Skip to content

Commit 4c77981

Browse files
imrocimroc
authored
add cert-manager-webhook-dnspod 1.4.5 (#132)
1 parent 5f6fa02 commit 4c77981

File tree

11 files changed

+525
-0
lines changed

11 files changed

+525
-0
lines changed

‎incubator/cert-manager-webhook-dnspod/.helmignore

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*~
18+
# Various IDEs
19+
.project
20+
.idea/
21+
*.tmproj

‎incubator/cert-manager-webhook-dnspod/Chart.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: v2
2+
appVersion: 1.3.0
3+
description: cert-manager webhook solver for DNSPod
4+
name: cert-manager-webhook-dnspod
5+
version: 1.4.5
6+
type: application
7+
icon: https://cloudcache.tencent-cloud.com/qcloud/ui/static/Industry_tke/6708b51c-0c8e-4409-8a25-74991cc89065.png
8+
maintainers:
9+
- name: rockerchen
10+
email: rockerchen@tencent.com

‎incubator/cert-manager-webhook-dnspod/templates/NOTES.txt

Whitespace-only changes.

‎incubator/cert-manager-webhook-dnspod/templates/_helpers.tpl

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{{/* vim: set filetype=mustache: */}}
2+
{{/*
3+
Expand the name of the chart.
4+
*/}}
5+
{{- define "dnspod-webhook.name" -}}
6+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
7+
{{- end -}}
8+
9+
{{/*
10+
Create a default fully qualified app name.
11+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
12+
If release name contains chart name it will be used as a full name.
13+
*/}}
14+
{{- define "dnspod-webhook.fullname" -}}
15+
{{- if .Values.fullnameOverride -}}
16+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
17+
{{- else -}}
18+
{{- $name := default .Chart.Name .Values.nameOverride -}}
19+
{{- if contains $name .Release.Name -}}
20+
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
21+
{{- else -}}
22+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
23+
{{- end -}}
24+
{{- end -}}
25+
{{- end -}}
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "dnspod-webhook.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
32+
{{- end -}}
33+
34+
{{- define "dnspod-webhook.selfSignedIssuer" -}}
35+
{{ printf "%s-selfsign" (include "dnspod-webhook.fullname" .) }}
36+
{{- end -}}
37+
38+
{{- define "dnspod-webhook.rootCAIssuer" -}}
39+
{{ printf "%s-ca" (include "dnspod-webhook.fullname" .) }}
40+
{{- end -}}
41+
42+
{{- define "dnspod-webhook.rootCACertificate" -}}
43+
{{ printf "%s-ca" (include "dnspod-webhook.fullname" .) }}
44+
{{- end -}}
45+
46+
{{- define "dnspod-webhook.servingCertificate" -}}
47+
{{ printf "%s-webhook-tls" (include "dnspod-webhook.fullname" .) }}
48+
{{- end -}}
49+
50+
{{- define "dnspod-webhook.clusterIssuer" -}}
51+
{{- if .Values.clusterIssuer.name -}}
52+
{{ .Values.clusterIssuer.name }}
53+
{{- else -}}
54+
{{ printf "%s-cluster-issuer" (include "dnspod-webhook.fullname" .) }}
55+
{{- end -}}
56+
{{- end -}}
57+
58+
59+
{{- define "dnspod-webhook.namespace" -}}
60+
{{ .Values.namespace | default .Release.Namespace }}
61+
{{- end -}}

‎incubator/cert-manager-webhook-dnspod/templates/apiservice.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: apiregistration.k8s.io/v1
2+
kind: APIService
3+
metadata:
4+
name: v1alpha1.{{ .Values.groupName }}
5+
labels:
6+
app: {{ include "dnspod-webhook.name" . }}
7+
chart: {{ include "dnspod-webhook.chart" . }}
8+
release: {{ .Release.Name }}
9+
heritage: {{ .Release.Service }}
10+
annotations:
11+
cert-manager.io/inject-ca-from: "{{ include "dnspod-webhook.namespace" . }}/{{ include "dnspod-webhook.servingCertificate" . }}"
12+
spec:
13+
group: {{ .Values.groupName }}
14+
groupPriorityMinimum: 1000
15+
versionPriority: 15
16+
service:
17+
name: {{ include "dnspod-webhook.fullname" . }}
18+
namespace: {{ include "dnspod-webhook.namespace" . }}
19+
version: v1alpha1

‎incubator/cert-manager-webhook-dnspod/templates/deployment.yaml

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: {{ include "dnspod-webhook.fullname" . }}
5+
namespace: {{ include "dnspod-webhook.namespace" . }}
6+
labels:
7+
app: {{ include "dnspod-webhook.name" . }}
8+
chart: {{ include "dnspod-webhook.chart" . }}
9+
release: {{ .Release.Name }}
10+
heritage: {{ .Release.Service }}
11+
spec:
12+
replicas: {{ .Values.replicaCount }}
13+
selector:
14+
matchLabels:
15+
app: {{ include "dnspod-webhook.name" . }}
16+
release: {{ .Release.Name }}
17+
template:
18+
metadata:
19+
labels:
20+
app: {{ include "dnspod-webhook.name" . }}
21+
release: {{ .Release.Name }}
22+
spec:
23+
serviceAccountName: {{ include "dnspod-webhook.fullname" . }}
24+
containers:
25+
- name: {{ .Chart.Name }}
26+
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
27+
imagePullPolicy: {{ .Values.image.pullPolicy }}
28+
args:
29+
- --tls-cert-file=/tls/tls.crt
30+
- --tls-private-key-file=/tls/tls.key
31+
env:
32+
- name: GROUP_NAME
33+
value: {{ .Values.groupName | quote }}
34+
ports:
35+
- name: https
36+
containerPort: 443
37+
protocol: TCP
38+
livenessProbe:
39+
httpGet:
40+
scheme: HTTPS
41+
path: /healthz
42+
port: https
43+
readinessProbe:
44+
httpGet:
45+
scheme: HTTPS
46+
path: /healthz
47+
port: https
48+
volumeMounts:
49+
- name: certs
50+
mountPath: /tls
51+
readOnly: true
52+
resources:
53+
{{ toYaml .Values.resources | indent 12 }}
54+
volumes:
55+
- name: certs
56+
secret:
57+
secretName: {{ include "dnspod-webhook.servingCertificate" . }}
58+
{{- with .Values.nodeSelector }}
59+
nodeSelector:
60+
{{ toYaml . | indent 8 }}
61+
{{- end }}
62+
{{- with .Values.affinity }}
63+
affinity:
64+
{{ toYaml . | indent 8 }}
65+
{{- end }}
66+
{{- with .Values.tolerations }}
67+
tolerations:
68+
{{ toYaml . | indent 8 }}
69+
{{- end }}

‎incubator/cert-manager-webhook-dnspod/templates/pki.yaml

+115
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
---
2+
# Create a selfsigned Issuer, in order to create a root CA certificate for
3+
# signing webhook serving certificates
4+
apiVersion: cert-manager.io/v1
5+
kind: Issuer
6+
metadata:
7+
name: {{ include "dnspod-webhook.selfSignedIssuer" . }}
8+
namespace: {{ include "dnspod-webhook.namespace" . }}
9+
labels:
10+
app: {{ include "dnspod-webhook.name" . }}
11+
chart: {{ include "dnspod-webhook.chart" . }}
12+
release: {{ .Release.Name }}
13+
heritage: {{ .Release.Service }}
14+
spec:
15+
selfSigned: {}
16+
17+
---
18+
19+
# Generate a CA Certificate used to sign certificates for the webhook
20+
apiVersion: cert-manager.io/v1
21+
kind: Certificate
22+
metadata:
23+
name: {{ include "dnspod-webhook.rootCACertificate" . }}
24+
namespace: {{ include "dnspod-webhook.namespace" . }}
25+
labels:
26+
app: {{ include "dnspod-webhook.name" . }}
27+
chart: {{ include "dnspod-webhook.chart" . }}
28+
release: {{ .Release.Name }}
29+
heritage: {{ .Release.Service }}
30+
spec:
31+
secretName: {{ include "dnspod-webhook.rootCACertificate" . }}
32+
duration: 43800h0m0s # 5y
33+
issuerRef:
34+
name: {{ include "dnspod-webhook.selfSignedIssuer" . }}
35+
commonName: "ca.dnspod-webhook.cert-manager"
36+
isCA: true
37+
38+
---
39+
40+
# Create an Issuer that uses the above generated CA certificate to issue certs
41+
apiVersion: cert-manager.io/v1
42+
kind: Issuer
43+
metadata:
44+
name: {{ include "dnspod-webhook.rootCAIssuer" . }}
45+
namespace: {{ include "dnspod-webhook.namespace" . }}
46+
labels:
47+
app: {{ include "dnspod-webhook.name" . }}
48+
chart: {{ include "dnspod-webhook.chart" . }}
49+
release: {{ .Release.Name }}
50+
heritage: {{ .Release.Service }}
51+
spec:
52+
ca:
53+
secretName: {{ include "dnspod-webhook.rootCACertificate" . }}
54+
55+
---
56+
57+
# Finally, generate a serving certificate for the webhook to use
58+
apiVersion: cert-manager.io/v1
59+
kind: Certificate
60+
metadata:
61+
name: {{ include "dnspod-webhook.servingCertificate" . }}
62+
namespace: {{ include "dnspod-webhook.namespace" . }}
63+
labels:
64+
app: {{ include "dnspod-webhook.name" . }}
65+
chart: {{ include "dnspod-webhook.chart" . }}
66+
release: {{ .Release.Name }}
67+
heritage: {{ .Release.Service }}
68+
spec:
69+
secretName: {{ include "dnspod-webhook.servingCertificate" . }}
70+
duration: 8760h0m0s # 1y
71+
issuerRef:
72+
name: {{ include "dnspod-webhook.rootCAIssuer" . }}
73+
dnsNames:
74+
- {{ include "dnspod-webhook.fullname" . }}
75+
- {{ include "dnspod-webhook.fullname" . }}.{{ include "dnspod-webhook.namespace" . }}
76+
- {{ include "dnspod-webhook.fullname" . }}.{{ include "dnspod-webhook.namespace" . }}.svc
77+
78+
{{- if .Values.clusterIssuer.enabled }}
79+
---
80+
81+
apiVersion: cert-manager.io/v1
82+
kind: ClusterIssuer
83+
metadata:
84+
name: {{ include "dnspod-webhook.clusterIssuer" . }}
85+
labels:
86+
app: {{ include "dnspod-webhook.name" . }}
87+
chart: {{ include "dnspod-webhook.chart" . }}
88+
release: {{ .Release.Name }}
89+
heritage: {{ .Release.Service }}
90+
spec:
91+
acme:
92+
{{- if .Values.clusterIssuer.staging }}
93+
server: https://acme-staging-v02.api.letsencrypt.org/directory
94+
{{- else }}
95+
server: https://acme-v02.api.letsencrypt.org/directory
96+
{{- end }}
97+
email: {{ .Values.clusterIssuer.email }}
98+
privateKeySecretRef:
99+
name: {{ include "dnspod-webhook.fullname" . }}-letsencrypt
100+
solvers:
101+
- dns01:
102+
webhook:
103+
groupName: {{ .Values.groupName }}
104+
solverName: dnspod
105+
config:
106+
ttl: {{ .Values.clusterIssuer.ttl }}
107+
secretId: {{ required ".Values.clusterIssuer.secretId is required" .Values.clusterIssuer.secretId }}
108+
secretKeyRef:
109+
key: secret-key
110+
name: {{ include "dnspod-webhook.fullname" . }}-secret
111+
{{- if .Values.clusterIssuer.selector }}
112+
selector: {{ toYaml .Values.clusterIssuer.selector | nindent 8 }}
113+
{{- end }}
114+
{{- end }}
115+

0 commit comments

Comments
 (0)