Add version 0.14.1
This commit is contained in:
parent
c2dcfea3f8
commit
2ec49e784c
39 changed files with 6779 additions and 0 deletions
|
|
@ -46,3 +46,9 @@
|
||||||
when:
|
when:
|
||||||
- certmanager_version | regex_search('(0.13)') or certmanager_actual_version.stdout | regex_search('(0.13)')
|
- certmanager_version | regex_search('(0.13)') or certmanager_actual_version.stdout | regex_search('(0.13)')
|
||||||
tags: certmanager
|
tags: certmanager
|
||||||
|
|
||||||
|
- name: install / uninstall version 0.14
|
||||||
|
include_tasks: "version_0.14.yml"
|
||||||
|
when:
|
||||||
|
- certmanager_version | regex_search('(0.14)') or certmanager_actual_version.stdout | regex_search('(0.14)')
|
||||||
|
tags: certmanager
|
||||||
|
|
|
||||||
54
tasks/version_0.14.yml
Normal file
54
tasks/version_0.14.yml
Normal file
|
|
@ -0,0 +1,54 @@
|
||||||
|
---
|
||||||
|
- set_fact:
|
||||||
|
certmanager_0_14_state: "present"
|
||||||
|
when:
|
||||||
|
- certmanager_version | regex_search('(0.14)')
|
||||||
|
|
||||||
|
- set_fact:
|
||||||
|
certmanager_0_14_state: "absent"
|
||||||
|
when:
|
||||||
|
- not certmanager_version | regex_search('(0.14)')
|
||||||
|
|
||||||
|
- name: Cert Manager files version {{ certmanager_version }} need to be {{ certmanager_0_14_state }}
|
||||||
|
k8s:
|
||||||
|
state: "{{ certmanager_0_14_state }}"
|
||||||
|
context: "{{ my_context }}"
|
||||||
|
resource_definition: "{{ lookup('template', item) | from_yaml }}"
|
||||||
|
with_items:
|
||||||
|
- "0.14/certificaterequests.cert-manager.io-CustomResourceDefinition.yaml"
|
||||||
|
- "0.14/certificates.cert-manager.io-CustomResourceDefinition.yaml"
|
||||||
|
- "0.14/challenges.acme.cert-manager.io-CustomResourceDefinition.yaml"
|
||||||
|
- "0.14/clusterissuers.cert-manager.io-CustomResourceDefinition.yaml"
|
||||||
|
- "0.14/issuers.cert-manager.io-CustomResourceDefinition.yaml"
|
||||||
|
- "0.14/orders.acme.cert-manager.io-CustomResourceDefinition.yaml"
|
||||||
|
- "0.14/cert-manager-Namespace.yaml"
|
||||||
|
- "0.14/cert-manager-cainjector-ServiceAccount.yaml"
|
||||||
|
- "0.14/cert-manager-ServiceAccount.yaml"
|
||||||
|
- "0.14/cert-manager-webhook-ServiceAccount.yaml"
|
||||||
|
- "0.14/cert-manager-cainjector-ClusterRole.yaml"
|
||||||
|
- "0.14/cert-manager-controller-certificates-ClusterRole.yaml"
|
||||||
|
- "0.14/cert-manager-controller-issuers-ClusterRole.yaml"
|
||||||
|
- "0.14/cert-manager-view-ClusterRole.yaml"
|
||||||
|
- "0.14/cert-manager-controller-orders-ClusterRole.yaml"
|
||||||
|
- "0.14/cert-manager-controller-challenges-ClusterRole.yaml"
|
||||||
|
- "0.14/cert-manager-controller-ingress-shim-ClusterRole.yaml"
|
||||||
|
- "0.14/cert-manager-controller-clusterissuers-ClusterRole.yaml"
|
||||||
|
- "0.14/cert-manager-edit-ClusterRole.yaml"
|
||||||
|
- "0.14/cert-manager-cainjector-ClusterRoleBinding.yaml"
|
||||||
|
- "0.14/cert-manager-controller-challenges-ClusterRoleBinding.yaml"
|
||||||
|
- "0.14/cert-manager-controller-issuers-ClusterRoleBinding.yaml"
|
||||||
|
- "0.14/cert-manager-controller-certificates-ClusterRoleBinding.yaml"
|
||||||
|
- "0.14/cert-manager-controller-orders-ClusterRoleBinding.yaml"
|
||||||
|
- "0.14/cert-manager-controller-clusterissuers-ClusterRoleBinding.yaml"
|
||||||
|
- "0.14/cert-manager-controller-ingress-shim-ClusterRoleBinding.yaml"
|
||||||
|
- "0.14/cert-manager-cainjector:leaderelection-Role.yaml"
|
||||||
|
- "0.14/cert-manager:leaderelection-Role.yaml"
|
||||||
|
- "0.14/cert-manager-cainjector:leaderelection-RoleBinding.yaml"
|
||||||
|
- "0.14/cert-manager:leaderelection-RoleBinding.yaml"
|
||||||
|
- "0.14/cert-manager-Service.yaml"
|
||||||
|
- "0.14/cert-manager-webhook-Service.yaml"
|
||||||
|
- "0.14/cert-manager-cainjector-Deployment.yaml"
|
||||||
|
- "0.14/cert-manager-Deployment.yaml"
|
||||||
|
- "0.14/cert-manager-webhook-Deployment.yaml"
|
||||||
|
- "0.14/cert-manager-webhook-MutatingWebhookConfiguration.yaml"
|
||||||
|
- "0.14/cert-manager-webhook-ValidatingWebhookConfiguration.yaml"
|
||||||
58
templates/0.14/cert-manager-Deployment.yaml
Normal file
58
templates/0.14/cert-manager-Deployment.yaml
Normal file
|
|
@ -0,0 +1,58 @@
|
||||||
|
# Source: cert-manager/templates/deployment.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: cert-manager
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
annotations:
|
||||||
|
prometheus.io/path: "/metrics"
|
||||||
|
prometheus.io/scrape: 'true'
|
||||||
|
prometheus.io/port: '9402'
|
||||||
|
spec:
|
||||||
|
serviceAccountName: cert-manager
|
||||||
|
containers:
|
||||||
|
- name: cert-manager
|
||||||
|
image: "quay.io/jetstack/cert-manager-controller:v0.14.1"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
args:
|
||||||
|
- --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53
|
||||||
|
- --v=2
|
||||||
|
- --cluster-resource-namespace=$(POD_NAMESPACE)
|
||||||
|
- --leader-election-namespace=kube-system
|
||||||
|
- --webhook-namespace=$(POD_NAMESPACE)
|
||||||
|
- --webhook-ca-secret=cert-manager-webhook-ca
|
||||||
|
- --webhook-serving-secret=cert-manager-webhook-tls
|
||||||
|
- --webhook-dns-names=cert-manager-webhook,cert-manager-webhook.cert-manager,cert-manager-webhook.cert-manager.svc
|
||||||
|
ports:
|
||||||
|
- containerPort: 9402
|
||||||
|
protocol: TCP
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
resources:
|
||||||
|
{}
|
||||||
4
templates/0.14/cert-manager-Namespace.yaml
Normal file
4
templates/0.14/cert-manager-Namespace.yaml
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: cert-manager
|
||||||
23
templates/0.14/cert-manager-Service.yaml
Normal file
23
templates/0.14/cert-manager-Service.yaml
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Source: cert-manager/templates/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: cert-manager
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- protocol: TCP
|
||||||
|
port: 9402
|
||||||
|
targetPort: 9402
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
14
templates/0.14/cert-manager-ServiceAccount.yaml
Normal file
14
templates/0.14/cert-manager-ServiceAccount.yaml
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
# Source: cert-manager/templates/serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: cert-manager
|
||||||
|
namespace: "cert-manager"
|
||||||
|
annotations:
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
31
templates/0.14/cert-manager-cainjector-ClusterRole.yaml
Normal file
31
templates/0.14/cert-manager-cainjector-ClusterRole.yaml
Normal file
|
|
@ -0,0 +1,31 @@
|
||||||
|
# Source: cert-manager/templates/cainjector-rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-cainjector
|
||||||
|
labels:
|
||||||
|
app: cainjector
|
||||||
|
app.kubernetes.io/name: cainjector
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["get", "create", "update", "patch"]
|
||||||
|
- apiGroups: ["admissionregistration.k8s.io"]
|
||||||
|
resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
|
||||||
|
verbs: ["get", "list", "watch", "update"]
|
||||||
|
- apiGroups: ["apiregistration.k8s.io"]
|
||||||
|
resources: ["apiservices"]
|
||||||
|
verbs: ["get", "list", "watch", "update"]
|
||||||
|
- apiGroups: ["apiextensions.k8s.io"]
|
||||||
|
resources: ["customresourcedefinitions"]
|
||||||
|
verbs: ["get", "list", "watch", "update"]
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Source: cert-manager/templates/cainjector-rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-cainjector
|
||||||
|
labels:
|
||||||
|
app: cainjector
|
||||||
|
app.kubernetes.io/name: cainjector
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: cert-manager-cainjector
|
||||||
|
subjects:
|
||||||
|
- name: cert-manager-cainjector
|
||||||
|
namespace: "cert-manager"
|
||||||
|
kind: ServiceAccount
|
||||||
46
templates/0.14/cert-manager-cainjector-Deployment.yaml
Normal file
46
templates/0.14/cert-manager-cainjector-Deployment.yaml
Normal file
|
|
@ -0,0 +1,46 @@
|
||||||
|
# Source: cert-manager/templates/cainjector-deployment.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-cainjector
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: cainjector
|
||||||
|
app.kubernetes.io/name: cainjector
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: cainjector
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: cainjector
|
||||||
|
app.kubernetes.io/name: cainjector
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
annotations:
|
||||||
|
spec:
|
||||||
|
serviceAccountName: cert-manager-cainjector
|
||||||
|
containers:
|
||||||
|
- name: cert-manager
|
||||||
|
image: "quay.io/jetstack/cert-manager-cainjector:v0.14.1"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
args:
|
||||||
|
- --v=2
|
||||||
|
- --leader-election-namespace=kube-system
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
resources:
|
||||||
|
{}
|
||||||
13
templates/0.14/cert-manager-cainjector-ServiceAccount.yaml
Normal file
13
templates/0.14/cert-manager-cainjector-ServiceAccount.yaml
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
# Source: cert-manager/templates/cainjector-serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-cainjector
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: cainjector
|
||||||
|
app.kubernetes.io/name: cainjector
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Source: cert-manager/templates/cainjector-rbac.yaml
|
||||||
|
# leader election rules
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-cainjector:leaderelection
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app: cainjector
|
||||||
|
app.kubernetes.io/name: cainjector
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
rules:
|
||||||
|
# Used for leader election by the controller
|
||||||
|
# TODO: refine the permission to *just* the leader election configmap
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["configmaps"]
|
||||||
|
verbs: ["get", "create", "update", "patch"]
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Source: cert-manager/templates/cainjector-rbac.yaml
|
||||||
|
# grant cert-manager permission to manage the leaderelection configmap in the
|
||||||
|
# leader election namespace
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-cainjector:leaderelection
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app: cainjector
|
||||||
|
app.kubernetes.io/name: cainjector
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "cainjector"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: cert-manager-cainjector:leaderelection
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: cert-manager-cainjector
|
||||||
|
namespace: cert-manager
|
||||||
|
|
@ -0,0 +1,35 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
# Certificates controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-certificates
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificaterequests", "clusterissuers", "issuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||||
|
# admission controller enabled:
|
||||||
|
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates/finalizers", "certificaterequests/finalizers"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["orders"]
|
||||||
|
verbs: ["create", "delete", "get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-certificates
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: cert-manager-controller-certificates
|
||||||
|
subjects:
|
||||||
|
- name: cert-manager
|
||||||
|
namespace: "cert-manager"
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
@ -0,0 +1,57 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
# Challenges controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-challenges
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
rules:
|
||||||
|
# Use to update challenge resource status
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["challenges", "challenges/status"]
|
||||||
|
verbs: ["update"]
|
||||||
|
# Used to watch challenge resources
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["challenges"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Used to watch challenges, issuer and clusterissuer resources
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["issuers", "clusterissuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Need to be able to retrieve ACME account private key to complete challenges
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# Used to create events
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
# HTTP01 rules
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["pods", "services"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "delete"]
|
||||||
|
- apiGroups: ["extensions"]
|
||||||
|
resources: ["ingresses"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "delete", "update"]
|
||||||
|
# We require the ability to specify a custom hostname when we are creating
|
||||||
|
# new ingress resources.
|
||||||
|
# See: https://github.com/openshift/origin/blob/21f191775636f9acadb44fa42beeb4f75b255532/pkg/route/apiserver/admission/ingress_admission.go#L84-L148
|
||||||
|
- apiGroups: ["route.openshift.io"]
|
||||||
|
resources: ["routes/custom-host"]
|
||||||
|
verbs: ["create"]
|
||||||
|
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||||
|
# admission controller enabled:
|
||||||
|
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["challenges/finalizers"]
|
||||||
|
verbs: ["update"]
|
||||||
|
# DNS01 rules (duplicated above)
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-challenges
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: cert-manager-controller-challenges
|
||||||
|
subjects:
|
||||||
|
- name: cert-manager
|
||||||
|
namespace: "cert-manager"
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
# ClusterIssuer controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-clusterissuers
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["clusterissuers", "clusterissuers/status"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["clusterissuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-clusterissuers
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: cert-manager-controller-clusterissuers
|
||||||
|
subjects:
|
||||||
|
- name: cert-manager
|
||||||
|
namespace: "cert-manager"
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
@ -0,0 +1,32 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
# ingress-shim controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-ingress-shim
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificaterequests"]
|
||||||
|
verbs: ["create", "update", "delete"]
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["extensions"]
|
||||||
|
resources: ["ingresses"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||||
|
# admission controller enabled:
|
||||||
|
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||||
|
- apiGroups: ["extensions"]
|
||||||
|
resources: ["ingresses/finalizers"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-ingress-shim
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: cert-manager-controller-ingress-shim
|
||||||
|
subjects:
|
||||||
|
- name: cert-manager
|
||||||
|
namespace: "cert-manager"
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
# Issuer controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-issuers
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["issuers", "issuers/status"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["issuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-issuers
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: cert-manager-controller-issuers
|
||||||
|
subjects:
|
||||||
|
- name: cert-manager
|
||||||
|
namespace: "cert-manager"
|
||||||
|
kind: ServiceAccount
|
||||||
|
|
@ -0,0 +1,38 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
# Orders controller role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-orders
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["orders", "orders/status"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["orders", "challenges"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["clusterissuers", "issuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["challenges"]
|
||||||
|
verbs: ["create", "delete"]
|
||||||
|
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||||
|
# admission controller enabled:
|
||||||
|
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||||
|
- apiGroups: ["acme.cert-manager.io"]
|
||||||
|
resources: ["orders/finalizers"]
|
||||||
|
verbs: ["update"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["events"]
|
||||||
|
verbs: ["create", "patch"]
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-controller-orders
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: cert-manager-controller-orders
|
||||||
|
subjects:
|
||||||
|
- name: cert-manager
|
||||||
|
namespace: "cert-manager"
|
||||||
|
kind: ServiceAccount
|
||||||
18
templates/0.14/cert-manager-edit-ClusterRole.yaml
Normal file
18
templates/0.14/cert-manager-edit-ClusterRole.yaml
Normal file
|
|
@ -0,0 +1,18 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-edit
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificaterequests", "issuers"]
|
||||||
|
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||||
19
templates/0.14/cert-manager-view-ClusterRole.yaml
Normal file
19
templates/0.14/cert-manager-view-ClusterRole.yaml
Normal file
|
|
@ -0,0 +1,19 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-view
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||||
|
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||||
|
rules:
|
||||||
|
- apiGroups: ["cert-manager.io"]
|
||||||
|
resources: ["certificates", "certificaterequests", "issuers"]
|
||||||
|
verbs: ["get", "list", "watch"]
|
||||||
65
templates/0.14/cert-manager-webhook-Deployment.yaml
Normal file
65
templates/0.14/cert-manager-webhook-Deployment.yaml
Normal file
|
|
@ -0,0 +1,65 @@
|
||||||
|
# Source: cert-manager/templates/webhook-deployment.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-webhook
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: webhook
|
||||||
|
app.kubernetes.io/name: webhook
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: webhook
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: webhook
|
||||||
|
app.kubernetes.io/name: webhook
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
annotations:
|
||||||
|
spec:
|
||||||
|
serviceAccountName: cert-manager-webhook
|
||||||
|
containers:
|
||||||
|
- name: cert-manager
|
||||||
|
image: "quay.io/jetstack/cert-manager-webhook:v0.14.1"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
args:
|
||||||
|
- --v=2
|
||||||
|
- --secure-port=10250
|
||||||
|
- --tls-cert-file=/certs/tls.crt
|
||||||
|
- --tls-private-key-file=/certs/tls.key
|
||||||
|
livenessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /livez
|
||||||
|
port: 6080
|
||||||
|
scheme: HTTP
|
||||||
|
readinessProbe:
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 6080
|
||||||
|
scheme: HTTP
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
resources:
|
||||||
|
{}
|
||||||
|
volumeMounts:
|
||||||
|
- name: certs
|
||||||
|
mountPath: /certs
|
||||||
|
volumes:
|
||||||
|
- name: certs
|
||||||
|
secret:
|
||||||
|
secretName: cert-manager-webhook-tls
|
||||||
|
|
@ -0,0 +1,35 @@
|
||||||
|
# Source: cert-manager/templates/webhook-mutating-webhook.yaml
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1beta1
|
||||||
|
kind: MutatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-webhook
|
||||||
|
labels:
|
||||||
|
app: webhook
|
||||||
|
app.kubernetes.io/name: webhook
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-tls"
|
||||||
|
webhooks:
|
||||||
|
- name: webhook.cert-manager.io
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- "cert-manager.io"
|
||||||
|
- "acme.cert-manager.io"
|
||||||
|
apiVersions:
|
||||||
|
- v1alpha2
|
||||||
|
operations:
|
||||||
|
- CREATE
|
||||||
|
- UPDATE
|
||||||
|
resources:
|
||||||
|
- "*/*"
|
||||||
|
failurePolicy: Fail
|
||||||
|
# Only include 'sideEffects' field in Kubernetes 1.12+
|
||||||
|
sideEffects: None
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
name: cert-manager-webhook
|
||||||
|
namespace: "cert-manager"
|
||||||
|
path: /mutate
|
||||||
23
templates/0.14/cert-manager-webhook-Service.yaml
Normal file
23
templates/0.14/cert-manager-webhook-Service.yaml
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Source: cert-manager/templates/webhook-service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-webhook
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: webhook
|
||||||
|
app.kubernetes.io/name: webhook
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- name: https
|
||||||
|
port: 443
|
||||||
|
targetPort: 10250
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: webhook
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
13
templates/0.14/cert-manager-webhook-ServiceAccount.yaml
Normal file
13
templates/0.14/cert-manager-webhook-ServiceAccount.yaml
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
# Source: cert-manager/templates/webhook-serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-webhook
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: webhook
|
||||||
|
app.kubernetes.io/name: webhook
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
|
@ -0,0 +1,45 @@
|
||||||
|
# Source: cert-manager/templates/webhook-validating-webhook.yaml
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1beta1
|
||||||
|
kind: ValidatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-webhook
|
||||||
|
labels:
|
||||||
|
app: webhook
|
||||||
|
app.kubernetes.io/name: webhook
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "webhook"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-tls"
|
||||||
|
webhooks:
|
||||||
|
- name: webhook.cert-manager.io
|
||||||
|
namespaceSelector:
|
||||||
|
matchExpressions:
|
||||||
|
- key: "cert-manager.io/disable-validation"
|
||||||
|
operator: "NotIn"
|
||||||
|
values:
|
||||||
|
- "true"
|
||||||
|
- key: "name"
|
||||||
|
operator: "NotIn"
|
||||||
|
values:
|
||||||
|
- cert-manager
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- "cert-manager.io"
|
||||||
|
- "acme.cert-manager.io"
|
||||||
|
apiVersions:
|
||||||
|
- v1alpha2
|
||||||
|
operations:
|
||||||
|
- CREATE
|
||||||
|
- UPDATE
|
||||||
|
resources:
|
||||||
|
- "*/*"
|
||||||
|
failurePolicy: Fail
|
||||||
|
# Only include 'sideEffects' field in Kubernetes 1.12+
|
||||||
|
sideEffects: None
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
name: cert-manager-webhook
|
||||||
|
namespace: "cert-manager"
|
||||||
|
path: /mutate
|
||||||
19
templates/0.14/cert-manager:leaderelection-Role.yaml
Normal file
19
templates/0.14/cert-manager:leaderelection-Role.yaml
Normal file
|
|
@ -0,0 +1,19 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
name: cert-manager:leaderelection
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
rules:
|
||||||
|
# Used for leader election by the controller
|
||||||
|
# TODO: refine the permission to *just* the leader election configmap
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["configmaps"]
|
||||||
|
verbs: ["get", "create", "update", "patch"]
|
||||||
24
templates/0.14/cert-manager:leaderelection-RoleBinding.yaml
Normal file
24
templates/0.14/cert-manager:leaderelection-RoleBinding.yaml
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
# Source: cert-manager/templates/rbac.yaml
|
||||||
|
# grant cert-manager permission to manage the leaderelection configmap in the
|
||||||
|
# leader election namespace
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1beta1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: cert-manager:leaderelection
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app: cert-manager
|
||||||
|
app.kubernetes.io/name: cert-manager
|
||||||
|
app.kubernetes.io/instance: cert-manager
|
||||||
|
app.kubernetes.io/managed-by: Helm
|
||||||
|
app.kubernetes.io/component: "controller"
|
||||||
|
helm.sh/chart: cert-manager-v0.14.1
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: cert-manager:leaderelection
|
||||||
|
subjects:
|
||||||
|
- apiGroup: ""
|
||||||
|
kind: ServiceAccount
|
||||||
|
name: cert-manager
|
||||||
|
namespace: cert-manager
|
||||||
|
|
@ -0,0 +1,215 @@
|
||||||
|
# Copyright YEAR The Jetstack cert-manager contributors.
|
||||||
|
#
|
||||||
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
# you may not use this file except in compliance with the License.
|
||||||
|
# You may obtain a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
# See the License for the specific language governing permissions and
|
||||||
|
# limitations under the License.
|
||||||
|
|
||||||
|
apiVersion: apiextensions.k8s.io/v1beta1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-tls
|
||||||
|
name: certificaterequests.cert-manager.io
|
||||||
|
spec:
|
||||||
|
additionalPrinterColumns:
|
||||||
|
- JSONPath: .status.conditions[?(@.type=="Ready")].status
|
||||||
|
name: Ready
|
||||||
|
type: string
|
||||||
|
- JSONPath: .spec.issuerRef.name
|
||||||
|
name: Issuer
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
- JSONPath: .status.conditions[?(@.type=="Ready")].message
|
||||||
|
name: Status
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
- JSONPath: .metadata.creationTimestamp
|
||||||
|
description: CreationTimestamp is a timestamp representing the server time when
|
||||||
|
this object was created. It is not guaranteed to be set in happens-before order
|
||||||
|
across separate operations. Clients may not set this value. It is represented
|
||||||
|
in RFC3339 form and is in UTC.
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
conversion:
|
||||||
|
strategy: Webhook
|
||||||
|
webhookClientConfig:
|
||||||
|
service:
|
||||||
|
name: cert-manager-webhook
|
||||||
|
namespace: cert-manager
|
||||||
|
path: /convert
|
||||||
|
group: cert-manager.io
|
||||||
|
names:
|
||||||
|
kind: CertificateRequest
|
||||||
|
listKind: CertificateRequestList
|
||||||
|
plural: certificaterequests
|
||||||
|
shortNames:
|
||||||
|
- cr
|
||||||
|
- crs
|
||||||
|
singular: certificaterequest
|
||||||
|
preserveUnknownFields: false
|
||||||
|
scope: Namespaced
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
validation:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: CertificateRequest is a type to represent a Certificate Signing
|
||||||
|
Request
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: CertificateRequestSpec defines the desired state of CertificateRequest
|
||||||
|
properties:
|
||||||
|
csr:
|
||||||
|
description: Byte slice containing the PEM encoded CertificateSigningRequest
|
||||||
|
format: byte
|
||||||
|
type: string
|
||||||
|
duration:
|
||||||
|
description: Requested certificate default Duration
|
||||||
|
type: string
|
||||||
|
isCA:
|
||||||
|
description: IsCA will mark the resulting certificate as valid for signing.
|
||||||
|
This implies that the 'cert sign' usage is set
|
||||||
|
type: boolean
|
||||||
|
issuerRef:
|
||||||
|
description: IssuerRef is a reference to the issuer for this CertificateRequest. If
|
||||||
|
the 'kind' field is not set, or set to 'Issuer', an Issuer resource
|
||||||
|
with the given name in the same namespace as the CertificateRequest
|
||||||
|
will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
|
||||||
|
with the provided name will be used. The 'name' field in this stanza
|
||||||
|
is required at all times. The group field refers to the API group
|
||||||
|
of the issuer which defaults to 'cert-manager.io' if empty.
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
usages:
|
||||||
|
description: Usages is the set of x509 actions that are enabled for
|
||||||
|
a given key. Defaults are ('digital signature', 'key encipherment')
|
||||||
|
if empty
|
||||||
|
items:
|
||||||
|
description: 'KeyUsage specifies valid usage contexts for keys. See:
|
||||||
|
https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
|
||||||
|
Valid KeyUsage values are as follows: "signing", "digital signature",
|
||||||
|
"content commitment", "key encipherment", "key agreement", "data
|
||||||
|
encipherment", "cert sign", "crl sign", "encipher only", "decipher
|
||||||
|
only", "any", "server auth", "client auth", "code signing", "email
|
||||||
|
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
|
||||||
|
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
|
||||||
|
sgc"'
|
||||||
|
enum:
|
||||||
|
- signing
|
||||||
|
- digital signature
|
||||||
|
- content commitment
|
||||||
|
- key encipherment
|
||||||
|
- key agreement
|
||||||
|
- data encipherment
|
||||||
|
- cert sign
|
||||||
|
- crl sign
|
||||||
|
- encipher only
|
||||||
|
- decipher only
|
||||||
|
- any
|
||||||
|
- server auth
|
||||||
|
- client auth
|
||||||
|
- code signing
|
||||||
|
- email protection
|
||||||
|
- s/mime
|
||||||
|
- ipsec end system
|
||||||
|
- ipsec tunnel
|
||||||
|
- ipsec user
|
||||||
|
- timestamping
|
||||||
|
- ocsp signing
|
||||||
|
- microsoft sgc
|
||||||
|
- netscape sgc
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- csr
|
||||||
|
- issuerRef
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: CertificateStatus defines the observed state of CertificateRequest
|
||||||
|
and resulting signed certificate.
|
||||||
|
properties:
|
||||||
|
ca:
|
||||||
|
description: Byte slice containing the PEM encoded certificate authority
|
||||||
|
of the signed certificate.
|
||||||
|
format: byte
|
||||||
|
type: string
|
||||||
|
certificate:
|
||||||
|
description: Byte slice containing a PEM encoded signed certificate
|
||||||
|
resulting from the given certificate signing request.
|
||||||
|
format: byte
|
||||||
|
type: string
|
||||||
|
conditions:
|
||||||
|
items:
|
||||||
|
description: CertificateRequestCondition contains condition information
|
||||||
|
for a CertificateRequest.
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: LastTransitionTime is the timestamp corresponding
|
||||||
|
to the last status change of this condition.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Message is a human readable description of the details
|
||||||
|
of the last transition, complementing reason.
|
||||||
|
type: string
|
||||||
|
reason:
|
||||||
|
description: Reason is a brief machine readable explanation for
|
||||||
|
the condition's last transition.
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: Status of the condition, one of ('True', 'False',
|
||||||
|
'Unknown').
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: Type of the condition, currently ('Ready', 'InvalidRequest').
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
failureTime:
|
||||||
|
description: FailureTime stores the time that this CertificateRequest
|
||||||
|
failed. This is used to influence garbage collection and back-off.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
versions:
|
||||||
|
- name: v1alpha2
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
- name: v1alpha3
|
||||||
|
served: true
|
||||||
|
storage: false
|
||||||
|
|
@ -0,0 +1,544 @@
|
||||||
|
apiVersion: apiextensions.k8s.io/v1beta1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-tls
|
||||||
|
name: certificates.cert-manager.io
|
||||||
|
spec:
|
||||||
|
additionalPrinterColumns:
|
||||||
|
- JSONPath: .status.conditions[?(@.type=="Ready")].status
|
||||||
|
name: Ready
|
||||||
|
type: string
|
||||||
|
- JSONPath: .spec.secretName
|
||||||
|
name: Secret
|
||||||
|
type: string
|
||||||
|
- JSONPath: .spec.issuerRef.name
|
||||||
|
name: Issuer
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
- JSONPath: .status.conditions[?(@.type=="Ready")].message
|
||||||
|
name: Status
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
- JSONPath: .metadata.creationTimestamp
|
||||||
|
description: CreationTimestamp is a timestamp representing the server time when
|
||||||
|
this object was created. It is not guaranteed to be set in happens-before order
|
||||||
|
across separate operations. Clients may not set this value. It is represented
|
||||||
|
in RFC3339 form and is in UTC.
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
conversion:
|
||||||
|
strategy: Webhook
|
||||||
|
webhookClientConfig:
|
||||||
|
service:
|
||||||
|
name: cert-manager-webhook
|
||||||
|
namespace: cert-manager
|
||||||
|
path: /convert
|
||||||
|
group: cert-manager.io
|
||||||
|
names:
|
||||||
|
kind: Certificate
|
||||||
|
listKind: CertificateList
|
||||||
|
plural: certificates
|
||||||
|
shortNames:
|
||||||
|
- cert
|
||||||
|
- certs
|
||||||
|
singular: certificate
|
||||||
|
preserveUnknownFields: false
|
||||||
|
scope: Namespaced
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
versions:
|
||||||
|
- name: v1alpha2
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: Certificate is a type to represent a Certificate from ACME
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: CertificateSpec defines the desired state of Certificate.
|
||||||
|
A valid Certificate requires at least one of a CommonName, DNSName,
|
||||||
|
or URISAN to be valid.
|
||||||
|
properties:
|
||||||
|
commonName:
|
||||||
|
description: 'CommonName is a common name to be used on the Certificate.
|
||||||
|
The CommonName should have a length of 64 characters or fewer to
|
||||||
|
avoid generating invalid CSRs. This value is ignored by TLS clients
|
||||||
|
when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4'
|
||||||
|
type: string
|
||||||
|
dnsNames:
|
||||||
|
description: DNSNames is a list of subject alt names to be used on
|
||||||
|
the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
duration:
|
||||||
|
description: Certificate default Duration
|
||||||
|
type: string
|
||||||
|
emailSANs:
|
||||||
|
description: EmailSANs is a list of Email Subject Alternative Names
|
||||||
|
to be set on this Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
ipAddresses:
|
||||||
|
description: IPAddresses is a list of IP addresses to be used on the
|
||||||
|
Certificate
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
isCA:
|
||||||
|
description: IsCA will mark this Certificate as valid for signing.
|
||||||
|
This implies that the 'cert sign' usage is set
|
||||||
|
type: boolean
|
||||||
|
issuerRef:
|
||||||
|
description: IssuerRef is a reference to the issuer for this certificate.
|
||||||
|
If the 'kind' field is not set, or set to 'Issuer', an Issuer resource
|
||||||
|
with the given name in the same namespace as the Certificate will
|
||||||
|
be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
|
||||||
|
with the provided name will be used. The 'name' field in this stanza
|
||||||
|
is required at all times.
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
keyAlgorithm:
|
||||||
|
description: KeyAlgorithm is the private key algorithm of the corresponding
|
||||||
|
private key for this certificate. If provided, allowed values are
|
||||||
|
either "rsa" or "ecdsa" If KeyAlgorithm is specified and KeySize
|
||||||
|
is not provided, key size of 256 will be used for "ecdsa" key algorithm
|
||||||
|
and key size of 2048 will be used for "rsa" key algorithm.
|
||||||
|
enum:
|
||||||
|
- rsa
|
||||||
|
- ecdsa
|
||||||
|
type: string
|
||||||
|
keyEncoding:
|
||||||
|
description: KeyEncoding is the private key cryptography standards
|
||||||
|
(PKCS) for this certificate's private key to be encoded in. If provided,
|
||||||
|
allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8,
|
||||||
|
respectively. If KeyEncoding is not specified, then PKCS#1 will
|
||||||
|
be used by default.
|
||||||
|
enum:
|
||||||
|
- pkcs1
|
||||||
|
- pkcs8
|
||||||
|
type: string
|
||||||
|
keySize:
|
||||||
|
description: KeySize is the key bit size of the corresponding private
|
||||||
|
key for this certificate. If provided, value must be between 2048
|
||||||
|
and 8192 inclusive when KeyAlgorithm is empty or is set to "rsa",
|
||||||
|
and value must be one of (256, 384, 521) when KeyAlgorithm is set
|
||||||
|
to "ecdsa".
|
||||||
|
maximum: 8192
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
organization:
|
||||||
|
description: Organization is the organization to be used on the Certificate
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
renewBefore:
|
||||||
|
description: Certificate renew before expiration duration
|
||||||
|
type: string
|
||||||
|
secretName:
|
||||||
|
description: SecretName is the name of the secret resource to store
|
||||||
|
this secret in
|
||||||
|
type: string
|
||||||
|
subject:
|
||||||
|
description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
|
||||||
|
properties:
|
||||||
|
countries:
|
||||||
|
description: Countries to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
localities:
|
||||||
|
description: Cities to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
organizationalUnits:
|
||||||
|
description: Organizational Units to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
postalCodes:
|
||||||
|
description: Postal codes to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
provinces:
|
||||||
|
description: State/Provinces to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
serialNumber:
|
||||||
|
description: Serial number to be used on the Certificate.
|
||||||
|
type: string
|
||||||
|
streetAddresses:
|
||||||
|
description: Street addresses to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
type: object
|
||||||
|
uriSANs:
|
||||||
|
description: URISANs is a list of URI Subject Alternative Names to
|
||||||
|
be set on this Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
usages:
|
||||||
|
description: Usages is the set of x509 actions that are enabled for
|
||||||
|
a given key. Defaults are ('digital signature', 'key encipherment')
|
||||||
|
if empty
|
||||||
|
items:
|
||||||
|
description: 'KeyUsage specifies valid usage contexts for keys.
|
||||||
|
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
|
||||||
|
Valid KeyUsage values are as follows: "signing", "digital signature",
|
||||||
|
"content commitment", "key encipherment", "key agreement", "data
|
||||||
|
encipherment", "cert sign", "crl sign", "encipher only", "decipher
|
||||||
|
only", "any", "server auth", "client auth", "code signing", "email
|
||||||
|
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
|
||||||
|
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
|
||||||
|
sgc"'
|
||||||
|
enum:
|
||||||
|
- signing
|
||||||
|
- digital signature
|
||||||
|
- content commitment
|
||||||
|
- key encipherment
|
||||||
|
- key agreement
|
||||||
|
- data encipherment
|
||||||
|
- cert sign
|
||||||
|
- crl sign
|
||||||
|
- encipher only
|
||||||
|
- decipher only
|
||||||
|
- any
|
||||||
|
- server auth
|
||||||
|
- client auth
|
||||||
|
- code signing
|
||||||
|
- email protection
|
||||||
|
- s/mime
|
||||||
|
- ipsec end system
|
||||||
|
- ipsec tunnel
|
||||||
|
- ipsec user
|
||||||
|
- timestamping
|
||||||
|
- ocsp signing
|
||||||
|
- microsoft sgc
|
||||||
|
- netscape sgc
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- issuerRef
|
||||||
|
- secretName
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: CertificateStatus defines the observed state of Certificate
|
||||||
|
properties:
|
||||||
|
conditions:
|
||||||
|
items:
|
||||||
|
description: CertificateCondition contains condition information
|
||||||
|
for an Certificate.
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: LastTransitionTime is the timestamp corresponding
|
||||||
|
to the last status change of this condition.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Message is a human readable description of the
|
||||||
|
details of the last transition, complementing reason.
|
||||||
|
type: string
|
||||||
|
reason:
|
||||||
|
description: Reason is a brief machine readable explanation
|
||||||
|
for the condition's last transition.
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: Status of the condition, one of ('True', 'False',
|
||||||
|
'Unknown').
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: Type of the condition, currently ('Ready').
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
lastFailureTime:
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
notAfter:
|
||||||
|
description: The expiration time of the certificate stored in the
|
||||||
|
secret named by this resource in spec.secretName.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
- name: v1alpha3
|
||||||
|
schema:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: Certificate is a type to represent a Certificate from ACME
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
description: CertificateSpec defines the desired state of Certificate.
|
||||||
|
A valid Certificate requires at least one of a CommonName, DNSName,
|
||||||
|
or URISAN to be valid.
|
||||||
|
properties:
|
||||||
|
commonName:
|
||||||
|
description: 'CommonName is a common name to be used on the Certificate.
|
||||||
|
The CommonName should have a length of 64 characters or fewer to
|
||||||
|
avoid generating invalid CSRs. This value is ignored by TLS clients
|
||||||
|
when any subject alt name is set. This is x509 behaviour: https://tools.ietf.org/html/rfc6125#section-6.4.4'
|
||||||
|
type: string
|
||||||
|
dnsNames:
|
||||||
|
description: DNSNames is a list of subject alt names to be used on
|
||||||
|
the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
duration:
|
||||||
|
description: Certificate default Duration
|
||||||
|
type: string
|
||||||
|
emailSANs:
|
||||||
|
description: EmailSANs is a list of Email Subject Alternative Names
|
||||||
|
to be set on this Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
ipAddresses:
|
||||||
|
description: IPAddresses is a list of IP addresses to be used on the
|
||||||
|
Certificate
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
isCA:
|
||||||
|
description: IsCA will mark this Certificate as valid for signing.
|
||||||
|
This implies that the 'cert sign' usage is set
|
||||||
|
type: boolean
|
||||||
|
issuerRef:
|
||||||
|
description: IssuerRef is a reference to the issuer for this certificate.
|
||||||
|
If the 'kind' field is not set, or set to 'Issuer', an Issuer resource
|
||||||
|
with the given name in the same namespace as the Certificate will
|
||||||
|
be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer
|
||||||
|
with the provided name will be used. The 'name' field in this stanza
|
||||||
|
is required at all times.
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
keyAlgorithm:
|
||||||
|
description: KeyAlgorithm is the private key algorithm of the corresponding
|
||||||
|
private key for this certificate. If provided, allowed values are
|
||||||
|
either "rsa" or "ecdsa" If KeyAlgorithm is specified and KeySize
|
||||||
|
is not provided, key size of 256 will be used for "ecdsa" key algorithm
|
||||||
|
and key size of 2048 will be used for "rsa" key algorithm.
|
||||||
|
enum:
|
||||||
|
- rsa
|
||||||
|
- ecdsa
|
||||||
|
type: string
|
||||||
|
keyEncoding:
|
||||||
|
description: KeyEncoding is the private key cryptography standards
|
||||||
|
(PKCS) for this certificate's private key to be encoded in. If provided,
|
||||||
|
allowed values are "pkcs1" and "pkcs8" standing for PKCS#1 and PKCS#8,
|
||||||
|
respectively. If KeyEncoding is not specified, then PKCS#1 will
|
||||||
|
be used by default.
|
||||||
|
enum:
|
||||||
|
- pkcs1
|
||||||
|
- pkcs8
|
||||||
|
type: string
|
||||||
|
keySize:
|
||||||
|
description: KeySize is the key bit size of the corresponding private
|
||||||
|
key for this certificate. If provided, value must be between 2048
|
||||||
|
and 8192 inclusive when KeyAlgorithm is empty or is set to "rsa",
|
||||||
|
and value must be one of (256, 384, 521) when KeyAlgorithm is set
|
||||||
|
to "ecdsa".
|
||||||
|
maximum: 8192
|
||||||
|
minimum: 0
|
||||||
|
type: integer
|
||||||
|
renewBefore:
|
||||||
|
description: Certificate renew before expiration duration
|
||||||
|
type: string
|
||||||
|
secretName:
|
||||||
|
description: SecretName is the name of the secret resource to store
|
||||||
|
this secret in
|
||||||
|
type: string
|
||||||
|
subject:
|
||||||
|
description: Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
|
||||||
|
properties:
|
||||||
|
countries:
|
||||||
|
description: Countries to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
localities:
|
||||||
|
description: Cities to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
organizationalUnits:
|
||||||
|
description: Organizational Units to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
organizations:
|
||||||
|
description: Organizations to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
postalCodes:
|
||||||
|
description: Postal codes to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
provinces:
|
||||||
|
description: State/Provinces to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
serialNumber:
|
||||||
|
description: Serial number to be used on the Certificate.
|
||||||
|
type: string
|
||||||
|
streetAddresses:
|
||||||
|
description: Street addresses to be used on the Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
type: object
|
||||||
|
uriSANs:
|
||||||
|
description: URISANs is a list of URI Subject Alternative Names to
|
||||||
|
be set on this Certificate.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
usages:
|
||||||
|
description: Usages is the set of x509 actions that are enabled for
|
||||||
|
a given key. Defaults are ('digital signature', 'key encipherment')
|
||||||
|
if empty
|
||||||
|
items:
|
||||||
|
description: 'KeyUsage specifies valid usage contexts for keys.
|
||||||
|
See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12
|
||||||
|
Valid KeyUsage values are as follows: "signing", "digital signature",
|
||||||
|
"content commitment", "key encipherment", "key agreement", "data
|
||||||
|
encipherment", "cert sign", "crl sign", "encipher only", "decipher
|
||||||
|
only", "any", "server auth", "client auth", "code signing", "email
|
||||||
|
protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec
|
||||||
|
user", "timestamping", "ocsp signing", "microsoft sgc", "netscape
|
||||||
|
sgc"'
|
||||||
|
enum:
|
||||||
|
- signing
|
||||||
|
- digital signature
|
||||||
|
- content commitment
|
||||||
|
- key encipherment
|
||||||
|
- key agreement
|
||||||
|
- data encipherment
|
||||||
|
- cert sign
|
||||||
|
- crl sign
|
||||||
|
- encipher only
|
||||||
|
- decipher only
|
||||||
|
- any
|
||||||
|
- server auth
|
||||||
|
- client auth
|
||||||
|
- code signing
|
||||||
|
- email protection
|
||||||
|
- s/mime
|
||||||
|
- ipsec end system
|
||||||
|
- ipsec tunnel
|
||||||
|
- ipsec user
|
||||||
|
- timestamping
|
||||||
|
- ocsp signing
|
||||||
|
- microsoft sgc
|
||||||
|
- netscape sgc
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
required:
|
||||||
|
- issuerRef
|
||||||
|
- secretName
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
description: CertificateStatus defines the observed state of Certificate
|
||||||
|
properties:
|
||||||
|
conditions:
|
||||||
|
items:
|
||||||
|
description: CertificateCondition contains condition information
|
||||||
|
for an Certificate.
|
||||||
|
properties:
|
||||||
|
lastTransitionTime:
|
||||||
|
description: LastTransitionTime is the timestamp corresponding
|
||||||
|
to the last status change of this condition.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
message:
|
||||||
|
description: Message is a human readable description of the
|
||||||
|
details of the last transition, complementing reason.
|
||||||
|
type: string
|
||||||
|
reason:
|
||||||
|
description: Reason is a brief machine readable explanation
|
||||||
|
for the condition's last transition.
|
||||||
|
type: string
|
||||||
|
status:
|
||||||
|
description: Status of the condition, one of ('True', 'False',
|
||||||
|
'Unknown').
|
||||||
|
enum:
|
||||||
|
- "True"
|
||||||
|
- "False"
|
||||||
|
- Unknown
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: Type of the condition, currently ('Ready').
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- status
|
||||||
|
- type
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
lastFailureTime:
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
notAfter:
|
||||||
|
description: The expiration time of the certificate stored in the
|
||||||
|
secret named by this resource in spec.secretName.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
type: object
|
||||||
|
served: true
|
||||||
|
storage: false
|
||||||
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
1749
templates/0.14/issuers.cert-manager.io-CustomResourceDefinition.yaml
Normal file
1749
templates/0.14/issuers.cert-manager.io-CustomResourceDefinition.yaml
Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,213 @@
|
||||||
|
apiVersion: apiextensions.k8s.io/v1beta1
|
||||||
|
kind: CustomResourceDefinition
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from-secret: cert-manager/cert-manager-webhook-tls
|
||||||
|
name: orders.acme.cert-manager.io
|
||||||
|
spec:
|
||||||
|
additionalPrinterColumns:
|
||||||
|
- JSONPath: .status.state
|
||||||
|
name: State
|
||||||
|
type: string
|
||||||
|
- JSONPath: .spec.issuerRef.name
|
||||||
|
name: Issuer
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
- JSONPath: .status.reason
|
||||||
|
name: Reason
|
||||||
|
priority: 1
|
||||||
|
type: string
|
||||||
|
- JSONPath: .metadata.creationTimestamp
|
||||||
|
description: CreationTimestamp is a timestamp representing the server time when
|
||||||
|
this object was created. It is not guaranteed to be set in happens-before order
|
||||||
|
across separate operations. Clients may not set this value. It is represented
|
||||||
|
in RFC3339 form and is in UTC.
|
||||||
|
name: Age
|
||||||
|
type: date
|
||||||
|
conversion:
|
||||||
|
strategy: Webhook
|
||||||
|
webhookClientConfig:
|
||||||
|
service:
|
||||||
|
name: cert-manager-webhook
|
||||||
|
namespace: cert-manager
|
||||||
|
path: /convert
|
||||||
|
group: acme.cert-manager.io
|
||||||
|
names:
|
||||||
|
kind: Order
|
||||||
|
listKind: OrderList
|
||||||
|
plural: orders
|
||||||
|
singular: order
|
||||||
|
preserveUnknownFields: false
|
||||||
|
scope: Namespaced
|
||||||
|
subresources:
|
||||||
|
status: {}
|
||||||
|
validation:
|
||||||
|
openAPIV3Schema:
|
||||||
|
description: Order is a type to represent an Order with an ACME server
|
||||||
|
properties:
|
||||||
|
apiVersion:
|
||||||
|
description: 'APIVersion defines the versioned schema of this representation
|
||||||
|
of an object. Servers should convert recognized schemas to the latest
|
||||||
|
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
description: 'Kind is a string value representing the REST resource this
|
||||||
|
object represents. Servers may infer this from the endpoint the client
|
||||||
|
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||||
|
type: string
|
||||||
|
metadata:
|
||||||
|
type: object
|
||||||
|
spec:
|
||||||
|
properties:
|
||||||
|
commonName:
|
||||||
|
description: CommonName is the common name as specified on the DER encoded
|
||||||
|
CSR. If CommonName is not specified, the first DNSName specified will
|
||||||
|
be used as the CommonName. At least one of CommonName or a DNSNames
|
||||||
|
must be set. This field must match the corresponding field on the
|
||||||
|
DER encoded CSR.
|
||||||
|
type: string
|
||||||
|
csr:
|
||||||
|
description: Certificate signing request bytes in DER encoding. This
|
||||||
|
will be used when finalizing the order. This field must be set on
|
||||||
|
the order.
|
||||||
|
format: byte
|
||||||
|
type: string
|
||||||
|
dnsNames:
|
||||||
|
description: DNSNames is a list of DNS names that should be included
|
||||||
|
as part of the Order validation process. If CommonName is not specified,
|
||||||
|
the first DNSName specified will be used as the CommonName. At least
|
||||||
|
one of CommonName or a DNSNames must be set. This field must match
|
||||||
|
the corresponding field on the DER encoded CSR.
|
||||||
|
items:
|
||||||
|
type: string
|
||||||
|
type: array
|
||||||
|
issuerRef:
|
||||||
|
description: IssuerRef references a properly configured ACME-type Issuer
|
||||||
|
which should be used to create this Order. If the Issuer does not
|
||||||
|
exist, processing will be retried. If the Issuer is not an 'ACME'
|
||||||
|
Issuer, an error will be returned and the Order will be marked as
|
||||||
|
failed.
|
||||||
|
properties:
|
||||||
|
group:
|
||||||
|
type: string
|
||||||
|
kind:
|
||||||
|
type: string
|
||||||
|
name:
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- name
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- csr
|
||||||
|
- issuerRef
|
||||||
|
type: object
|
||||||
|
status:
|
||||||
|
properties:
|
||||||
|
authorizations:
|
||||||
|
description: Authorizations contains data returned from the ACME server
|
||||||
|
on what authorizations must be completed in order to validate the
|
||||||
|
DNS names specified on the Order.
|
||||||
|
items:
|
||||||
|
description: ACMEAuthorization contains data returned from the ACME
|
||||||
|
server on an authorization that must be completed in order validate
|
||||||
|
a DNS name on an ACME Order resource.
|
||||||
|
properties:
|
||||||
|
challenges:
|
||||||
|
description: Challenges specifies the challenge types offered
|
||||||
|
by the ACME server. One of these challenge types will be selected
|
||||||
|
when validating the DNS name and an appropriate Challenge resource
|
||||||
|
will be created to perform the ACME challenge process.
|
||||||
|
items:
|
||||||
|
description: Challenge specifies a challenge offered by the
|
||||||
|
ACME server for an Order. An appropriate Challenge resource
|
||||||
|
can be created to perform the ACME challenge process.
|
||||||
|
properties:
|
||||||
|
token:
|
||||||
|
description: Token is the token that must be presented for
|
||||||
|
this challenge. This is used to compute the 'key' that
|
||||||
|
must also be presented.
|
||||||
|
type: string
|
||||||
|
type:
|
||||||
|
description: Type is the type of challenge being offered,
|
||||||
|
e.g. http-01, dns-01
|
||||||
|
type: string
|
||||||
|
url:
|
||||||
|
description: URL is the URL of this challenge. It can be
|
||||||
|
used to retrieve additional metadata about the Challenge
|
||||||
|
from the ACME server.
|
||||||
|
type: string
|
||||||
|
required:
|
||||||
|
- token
|
||||||
|
- type
|
||||||
|
- url
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
identifier:
|
||||||
|
description: Identifier is the DNS name to be validated as part
|
||||||
|
of this authorization
|
||||||
|
type: string
|
||||||
|
url:
|
||||||
|
description: URL is the URL of the Authorization that must be
|
||||||
|
completed
|
||||||
|
type: string
|
||||||
|
wildcard:
|
||||||
|
description: Wildcard will be true if this authorization is for
|
||||||
|
a wildcard DNS name. If this is true, the identifier will be
|
||||||
|
the *non-wildcard* version of the DNS name. For example, if
|
||||||
|
'*.example.com' is the DNS name being validated, this field
|
||||||
|
will be 'true' and the 'identifier' field will be 'example.com'.
|
||||||
|
type: boolean
|
||||||
|
required:
|
||||||
|
- url
|
||||||
|
type: object
|
||||||
|
type: array
|
||||||
|
certificate:
|
||||||
|
description: Certificate is a copy of the PEM encoded certificate for
|
||||||
|
this Order. This field will be populated after the order has been
|
||||||
|
successfully finalized with the ACME server, and the order has transitioned
|
||||||
|
to the 'valid' state.
|
||||||
|
format: byte
|
||||||
|
type: string
|
||||||
|
failureTime:
|
||||||
|
description: FailureTime stores the time that this order failed. This
|
||||||
|
is used to influence garbage collection and back-off.
|
||||||
|
format: date-time
|
||||||
|
type: string
|
||||||
|
finalizeURL:
|
||||||
|
description: FinalizeURL of the Order. This is used to obtain certificates
|
||||||
|
for this order once it has been completed.
|
||||||
|
type: string
|
||||||
|
reason:
|
||||||
|
description: Reason optionally provides more information about a why
|
||||||
|
the order is in the current state.
|
||||||
|
type: string
|
||||||
|
state:
|
||||||
|
description: State contains the current state of this Order resource.
|
||||||
|
States 'success' and 'expired' are 'final'
|
||||||
|
enum:
|
||||||
|
- valid
|
||||||
|
- ready
|
||||||
|
- pending
|
||||||
|
- processing
|
||||||
|
- invalid
|
||||||
|
- expired
|
||||||
|
- errored
|
||||||
|
type: string
|
||||||
|
url:
|
||||||
|
description: URL of the Order. This will initially be empty when the
|
||||||
|
resource is first created. The Order controller will populate this
|
||||||
|
field when the Order is first processed. This field will be immutable
|
||||||
|
after it is initially set.
|
||||||
|
type: string
|
||||||
|
type: object
|
||||||
|
required:
|
||||||
|
- metadata
|
||||||
|
type: object
|
||||||
|
versions:
|
||||||
|
- name: v1alpha2
|
||||||
|
served: true
|
||||||
|
storage: true
|
||||||
|
- name: v1alpha3
|
||||||
|
served: true
|
||||||
|
storage: false
|
||||||
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue