Skip to content

Commit 990d3a1

Browse files
Ani1357srodenhuis
Ani1357
and
srodenhuis
authored
feat: Apl-10 ingress apps update (#1761)
Co-authored-by: Sander Rodenhuis <[email protected]>
1 parent f29e5bf commit 990d3a1

File tree

400 files changed

+28446
-8399
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

400 files changed

+28446
-8399
lines changed

‎charts/cert-manager/Chart.yaml

+8-6
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,26 @@
11
annotations:
2+
artifacthub.io/category: security
3+
artifacthub.io/license: Apache-2.0
24
artifacthub.io/prerelease: "false"
35
artifacthub.io/signKey: |
46
fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
57
url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
6-
apiVersion: v1
7-
appVersion: v1.11.4
8+
apiVersion: v2
9+
appVersion: v1.16.1
810
description: A Helm chart for cert-manager
9-
home: https://github.com/cert-manager/cert-manager
10-
icon: https://raw.githubusercontent.com/cert-manager/cert-manager/d53c0b9270f8cd90d908460d69502694e1838f5f/logo/logo-small.png
11+
home: https://cert-manager.io
12+
icon: https://raw.githubusercontent.com/cert-manager/community/4d35a69437d21b76322157e6284be4cd64e6d2b7/logo/logo-small.png
1113
keywords:
1214
- cert-manager
1315
- kube-lego
1416
- letsencrypt
1517
- tls
16-
kubeVersion: '>= 1.21.0-0'
18+
kubeVersion: '>= 1.22.0-0'
1719
maintainers:
1820
- email: [email protected]
1921
name: cert-manager-maintainers
2022
url: https://cert-manager.io
2123
name: cert-manager
2224
sources:
2325
- https://github.com/cert-manager/cert-manager
24-
version: v1.11.4
26+
version: v1.16.1

‎charts/cert-manager/README.md

+1,896-154
Large diffs are not rendered by default.

‎charts/cert-manager/templates/NOTES.txt

+3
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
{{- if .Values.installCRDs }}
2+
⚠️ WARNING: `installCRDs` is deprecated, use `crds.enabled` instead.
3+
{{- end }}
14
cert-manager {{ .Chart.AppVersion }} has been deployed successfully!
25

36
In order to begin issuing certificates, you will need to set up a ClusterIssuer

‎charts/cert-manager/templates/_helpers.tpl

+29-1
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ Labels that should be added on each resource
152152
*/}}
153153
{{- define "labels" -}}
154154
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
155-
{{- if eq (default "helm" .Values.creator) "helm" }}
155+
{{- if eq .Values.creator "helm" }}
156156
app.kubernetes.io/managed-by: {{ .Release.Service }}
157157
helm.sh/chart: {{ include "chartName" . }}
158158
{{- end -}}
@@ -172,3 +172,31 @@ https://github.com/helm/helm/issues/5358
172172
{{- define "cert-manager.namespace" -}}
173173
{{ .Values.namespace | default .Release.Namespace }}
174174
{{- end -}}
175+
176+
{{/*
177+
Util function for generating the image URL based on the provided options.
178+
IMPORTANT: This function is standardized across all charts in the cert-manager GH organization.
179+
Any changes to this function should also be made in cert-manager, trust-manager, approver-policy, ...
180+
See https://github.com/cert-manager/cert-manager/issues/6329 for a list of linked PRs.
181+
*/}}
182+
{{- define "image" -}}
183+
{{- $defaultTag := index . 1 -}}
184+
{{- with index . 0 -}}
185+
{{- if .registry -}}{{ printf "%s/%s" .registry .repository }}{{- else -}}{{- .repository -}}{{- end -}}
186+
{{- if .digest -}}{{ printf "@%s" .digest }}{{- else -}}{{ printf ":%s" (default $defaultTag .tag) }}{{- end -}}
187+
{{- end }}
188+
{{- end }}
189+
190+
{{/*
191+
Check that the user has not set both .installCRDs and .crds.enabled or
192+
set .installCRDs and disabled .crds.keep.
193+
.installCRDs is deprecated and users should use .crds.enabled and .crds.keep instead.
194+
*/}}
195+
{{- define "cert-manager.crd-check" -}}
196+
{{- if and (.Values.installCRDs) (.Values.crds.enabled) }}
197+
{{- fail "ERROR: the deprecated .installCRDs option cannot be enabled at the same time as its replacement .crds.enabled" }}
198+
{{- end }}
199+
{{- if and (.Values.installCRDs) (not .Values.crds.keep) }}
200+
{{- fail "ERROR: .crds.keep is not compatible with .installCRDs, please use .crds.enabled and .crds.keep instead" }}
201+
{{- end }}
202+
{{- end -}}

‎charts/cert-manager/templates/cainjector-config.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{{- if .Values.cainjector.config -}}
2+
{{- $config := .Values.cainjector.config -}}
3+
{{- $_ := set $config "apiVersion" (default "cainjector.config.cert-manager.io/v1alpha1" $config.apiVersion) -}}
4+
{{- $_ := set $config "kind" (default "CAInjectorConfiguration" $config.kind) -}}
5+
apiVersion: v1
6+
kind: ConfigMap
7+
metadata:
8+
name: {{ include "cainjector.fullname" . }}
9+
namespace: {{ include "cert-manager.namespace" . }}
10+
labels:
11+
app: {{ include "cainjector.name" . }}
12+
app.kubernetes.io/name: {{ include "cainjector.name" . }}
13+
app.kubernetes.io/instance: {{ .Release.Name }}
14+
app.kubernetes.io/component: "cainjector"
15+
{{- include "labels" . | nindent 4 }}
16+
data:
17+
config.yaml: |
18+
{{- $config | toYaml | nindent 4 }}
19+
{{- end -}}

‎charts/cert-manager/templates/cainjector-deployment.yaml

+55-4
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ metadata:
1616
{{- end }}
1717
spec:
1818
replicas: {{ .Values.cainjector.replicaCount }}
19+
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
20+
{{- if not (has (quote .Values.global.revisionHistoryLimit) (list "" (quote ""))) }}
21+
revisionHistoryLimit: {{ .Values.global.revisionHistoryLimit }}
22+
{{- end }}
1923
selector:
2024
matchLabels:
2125
app.kubernetes.io/name: {{ include "cainjector.name" . }}
@@ -40,11 +44,20 @@ spec:
4044
annotations:
4145
{{- toYaml . | nindent 8 }}
4246
{{- end }}
47+
{{- if and .Values.prometheus.enabled (not (or .Values.prometheus.servicemonitor.enabled .Values.prometheus.podmonitor.enabled)) }}
48+
{{- if not .Values.cainjector.podAnnotations }}
49+
annotations:
50+
{{- end }}
51+
prometheus.io/path: "/metrics"
52+
prometheus.io/scrape: 'true'
53+
prometheus.io/port: '9402'
54+
{{- end }}
4355
spec:
4456
serviceAccountName: {{ template "cainjector.serviceAccountName" . }}
4557
{{- if hasKey .Values.cainjector "automountServiceAccountToken" }}
4658
automountServiceAccountToken: {{ .Values.cainjector.automountServiceAccountToken }}
4759
{{- end }}
60+
enableServiceLinks: {{ .Values.cainjector.enableServiceLinks }}
4861
{{- with .Values.global.priorityClassName }}
4962
priorityClassName: {{ . | quote }}
5063
{{- end }}
@@ -54,14 +67,16 @@ spec:
5467
{{- end }}
5568
containers:
5669
- name: {{ .Chart.Name }}-cainjector
57-
{{- with .Values.cainjector.image }}
58-
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
59-
{{- end }}
70+
image: "{{ template "image" (tuple .Values.cainjector.image $.Chart.AppVersion) }}"
6071
imagePullPolicy: {{ .Values.cainjector.image.pullPolicy }}
6172
args:
62-
{{- if .Values.global.logLevel }}
73+
{{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
74+
{{- if not (has (quote .Values.global.logLevel) (list "" (quote ""))) }}
6375
- --v={{ .Values.global.logLevel }}
6476
{{- end }}
77+
{{- if .Values.cainjector.config }}
78+
- --config=/var/cert-manager/config/config.yaml
79+
{{- end }}
6580
{{- with .Values.global.leaderElection }}
6681
- --leader-election-namespace={{ .namespace }}
6782
{{- if .leaseDuration }}
@@ -74,14 +89,29 @@ spec:
7489
- --leader-election-retry-period={{ .retryPeriod }}
7590
{{- end }}
7691
{{- end }}
92+
{{- with .Values.cainjector.featureGates}}
93+
- --feature-gates={{ . }}
94+
{{- end}}
7795
{{- with .Values.cainjector.extraArgs }}
7896
{{- toYaml . | nindent 10 }}
7997
{{- end }}
98+
{{- if not .Values.prometheus.enabled }}
99+
- --metrics-listen-address=0
100+
{{- end }}
101+
{{- if .Values.prometheus.enabled }}
102+
ports:
103+
- containerPort: 9402
104+
name: http-metrics
105+
protocol: TCP
106+
{{- end }}
80107
env:
81108
- name: POD_NAMESPACE
82109
valueFrom:
83110
fieldRef:
84111
fieldPath: metadata.namespace
112+
{{- with .Values.cainjector.extraEnv }}
113+
{{- toYaml . | nindent 10 }}
114+
{{- end }}
85115
{{- with .Values.cainjector.containerSecurityContext }}
86116
securityContext:
87117
{{- toYaml . | nindent 12 }}
@@ -90,6 +120,16 @@ spec:
90120
resources:
91121
{{- toYaml . | nindent 12 }}
92122
{{- end }}
123+
{{- if or .Values.cainjector.config .Values.cainjector.volumeMounts }}
124+
volumeMounts:
125+
{{- if .Values.cainjector.config }}
126+
- name: config
127+
mountPath: /var/cert-manager/config
128+
{{- end }}
129+
{{- with .Values.cainjector.volumeMounts }}
130+
{{- toYaml . | nindent 12 }}
131+
{{- end }}
132+
{{- end }}
93133
{{- with .Values.cainjector.nodeSelector }}
94134
nodeSelector:
95135
{{- toYaml . | nindent 8 }}
@@ -106,4 +146,15 @@ spec:
106146
topologySpreadConstraints:
107147
{{- toYaml . | nindent 8 }}
108148
{{- end }}
149+
{{- if or .Values.cainjector.volumes .Values.cainjector.config }}
150+
volumes:
151+
{{- if .Values.cainjector.config }}
152+
- name: config
153+
configMap:
154+
name: {{ include "cainjector.fullname" . }}
155+
{{- end }}
156+
{{ with .Values.cainjector.volumes }}
157+
{{- toYaml . | nindent 8 }}
158+
{{- end }}
159+
{{- end }}
109160
{{- end }}

‎charts/cert-manager/templates/cainjector-poddisruptionbudget.yaml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{{- if .Values.cainjector.podDisruptionBudget.enabled }}
2+
apiVersion: policy/v1
3+
kind: PodDisruptionBudget
4+
metadata:
5+
name: {{ include "cainjector.fullname" . }}
6+
namespace: {{ include "cert-manager.namespace" . }}
7+
labels:
8+
app: {{ include "cainjector.name" . }}
9+
app.kubernetes.io/name: {{ include "cainjector.name" . }}
10+
app.kubernetes.io/instance: {{ .Release.Name }}
11+
app.kubernetes.io/component: "cainjector"
12+
{{- include "labels" . | nindent 4 }}
13+
spec:
14+
selector:
15+
matchLabels:
16+
app.kubernetes.io/name: {{ include "cainjector.name" . }}
17+
app.kubernetes.io/instance: {{ .Release.Name }}
18+
app.kubernetes.io/component: "cainjector"
19+
20+
{{- if not (or (hasKey .Values.cainjector.podDisruptionBudget "minAvailable") (hasKey .Values.cainjector.podDisruptionBudget "maxUnavailable")) }}
21+
minAvailable: 1 # Default value because minAvailable and maxUnavailable are not set
22+
{{- end }}
23+
{{- if hasKey .Values.cainjector.podDisruptionBudget "minAvailable" }}
24+
minAvailable: {{ .Values.cainjector.podDisruptionBudget.minAvailable }}
25+
{{- end }}
26+
{{- if hasKey .Values.cainjector.podDisruptionBudget "maxUnavailable" }}
27+
maxUnavailable: {{ .Values.cainjector.podDisruptionBudget.maxUnavailable }}
28+
{{- end }}
29+
{{- end }}

‎charts/cert-manager/templates/cainjector-rbac.yaml

+56-3
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ rules:
2222
verbs: ["get", "create", "update", "patch"]
2323
- apiGroups: ["admissionregistration.k8s.io"]
2424
resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
25-
verbs: ["get", "list", "watch", "update"]
25+
verbs: ["get", "list", "watch", "update", "patch"]
2626
- apiGroups: ["apiregistration.k8s.io"]
2727
resources: ["apiservices"]
28-
verbs: ["get", "list", "watch", "update"]
28+
verbs: ["get", "list", "watch", "update", "patch"]
2929
- apiGroups: ["apiextensions.k8s.io"]
3030
resources: ["customresourcedefinitions"]
31-
verbs: ["get", "list", "watch", "update"]
31+
verbs: ["get", "list", "watch", "update", "patch"]
3232
---
3333
apiVersion: rbac.authorization.k8s.io/v1
3434
kind: ClusterRoleBinding
@@ -101,3 +101,56 @@ subjects:
101101
namespace: {{ include "cert-manager.namespace" . }}
102102
{{- end }}
103103
{{- end }}
104+
{{- $certmanagerNamespace := include "cert-manager.namespace" . }}
105+
{{- if (.Values.cainjector.config.metricsTLSConfig).dynamic }}
106+
{{- if $certmanagerNamespace | eq .Values.cainjector.config.metricsTLSConfig.dynamic.secretNamespace }}
107+
108+
---
109+
110+
# Metrics server dynamic TLS serving certificate rules
111+
apiVersion: rbac.authorization.k8s.io/v1
112+
kind: Role
113+
metadata:
114+
name: {{ template "cainjector.fullname" . }}:dynamic-serving
115+
namespace: {{ include "cert-manager.namespace" . }}
116+
labels:
117+
app: {{ include "cainjector.name" . }}
118+
app.kubernetes.io/name: {{ include "cainjector.name" . }}
119+
app.kubernetes.io/instance: {{ .Release.Name }}
120+
app.kubernetes.io/component: "cainjector"
121+
{{- include "labels" . | nindent 4 }}
122+
rules:
123+
- apiGroups: [""]
124+
resources: ["secrets"]
125+
resourceNames:
126+
# Allow cainjector to read and update the metrics CA Secret when dynamic TLS is
127+
# enabled for the metrics server and if the Secret is configured to be in the
128+
# same namespace as cert-manager.
129+
- {{ .Values.cainjector.config.metricsTLSConfig.dynamic.secretName | quote }}
130+
verbs: ["get", "list", "watch", "update"]
131+
# It's not possible to grant CREATE permission on a single resourceName.
132+
- apiGroups: [""]
133+
resources: ["secrets"]
134+
verbs: ["create"]
135+
---
136+
apiVersion: rbac.authorization.k8s.io/v1
137+
kind: RoleBinding
138+
metadata:
139+
name: {{ include "cainjector.fullname" . }}:dynamic-serving
140+
namespace: {{ include "cert-manager.namespace" . }}
141+
labels:
142+
app: {{ include "cainjector.name" . }}
143+
app.kubernetes.io/name: {{ include "cainjector.name" . }}
144+
app.kubernetes.io/instance: {{ .Release.Name }}
145+
app.kubernetes.io/component: "cainjector"
146+
{{- include "labels" . | nindent 4 }}
147+
roleRef:
148+
apiGroup: rbac.authorization.k8s.io
149+
kind: Role
150+
name: {{ template "cainjector.fullname" . }}:dynamic-serving
151+
subjects:
152+
- kind: ServiceAccount
153+
name: {{ template "cainjector.serviceAccountName" . }}
154+
namespace: {{ include "cert-manager.namespace" . }}
155+
{{- end }}
156+
{{- end }}

‎charts/cert-manager/templates/cainjector-service.yaml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{{- if and .Values.prometheus.enabled (not .Values.prometheus.podmonitor.enabled) }}
2+
apiVersion: v1
3+
kind: Service
4+
metadata:
5+
name: {{ template "cainjector.fullname" . }}
6+
namespace: {{ include "cert-manager.namespace" . }}
7+
{{- with .Values.cainjector.serviceAnnotations }}
8+
annotations:
9+
{{ toYaml . | indent 4 }}
10+
{{- end }}
11+
labels:
12+
app: {{ include "cainjector.name" . }}
13+
app.kubernetes.io/name: {{ include "cainjector.name" . }}
14+
app.kubernetes.io/instance: {{ .Release.Name }}
15+
app.kubernetes.io/component: "cainjector"
16+
{{- include "labels" . | nindent 4 }}
17+
{{- with .Values.cainjector.serviceLabels }}
18+
{{- toYaml . | nindent 4 }}
19+
{{- end }}
20+
spec:
21+
type: ClusterIP
22+
ports:
23+
- protocol: TCP
24+
port: 9402
25+
name: http-metrics
26+
selector:
27+
app.kubernetes.io/name: {{ include "cainjector.name" . }}
28+
app.kubernetes.io/instance: {{ .Release.Name }}
29+
app.kubernetes.io/component: "cainjector"
30+
{{- end }}

‎charts/cert-manager/templates/controller-config.yaml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{{- if .Values.config -}}
2+
{{- $config := .Values.config -}}
3+
{{- $_ := set $config "apiVersion" (default "controller.config.cert-manager.io/v1alpha1" $config.apiVersion) -}}
4+
{{- $_ := set $config "kind" (default "ControllerConfiguration" $config.kind) -}}
5+
apiVersion: v1
6+
kind: ConfigMap
7+
metadata:
8+
name: {{ include "cert-manager.fullname" . }}
9+
namespace: {{ include "cert-manager.namespace" . }}
10+
labels:
11+
app: {{ include "cert-manager.name" . }}
12+
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
13+
app.kubernetes.io/instance: {{ .Release.Name }}
14+
app.kubernetes.io/component: "controller"
15+
{{- include "labels" . | nindent 4 }}
16+
data:
17+
config.yaml: |
18+
{{- $config | toYaml | nindent 4 }}
19+
{{- end -}}

0 commit comments

Comments
 (0)