- --leader-election-namespace=$(POD_NAMESPACE)
|
||||
- --leader-election-namespace=kube-system
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
|
|
@ -43,3 +43,5 @@ spec:
|
|||
fieldPath: metadata.namespace
|
||||
resources:
|
||||
{}
|
||||
|
||||
|
||||
|
|
@ -9,4 +9,5 @@ metadata:
|
|||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cainjector-v0.9.0
|
||||
helm.sh/chart: cainjector-v0.11.0
|
||||
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
# leader election rules
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: cert-manager-cainjector:leaderelection
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: cainjector
|
||||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cainjector-v0.11.0
|
||||
rules:
|
||||
# Used for leader election by the controller
|
||||
# TODO: refine the permission to *just* the leader election configmap
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "create", "update", "patch"]
|
||||
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
|
||||
# grant cert-manager permission to manage the leaderelection configmap in the
|
||||
# leader election namespace
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: cert-manager-cainjector:leaderelection
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: cainjector
|
||||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cainjector-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: cert-manager-cainjector:leaderelection
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: cert-manager-cainjector
|
||||
namespace: cert-manager
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
# Certificates controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRole
|
||||
|
|
@ -8,26 +9,27 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
rules:
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
resources: ["certificates", "certificaterequests", "clusterissuers", "issuers", "orders"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "clusterissuers", "issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders"]
|
||||
verbs: ["create", "delete"]
|
||||
verbs: ["create", "delete", "get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
|
|
@ -7,7 +8,7 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
|
|
@ -16,3 +17,4 @@ subjects:
|
|||
- name: cert-manager
|
||||
namespace: "cert-manager"
|
||||
kind: ServiceAccount
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
# Challenges controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRole
|
||||
|
|
@ -8,15 +9,19 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
rules:
|
||||
# Use to update challenge resource status
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges", "challenges/status"]
|
||||
verbs: ["update"]
|
||||
# Used to watch challenge resources
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# Used to watch challenges, issuer and clusterissuer resources
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
resources: ["challenges", "issuers", "clusterissuers"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["issuers", "clusterissuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# Need to be able to retrieve ACME account private key to complete challenges
|
||||
- apiGroups: [""]
|
||||
|
|
@ -34,12 +39,13 @@ rules:
|
|||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch", "create", "delete", "update"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges/finalizers"]
|
||||
verbs: ["update"]
|
||||
# DNS01 rules (duplicated above)
|
||||
# DNS01 rules (duplicated above)
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
|
|
@ -7,7 +8,7 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
|
|
@ -16,3 +17,4 @@ subjects:
|
|||
- name: cert-manager
|
||||
namespace: "cert-manager"
|
||||
kind: ServiceAccount
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
# ClusterIssuer controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRole
|
||||
|
|
@ -8,12 +9,12 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
rules:
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["clusterissuers", "clusterissuers/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["clusterissuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
|
|
@ -22,3 +23,4 @@ rules:
|
|||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
|
|
@ -7,7 +8,7 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
|
|
@ -16,3 +17,4 @@ subjects:
|
|||
- name: cert-manager
|
||||
namespace: "cert-manager"
|
||||
kind: ServiceAccount
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
# ingress-shim controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRole
|
||||
|
|
@ -8,19 +9,19 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
rules:
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests"]
|
||||
verbs: ["create", "update", "delete"]
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["extensions"]
|
||||
resources: ["ingresses/finalizers"]
|
||||
|
|
@ -28,3 +29,4 @@ rules:
|
|||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
|
|
@ -7,7 +8,7 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
|
|
@ -16,3 +17,4 @@ subjects:
|
|||
- name: cert-manager
|
||||
namespace: "cert-manager"
|
||||
kind: ServiceAccount
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
# Issuer controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRole
|
||||
|
|
@ -8,12 +9,12 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
rules:
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["issuers", "issuers/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
|
|
@ -22,3 +23,4 @@ rules:
|
|||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
|
|
@ -7,7 +8,7 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
|
|
@ -16,3 +17,4 @@ subjects:
|
|||
- name: cert-manager
|
||||
namespace: "cert-manager"
|
||||
kind: ServiceAccount
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
# Orders controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRole
|
||||
|
|
@ -8,21 +9,24 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
rules:
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders", "orders/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
resources: ["orders", "clusterissuers", "issuers", "challenges"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders", "challenges"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["clusterissuers", "issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges"]
|
||||
verbs: ["create", "delete"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: [""]
|
||||
|
|
@ -31,3 +35,4 @@ rules:
|
|||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
|
|
@ -7,7 +8,7 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
|
|
@ -16,3 +17,4 @@ subjects:
|
|||
- name: cert-manager
|
||||
namespace: "cert-manager"
|
||||
kind: ServiceAccount
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
|
|
@ -7,10 +8,11 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
rules:
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "issuers"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
|
|
@ -7,7 +8,7 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
|
|
@ -16,3 +17,4 @@ subjects:
|
|||
- name: cert-manager
|
||||
namespace: "cert-manager"
|
||||
kind: ServiceAccount
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
|
|
@ -7,11 +8,12 @@ metadata:
|
|||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
rules:
|
||||
- apiGroups: ["certmanager.k8s.io"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# Source: cert-manager/charts/webhook/templates/deployment.yaml
|
||||
# Source: cert-manager/templates/webhook-deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
|
|
@ -9,7 +9,7 @@ metadata:
|
|||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
|
|
@ -25,13 +25,13 @@ spec:
|
|||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
annotations:
|
||||
spec:
|
||||
serviceAccountName: cert-manager-webhook
|
||||
containers:
|
||||
- name: webhook
|
||||
image: "quay.io/jetstack/cert-manager-webhook:v0.9.0"
|
||||
- name: cert-manager
|
||||
image: "quay.io/jetstack/cert-manager-webhook:v0.11.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --v=2
|
||||
|
|
@ -52,4 +52,4 @@ spec:
|
|||
volumes:
|
||||
- name: certs
|
||||
secret:
|
||||
secretName: cert-manager-webhook-webhook-tls
|
||||
secretName: cert-manager-webhook-tls
|
||||
|
|
@ -0,0 +1,36 @@
|
|||
# Source: cert-manager/templates/webhook-mutating-webhook.yaml
|
||||
apiVersion: admissionregistration.k8s.io/v1beta1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
name: cert-manager-webhook
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
annotations:
|
||||
cert-manager.io/inject-apiserver-ca: "true"
|
||||
webhooks:
|
||||
- name: webhook.cert-manager.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "cert-manager.io"
|
||||
apiVersions:
|
||||
- v1alpha2
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- certificates
|
||||
- issuers
|
||||
- clusterissuers
|
||||
- orders
|
||||
- challenges
|
||||
- certificaterequests
|
||||
failurePolicy: Fail
|
||||
clientConfig:
|
||||
service:
|
||||
name: kubernetes
|
||||
namespace: default
|
||||
path: /apis/webhook.cert-manager.io/v1beta1/mutations
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# Source: cert-manager/charts/webhook/templates/service.yaml
|
||||
# Source: cert-manager/templates/webhook-service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
|
|
@ -9,7 +9,7 @@ metadata:
|
|||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
# Source: cert-manager/charts/webhook/templates/serviceaccount.yaml
|
||||
# Source: cert-manager/templates/webhook-serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
|
|
@ -9,4 +9,4 @@ metadata:
|
|||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
# Source: cert-manager/templates/webhook-validating-webhook.yaml
|
||||
apiVersion: admissionregistration.k8s.io/v1beta1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: cert-manager-webhook
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
annotations:
|
||||
cert-manager.io/inject-apiserver-ca: "true"
|
||||
webhooks:
|
||||
- name: webhook.cert-manager.io
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: "cert-manager.io/disable-validation"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- "true"
|
||||
- key: "name"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- cert-manager
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "cert-manager.io"
|
||||
apiVersions:
|
||||
- v1alpha2
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- certificates
|
||||
- issuers
|
||||
- clusterissuers
|
||||
- certificaterequests
|
||||
failurePolicy: Fail
|
||||
sideEffects: None
|
||||
clientConfig:
|
||||
service:
|
||||
name: kubernetes
|
||||
namespace: default
|
||||
path: /apis/webhook.cert-manager.io/v1beta1/validations
|
||||
|
|
@ -9,7 +9,7 @@ metadata:
|
|||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
|
|
@ -19,3 +19,4 @@ subjects:
|
|||
kind: ServiceAccount
|
||||
name: cert-manager-webhook
|
||||
namespace: cert-manager
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
# apiserver gets the ability to read authentication. This allows it to
|
||||
# read the specific configmap that has the requestheader-* entries to
|
||||
# api agg
|
||||
|
|
@ -11,7 +12,7 @@ metadata:
|
|||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
|
|
@ -21,3 +22,4 @@ subjects:
|
|||
kind: ServiceAccount
|
||||
name: cert-manager-webhook
|
||||
namespace: cert-manager
|
||||
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
|
|
@ -7,10 +8,10 @@ metadata:
|
|||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
rules:
|
||||
- apiGroups:
|
||||
- admission.certmanager.k8s.io
|
||||
- admission.cert-manager.io
|
||||
resources:
|
||||
- certificates
|
||||
- certificaterequests
|
||||
6361
templates/0.11.0/cert-manager.yaml
Normal file
6361
templates/0.11.0/cert-manager.yaml
Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -1,16 +1,19 @@
|
|||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: ClusterRole
|
||||
kind: Role
|
||||
metadata:
|
||||
name: cert-manager-leaderelection
|
||||
name: cert-manager:leaderelection
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
rules:
|
||||
# Used for leader election by the controller
|
||||
# TODO: refine the permission to *just* the leader election configmap
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["get", "create", "update", "patch"]
|
||||
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
|
||||
# grant cert-manager permission to manage the leaderelection configmap in the
|
||||
# leader election namespace
|
||||
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: cert-manager:leaderelection
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: cert-manager:leaderelection
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: cert-manager
|
||||
namespace: cert-manager
|
||||
|
||||
|
|
@ -2,9 +2,7 @@ apiVersion: apiextensions.k8s.io/v1beta1
|
|||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
controller-tools.k8s.io: "1.0"
|
||||
name: certificaterequests.certmanager.k8s.io
|
||||
name: certificaterequests.cert-manager.io
|
||||
spec:
|
||||
additionalPrinterColumns:
|
||||
- JSONPath: .status.conditions[?(@.type=="Ready")].status
|
||||
|
|
@ -25,30 +23,37 @@ spec:
|
|||
in RFC3339 form and is in UTC.
|
||||
name: Age
|
||||
type: date
|
||||
group: certmanager.k8s.io
|
||||
group: cert-manager.io
|
||||
names:
|
||||
kind: CertificateRequest
|
||||
listKind: CertificateRequestList
|
||||
plural: certificaterequests
|
||||
shortNames:
|
||||
- cr
|
||||
- crs
|
||||
singular: certificaterequest
|
||||
scope: Namespaced
|
||||
subresources:
|
||||
status: {}
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
description: CertificateRequest is a type to represent a Certificate Signing
|
||||
Request
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: CertificateRequestSpec defines the desired state of CertificateRequest
|
||||
properties:
|
||||
csr:
|
||||
description: Byte slice containing the PEM encoded CertificateSigningRequest
|
||||
|
|
@ -59,7 +64,7 @@ spec:
|
|||
type: string
|
||||
isCA:
|
||||
description: IsCA will mark the resulting certificate as valid for signing.
|
||||
This implies that the 'signing' usage is set
|
||||
This implies that the 'cert sign' usage is set
|
||||
type: boolean
|
||||
issuerRef:
|
||||
description: IssuerRef is a reference to the issuer for this CertificateRequest. If
|
||||
|
|
@ -68,7 +73,7 @@ spec:
|
|||
will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
|
||||
with the provided name will be used. The 'name' field in this stanza
|
||||
is required at all times. The group field refers to the API group
|
||||
of the issuer which defaults to 'certmanager.k8s.io' if empty.
|
||||
of the issuer which defaults to 'cert-manager.io' if empty.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
|
|
@ -79,10 +84,45 @@ spec:
|
|||
required:
|
||||
- name
|
||||
type: object
|
||||
usages:
|
||||
description: Usages is the set of x509 actions that are enabled for
|
||||
a given key. Defaults are ('digital signature', 'key encipherment')
|
||||
if empty
|
||||
items:
|
||||
description: 'KeyUsage specifies valid usage contexts for keys. See:
|
||||
https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12'
|
||||
enum:
|
||||
- signing
|
||||
- digital signature
|
||||
- content commitment
|
||||
- key encipherment
|
||||
- key agreement
|
||||
- data encipherment
|
||||
- cert sign
|
||||
- crl sign
|
||||
- encipher only
|
||||
- decipher only
|
||||
- any
|
||||
- server auth
|
||||
- client auth
|
||||
- code signing
|
||||
- email protection
|
||||
- s/mime
|
||||
- ipsec end system
|
||||
- ipsec tunnel
|
||||
- ipsec user
|
||||
- timestamping
|
||||
- ocsp signing
|
||||
- microsoft sgc
|
||||
- netscape sgc
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- issuerRef
|
||||
type: object
|
||||
status:
|
||||
description: CertificateStatus defines the observed state of CertificateRequest
|
||||
and resulting signed certificate.
|
||||
properties:
|
||||
ca:
|
||||
description: Byte slice containing the PEM encoded certificate authority
|
||||
|
|
@ -96,6 +136,8 @@ spec:
|
|||
type: string
|
||||
conditions:
|
||||
items:
|
||||
description: CertificateRequestCondition contains condition information
|
||||
for a CertificateRequest.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: LastTransitionTime is the timestamp corresponding
|
||||
|
|
@ -122,12 +164,22 @@ spec:
|
|||
description: Type of the condition, currently ('Ready').
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
failureTime:
|
||||
description: FailureTime stores the time that this CertificateRequest
|
||||
failed. This is used to influence garbage collection and back-off.
|
||||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
version: v1alpha1
|
||||
type: object
|
||||
version: v1alpha2
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
served: true
|
||||
storage: true
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
|
|
@ -2,9 +2,7 @@ apiVersion: apiextensions.k8s.io/v1beta1
|
|||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
controller-tools.k8s.io: "1.0"
|
||||
name: certificates.certmanager.k8s.io
|
||||
name: certificates.cert-manager.io
|
||||
spec:
|
||||
additionalPrinterColumns:
|
||||
- JSONPath: .status.conditions[?(@.type=="Ready")].status
|
||||
|
|
@ -28,66 +26,47 @@ spec:
|
|||
in RFC3339 form and is in UTC.
|
||||
name: Age
|
||||
type: date
|
||||
group: certmanager.k8s.io
|
||||
group: cert-manager.io
|
||||
names:
|
||||
kind: Certificate
|
||||
listKind: CertificateList
|
||||
plural: certificates
|
||||
shortNames:
|
||||
- cert
|
||||
- certs
|
||||
singular: certificate
|
||||
scope: Namespaced
|
||||
subresources:
|
||||
status: {}
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
description: Certificate is a type to represent a Certificate from ACME
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: CertificateSpec defines the desired state of Certificate. A
|
||||
valid Certificate requires at least one of a CommonName, DNSName, or URISAN
|
||||
to be valid.
|
||||
properties:
|
||||
acme:
|
||||
description: ACME contains configuration specific to ACME Certificates.
|
||||
Notably, this contains details on how the domain names listed on this
|
||||
Certificate resource should be 'solved', i.e. mapping HTTP01 and DNS01
|
||||
providers to DNS names.
|
||||
properties:
|
||||
config:
|
||||
items:
|
||||
properties:
|
||||
domains:
|
||||
description: Domains is the list of domains that this SolverConfig
|
||||
applies to.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- domains
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- config
|
||||
type: object
|
||||
commonName:
|
||||
description: CommonName is a common name to be used on the Certificate.
|
||||
If no CommonName is given, then the first entry in DNSNames is used
|
||||
as the CommonName. The CommonName should have a length of 64 characters
|
||||
or fewer to avoid generating invalid CSRs; in order to have longer
|
||||
domain names, set the CommonName (or first DNSNames entry) to have
|
||||
64 characters or fewer, and then add the longer domain name to DNSNames.
|
||||
The CommonName should have a length of 64 characters or fewer to avoid
|
||||
generating invalid CSRs.
|
||||
type: string
|
||||
dnsNames:
|
||||
description: DNSNames is a list of subject alt names to be used on the
|
||||
Certificate. If no CommonName is given, then the first entry in DNSNames
|
||||
is used as the CommonName and must have a length of 64 characters
|
||||
or fewer.
|
||||
Certificate.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
|
|
@ -102,7 +81,7 @@ spec:
|
|||
type: array
|
||||
isCA:
|
||||
description: IsCA will mark this Certificate as valid for signing. This
|
||||
implies that the 'signing' usage is set
|
||||
implies that the 'cert sign' usage is set
|
||||
type: boolean
|
||||
issuerRef:
|
||||
description: IssuerRef is a reference to the issuer for this certificate.
|
||||
|
|
@ -137,6 +116,9 @@ spec:
|
|||
allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8,
|
||||
respectively. If KeyEncoding is not specified, then PKCS#1 will be
|
||||
used by default.
|
||||
enum:
|
||||
- pkcs1
|
||||
- pkcs8
|
||||
type: string
|
||||
keySize:
|
||||
description: KeySize is the key bit size of the corresponding private
|
||||
|
|
@ -144,7 +126,6 @@ spec:
|
|||
and 8192 inclusive when KeyAlgorithm is empty or is set to "rsa",
|
||||
and value must be one of (256, 384, 521) when KeyAlgorithm is set
|
||||
to "ecdsa".
|
||||
format: int64
|
||||
type: integer
|
||||
organization:
|
||||
description: Organization is the organization to be used on the Certificate
|
||||
|
|
@ -158,14 +139,56 @@ spec:
|
|||
description: SecretName is the name of the secret resource to store
|
||||
this secret in
|
||||
type: string
|
||||
uriSANs:
|
||||
description: URISANs is a list of URI Subject Alternative Names to be
|
||||
set on this Certificate.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
usages:
|
||||
description: Usages is the set of x509 actions that are enabled for
|
||||
a given key. Defaults are ('digital signature', 'key encipherment')
|
||||
if empty
|
||||
items:
|
||||
description: 'KeyUsage specifies valid usage contexts for keys. See:
|
||||
https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12'
|
||||
enum:
|
||||
- signing
|
||||
- digital signature
|
||||
- content commitment
|
||||
- key encipherment
|
||||
- key agreement
|
||||
- data encipherment
|
||||
- cert sign
|
||||
- crl sign
|
||||
- encipher only
|
||||
- decipher only
|
||||
- any
|
||||
- server auth
|
||||
- client auth
|
||||
- code signing
|
||||
- email protection
|
||||
- s/mime
|
||||
- ipsec end system
|
||||
- ipsec tunnel
|
||||
- ipsec user
|
||||
- timestamping
|
||||
- ocsp signing
|
||||
- microsoft sgc
|
||||
- netscape sgc
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- secretName
|
||||
- issuerRef
|
||||
- secretName
|
||||
type: object
|
||||
status:
|
||||
description: CertificateStatus defines the observed state of Certificate
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: CertificateCondition contains condition information for
|
||||
an Certificate.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: LastTransitionTime is the timestamp corresponding
|
||||
|
|
@ -192,8 +215,8 @@ spec:
|
|||
description: Type of the condition, currently ('Ready').
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
lastFailureTime:
|
||||
|
|
@ -205,7 +228,12 @@ spec:
|
|||
format: date-time
|
||||
type: string
|
||||
type: object
|
||||
version: v1alpha1
|
||||
type: object
|
||||
version: v1alpha2
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
served: true
|
||||
storage: true
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,207 @@
|
|||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: orders.acme.cert-manager.io
|
||||
spec:
|
||||
additionalPrinterColumns:
|
||||
- JSONPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- JSONPath: .spec.issuerRef.name
|
||||
name: Issuer
|
||||
priority: 1
|
||||
type: string
|
||||
- JSONPath: .status.reason
|
||||
name: Reason
|
||||
priority: 1
|
||||
type: string
|
||||
- JSONPath: .metadata.creationTimestamp
|
||||
description: CreationTimestamp is a timestamp representing the server time when
|
||||
this object was created. It is not guaranteed to be set in happens-before order
|
||||
across separate operations. Clients may not set this value. It is represented
|
||||
in RFC3339 form and is in UTC.
|
||||
name: Age
|
||||
type: date
|
||||
group: acme.cert-manager.io
|
||||
names:
|
||||
kind: Order
|
||||
listKind: OrderList
|
||||
plural: orders
|
||||
singular: order
|
||||
scope: Namespaced
|
||||
subresources:
|
||||
status: {}
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
description: Order is a type to represent an Order with an ACME server
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
commonName:
|
||||
description: CommonName is the common name as specified on the DER encoded
|
||||
CSR. If CommonName is not specified, the first DNSName specified will
|
||||
be used as the CommonName. At least one of CommonName or a DNSNames
|
||||
must be set. This field must match the corresponding field on the
|
||||
DER encoded CSR.
|
||||
type: string
|
||||
csr:
|
||||
description: Certificate signing request bytes in DER encoding. This
|
||||
will be used when finalizing the order. This field must be set on
|
||||
the order.
|
||||
format: byte
|
||||
type: string
|
||||
dnsNames:
|
||||
description: DNSNames is a list of DNS names that should be included
|
||||
as part of the Order validation process. If CommonName is not specified,
|
||||
the first DNSName specified will be used as the CommonName. At least
|
||||
one of CommonName or a DNSNames must be set. This field must match
|
||||
the corresponding field on the DER encoded CSR.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
issuerRef:
|
||||
description: IssuerRef references a properly configured ACME-type Issuer
|
||||
which should be used to create this Order. If the Issuer does not
|
||||
exist, processing will be retried. If the Issuer is not an 'ACME'
|
||||
Issuer, an error will be returned and the Order will be marked as
|
||||
failed.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- csr
|
||||
- issuerRef
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
authorizations:
|
||||
description: Authorizations contains data returned from the ACME server
|
||||
on what authoriations must be completed in order to validate the DNS
|
||||
names specified on the Order.
|
||||
items:
|
||||
description: ACMEAuthorization contains data returned from the ACME
|
||||
server on an authorization that must be completed in order validate
|
||||
a DNS name on an ACME Order resource.
|
||||
properties:
|
||||
challenges:
|
||||
description: Challenges specifies the challenge types offered
|
||||
by the ACME server. One of these challenge types will be selected
|
||||
when validating the DNS name and an appropriate Challenge resource
|
||||
will be created to perform the ACME challenge process.
|
||||
items:
|
||||
description: Challenge specifies a challenge offered by the
|
||||
ACME server for an Order. An appropriate Challenge resource
|
||||
can be created to perform the ACME challenge process.
|
||||
properties:
|
||||
token:
|
||||
description: Token is the token that must be presented for
|
||||
this challenge. This is used to compute the 'key' that
|
||||
must also be presented.
|
||||
type: string
|
||||
type:
|
||||
description: Type is the type of challenge being offered,
|
||||
e.g. http-01, dns-01
|
||||
type: string
|
||||
url:
|
||||
description: URL is the URL of this challenge. It can be
|
||||
used to retrieve additional metadata about the Challenge
|
||||
from the ACME server.
|
||||
type: string
|
||||
required:
|
||||
- token
|
||||
- type
|
||||
- url
|
||||
type: object
|
||||
type: array
|
||||
identifier:
|
||||
description: Identifier is the DNS name to be validated as part
|
||||
of this authorization
|
||||
type: string
|
||||
url:
|
||||
description: URL is the URL of the Authorization that must be
|
||||
completed
|
||||
type: string
|
||||
wildcard:
|
||||
description: Wildcard will be true if this authorization is for
|
||||
a wildcard DNS name. If this is true, the identifier will be
|
||||
the *non-wildcard* version of the DNS name. For example, if
|
||||
'*.example.com' is the DNS name being validated, this field
|
||||
will be 'true' and the 'identifier' field will be 'example.com'.
|
||||
type: boolean
|
||||
required:
|
||||
- url
|
||||
type: object
|
||||
type: array
|
||||
certificate:
|
||||
description: Certificate is a copy of the PEM encoded certificate for
|
||||
this Order. This field will be populated after the order has been
|
||||
successfully finalized with the ACME server, and the order has transitioned
|
||||
to the 'valid' state.
|
||||
format: byte
|
||||
type: string
|
||||
failureTime:
|
||||
description: FailureTime stores the time that this order failed. This
|
||||
is used to influence garbage collection and back-off.
|
||||
format: date-time
|
||||
type: string
|
||||
finalizeURL:
|
||||
description: FinalizeURL of the Order. This is used to obtain certificates
|
||||
for this order once it has been completed.
|
||||
type: string
|
||||
reason:
|
||||
description: Reason optionally provides more information about a why
|
||||
the order is in the current state.
|
||||
type: string
|
||||
state:
|
||||
description: State contains the current state of this Order resource.
|
||||
States 'success' and 'expired' are 'final'
|
||||
enum:
|
||||
- valid
|
||||
- ready
|
||||
- pending
|
||||
- processing
|
||||
- invalid
|
||||
- expired
|
||||
- errored
|
||||
type: string
|
||||
url:
|
||||
description: URL of the Order. This will initially be empty when the
|
||||
resource is first created. The Order controller will populate this
|
||||
field when the Order is first processed. This field will be immutable
|
||||
after it is initially set.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
type: object
|
||||
version: v1alpha2
|
||||
versions:
|
||||
- name: v1alpha2
|
||||
served: true
|
||||
storage: true
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
|
@ -1,18 +1,18 @@
|
|||
# Source: cert-manager/charts/webhook/templates/apiservice.yaml
|
||||
# Source: cert-manager/templates/webhook-apiservice.yaml
|
||||
apiVersion: apiregistration.k8s.io/v1beta1
|
||||
kind: APIService
|
||||
metadata:
|
||||
name: v1beta1.admission.certmanager.k8s.io
|
||||
name: v1beta1.webhook.cert-manager.io
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
helm.sh/chart: cert-manager-v0.11.0
|
||||
annotations:
|
||||
certmanager.k8s.io/inject-ca-from: "cert-manager/cert-manager-webhook-webhook-tls"
|
||||
cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-tls"
|
||||
spec:
|
||||
group: admission.certmanager.k8s.io
|
||||
group: webhook.cert-manager.io
|
||||
groupPriorityMinimum: 1000
|
||||
versionPriority: 15
|
||||
service:
|
||||
|
|
@ -1,21 +0,0 @@
|
|||
# Finally, generate a serving certificate for the webhook to use
|
||||
apiVersion: certmanager.k8s.io/v1alpha1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: cert-manager-webhook-webhook-tls
|
||||
namespace: "cert-manager"
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
spec:
|
||||
secretName: cert-manager-webhook-webhook-tls
|
||||
duration: 8760h # 1y
|
||||
issuerRef:
|
||||
name: cert-manager-webhook-ca
|
||||
dnsNames:
|
||||
- cert-manager-webhook
|
||||
- cert-manager-webhook.cert-manager
|
||||
- cert-manager-webhook.cert-manager.svc
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
# Generate a CA Certificate used to sign certificates for the webhook
|
||||
apiVersion: certmanager.k8s.io/v1alpha1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: cert-manager-webhook-ca
|
||||
namespace: "cert-manager"
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
spec:
|
||||
secretName: cert-manager-webhook-ca
|
||||
duration: 43800h # 5y
|
||||
issuerRef:
|
||||
name: cert-manager-webhook-selfsign
|
||||
commonName: "ca.webhook.cert-manager"
|
||||
isCA: true
|
||||
|
|
@ -1,197 +0,0 @@
|
|||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
controller-tools.k8s.io: "1.0"
|
||||
name: challenges.certmanager.k8s.io
|
||||
spec:
|
||||
additionalPrinterColumns:
|
||||
- JSONPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- JSONPath: .spec.dnsName
|
||||
name: Domain
|
||||
type: string
|
||||
- JSONPath: .status.reason
|
||||
name: Reason
|
||||
priority: 1
|
||||
type: string
|
||||
- JSONPath: .metadata.creationTimestamp
|
||||
description: CreationTimestamp is a timestamp representing the server time when
|
||||
this object was created. It is not guaranteed to be set in happens-before order
|
||||
across separate operations. Clients may not set this value. It is represented
|
||||
in RFC3339 form and is in UTC.
|
||||
name: Age
|
||||
type: date
|
||||
group: certmanager.k8s.io
|
||||
names:
|
||||
kind: Challenge
|
||||
plural: challenges
|
||||
scope: Namespaced
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
authzURL:
|
||||
description: AuthzURL is the URL to the ACME Authorization resource
|
||||
that this challenge is a part of.
|
||||
type: string
|
||||
config:
|
||||
description: 'Config specifies the solver configuration for this challenge.
|
||||
Only **one** of ''config'' or ''solver'' may be specified, and if
|
||||
both are specified then no action will be performed on the Challenge
|
||||
resource. DEPRECATED: the ''solver'' field should be specified instead'
|
||||
type: object
|
||||
dnsName:
|
||||
description: DNSName is the identifier that this challenge is for, e.g.
|
||||
example.com.
|
||||
type: string
|
||||
issuerRef:
|
||||
description: IssuerRef references a properly configured ACME-type Issuer
|
||||
which should be used to create this Challenge. If the Issuer does
|
||||
not exist, processing will be retried. If the Issuer is not an 'ACME'
|
||||
Issuer, an error will be returned and the Challenge will be marked
|
||||
as failed.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
key:
|
||||
description: Key is the ACME challenge key for this challenge
|
||||
type: string
|
||||
solver:
|
||||
description: Solver contains the domain solving configuration that should
|
||||
be used to solve this challenge resource. Only **one** of 'config'
|
||||
or 'solver' may be specified, and if both are specified then no action
|
||||
will be performed on the Challenge resource.
|
||||
properties:
|
||||
selector:
|
||||
description: Selector selects a set of DNSNames on the Certificate
|
||||
resource that should be solved using this challenge solver.
|
||||
properties:
|
||||
dnsNames:
|
||||
description: List of DNSNames that this solver will be used
|
||||
to solve. If specified and a match is found, a dnsNames selector
|
||||
will take precedence over a dnsZones selector. If multiple
|
||||
solvers match with the same dnsNames value, the solver with
|
||||
the most matching labels in matchLabels will be selected.
|
||||
If neither has more matches, the solver defined earlier in
|
||||
the list will be selected.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
dnsZones:
|
||||
description: List of DNSZones that this solver will be used
|
||||
to solve. The most specific DNS zone match specified here
|
||||
will take precedence over other DNS zone matches, so a solver
|
||||
specifying sys.example.com will be selected over one specifying
|
||||
example.com for the domain www.sys.example.com. If multiple
|
||||
solvers match with the same dnsZones value, the solver with
|
||||
the most matching labels in matchLabels will be selected.
|
||||
If neither has more matches, the solver defined earlier in
|
||||
the list will be selected.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
matchLabels:
|
||||
description: A label selector that is used to refine the set
|
||||
of certificate's that this challenge solver will apply to.
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
token:
|
||||
description: Token is the ACME challenge token for this challenge.
|
||||
type: string
|
||||
type:
|
||||
description: Type is the type of ACME challenge this resource represents,
|
||||
e.g. "dns01" or "http01"
|
||||
type: string
|
||||
url:
|
||||
description: URL is the URL of the ACME Challenge resource for this
|
||||
challenge. This can be used to lookup details about the status of
|
||||
this challenge.
|
||||
type: string
|
||||
wildcard:
|
||||
description: Wildcard will be true if this challenge is for a wildcard
|
||||
identifier, for example '*.example.com'
|
||||
type: boolean
|
||||
required:
|
||||
- authzURL
|
||||
- type
|
||||
- url
|
||||
- dnsName
|
||||
- token
|
||||
- key
|
||||
- wildcard
|
||||
- issuerRef
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
presented:
|
||||
description: Presented will be set to true if the challenge values for
|
||||
this challenge are currently 'presented'. This *does not* imply the
|
||||
self check is passing. Only that the values have been 'submitted'
|
||||
for the appropriate challenge mechanism (i.e. the DNS01 TXT record
|
||||
has been presented, or the HTTP01 configuration has been configured).
|
||||
type: boolean
|
||||
processing:
|
||||
description: Processing is used to denote whether this challenge should
|
||||
be processed or not. This field will only be set to true by the 'scheduling'
|
||||
component. It will only be set to false by the 'challenges' controller,
|
||||
after the challenge has reached a final state or timed out. If this
|
||||
field is set to false, the challenge controller will not take any
|
||||
more action.
|
||||
type: boolean
|
||||
reason:
|
||||
description: Reason contains human readable information on why the Challenge
|
||||
is in the current state.
|
||||
type: string
|
||||
state:
|
||||
description: State contains the current 'state' of the challenge. If
|
||||
not set, the state of the challenge is unknown.
|
||||
enum:
|
||||
- ""
|
||||
- valid
|
||||
- ready
|
||||
- pending
|
||||
- processing
|
||||
- invalid
|
||||
- expired
|
||||
- errored
|
||||
type: string
|
||||
required:
|
||||
- processing
|
||||
- presented
|
||||
- reason
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
- status
|
||||
version: v1alpha1
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
|
@ -1,300 +0,0 @@
|
|||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
controller-tools.k8s.io: "1.0"
|
||||
name: clusterissuers.certmanager.k8s.io
|
||||
spec:
|
||||
group: certmanager.k8s.io
|
||||
names:
|
||||
kind: ClusterIssuer
|
||||
plural: clusterissuers
|
||||
scope: Cluster
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
acme:
|
||||
properties:
|
||||
email:
|
||||
description: Email is the email for this account
|
||||
type: string
|
||||
privateKeySecretRef:
|
||||
description: PrivateKey is the name of a secret containing the private
|
||||
key for this user account.
|
||||
properties:
|
||||
key:
|
||||
description: The key of the secret to select from. Must be a
|
||||
valid secret key.
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
server:
|
||||
description: Server is the ACME server URL
|
||||
type: string
|
||||
skipTLSVerify:
|
||||
description: If true, skip verifying the ACME server TLS certificate
|
||||
type: boolean
|
||||
solvers:
|
||||
description: Solvers is a list of challenge solvers that will be
|
||||
used to solve ACME challenges for the matching domains.
|
||||
items:
|
||||
properties:
|
||||
selector:
|
||||
description: Selector selects a set of DNSNames on the Certificate
|
||||
resource that should be solved using this challenge solver.
|
||||
properties:
|
||||
dnsNames:
|
||||
description: List of DNSNames that this solver will be
|
||||
used to solve. If specified and a match is found, a
|
||||
dnsNames selector will take precedence over a dnsZones
|
||||
selector. If multiple solvers match with the same dnsNames
|
||||
value, the solver with the most matching labels in matchLabels
|
||||
will be selected. If neither has more matches, the solver
|
||||
defined earlier in the list will be selected.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
dnsZones:
|
||||
description: List of DNSZones that this solver will be
|
||||
used to solve. The most specific DNS zone match specified
|
||||
here will take precedence over other DNS zone matches,
|
||||
so a solver specifying sys.example.com will be selected
|
||||
over one specifying example.com for the domain www.sys.example.com.
|
||||
If multiple solvers match with the same dnsZones value,
|
||||
the solver with the most matching labels in matchLabels
|
||||
will be selected. If neither has more matches, the solver
|
||||
defined earlier in the list will be selected.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
matchLabels:
|
||||
description: A label selector that is used to refine the
|
||||
set of certificate's that this challenge solver will
|
||||
apply to.
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- server
|
||||
- privateKeySecretRef
|
||||
type: object
|
||||
ca:
|
||||
properties:
|
||||
secretName:
|
||||
description: SecretName is the name of the secret used to sign Certificates
|
||||
issued by this Issuer.
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
selfSigned:
|
||||
type: object
|
||||
vault:
|
||||
properties:
|
||||
auth:
|
||||
description: Vault authentication
|
||||
properties:
|
||||
appRole:
|
||||
description: This Secret contains a AppRole and Secret
|
||||
properties:
|
||||
path:
|
||||
description: Where the authentication path is mounted in
|
||||
Vault.
|
||||
type: string
|
||||
roleId:
|
||||
type: string
|
||||
secretRef:
|
||||
properties:
|
||||
key:
|
||||
description: The key of the secret to select from. Must
|
||||
be a valid secret key.
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- path
|
||||
- roleId
|
||||
- secretRef
|
||||
type: object
|
||||
tokenSecretRef:
|
||||
description: This Secret contains the Vault token key
|
||||
properties:
|
||||
key:
|
||||
description: The key of the secret to select from. Must
|
||||
be a valid secret key.
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
caBundle:
|
||||
description: Base64 encoded CA bundle to validate Vault server certificate.
|
||||
Only used if the Server URL is using HTTPS protocol. This parameter
|
||||
is ignored for plain HTTP protocol connection. If not set the
|
||||
system root certificates are used to validate the TLS connection.
|
||||
format: byte
|
||||
type: string
|
||||
path:
|
||||
description: Vault URL path to the certificate role
|
||||
type: string
|
||||
server:
|
||||
description: Server is the vault connection address
|
||||
type: string
|
||||
required:
|
||||
- auth
|
||||
- server
|
||||
- path
|
||||
type: object
|
||||
venafi:
|
||||
properties:
|
||||
cloud:
|
||||
description: Cloud specifies the Venafi cloud configuration settings.
|
||||
Only one of TPP or Cloud may be specified.
|
||||
properties:
|
||||
apiTokenSecretRef:
|
||||
description: APITokenSecretRef is a secret key selector for
|
||||
the Venafi Cloud API token.
|
||||
properties:
|
||||
key:
|
||||
description: The key of the secret to select from. Must
|
||||
be a valid secret key.
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
url:
|
||||
description: URL is the base URL for Venafi Cloud
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
- apiTokenSecretRef
|
||||
type: object
|
||||
tpp:
|
||||
description: TPP specifies Trust Protection Platform configuration
|
||||
settings. Only one of TPP or Cloud may be specified.
|
||||
properties:
|
||||
caBundle:
|
||||
description: CABundle is a PEM encoded TLS certifiate to use
|
||||
to verify connections to the TPP instance. If specified, system
|
||||
roots will not be used and the issuing CA for the TPP instance
|
||||
must be verifiable using the provided root. If not specified,
|
||||
the connection will be verified using the cert-manager system
|
||||
root certificates.
|
||||
format: byte
|
||||
type: string
|
||||
credentialsRef:
|
||||
description: CredentialsRef is a reference to a Secret containing
|
||||
the username and password for the TPP server. The secret must
|
||||
contain two keys, 'username' and 'password'.
|
||||
properties:
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
url:
|
||||
description: URL is the base URL for the Venafi TPP instance
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
- credentialsRef
|
||||
type: object
|
||||
zone:
|
||||
description: Zone is the Venafi Policy Zone to use for this issuer.
|
||||
All requests made to the Venafi platform will be restricted by
|
||||
the named zone policy. This field is required.
|
||||
type: string
|
||||
required:
|
||||
- zone
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
acme:
|
||||
properties:
|
||||
lastRegisteredEmail:
|
||||
description: LastRegisteredEmail is the email associated with the
|
||||
latest registered ACME account, in order to track changes made
|
||||
to registered account associated with the Issuer
|
||||
type: string
|
||||
uri:
|
||||
description: URI is the unique account identifier, which can also
|
||||
be used to retrieve account details from the CA
|
||||
type: string
|
||||
type: object
|
||||
conditions:
|
||||
items:
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: LastTransitionTime is the timestamp corresponding
|
||||
to the last status change of this condition.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: Message is a human readable description of the details
|
||||
of the last transition, complementing reason.
|
||||
type: string
|
||||
reason:
|
||||
description: Reason is a brief machine readable explanation for
|
||||
the condition's last transition.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of ('True', 'False',
|
||||
'Unknown').
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: Type of the condition, currently ('Ready').
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
- status
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
version: v1alpha1
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
|
@ -1,300 +0,0 @@
|
|||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
controller-tools.k8s.io: "1.0"
|
||||
name: issuers.certmanager.k8s.io
|
||||
spec:
|
||||
group: certmanager.k8s.io
|
||||
names:
|
||||
kind: Issuer
|
||||
plural: issuers
|
||||
scope: Namespaced
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
acme:
|
||||
properties:
|
||||
email:
|
||||
description: Email is the email for this account
|
||||
type: string
|
||||
privateKeySecretRef:
|
||||
description: PrivateKey is the name of a secret containing the private
|
||||
key for this user account.
|
||||
properties:
|
||||
key:
|
||||
description: The key of the secret to select from. Must be a
|
||||
valid secret key.
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
server:
|
||||
description: Server is the ACME server URL
|
||||
type: string
|
||||
skipTLSVerify:
|
||||
description: If true, skip verifying the ACME server TLS certificate
|
||||
type: boolean
|
||||
solvers:
|
||||
description: Solvers is a list of challenge solvers that will be
|
||||
used to solve ACME challenges for the matching domains.
|
||||
items:
|
||||
properties:
|
||||
selector:
|
||||
description: Selector selects a set of DNSNames on the Certificate
|
||||
resource that should be solved using this challenge solver.
|
||||
properties:
|
||||
dnsNames:
|
||||
description: List of DNSNames that this solver will be
|
||||
used to solve. If specified and a match is found, a
|
||||
dnsNames selector will take precedence over a dnsZones
|
||||
selector. If multiple solvers match with the same dnsNames
|
||||
value, the solver with the most matching labels in matchLabels
|
||||
will be selected. If neither has more matches, the solver
|
||||
defined earlier in the list will be selected.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
dnsZones:
|
||||
description: List of DNSZones that this solver will be
|
||||
used to solve. The most specific DNS zone match specified
|
||||
here will take precedence over other DNS zone matches,
|
||||
so a solver specifying sys.example.com will be selected
|
||||
over one specifying example.com for the domain www.sys.example.com.
|
||||
If multiple solvers match with the same dnsZones value,
|
||||
the solver with the most matching labels in matchLabels
|
||||
will be selected. If neither has more matches, the solver
|
||||
defined earlier in the list will be selected.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
matchLabels:
|
||||
description: A label selector that is used to refine the
|
||||
set of certificate's that this challenge solver will
|
||||
apply to.
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
type: array
|
||||
required:
|
||||
- server
|
||||
- privateKeySecretRef
|
||||
type: object
|
||||
ca:
|
||||
properties:
|
||||
secretName:
|
||||
description: SecretName is the name of the secret used to sign Certificates
|
||||
issued by this Issuer.
|
||||
type: string
|
||||
required:
|
||||
- secretName
|
||||
type: object
|
||||
selfSigned:
|
||||
type: object
|
||||
vault:
|
||||
properties:
|
||||
auth:
|
||||
description: Vault authentication
|
||||
properties:
|
||||
appRole:
|
||||
description: This Secret contains a AppRole and Secret
|
||||
properties:
|
||||
path:
|
||||
description: Where the authentication path is mounted in
|
||||
Vault.
|
||||
type: string
|
||||
roleId:
|
||||
type: string
|
||||
secretRef:
|
||||
properties:
|
||||
key:
|
||||
description: The key of the secret to select from. Must
|
||||
be a valid secret key.
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- path
|
||||
- roleId
|
||||
- secretRef
|
||||
type: object
|
||||
tokenSecretRef:
|
||||
description: This Secret contains the Vault token key
|
||||
properties:
|
||||
key:
|
||||
description: The key of the secret to select from. Must
|
||||
be a valid secret key.
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
caBundle:
|
||||
description: Base64 encoded CA bundle to validate Vault server certificate.
|
||||
Only used if the Server URL is using HTTPS protocol. This parameter
|
||||
is ignored for plain HTTP protocol connection. If not set the
|
||||
system root certificates are used to validate the TLS connection.
|
||||
format: byte
|
||||
type: string
|
||||
path:
|
||||
description: Vault URL path to the certificate role
|
||||
type: string
|
||||
server:
|
||||
description: Server is the vault connection address
|
||||
type: string
|
||||
required:
|
||||
- auth
|
||||
- server
|
||||
- path
|
||||
type: object
|
||||
venafi:
|
||||
properties:
|
||||
cloud:
|
||||
description: Cloud specifies the Venafi cloud configuration settings.
|
||||
Only one of TPP or Cloud may be specified.
|
||||
properties:
|
||||
apiTokenSecretRef:
|
||||
description: APITokenSecretRef is a secret key selector for
|
||||
the Venafi Cloud API token.
|
||||
properties:
|
||||
key:
|
||||
description: The key of the secret to select from. Must
|
||||
be a valid secret key.
|
||||
type: string
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
url:
|
||||
description: URL is the base URL for Venafi Cloud
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
- apiTokenSecretRef
|
||||
type: object
|
||||
tpp:
|
||||
description: TPP specifies Trust Protection Platform configuration
|
||||
settings. Only one of TPP or Cloud may be specified.
|
||||
properties:
|
||||
caBundle:
|
||||
description: CABundle is a PEM encoded TLS certifiate to use
|
||||
to verify connections to the TPP instance. If specified, system
|
||||
roots will not be used and the issuing CA for the TPP instance
|
||||
must be verifiable using the provided root. If not specified,
|
||||
the connection will be verified using the cert-manager system
|
||||
root certificates.
|
||||
format: byte
|
||||
type: string
|
||||
credentialsRef:
|
||||
description: CredentialsRef is a reference to a Secret containing
|
||||
the username and password for the TPP server. The secret must
|
||||
contain two keys, 'username' and 'password'.
|
||||
properties:
|
||||
name:
|
||||
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
TODO: Add other useful fields. apiVersion, kind, uid?'
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
url:
|
||||
description: URL is the base URL for the Venafi TPP instance
|
||||
type: string
|
||||
required:
|
||||
- url
|
||||
- credentialsRef
|
||||
type: object
|
||||
zone:
|
||||
description: Zone is the Venafi Policy Zone to use for this issuer.
|
||||
All requests made to the Venafi platform will be restricted by
|
||||
the named zone policy. This field is required.
|
||||
type: string
|
||||
required:
|
||||
- zone
|
||||
type: object
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
acme:
|
||||
properties:
|
||||
lastRegisteredEmail:
|
||||
description: LastRegisteredEmail is the email associated with the
|
||||
latest registered ACME account, in order to track changes made
|
||||
to registered account associated with the Issuer
|
||||
type: string
|
||||
uri:
|
||||
description: URI is the unique account identifier, which can also
|
||||
be used to retrieve account details from the CA
|
||||
type: string
|
||||
type: object
|
||||
conditions:
|
||||
items:
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: LastTransitionTime is the timestamp corresponding
|
||||
to the last status change of this condition.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: Message is a human readable description of the details
|
||||
of the last transition, complementing reason.
|
||||
type: string
|
||||
reason:
|
||||
description: Reason is a brief machine readable explanation for
|
||||
the condition's last transition.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of ('True', 'False',
|
||||
'Unknown').
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: Type of the condition, currently ('Ready').
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
- status
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
version: v1alpha1
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
|
@ -1,273 +0,0 @@
|
|||
apiVersion: apiextensions.k8s.io/v1beta1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
controller-tools.k8s.io: "1.0"
|
||||
name: orders.certmanager.k8s.io
|
||||
spec:
|
||||
additionalPrinterColumns:
|
||||
- JSONPath: .status.state
|
||||
name: State
|
||||
type: string
|
||||
- JSONPath: .spec.issuerRef.name
|
||||
name: Issuer
|
||||
priority: 1
|
||||
type: string
|
||||
- JSONPath: .status.reason
|
||||
name: Reason
|
||||
priority: 1
|
||||
type: string
|
||||
- JSONPath: .metadata.creationTimestamp
|
||||
description: CreationTimestamp is a timestamp representing the server time when
|
||||
this object was created. It is not guaranteed to be set in happens-before order
|
||||
across separate operations. Clients may not set this value. It is represented
|
||||
in RFC3339 form and is in UTC.
|
||||
name: Age
|
||||
type: date
|
||||
group: certmanager.k8s.io
|
||||
names:
|
||||
kind: Order
|
||||
plural: orders
|
||||
scope: Namespaced
|
||||
validation:
|
||||
openAPIV3Schema:
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation
|
||||
of an object. Servers should convert recognized schemas to the latest
|
||||
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this
|
||||
object represents. Servers may infer this from the endpoint the client
|
||||
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
properties:
|
||||
commonName:
|
||||
description: CommonName is the common name as specified on the DER encoded
|
||||
CSR. If CommonName is not specified, the first DNSName specified will
|
||||
be used as the CommonName. At least one of CommonName or a DNSNames
|
||||
must be set. This field must match the corresponding field on the
|
||||
DER encoded CSR.
|
||||
type: string
|
||||
config:
|
||||
description: 'Config specifies a mapping from DNS identifiers to how
|
||||
those identifiers should be solved when performing ACME challenges.
|
||||
A config entry must exist for each domain listed in DNSNames and CommonName.
|
||||
Only **one** of ''config'' or ''solvers'' may be specified, and if
|
||||
both are specified then no action will be performed on the Order resource. This
|
||||
field will be removed when support for solver config specified on
|
||||
the Certificate under certificate.spec.acme has been removed. DEPRECATED:
|
||||
this field will be removed in future. Solver configuration must instead
|
||||
be provided on ACME Issuer resources.'
|
||||
items:
|
||||
properties:
|
||||
domains:
|
||||
description: Domains is the list of domains that this SolverConfig
|
||||
applies to.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
required:
|
||||
- domains
|
||||
type: object
|
||||
type: array
|
||||
csr:
|
||||
description: Certificate signing request bytes in DER encoding. This
|
||||
will be used when finalizing the order. This field must be set on
|
||||
the order.
|
||||
format: byte
|
||||
type: string
|
||||
dnsNames:
|
||||
description: DNSNames is a list of DNS names that should be included
|
||||
as part of the Order validation process. If CommonName is not specified,
|
||||
the first DNSName specified will be used as the CommonName. At least
|
||||
one of CommonName or a DNSNames must be set. This field must match
|
||||
the corresponding field on the DER encoded CSR.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
issuerRef:
|
||||
description: IssuerRef references a properly configured ACME-type Issuer
|
||||
which should be used to create this Order. If the Issuer does not
|
||||
exist, processing will be retried. If the Issuer is not an 'ACME'
|
||||
Issuer, an error will be returned and the Order will be marked as
|
||||
failed.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- csr
|
||||
- issuerRef
|
||||
type: object
|
||||
status:
|
||||
properties:
|
||||
certificate:
|
||||
description: Certificate is a copy of the PEM encoded certificate for
|
||||
this Order. This field will be populated after the order has been
|
||||
successfully finalized with the ACME server, and the order has transitioned
|
||||
to the 'valid' state.
|
||||
format: byte
|
||||
type: string
|
||||
challenges:
|
||||
description: Challenges is a list of ChallengeSpecs for Challenges that
|
||||
must be created in order to complete this Order.
|
||||
items:
|
||||
properties:
|
||||
authzURL:
|
||||
description: AuthzURL is the URL to the ACME Authorization resource
|
||||
that this challenge is a part of.
|
||||
type: string
|
||||
config:
|
||||
description: 'Config specifies the solver configuration for this
|
||||
challenge. Only **one** of ''config'' or ''solver'' may be specified,
|
||||
and if both are specified then no action will be performed on
|
||||
the Challenge resource. DEPRECATED: the ''solver'' field should
|
||||
be specified instead'
|
||||
type: object
|
||||
dnsName:
|
||||
description: DNSName is the identifier that this challenge is
|
||||
for, e.g. example.com.
|
||||
type: string
|
||||
issuerRef:
|
||||
description: IssuerRef references a properly configured ACME-type
|
||||
Issuer which should be used to create this Challenge. If the
|
||||
Issuer does not exist, processing will be retried. If the Issuer
|
||||
is not an 'ACME' Issuer, an error will be returned and the Challenge
|
||||
will be marked as failed.
|
||||
properties:
|
||||
group:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
name:
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
key:
|
||||
description: Key is the ACME challenge key for this challenge
|
||||
type: string
|
||||
solver:
|
||||
description: Solver contains the domain solving configuration
|
||||
that should be used to solve this challenge resource. Only **one**
|
||||
of 'config' or 'solver' may be specified, and if both are specified
|
||||
then no action will be performed on the Challenge resource.
|
||||
properties:
|
||||
selector:
|
||||
description: Selector selects a set of DNSNames on the Certificate
|
||||
resource that should be solved using this challenge solver.
|
||||
properties:
|
||||
dnsNames:
|
||||
description: List of DNSNames that this solver will be
|
||||
used to solve. If specified and a match is found, a
|
||||
dnsNames selector will take precedence over a dnsZones
|
||||
selector. If multiple solvers match with the same dnsNames
|
||||
value, the solver with the most matching labels in matchLabels
|
||||
will be selected. If neither has more matches, the solver
|
||||
defined earlier in the list will be selected.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
dnsZones:
|
||||
description: List of DNSZones that this solver will be
|
||||
used to solve. The most specific DNS zone match specified
|
||||
here will take precedence over other DNS zone matches,
|
||||
so a solver specifying sys.example.com will be selected
|
||||
over one specifying example.com for the domain www.sys.example.com.
|
||||
If multiple solvers match with the same dnsZones value,
|
||||
the solver with the most matching labels in matchLabels
|
||||
will be selected. If neither has more matches, the solver
|
||||
defined earlier in the list will be selected.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
matchLabels:
|
||||
description: A label selector that is used to refine the
|
||||
set of certificate's that this challenge solver will
|
||||
apply to.
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
token:
|
||||
description: Token is the ACME challenge token for this challenge.
|
||||
type: string
|
||||
type:
|
||||
description: Type is the type of ACME challenge this resource
|
||||
represents, e.g. "dns01" or "http01"
|
||||
type: string
|
||||
url:
|
||||
description: URL is the URL of the ACME Challenge resource for
|
||||
this challenge. This can be used to lookup details about the
|
||||
status of this challenge.
|
||||
type: string
|
||||
wildcard:
|
||||
description: Wildcard will be true if this challenge is for a
|
||||
wildcard identifier, for example '*.example.com'
|
||||
type: boolean
|
||||
required:
|
||||
- authzURL
|
||||
- type
|
||||
- url
|
||||
- dnsName
|
||||
- token
|
||||
- key
|
||||
- wildcard
|
||||
- issuerRef
|
||||
type: object
|
||||
type: array
|
||||
failureTime:
|
||||
description: FailureTime stores the time that this order failed. This
|
||||
is used to influence garbage collection and back-off.
|
||||
format: date-time
|
||||
type: string
|
||||
finalizeURL:
|
||||
description: FinalizeURL of the Order. This is used to obtain certificates
|
||||
for this order once it has been completed.
|
||||
type: string
|
||||
reason:
|
||||
description: Reason optionally provides more information about a why
|
||||
the order is in the current state.
|
||||
type: string
|
||||
state:
|
||||
description: State contains the current state of this Order resource.
|
||||
States 'success' and 'expired' are 'final'
|
||||
enum:
|
||||
- ""
|
||||
- valid
|
||||
- ready
|
||||
- pending
|
||||
- processing
|
||||
- invalid
|
||||
- expired
|
||||
- errored
|
||||
type: string
|
||||
url:
|
||||
description: URL of the Order. This will initially be empty when the
|
||||
resource is first created. The Order controller will populate this
|
||||
field when the Order is first processed. This field will be immutable
|
||||
after it is initially set.
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- metadata
|
||||
- spec
|
||||
- status
|
||||
version: v1alpha1
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
# Create an Issuer that uses the above generated CA certificate to issue certs
|
||||
apiVersion: certmanager.k8s.io/v1alpha1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: cert-manager-webhook-ca
|
||||
namespace: "cert-manager"
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
spec:
|
||||
ca:
|
||||
secretName: cert-manager-webhook-ca
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
# Create a selfsigned Issuer, in order to create a root CA certificate for
|
||||
# signing webhook serving certificates
|
||||
apiVersion: certmanager.k8s.io/v1alpha1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: cert-manager-webhook-selfsign
|
||||
namespace: "cert-manager"
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
spec:
|
||||
selfSigned: {}
|
||||
|
|
@ -1,96 +0,0 @@
|
|||
# Source: cert-manager/charts/webhook/templates/validating-webhook.yaml
|
||||
apiVersion: admissionregistration.k8s.io/v1beta1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: cert-manager-webhook
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/managed-by: Tiller
|
||||
helm.sh/chart: webhook-v0.9.0
|
||||
annotations:
|
||||
certmanager.k8s.io/inject-apiserver-ca: "true"
|
||||
webhooks:
|
||||
- name: certificates.admission.certmanager.k8s.io
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: "certmanager.k8s.io/disable-validation"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- "true"
|
||||
- key: "name"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- cert-manager
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "certmanager.k8s.io"
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- certificates
|
||||
failurePolicy: Fail
|
||||
clientConfig:
|
||||
service:
|
||||
name: kubernetes
|
||||
namespace: default
|
||||
path: /apis/admission.certmanager.k8s.io/v1beta1/certificates
|
||||
- name: issuers.admission.certmanager.k8s.io
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: "certmanager.k8s.io/disable-validation"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- "true"
|
||||
- key: "name"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- cert-manager
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "certmanager.k8s.io"
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- issuers
|
||||
failurePolicy: Fail
|
||||
clientConfig:
|
||||
service:
|
||||
name: kubernetes
|
||||
namespace: default
|
||||
path: /apis/admission.certmanager.k8s.io/v1beta1/issuers
|
||||
- name: clusterissuers.admission.certmanager.k8s.io
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: "certmanager.k8s.io/disable-validation"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- "true"
|
||||
- key: "name"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- cert-manager
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "certmanager.k8s.io"
|
||||
apiVersions:
|
||||
- v1alpha1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- clusterissuers
|
||||
failurePolicy: Fail
|
||||
clientConfig:
|
||||
service:
|
||||
name: kubernetes
|
||||
namespace: default
|
||||
path: /apis/admission.certmanager.k8s.io/v1beta1/clusterissuers
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue