adrien/ansible-role-k8s-cert-manager
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

First commit

Browse source
This commit is contained in:
Adrien Reslinger 2019-08-02 23:12:00 +02:00
parent 33faa0bbd0
commit 29a85200b6
45 changed files with 2381 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
defaults/main.yml Normal file
View file

@ -0,0 +1,8 @@
my_context: flamykubekube
ingress_domain: "local.dataminem.net"
#ingress_whitelist:
# - 10.96.0.0/12
# - 10.244.0.0/16
# - 192.168.140.0/24
certmanager_version: 0.9.0

7
meta/main.yml Normal file
View file

@ -0,0 +1,7 @@
galaxy_info:
author: Adrien Reslinger
description: Install cert manager to a cluster
company: Flaminem
min_ansible_version: 2.6
galaxy_tags: []

64
tasks/main.yml Normal file
View file

@ -0,0 +1,64 @@
- name: Print the kubectl context
debug:
var: my_context
tags: certmanager
- name: Cert Manager setup
block:
# - name: namespace
# k8s:
# context: "{{ my_context }}"
# state: present
# name: cert-manager
# api_version: v1
# kind: Namespace
# tags: certmanager
- name: Cert Manager files
k8s:
state: present
context: "{{ my_context }}"
resource_definition: "{{ lookup('template', item) | from_yaml }}"
with_items:
- "cert-manager-crd-crt-{{ certmanager_version }}.yaml"
- "cert-manager-crd-crtreq-{{ certmanager_version }}.yaml"
- "cert-manager-crd-challenges-{{ certmanager_version }}.yaml"
- "cert-manager-crd-clusterissuers-{{ certmanager_version }}.yaml"
- "cert-manager-crd-issuers-{{ certmanager_version }}.yaml"
- "cert-manager-crd-orders-{{ certmanager_version }}.yaml"
- "cert-manager-ns-{{ certmanager_version }}.yaml"
- "cert-manager-sa-cainjector-{{ certmanager_version }}.yaml"
- "cert-manager-sa-webhook-{{ certmanager_version }}.yaml"
- "cert-manager-sa-certmanager-{{ certmanager_version }}.yaml"
- "cert-manager-cr-cainjector-{{ certmanager_version }}.yaml"
- "cert-manager-crb-cainjector-{{ certmanager_version }}.yaml"
- "cert-manager-cr-certmanager-leaderelection-{{ certmanager_version }}.yaml"
- "cert-manager-cr-certmanager-controlerissuers-{{ certmanager_version }}.yaml"
- "cert-manager-cr-certmanager-controlerclusterissuers-{{ certmanager_version }}.yaml"
- "cert-manager-cr-certmanager-certificates-{{ certmanager_version }}.yaml"
- "cert-manager-cr-certmanager-orders-{{ certmanager_version }}.yaml"
- "cert-manager-cr-certmanager-challenges-{{ certmanager_version }}.yaml"
- "cert-manager-cr-certmanager-ingressshim-{{ certmanager_version }}.yaml"
- "cert-manager-crb-certmanager-leaderelection-{{ certmanager_version }}.yaml"
- "cert-manager-crb-certmanager-controlerissuers-{{ certmanager_version }}.yaml"
- "cert-manager-crb-certmanager-controlerclusterissuers-{{ certmanager_version }}.yaml"
- "cert-manager-crb-certmanager-certificates-{{ certmanager_version }}.yaml"
- "cert-manager-crb-certmanager-orders-{{ certmanager_version }}.yaml"
- "cert-manager-crb-certmanager-challenges-{{ certmanager_version }}.yaml"
- "cert-manager-crb-certmanager-ingressshim-{{ certmanager_version }}.yaml"
- "cert-manager-cr-certmanager-view-{{ certmanager_version }}.yaml"
- "cert-manager-cr-certmanager-edit-{{ certmanager_version }}.yaml"
- "cert-manager-crb-certmanager-webhook-{{ certmanager_version }}.yaml"
- "cert-manager-rb-certmanager-webhook-{{ certmanager_version }}.yaml"
- "cert-manager-cr-certmanager-webhook-{{ certmanager_version }}.yaml"
- "cert-manager-svc-webhook-{{ certmanager_version }}.yaml"
- "cert-manager-dp-cainjector-{{ certmanager_version }}.yaml"
- "cert-manager-dp-webhook-{{ certmanager_version }}.yaml"
- "cert-manager-dp-{{ certmanager_version }}.yaml"
- "cert-manager-apiservice-{{ certmanager_version }}.yaml"
- "cert-manager-issuer-webhookselfsign-{{ certmanager_version }}.yaml"
- "cert-manager-certificat-webhookca-{{ certmanager_version }}.yaml"
- "cert-manager-issuer-webhookca-{{ certmanager_version }}.yaml"
- "cert-manager-certificat-webhook-{{ certmanager_version }}.yaml"
- "cert-manager-validatewebhook-{{ certmanager_version }}.yaml"
tags: certmanager

21
templates/cert-manager-apiservice-0.9.0.yaml Normal file
View file

@ -0,0 +1,21 @@
# Source: cert-manager/charts/webhook/templates/apiservice.yaml
apiVersion: apiregistration.k8s.io/v1beta1
kind: APIService
metadata:
name: v1beta1.admission.certmanager.k8s.io
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
annotations:
certmanager.k8s.io/inject-ca-from: "cert-manager/cert-manager-webhook-webhook-tls"
spec:
group: admission.certmanager.k8s.io
groupPriorityMinimum: 1000
versionPriority: 15
service:
name: cert-manager-webhook
namespace: "cert-manager"
version: v1beta1

21
templates/cert-manager-certificat-webhook-0.9.0.yaml Normal file
View file

@ -0,0 +1,21 @@
# Finally, generate a serving certificate for the webhook to use
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
name: cert-manager-webhook-webhook-tls
namespace: "cert-manager"
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
spec:
secretName: cert-manager-webhook-webhook-tls
duration: 8760h # 1y
issuerRef:
name: cert-manager-webhook-ca
dnsNames:
- cert-manager-webhook
- cert-manager-webhook.cert-manager
- cert-manager-webhook.cert-manager.svc

19
templates/cert-manager-certificat-webhookca-0.9.0.yaml Normal file
View file

@ -0,0 +1,19 @@
# Generate a CA Certificate used to sign certificates for the webhook
apiVersion: certmanager.k8s.io/v1alpha1
kind: Certificate
metadata:
name: cert-manager-webhook-ca
namespace: "cert-manager"
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
spec:
secretName: cert-manager-webhook-ca
duration: 43800h # 5y
issuerRef:
name: cert-manager-webhook-selfsign
commonName: "ca.webhook.cert-manager"
isCA: true

30
templates/cert-manager-cr-cainjector-0.9.0.yaml Normal file
View file

@ -0,0 +1,30 @@
# Source: cert-manager/charts/cainjector/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: cert-manager-cainjector
labels:
app: cainjector
app.kubernetes.io/name: cainjector
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cainjector-v0.9.0
rules:
- apiGroups: ["certmanager.k8s.io"]
resources: ["certificates"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["configmaps", "events"]
verbs: ["get", "create", "update", "patch"]
- apiGroups: ["admissionregistration.k8s.io"]
resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["apiregistration.k8s.io"]
resources: ["apiservices"]
verbs: ["get", "list", "watch", "update"]
- apiGroups: ["apiextensions.k8s.io"]
resources: ["customresourcedefinitions"]
verbs: ["get", "list", "watch", "update"]

33
templates/cert-manager-cr-certmanager-certificates-0.9.0.yaml Normal file
View file

@ -0,0 +1,33 @@
# Certificates controller role
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: cert-manager-controller-certificates
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
rules:
- apiGroups: ["certmanager.k8s.io"]
resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"]
verbs: ["update"]
- apiGroups: ["certmanager.k8s.io"]
resources: ["certificates", "certificaterequests", "clusterissuers", "issuers", "orders"]
verbs: ["get", "list", "watch"]
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
# admission controller enabled:
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
- apiGroups: ["certmanager.k8s.io"]
resources: ["certificates/finalizers"]
verbs: ["update"]
- apiGroups: ["certmanager.k8s.io"]
resources: ["orders"]
verbs: ["create", "delete"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]

45
templates/cert-manager-cr-certmanager-challenges-0.9.0.yaml Normal file
View file

@ -0,0 +1,45 @@
# Challenges controller role
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: cert-manager-controller-challenges
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
rules:
# Use to update challenge resource status
- apiGroups: ["certmanager.k8s.io"]
resources: ["challenges", "challenges/status"]
verbs: ["update"]
# Used to watch challenges, issuer and clusterissuer resources
- apiGroups: ["certmanager.k8s.io"]
resources: ["challenges", "issuers", "clusterissuers"]
verbs: ["get", "list", "watch"]
# Need to be able to retrieve ACME account private key to complete challenges
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list", "watch"]
# Used to create events
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]
# HTTP01 rules
- apiGroups: [""]
resources: ["pods", "services"]
verbs: ["get", "list", "watch", "create", "delete"]
- apiGroups: ["extensions"]
resources: ["ingresses"]
verbs: ["get", "list", "watch", "create", "delete", "update"]
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
# admission controller enabled:
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
- apiGroups: ["certmanager.k8s.io"]
resources: ["challenges/finalizers"]
verbs: ["update"]
# DNS01 rules (duplicated above)
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list", "watch"]

24
templates/cert-manager-cr-certmanager-controlerclusterissuers-0.9.0.yaml Normal file
View file

@ -0,0 +1,24 @@
# ClusterIssuer controller role
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: cert-manager-controller-clusterissuers
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
rules:
- apiGroups: ["certmanager.k8s.io"]
resources: ["clusterissuers", "clusterissuers/status"]
verbs: ["update"]
- apiGroups: ["certmanager.k8s.io"]
resources: ["clusterissuers"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]

24
templates/cert-manager-cr-certmanager-controlerissuers-0.9.0.yaml Normal file
View file

@ -0,0 +1,24 @@
# Issuer controller role
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: cert-manager-controller-issuers
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
rules:
- apiGroups: ["certmanager.k8s.io"]
resources: ["issuers", "issuers/status"]
verbs: ["update"]
- apiGroups: ["certmanager.k8s.io"]
resources: ["issuers"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]

16
templates/cert-manager-cr-certmanager-edit-0.9.0.yaml Normal file
View file

@ -0,0 +1,16 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cert-manager-edit
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
- apiGroups: ["certmanager.k8s.io"]
resources: ["certificates", "certificaterequests", "issuers"]
verbs: ["create", "delete", "deletecollection", "patch", "update"]

30
templates/cert-manager-cr-certmanager-ingressshim-0.9.0.yaml Normal file
View file

@ -0,0 +1,30 @@
# ingress-shim controller role
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: cert-manager-controller-ingress-shim
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
rules:
- apiGroups: ["certmanager.k8s.io"]
resources: ["certificates", "certificaterequests"]
verbs: ["create", "update", "delete"]
- apiGroups: ["certmanager.k8s.io"]
resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"]
verbs: ["get", "list", "watch"]
- apiGroups: ["extensions"]
resources: ["ingresses"]
verbs: ["get", "list", "watch"]
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
# admission controller enabled:
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
- apiGroups: ["extensions"]
resources: ["ingresses/finalizers"]
verbs: ["update"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]

16
templates/cert-manager-cr-certmanager-leaderelection-0.9.0.yaml Normal file
View file

@ -0,0 +1,16 @@
# Source: cert-manager/templates/rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: cert-manager-leaderelection
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
rules:
# Used for leader election by the controller
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "create", "update", "patch"]

33
templates/cert-manager-cr-certmanager-orders-0.9.0.yaml Normal file
View file

@ -0,0 +1,33 @@
# Orders controller role
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
name: cert-manager-controller-orders
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
rules:
- apiGroups: ["certmanager.k8s.io"]
resources: ["orders", "orders/status"]
verbs: ["update"]
- apiGroups: ["certmanager.k8s.io"]
resources: ["orders", "clusterissuers", "issuers", "challenges"]
verbs: ["get", "list", "watch"]
- apiGroups: ["certmanager.k8s.io"]
resources: ["challenges"]
verbs: ["create", "delete"]
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
# admission controller enabled:
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
- apiGroups: ["certmanager.k8s.io"]
resources: ["orders/finalizers"]
verbs: ["update"]
- apiGroups: [""]
resources: ["secrets"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]

17
templates/cert-manager-cr-certmanager-view-0.9.0.yaml Normal file
View file

@ -0,0 +1,17 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cert-manager-view
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
rbac.authorization.k8s.io/aggregate-to-view: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
- apiGroups: ["certmanager.k8s.io"]
resources: ["certificates", "certificaterequests", "issuers"]
verbs: ["get", "list", "watch"]

20
templates/cert-manager-cr-certmanager-webhook-0.9.0.yaml Normal file
View file

@ -0,0 +1,20 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cert-manager-webhook:webhook-requester
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
rules:
- apiGroups:
- admission.certmanager.k8s.io
resources:
- certificates
- certificaterequests
- issuers
- clusterissuers
verbs:
- create

18
templates/cert-manager-crb-cainjector-0.9.0.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: cert-manager-cainjector
labels:
app: cainjector
app.kubernetes.io/name: cainjector
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cainjector-v0.9.0
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cert-manager-cainjector
subjects:
- name: cert-manager-cainjector
namespace: "cert-manager"
kind: ServiceAccount

18
templates/cert-manager-crb-certmanager-certificates-0.9.0.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: cert-manager-controller-certificates
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cert-manager-controller-certificates
subjects:
- name: cert-manager
namespace: "cert-manager"
kind: ServiceAccount

18
templates/cert-manager-crb-certmanager-challenges-0.9.0.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: cert-manager-controller-challenges
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cert-manager-controller-challenges
subjects:
- name: cert-manager
namespace: "cert-manager"
kind: ServiceAccount

18
templates/cert-manager-crb-certmanager-controlerclusterissuers-0.9.0.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: cert-manager-controller-clusterissuers
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cert-manager-controller-clusterissuers
subjects:
- name: cert-manager
namespace: "cert-manager"
kind: ServiceAccount

18
templates/cert-manager-crb-certmanager-controlerissuers-0.9.0.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: cert-manager-controller-issuers
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cert-manager-controller-issuers
subjects:
- name: cert-manager
namespace: "cert-manager"
kind: ServiceAccount

18
templates/cert-manager-crb-certmanager-ingressshim-0.9.0.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: cert-manager-controller-ingress-shim
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cert-manager-controller-ingress-shim
subjects:
- name: cert-manager
namespace: "cert-manager"
kind: ServiceAccount

18
templates/cert-manager-crb-certmanager-leaderelection-0.9.0.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: cert-manager-leaderelection
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cert-manager-leaderelection
subjects:
- name: cert-manager
namespace: "cert-manager"
kind: ServiceAccount

18
templates/cert-manager-crb-certmanager-orders-0.9.0.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: cert-manager-controller-orders
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cert-manager-controller-orders
subjects:
- name: cert-manager
namespace: "cert-manager"
kind: ServiceAccount

21
templates/cert-manager-crb-certmanager-webhook-0.9.0.yaml Normal file
View file

@ -0,0 +1,21 @@
# apiserver gets the auth-delegator role to delegate auth decisions to
# the core apiserver
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: cert-manager-webhook:auth-delegator
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:auth-delegator
subjects:
- apiGroup: ""
kind: ServiceAccount
name: cert-manager-webhook
namespace: cert-manager

197
templates/cert-manager-crd-challenges-0.9.0.yaml Normal file
View file

@ -0,0 +1,197 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
creationTimestamp: null
labels:
controller-tools.k8s.io: "1.0"
name: challenges.certmanager.k8s.io
spec:
additionalPrinterColumns:
- JSONPath: .status.state
name: State
type: string
- JSONPath: .spec.dnsName
name: Domain
type: string
- JSONPath: .status.reason
name: Reason
priority: 1
type: string
- JSONPath: .metadata.creationTimestamp
description: CreationTimestamp is a timestamp representing the server time when
this object was created. It is not guaranteed to be set in happens-before order
across separate operations. Clients may not set this value. It is represented
in RFC3339 form and is in UTC.
name: Age
type: date
group: certmanager.k8s.io
names:
kind: Challenge
plural: challenges
scope: Namespaced
validation:
openAPIV3Schema:
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
properties:
authzURL:
description: AuthzURL is the URL to the ACME Authorization resource
that this challenge is a part of.
type: string
config:
description: 'Config specifies the solver configuration for this challenge.
Only **one** of ''config'' or ''solver'' may be specified, and if
both are specified then no action will be performed on the Challenge
resource. DEPRECATED: the ''solver'' field should be specified instead'
type: object
dnsName:
description: DNSName is the identifier that this challenge is for, e.g.
example.com.
type: string
issuerRef:
description: IssuerRef references a properly configured ACME-type Issuer
which should be used to create this Challenge. If the Issuer does
not exist, processing will be retried. If the Issuer is not an 'ACME'
Issuer, an error will be returned and the Challenge will be marked
as failed.
properties:
group:
type: string
kind:
type: string
name:
type: string
required:
- name
type: object
key:
description: Key is the ACME challenge key for this challenge
type: string
solver:
description: Solver contains the domain solving configuration that should
be used to solve this challenge resource. Only **one** of 'config'
or 'solver' may be specified, and if both are specified then no action
will be performed on the Challenge resource.
properties:
selector:
description: Selector selects a set of DNSNames on the Certificate
resource that should be solved using this challenge solver.
properties:
dnsNames:
description: List of DNSNames that this solver will be used
to solve. If specified and a match is found, a dnsNames selector
will take precedence over a dnsZones selector. If multiple
solvers match with the same dnsNames value, the solver with
the most matching labels in matchLabels will be selected.
If neither has more matches, the solver defined earlier in
the list will be selected.
items:
type: string
type: array
dnsZones:
description: List of DNSZones that this solver will be used
to solve. The most specific DNS zone match specified here
will take precedence over other DNS zone matches, so a solver
specifying sys.example.com will be selected over one specifying
example.com for the domain www.sys.example.com. If multiple
solvers match with the same dnsZones value, the solver with
the most matching labels in matchLabels will be selected.
If neither has more matches, the solver defined earlier in
the list will be selected.
items:
type: string
type: array
matchLabels:
description: A label selector that is used to refine the set
of certificate's that this challenge solver will apply to.
type: object
type: object
type: object
token:
description: Token is the ACME challenge token for this challenge.
type: string
type:
description: Type is the type of ACME challenge this resource represents,
e.g. "dns01" or "http01"
type: string
url:
description: URL is the URL of the ACME Challenge resource for this
challenge. This can be used to lookup details about the status of
this challenge.
type: string
wildcard:
description: Wildcard will be true if this challenge is for a wildcard
identifier, for example '*.example.com'
type: boolean
required:
- authzURL
- type
- url
- dnsName
- token
- key
- wildcard
- issuerRef
type: object
status:
properties:
presented:
description: Presented will be set to true if the challenge values for
this challenge are currently 'presented'. This *does not* imply the
self check is passing. Only that the values have been 'submitted'
for the appropriate challenge mechanism (i.e. the DNS01 TXT record
has been presented, or the HTTP01 configuration has been configured).
type: boolean
processing:
description: Processing is used to denote whether this challenge should
be processed or not. This field will only be set to true by the 'scheduling'
component. It will only be set to false by the 'challenges' controller,
after the challenge has reached a final state or timed out. If this
field is set to false, the challenge controller will not take any
more action.
type: boolean
reason:
description: Reason contains human readable information on why the Challenge
is in the current state.
type: string
state:
description: State contains the current 'state' of the challenge. If
not set, the state of the challenge is unknown.
enum:
- ""
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
type: string
required:
- processing
- presented
- reason
type: object
required:
- metadata
- spec
- status
version: v1alpha1
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []

300
templates/cert-manager-crd-clusterissuers-0.9.0.yaml Normal file
View file

@ -0,0 +1,300 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
creationTimestamp: null
labels:
controller-tools.k8s.io: "1.0"
name: clusterissuers.certmanager.k8s.io
spec:
group: certmanager.k8s.io
names:
kind: ClusterIssuer
plural: clusterissuers
scope: Cluster
validation:
openAPIV3Schema:
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
properties:
acme:
properties:
email:
description: Email is the email for this account
type: string
privateKeySecretRef:
description: PrivateKey is the name of a secret containing the private
key for this user account.
properties:
key:
description: The key of the secret to select from. Must be a
valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
required:
- name
type: object
server:
description: Server is the ACME server URL
type: string
skipTLSVerify:
description: If true, skip verifying the ACME server TLS certificate
type: boolean
solvers:
description: Solvers is a list of challenge solvers that will be
used to solve ACME challenges for the matching domains.
items:
properties:
selector:
description: Selector selects a set of DNSNames on the Certificate
resource that should be solved using this challenge solver.
properties:
dnsNames:
description: List of DNSNames that this solver will be
used to solve. If specified and a match is found, a
dnsNames selector will take precedence over a dnsZones
selector. If multiple solvers match with the same dnsNames
value, the solver with the most matching labels in matchLabels
will be selected. If neither has more matches, the solver
defined earlier in the list will be selected.
items:
type: string
type: array
dnsZones:
description: List of DNSZones that this solver will be
used to solve. The most specific DNS zone match specified
here will take precedence over other DNS zone matches,
so a solver specifying sys.example.com will be selected
over one specifying example.com for the domain www.sys.example.com.
If multiple solvers match with the same dnsZones value,
the solver with the most matching labels in matchLabels
will be selected. If neither has more matches, the solver
defined earlier in the list will be selected.
items:
type: string
type: array
matchLabels:
description: A label selector that is used to refine the
set of certificate's that this challenge solver will
apply to.
type: object
type: object
type: object
type: array
required:
- server
- privateKeySecretRef
type: object
ca:
properties:
secretName:
description: SecretName is the name of the secret used to sign Certificates
issued by this Issuer.
type: string
required:
- secretName
type: object
selfSigned:
type: object
vault:
properties:
auth:
description: Vault authentication
properties:
appRole:
description: This Secret contains a AppRole and Secret
properties:
path:
description: Where the authentication path is mounted in
Vault.
type: string
roleId:
type: string
secretRef:
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
required:
- name
type: object
required:
- path
- roleId
- secretRef
type: object
tokenSecretRef:
description: This Secret contains the Vault token key
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
required:
- name
type: object
type: object
caBundle:
description: Base64 encoded CA bundle to validate Vault server certificate.
Only used if the Server URL is using HTTPS protocol. This parameter
is ignored for plain HTTP protocol connection. If not set the
system root certificates are used to validate the TLS connection.
format: byte
type: string
path:
description: Vault URL path to the certificate role
type: string
server:
description: Server is the vault connection address
type: string
required:
- auth
- server
- path
type: object
venafi:
properties:
cloud:
description: Cloud specifies the Venafi cloud configuration settings.
Only one of TPP or Cloud may be specified.
properties:
apiTokenSecretRef:
description: APITokenSecretRef is a secret key selector for
the Venafi Cloud API token.
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
required:
- name
type: object
url:
description: URL is the base URL for Venafi Cloud
type: string
required:
- url
- apiTokenSecretRef
type: object
tpp:
description: TPP specifies Trust Protection Platform configuration
settings. Only one of TPP or Cloud may be specified.
properties:
caBundle:
description: CABundle is a PEM encoded TLS certifiate to use
to verify connections to the TPP instance. If specified, system
roots will not be used and the issuing CA for the TPP instance
must be verifiable using the provided root. If not specified,
the connection will be verified using the cert-manager system
root certificates.
format: byte
type: string
credentialsRef:
description: CredentialsRef is a reference to a Secret containing
the username and password for the TPP server. The secret must
contain two keys, 'username' and 'password'.
properties:
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
required:
- name
type: object
url:
description: URL is the base URL for the Venafi TPP instance
type: string
required:
- url
- credentialsRef
type: object
zone:
description: Zone is the Venafi Policy Zone to use for this issuer.
All requests made to the Venafi platform will be restricted by
the named zone policy. This field is required.
type: string
required:
- zone
type: object
type: object
status:
properties:
acme:
properties:
lastRegisteredEmail:
description: LastRegisteredEmail is the email associated with the
latest registered ACME account, in order to track changes made
to registered account associated with the Issuer
type: string
uri:
description: URI is the unique account identifier, which can also
be used to retrieve account details from the CA
type: string
type: object
conditions:
items:
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding
to the last status change of this condition.
format: date-time
type: string
message:
description: Message is a human readable description of the details
of the last transition, complementing reason.
type: string
reason:
description: Reason is a brief machine readable explanation for
the condition's last transition.
type: string
status:
description: Status of the condition, one of ('True', 'False',
'Unknown').
enum:
- "True"
- "False"
- Unknown
type: string
type:
description: Type of the condition, currently ('Ready').
type: string
required:
- type
- status
type: object
type: array
type: object
version: v1alpha1
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []

214
templates/cert-manager-crd-crt-0.9.0.yaml Normal file
View file

@ -0,0 +1,214 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
creationTimestamp: null
labels:
controller-tools.k8s.io: "1.0"
name: certificates.certmanager.k8s.io
spec:
additionalPrinterColumns:
- JSONPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- JSONPath: .spec.secretName
name: Secret
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
priority: 1
type: string
- JSONPath: .status.conditions[?(@.type=="Ready")].message
name: Status
priority: 1
type: string
- JSONPath: .metadata.creationTimestamp
description: CreationTimestamp is a timestamp representing the server time when
this object was created. It is not guaranteed to be set in happens-before order
across separate operations. Clients may not set this value. It is represented
in RFC3339 form and is in UTC.
name: Age
type: date
group: certmanager.k8s.io
names:
kind: Certificate
plural: certificates
shortNames:
- cert
- certs
scope: Namespaced
validation:
openAPIV3Schema:
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
properties:
acme:
description: ACME contains configuration specific to ACME Certificates.
Notably, this contains details on how the domain names listed on this
Certificate resource should be 'solved', i.e. mapping HTTP01 and DNS01
providers to DNS names.
properties:
config:
items:
properties:
domains:
description: Domains is the list of domains that this SolverConfig
applies to.
items:
type: string
type: array
required:
- domains
type: object
type: array
required:
- config
type: object
commonName:
description: CommonName is a common name to be used on the Certificate.
If no CommonName is given, then the first entry in DNSNames is used
as the CommonName. The CommonName should have a length of 64 characters
or fewer to avoid generating invalid CSRs; in order to have longer
domain names, set the CommonName (or first DNSNames entry) to have
64 characters or fewer, and then add the longer domain name to DNSNames.
type: string
dnsNames:
description: DNSNames is a list of subject alt names to be used on the
Certificate. If no CommonName is given, then the first entry in DNSNames
is used as the CommonName and must have a length of 64 characters
or fewer.
items:
type: string
type: array
duration:
description: Certificate default Duration
type: string
ipAddresses:
description: IPAddresses is a list of IP addresses to be used on the
Certificate
items:
type: string
type: array
isCA:
description: IsCA will mark this Certificate as valid for signing. This
implies that the 'signing' usage is set
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this certificate.
If the 'kind' field is not set, or set to 'Issuer', an Issuer resource
with the given name in the same namespace as the Certificate will
be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
with the provided name will be used. The 'name' field in this stanza
is required at all times.
properties:
group:
type: string
kind:
type: string
name:
type: string
required:
- name
type: object
keyAlgorithm:
description: KeyAlgorithm is the private key algorithm of the corresponding
private key for this certificate. If provided, allowed values are
either "rsa" or "ecdsa" If KeyAlgorithm is specified and KeySize is
not provided, key size of 256 will be used for "ecdsa" key algorithm
and key size of 2048 will be used for "rsa" key algorithm.
enum:
- rsa
- ecdsa
type: string
keyEncoding:
description: KeyEncoding is the private key cryptography standards (PKCS)
for this certificate's private key to be encoded in. If provided,
allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8,
respectively. If KeyEncoding is not specified, then PKCS#1 will be
used by default.
type: string
keySize:
description: KeySize is the key bit size of the corresponding private
key for this certificate. If provided, value must be between 2048
and 8192 inclusive when KeyAlgorithm is empty or is set to "rsa",
and value must be one of (256, 384, 521) when KeyAlgorithm is set
to "ecdsa".
format: int64
type: integer
organization:
description: Organization is the organization to be used on the Certificate
items:
type: string
type: array
renewBefore:
description: Certificate renew before expiration duration
type: string
secretName:
description: SecretName is the name of the secret resource to store
this secret in
type: string
required:
- secretName
- issuerRef
type: object
status:
properties:
conditions:
items:
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding
to the last status change of this condition.
format: date-time
type: string
message:
description: Message is a human readable description of the details
of the last transition, complementing reason.
type: string
reason:
description: Reason is a brief machine readable explanation for
the condition's last transition.
type: string
status:
description: Status of the condition, one of ('True', 'False',
'Unknown').
enum:
- "True"
- "False"
- Unknown
type: string
type:
description: Type of the condition, currently ('Ready').
type: string
required:
- type
- status
type: object
type: array
lastFailureTime:
format: date-time
type: string
notAfter:
description: The expiration time of the certificate stored in the secret
named by this resource in spec.secretName.
format: date-time
type: string
type: object
version: v1alpha1
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []

136
templates/cert-manager-crd-crtreq-0.9.0.yaml Normal file
View file

@ -0,0 +1,136 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
creationTimestamp: null
labels:
controller-tools.k8s.io: "1.0"
name: certificaterequests.certmanager.k8s.io
spec:
additionalPrinterColumns:
- JSONPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
priority: 1
type: string
- JSONPath: .status.conditions[?(@.type=="Ready")].message
name: Status
priority: 1
type: string
- JSONPath: .metadata.creationTimestamp
description: CreationTimestamp is a timestamp representing the server time when
this object was created. It is not guaranteed to be set in happens-before order
across separate operations. Clients may not set this value. It is represented
in RFC3339 form and is in UTC.
name: Age
type: date
group: certmanager.k8s.io
names:
kind: CertificateRequest
plural: certificaterequests
shortNames:
- cr
- crs
scope: Namespaced
validation:
openAPIV3Schema:
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
properties:
csr:
description: Byte slice containing the PEM encoded CertificateSigningRequest
format: byte
type: string
duration:
description: Requested certificate default Duration
type: string
isCA:
description: IsCA will mark the resulting certificate as valid for signing.
This implies that the 'signing' usage is set
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this CertificateRequest. If
the 'kind' field is not set, or set to 'Issuer', an Issuer resource
with the given name in the same namespace as the CertificateRequest
will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
with the provided name will be used. The 'name' field in this stanza
is required at all times. The group field refers to the API group
of the issuer which defaults to 'certmanager.k8s.io' if empty.
properties:
group:
type: string
kind:
type: string
name:
type: string
required:
- name
type: object
required:
- issuerRef
type: object
status:
properties:
ca:
description: Byte slice containing the PEM encoded certificate authority
of the signed certificate.
format: byte
type: string
certificate:
description: Byte slice containing a PEM encoded signed certificate
resulting from the given certificate signing request.
format: byte
type: string
conditions:
items:
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding
to the last status change of this condition.
format: date-time
type: string
message:
description: Message is a human readable description of the details
of the last transition, complementing reason.
type: string
reason:
description: Reason is a brief machine readable explanation for
the condition's last transition.
type: string
status:
description: Status of the condition, one of ('True', 'False',
'Unknown').
enum:
- "True"
- "False"
- Unknown
type: string
type:
description: Type of the condition, currently ('Ready').
type: string
required:
- type
- status
type: object
type: array
type: object
version: v1alpha1
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []

300
templates/cert-manager-crd-issuers-0.9.0.yaml Normal file
View file

@ -0,0 +1,300 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
creationTimestamp: null
labels:
controller-tools.k8s.io: "1.0"
name: issuers.certmanager.k8s.io
spec:
group: certmanager.k8s.io
names:
kind: Issuer
plural: issuers
scope: Namespaced
validation:
openAPIV3Schema:
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
properties:
acme:
properties:
email:
description: Email is the email for this account
type: string
privateKeySecretRef:
description: PrivateKey is the name of a secret containing the private
key for this user account.
properties:
key:
description: The key of the secret to select from. Must be a
valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
required:
- name
type: object
server:
description: Server is the ACME server URL
type: string
skipTLSVerify:
description: If true, skip verifying the ACME server TLS certificate
type: boolean
solvers:
description: Solvers is a list of challenge solvers that will be
used to solve ACME challenges for the matching domains.
items:
properties:
selector:
description: Selector selects a set of DNSNames on the Certificate
resource that should be solved using this challenge solver.
properties:
dnsNames:
description: List of DNSNames that this solver will be
used to solve. If specified and a match is found, a
dnsNames selector will take precedence over a dnsZones
selector. If multiple solvers match with the same dnsNames
value, the solver with the most matching labels in matchLabels
will be selected. If neither has more matches, the solver
defined earlier in the list will be selected.
items:
type: string
type: array
dnsZones:
description: List of DNSZones that this solver will be
used to solve. The most specific DNS zone match specified
here will take precedence over other DNS zone matches,
so a solver specifying sys.example.com will be selected
over one specifying example.com for the domain www.sys.example.com.
If multiple solvers match with the same dnsZones value,
the solver with the most matching labels in matchLabels
will be selected. If neither has more matches, the solver
defined earlier in the list will be selected.
items:
type: string
type: array
matchLabels:
description: A label selector that is used to refine the
set of certificate's that this challenge solver will
apply to.
type: object
type: object
type: object
type: array
required:
- server
- privateKeySecretRef
type: object
ca:
properties:
secretName:
description: SecretName is the name of the secret used to sign Certificates
issued by this Issuer.
type: string
required:
- secretName
type: object
selfSigned:
type: object
vault:
properties:
auth:
description: Vault authentication
properties:
appRole:
description: This Secret contains a AppRole and Secret
properties:
path:
description: Where the authentication path is mounted in
Vault.
type: string
roleId:
type: string
secretRef:
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
required:
- name
type: object
required:
- path
- roleId
- secretRef
type: object
tokenSecretRef:
description: This Secret contains the Vault token key
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
required:
- name
type: object
type: object
caBundle:
description: Base64 encoded CA bundle to validate Vault server certificate.
Only used if the Server URL is using HTTPS protocol. This parameter
is ignored for plain HTTP protocol connection. If not set the
system root certificates are used to validate the TLS connection.
format: byte
type: string
path:
description: Vault URL path to the certificate role
type: string
server:
description: Server is the vault connection address
type: string
required:
- auth
- server
- path
type: object
venafi:
properties:
cloud:
description: Cloud specifies the Venafi cloud configuration settings.
Only one of TPP or Cloud may be specified.
properties:
apiTokenSecretRef:
description: APITokenSecretRef is a secret key selector for
the Venafi Cloud API token.
properties:
key:
description: The key of the secret to select from. Must
be a valid secret key.
type: string
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
required:
- name
type: object
url:
description: URL is the base URL for Venafi Cloud
type: string
required:
- url
- apiTokenSecretRef
type: object
tpp:
description: TPP specifies Trust Protection Platform configuration
settings. Only one of TPP or Cloud may be specified.
properties:
caBundle:
description: CABundle is a PEM encoded TLS certifiate to use
to verify connections to the TPP instance. If specified, system
roots will not be used and the issuing CA for the TPP instance
must be verifiable using the provided root. If not specified,
the connection will be verified using the cert-manager system
root certificates.
format: byte
type: string
credentialsRef:
description: CredentialsRef is a reference to a Secret containing
the username and password for the TPP server. The secret must
contain two keys, 'username' and 'password'.
properties:
name:
description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?'
type: string
required:
- name
type: object
url:
description: URL is the base URL for the Venafi TPP instance
type: string
required:
- url
- credentialsRef
type: object
zone:
description: Zone is the Venafi Policy Zone to use for this issuer.
All requests made to the Venafi platform will be restricted by
the named zone policy. This field is required.
type: string
required:
- zone
type: object
type: object
status:
properties:
acme:
properties:
lastRegisteredEmail:
description: LastRegisteredEmail is the email associated with the
latest registered ACME account, in order to track changes made
to registered account associated with the Issuer
type: string
uri:
description: URI is the unique account identifier, which can also
be used to retrieve account details from the CA
type: string
type: object
conditions:
items:
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding
to the last status change of this condition.
format: date-time
type: string
message:
description: Message is a human readable description of the details
of the last transition, complementing reason.
type: string
reason:
description: Reason is a brief machine readable explanation for
the condition's last transition.
type: string
status:
description: Status of the condition, one of ('True', 'False',
'Unknown').
enum:
- "True"
- "False"
- Unknown
type: string
type:
description: Type of the condition, currently ('Ready').
type: string
required:
- type
- status
type: object
type: array
type: object
version: v1alpha1
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []

273
templates/cert-manager-crd-orders-0.9.0.yaml Normal file
View file

@ -0,0 +1,273 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
creationTimestamp: null
labels:
controller-tools.k8s.io: "1.0"
name: orders.certmanager.k8s.io
spec:
additionalPrinterColumns:
- JSONPath: .status.state
name: State
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
priority: 1
type: string
- JSONPath: .status.reason
name: Reason
priority: 1
type: string
- JSONPath: .metadata.creationTimestamp
description: CreationTimestamp is a timestamp representing the server time when
this object was created. It is not guaranteed to be set in happens-before order
across separate operations. Clients may not set this value. It is represented
in RFC3339 form and is in UTC.
name: Age
type: date
group: certmanager.k8s.io
names:
kind: Order
plural: orders
scope: Namespaced
validation:
openAPIV3Schema:
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
properties:
commonName:
description: CommonName is the common name as specified on the DER encoded
CSR. If CommonName is not specified, the first DNSName specified will
be used as the CommonName. At least one of CommonName or a DNSNames
must be set. This field must match the corresponding field on the
DER encoded CSR.
type: string
config:
description: 'Config specifies a mapping from DNS identifiers to how
those identifiers should be solved when performing ACME challenges.
A config entry must exist for each domain listed in DNSNames and CommonName.
Only **one** of ''config'' or ''solvers'' may be specified, and if
both are specified then no action will be performed on the Order resource. This
field will be removed when support for solver config specified on
the Certificate under certificate.spec.acme has been removed. DEPRECATED:
this field will be removed in future. Solver configuration must instead
be provided on ACME Issuer resources.'
items:
properties:
domains:
description: Domains is the list of domains that this SolverConfig
applies to.
items:
type: string
type: array
required:
- domains
type: object
type: array
csr:
description: Certificate signing request bytes in DER encoding. This
will be used when finalizing the order. This field must be set on
the order.
format: byte
type: string
dnsNames:
description: DNSNames is a list of DNS names that should be included
as part of the Order validation process. If CommonName is not specified,
the first DNSName specified will be used as the CommonName. At least
one of CommonName or a DNSNames must be set. This field must match
the corresponding field on the DER encoded CSR.
items:
type: string
type: array
issuerRef:
description: IssuerRef references a properly configured ACME-type Issuer
which should be used to create this Order. If the Issuer does not
exist, processing will be retried. If the Issuer is not an 'ACME'
Issuer, an error will be returned and the Order will be marked as
failed.
properties:
group:
type: string
kind:
type: string
name:
type: string
required:
- name
type: object
required:
- csr
- issuerRef
type: object
status:
properties:
certificate:
description: Certificate is a copy of the PEM encoded certificate for
this Order. This field will be populated after the order has been
successfully finalized with the ACME server, and the order has transitioned
to the 'valid' state.
format: byte
type: string
challenges:
description: Challenges is a list of ChallengeSpecs for Challenges that
must be created in order to complete this Order.
items:
properties:
authzURL:
description: AuthzURL is the URL to the ACME Authorization resource
that this challenge is a part of.
type: string
config:
description: 'Config specifies the solver configuration for this
challenge. Only **one** of ''config'' or ''solver'' may be specified,
and if both are specified then no action will be performed on
the Challenge resource. DEPRECATED: the ''solver'' field should
be specified instead'
type: object
dnsName:
description: DNSName is the identifier that this challenge is
for, e.g. example.com.
type: string
issuerRef:
description: IssuerRef references a properly configured ACME-type
Issuer which should be used to create this Challenge. If the
Issuer does not exist, processing will be retried. If the Issuer
is not an 'ACME' Issuer, an error will be returned and the Challenge
will be marked as failed.
properties:
group:
type: string
kind:
type: string
name:
type: string
required:
- name
type: object
key:
description: Key is the ACME challenge key for this challenge
type: string
solver:
description: Solver contains the domain solving configuration
that should be used to solve this challenge resource. Only **one**
of 'config' or 'solver' may be specified, and if both are specified
then no action will be performed on the Challenge resource.
properties:
selector:
description: Selector selects a set of DNSNames on the Certificate
resource that should be solved using this challenge solver.
properties:
dnsNames:
description: List of DNSNames that this solver will be
used to solve. If specified and a match is found, a
dnsNames selector will take precedence over a dnsZones
selector. If multiple solvers match with the same dnsNames
value, the solver with the most matching labels in matchLabels
will be selected. If neither has more matches, the solver
defined earlier in the list will be selected.
items:
type: string
type: array
dnsZones:
description: List of DNSZones that this solver will be
used to solve. The most specific DNS zone match specified
here will take precedence over other DNS zone matches,
so a solver specifying sys.example.com will be selected
over one specifying example.com for the domain www.sys.example.com.
If multiple solvers match with the same dnsZones value,
the solver with the most matching labels in matchLabels
will be selected. If neither has more matches, the solver
defined earlier in the list will be selected.
items:
type: string
type: array
matchLabels:
description: A label selector that is used to refine the
set of certificate's that this challenge solver will
apply to.
type: object
type: object
type: object
token:
description: Token is the ACME challenge token for this challenge.
type: string
type:
description: Type is the type of ACME challenge this resource
represents, e.g. "dns01" or "http01"
type: string
url:
description: URL is the URL of the ACME Challenge resource for
this challenge. This can be used to lookup details about the
status of this challenge.
type: string
wildcard:
description: Wildcard will be true if this challenge is for a
wildcard identifier, for example '*.example.com'
type: boolean
required:
- authzURL
- type
- url
- dnsName
- token
- key
- wildcard
- issuerRef
type: object
type: array
failureTime:
description: FailureTime stores the time that this order failed. This
is used to influence garbage collection and back-off.
format: date-time
type: string
finalizeURL:
description: FinalizeURL of the Order. This is used to obtain certificates
for this order once it has been completed.
type: string
reason:
description: Reason optionally provides more information about a why
the order is in the current state.
type: string
state:
description: State contains the current state of this Order resource.
States 'success' and 'expired' are 'final'
enum:
- ""
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
type: string
url:
description: URL of the Order. This will initially be empty when the
resource is first created. The Order controller will populate this
field when the Order is first processed. This field will be immutable
after it is initially set.
type: string
type: object
required:
- metadata
- spec
- status
version: v1alpha1
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []

53
templates/cert-manager-dp-0.9.0.yaml Normal file
View file

@ -0,0 +1,53 @@
# Source: cert-manager/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: cert-manager
namespace: "cert-manager"
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
spec:
replicas: 1
selector:
matchLabels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
template:
metadata:
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0
annotations:
prometheus.io/path: "/metrics"
prometheus.io/scrape: 'true'
prometheus.io/port: '9402'
spec:
serviceAccountName: cert-manager
containers:
- name: cert-manager
image: "quay.io/jetstack/cert-manager-controller:v0.9.0"
imagePullPolicy: IfNotPresent
args:
- --v=2
- --cluster-resource-namespace=$(POD_NAMESPACE)
- --leader-election-namespace=$(POD_NAMESPACE)
ports:
- containerPort: 9402
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
resources:
requests:
cpu: 10m
memory: 32Mi

45
templates/cert-manager-dp-cainjector-0.9.0.yaml Normal file
View file

@ -0,0 +1,45 @@
# Source: cert-manager/charts/cainjector/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: cert-manager-cainjector
namespace: "cert-manager"
labels:
app: cainjector
app.kubernetes.io/name: cainjector
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cainjector-v0.9.0
spec:
replicas: 1
selector:
matchLabels:
app: cainjector
app.kubernetes.io/name: cainjector
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
template:
metadata:
labels:
app: cainjector
app.kubernetes.io/name: cainjector
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cainjector-v0.9.0
annotations:
spec:
serviceAccountName: cert-manager-cainjector
containers:
- name: cainjector
image: "quay.io/jetstack/cert-manager-cainjector:v0.9.0"
imagePullPolicy: IfNotPresent
args:
- --v=2
- --leader-election-namespace=$(POD_NAMESPACE)
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
resources:
{}

55
templates/cert-manager-dp-webhook-0.9.0.yaml Normal file
View file

@ -0,0 +1,55 @@
# Source: cert-manager/charts/webhook/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: cert-manager-webhook
namespace: "cert-manager"
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
spec:
replicas: 1
selector:
matchLabels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
template:
metadata:
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
annotations:
spec:
serviceAccountName: cert-manager-webhook
containers:
- name: webhook
image: "quay.io/jetstack/cert-manager-webhook:v0.9.0"
imagePullPolicy: IfNotPresent
args:
- --v=2
- --secure-port=6443
- --tls-cert-file=/certs/tls.crt
- --tls-private-key-file=/certs/tls.key
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
resources:
{}
volumeMounts:
- name: certs
mountPath: /certs
volumes:
- name: certs
secret:
secretName: cert-manager-webhook-webhook-tls

15
templates/cert-manager-issuer-webhookca-0.9.0.yaml Normal file
View file

@ -0,0 +1,15 @@
# Create an Issuer that uses the above generated CA certificate to issue certs
apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer
metadata:
name: cert-manager-webhook-ca
namespace: "cert-manager"
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
spec:
ca:
secretName: cert-manager-webhook-ca

15
templates/cert-manager-issuer-webhookselfsign-0.9.0.yaml Normal file
View file

@ -0,0 +1,15 @@
# Create a selfsigned Issuer, in order to create a root CA certificate for
# signing webhook serving certificates
apiVersion: certmanager.k8s.io/v1alpha1
kind: Issuer
metadata:
name: cert-manager-webhook-selfsign
namespace: "cert-manager"
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
spec:
selfSigned: {}

6
templates/cert-manager-ns-0.9.0.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: v1
kind: Namespace
metadata:
name: cert-manager
labels:
certmanager.k8s.io/disable-validation: "true"

23
templates/cert-manager-rb-certmanager-webhook-0.9.0.yaml Normal file
View file

@ -0,0 +1,23 @@
# apiserver gets the ability to read authentication. This allows it to
# read the specific configmap that has the requestheader-* entries to
# api agg
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
name: cert-manager-webhook:webhook-authentication-reader
namespace: kube-system
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: extension-apiserver-authentication-reader
subjects:
- apiGroup: ""
kind: ServiceAccount
name: cert-manager-webhook
namespace: cert-manager

12
templates/cert-manager-sa-cainjector-0.9.0.yaml Normal file
View file

@ -0,0 +1,12 @@
# Source: cert-manager/charts/cainjector/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: cert-manager-cainjector
namespace: "cert-manager"
labels:
app: cainjector
app.kubernetes.io/name: cainjector
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cainjector-v0.9.0

12
templates/cert-manager-sa-certmanager-0.9.0.yaml Normal file
View file

@ -0,0 +1,12 @@
# Source: cert-manager/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: cert-manager
namespace: "cert-manager"
labels:
app: cert-manager
app.kubernetes.io/name: cert-manager
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: cert-manager-v0.9.0

12
templates/cert-manager-sa-webhook-0.9.0.yaml Normal file
View file

@ -0,0 +1,12 @@
# Source: cert-manager/charts/webhook/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: cert-manager-webhook
namespace: "cert-manager"
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0

23
templates/cert-manager-svc-webhook-0.9.0.yaml Normal file
View file

@ -0,0 +1,23 @@
# Source: cert-manager/charts/webhook/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: cert-manager-webhook
namespace: "cert-manager"
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
spec:
type: ClusterIP
ports:
- name: https
port: 443
targetPort: 6443
selector:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller

96
templates/cert-manager-validatewebhook-0.9.0.yaml Normal file
View file

@ -0,0 +1,96 @@
# Source: cert-manager/charts/webhook/templates/validating-webhook.yaml
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
name: cert-manager-webhook
labels:
app: webhook
app.kubernetes.io/name: webhook
app.kubernetes.io/instance: cert-manager
app.kubernetes.io/managed-by: Tiller
helm.sh/chart: webhook-v0.9.0
annotations:
certmanager.k8s.io/inject-apiserver-ca: "true"
webhooks:
- name: certificates.admission.certmanager.k8s.io
namespaceSelector:
matchExpressions:
- key: "certmanager.k8s.io/disable-validation"
operator: "NotIn"
values:
- "true"
- key: "name"
operator: "NotIn"
values:
- cert-manager
rules:
- apiGroups:
- "certmanager.k8s.io"
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
resources:
- certificates
failurePolicy: Fail
clientConfig:
service:
name: kubernetes
namespace: default
path: /apis/admission.certmanager.k8s.io/v1beta1/certificates
- name: issuers.admission.certmanager.k8s.io
namespaceSelector:
matchExpressions:
- key: "certmanager.k8s.io/disable-validation"
operator: "NotIn"
values:
- "true"
- key: "name"
operator: "NotIn"
values:
- cert-manager
rules:
- apiGroups:
- "certmanager.k8s.io"
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
resources:
- issuers
failurePolicy: Fail
clientConfig:
service:
name: kubernetes
namespace: default
path: /apis/admission.certmanager.k8s.io/v1beta1/issuers
- name: clusterissuers.admission.certmanager.k8s.io
namespaceSelector:
matchExpressions:
- key: "certmanager.k8s.io/disable-validation"
operator: "NotIn"
values:
- "true"
- key: "name"
operator: "NotIn"
values:
- cert-manager
rules:
- apiGroups:
- "certmanager.k8s.io"
apiVersions:
- v1alpha1
operations:
- CREATE
- UPDATE
resources:
- clusterissuers
failurePolicy: Fail
clientConfig:
service:
name: kubernetes
namespace: default
path: /apis/admission.certmanager.k8s.io/v1beta1/clusterissuers

1
vars/main.yml Normal file
View file

@ -0,0 +1 @@
user: "{{ ansible_user_id }}"