mirror of https://git.rancher.io/charts
Make Remove
Kevin Joiner
parent
6bad16bbf8
commit
dea2a8d0a7
Binary file not shown.
|
|
@ -1,21 +0,0 @@
|
||||||
# Patterns to ignore when building packages.
|
|
||||||
# This supports shell glob matching, relative path matching, and
|
|
||||||
# negation (prefixed with !). Only one pattern per line.
|
|
||||||
.DS_Store
|
|
||||||
# Common VCS dirs
|
|
||||||
.git/
|
|
||||||
.gitignore
|
|
||||||
.bzr/
|
|
||||||
.bzrignore
|
|
||||||
.hg/
|
|
||||||
.hgignore
|
|
||||||
.svn/
|
|
||||||
# Common backup files
|
|
||||||
*.swp
|
|
||||||
*.bak
|
|
||||||
*.tmp
|
|
||||||
*~
|
|
||||||
# Various IDEs
|
|
||||||
.project
|
|
||||||
.idea/
|
|
||||||
*.tmproj
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
annotations:
|
|
||||||
catalog.cattle.io/certified: rancher
|
|
||||||
catalog.cattle.io/display-name: External IP Webhook
|
|
||||||
catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.22.0-0'
|
|
||||||
catalog.cattle.io/namespace: cattle-externalip-system
|
|
||||||
catalog.cattle.io/os: linux
|
|
||||||
catalog.cattle.io/permits-os: linux,windows
|
|
||||||
catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0'
|
|
||||||
catalog.cattle.io/release-name: rancher-external-ip-webhook
|
|
||||||
catalog.cattle.io/ui-component: rancher-external-ip-webhook
|
|
||||||
catalog.cattle.io/upstream-version: 1.0.1
|
|
||||||
apiVersion: v1
|
|
||||||
appVersion: v1.0.1
|
|
||||||
description: |
|
|
||||||
Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
|
|
||||||
home: https://github.com/rancher/externalip-webhook
|
|
||||||
keywords:
|
|
||||||
- cve
|
|
||||||
- externalip
|
|
||||||
- webhook
|
|
||||||
- security
|
|
||||||
kubeVersion: < 1.22.0
|
|
||||||
maintainers:
|
|
||||||
- email: raul@rancher.com
|
|
||||||
name: rawmind0
|
|
||||||
name: rancher-external-ip-webhook
|
|
||||||
sources:
|
|
||||||
- https://github.com/rancher/externalip-webhook
|
|
||||||
version: 101.0.0+up1.0.1
|
|
||||||
|
|
@ -1,71 +0,0 @@
|
||||||
# externalip-webhook
|
|
||||||
|
|
||||||
## Chart Details
|
|
||||||
|
|
||||||
This chart will create a deployment of `externalip-webhook` within your Kubernetes Cluster. It is required on kubernetes versions prior to 1.21 to mitigate CVE-2020-8554.
|
|
||||||
|
|
||||||
**Note:** This chart is deprecated for kubernetes version 1.21 and unsupported starting with 1.22. To mitigate CVE-2020-8554, enable the [`DenyServiceExternalIPs` admission controller](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#denyserviceexternalips) on the cluster.
|
|
||||||
|
|
||||||
## Installing the Chart
|
|
||||||
|
|
||||||
To install the chart with the release name `rancher-external-ip-webhook`:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
$ helm repo add rancher-chart https://charts.rancher.io
|
|
||||||
$ helm repo update
|
|
||||||
$ helm install rancher-external-ip-webhook rancher-chart/rancher-external-ip-webhook --namespace cattle-externalip-system -f values.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
## Configuration
|
|
||||||
|
|
||||||
The following table lists the configurable parameters of the externalip-webhook chart and their default values.
|
|
||||||
|
|
||||||
|
|
||||||
| Parameter | Description | Default |
|
|
||||||
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
|
|
||||||
| `allowedExternalIPCidrs` | Set allowed external IP CIDRs separated by a comma | `""` |
|
|
||||||
| `certificates.caBundle` | If cert-manager integration is disabled, add here self signed ca.crt in base64 format | `""` |
|
|
||||||
| `certificates.certManager.enabled` | Enable cert manager integration. Cert manager should be already installed at the k8s cluster | `true` |
|
|
||||||
| `certificates.certManager.version` | Cert manager version to use | `""` |
|
|
||||||
| `certificates.secretName` | If cert-manager integration is disabled, upload certs data (ca.crt, tls.crt & tls.key) as k8s secretName in the namespace | `"webhook-server-cert"` |
|
|
||||||
| `global.cattle.systemDefaultRegistry`| Pull docker images from systemDefaultRegistry | `""` |
|
|
||||||
| `image.pullPolicy` | Webhook server docker pull policy | `"IfNotPresent"` |
|
|
||||||
| `image.pullSecrets` | Webhook server docker pull secret | `""` |
|
|
||||||
| `image.repository` | Webhook server docker image repository | `"rancher/externalip-webhook"` |
|
|
||||||
| `image.tag` | Webhook server docker image tag Defaults to | `".Chart.appVersion"` |
|
|
||||||
| `metrics.enabled` | Enable metrics endpoint | `false` |
|
|
||||||
| `metrics.port` | Webhook metrics pod port | `8443` |
|
|
||||||
| `metrics.prometheusExport` | Enable Prometheus export. Follow [exporting-metrics-for-prometheus](https://book.kubebuilder.io/reference/metrics.html#exporting-metrics-for-prometheus) to export the webhook metrics | `false` |
|
|
||||||
| `metrics.authProxy.enabled` | Enable auth proxy for metrics endpoint | `false` |
|
|
||||||
| `metrics.authProxy.port` | Webhook auth proxy pod port | `8080` |
|
|
||||||
| `metrics.authProxy.image.pullPolicy` | Webhook auth proxy docker pull policy | `"IfNotPresent"` |
|
|
||||||
| `metrics.authProxy.image.pullSecrets`| Webhook auth proxy docker pull secrets | `""` |
|
|
||||||
| `metrics.authProxy.image.repository` | Webhook auth proxy docker image repository | `"gcr.io/kubebuilder/kube-rbac-proxy"` |
|
|
||||||
| `metrics.authProxy.image.pullPolicy` | Webhook auth proxy docker image tag | `"v0.5.0"` |
|
|
||||||
| `metrics.authProxy.resources.limits.cpu` | Webhook auth proxy resource cpu limit | `"100m"` |
|
|
||||||
| `metrics.authProxy.resources.limits.memory` | Webhook auth proxy resource memory limit | `"30Mi"` |
|
|
||||||
| `metrics.authProxy.resources.requests.cpu` | Webhook auth proxy wesource cpu reservation | `"100m"` |
|
|
||||||
| `metrics.authProxy.resources.requests.memory` | Webhook auth proxy resource memory reservation | `"20Mi"` |
|
|
||||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
|
||||||
| `rbac.apiVersion` | Rbac API version to use | `"v1"` |
|
|
||||||
| `resources.limits.cpu` | Resource cpu limit | `"100m"` |
|
|
||||||
| `resources.limits.memory` | Resource memory limit | `"30Mi"` |
|
|
||||||
| `resources.requests.cpu` | Resource cpu reservation | `"100m"` |
|
|
||||||
| `resources.requests.memory` | Resource memory reservation | `"20Mi"` |
|
|
||||||
| `service.metricsPort` | Webhook metrics service port | `8443` |
|
|
||||||
| `service.webhookPort` | Webhook server service port | `443` |
|
|
||||||
| `serviceAccountName` | Webhook serviceAccountName. Just used if metrics.authProxy.enabled = false | `"default"` |
|
|
||||||
| `tolerations` | List of node taints to tolerate (requires Kubernetes >= 1.6) | `[]` |
|
|
||||||
| `webhookPort` | Webhook server pod port | `9443` |
|
|
||||||
|
|
||||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
|
|
||||||
|
|
||||||
Alternatively, a YAML file that specifies the values for the parameters can be provided while installing the chart. For example,
|
|
||||||
|
|
||||||
```bash
|
|
||||||
$ helm repo add rancher-chart https://charts.rancher.io
|
|
||||||
$ helm repo update
|
|
||||||
$ helm install rancher-external-ip-webhook rancher-chart/rancher-external-ip-webhook --namespace cattle-externalip-system -f values.yaml
|
|
||||||
```
|
|
||||||
|
|
||||||
> **Tip**: You can use the default [values.yaml](https://github.com/rancher/externalip-webhook/blob/master/chart/values.yaml)
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
# externalip-webhook
|
|
||||||
|
|
||||||
This chart was created to mitigate [CVE-2020-8554](https://www.cvedetails.com/cve/CVE-2020-8554/)
|
|
||||||
|
|
||||||
External IP Webhook is a validating k8s webhook which prevents services from using random external IPs.
|
|
||||||
Cluster administrators can specify list of CIDRs allowed to be used as external IP by specifying `allowed-external-ip-cidrs` parameter. The webhook will only allow services which either don’t set external IP, or whose external IPs are within the range specified by the administrator.
|
|
||||||
|
|
||||||
External IP Webhook certificates are required. They can be generated in 2 ways:
|
|
||||||
* cert-manager: This is the default chart configuration. Cert manager should be already installed at the k8s cluster
|
|
||||||
* uploading certs: Disable `Cert Manager integration` and set `Secret name` and `CA Bundle` at `Certificates` section.
|
|
||||||
|
|
||||||
For more information, review the Helm README of this chart.
|
|
||||||
|
|
@ -1,26 +0,0 @@
|
||||||
questions:
|
|
||||||
# allowedExternalIPCidrs
|
|
||||||
- variable: allowedExternalIPCidrs
|
|
||||||
label: Allowed external IP cidrs
|
|
||||||
description: Set allowed external IP CIDRs separated by a comma
|
|
||||||
type: string
|
|
||||||
group: Configuration
|
|
||||||
- variable: certificates.certManager.enabled
|
|
||||||
default: true
|
|
||||||
description: Enable cert manager integration. Cert manager should be already installed
|
|
||||||
label: Enable Cert Manager integration
|
|
||||||
type: boolean
|
|
||||||
group: "Certificates"
|
|
||||||
show_subquestion_if: false
|
|
||||||
subquestions:
|
|
||||||
- variable: certificates.secretName
|
|
||||||
default: webhook-server-cert
|
|
||||||
description: Use certificates from secret. Secret should exists in the app namespace, with certs data (ca.crt, tls.crt & tls.key)
|
|
||||||
label: Secret name
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
- variable: certificates.caBundle
|
|
||||||
description: Use self signed CA Bundle. It should be provided in base64 format
|
|
||||||
label: CA Bundle
|
|
||||||
type: string
|
|
||||||
required: true
|
|
||||||
|
|
@ -1,3 +0,0 @@
|
||||||
To verify that externalip-webhook has started, run:
|
|
||||||
|
|
||||||
kubectl --namespace={{ .Release.Namespace }} get pods -l "app={{ template "externalip-webhook.name" . }},release={{ .Release.Name }}"
|
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
{{/* vim: set filetype=mustache: */}}
|
|
||||||
{{/*
|
|
||||||
Expand the name of the chart.
|
|
||||||
*/}}
|
|
||||||
{{- define "externalip-webhook.name" -}}
|
|
||||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create a default fully qualified app name.
|
|
||||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
|
||||||
*/}}
|
|
||||||
{{- define "externalip-webhook.fullname" -}}
|
|
||||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
|
||||||
{{- if ne $name .Release.Name -}}
|
|
||||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- else -}}
|
|
||||||
{{- printf "%s" $name | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/* Generate basic labels */}}
|
|
||||||
{{- define "externalip-webhook.labels" }}
|
|
||||||
app: {{ template "externalip-webhook.name" . }}
|
|
||||||
heritage: {{.Release.Service }}
|
|
||||||
release: {{.Release.Name }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Windows cluster will add default taint for linux nodes,
|
|
||||||
add below linux tolerations to workloads could be scheduled to those linux nodes
|
|
||||||
*/}}
|
|
||||||
{{- define "linux-node-tolerations" -}}
|
|
||||||
- key: "cattle.io/os"
|
|
||||||
value: "linux"
|
|
||||||
effect: "NoSchedule"
|
|
||||||
operator: "Equal"
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "linux-node-selector" -}}
|
|
||||||
kubernetes.io/os: linux
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "system_default_registry" -}}
|
|
||||||
{{- if .Values.global.cattle.systemDefaultRegistry -}}
|
|
||||||
{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}}
|
|
||||||
{{- else -}}
|
|
||||||
{{- "" -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,30 +0,0 @@
|
||||||
apiVersion: admissionregistration.k8s.io/v1beta1
|
|
||||||
kind: ValidatingWebhookConfiguration
|
|
||||||
metadata:
|
|
||||||
{{- if .Values.certificates.certManager.enabled }}
|
|
||||||
annotations:
|
|
||||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "externalip-webhook.fullname" . }}-server-cert
|
|
||||||
{{- end }}
|
|
||||||
creationTimestamp: null
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}-validating-webhook-configuration
|
|
||||||
webhooks:
|
|
||||||
- clientConfig:
|
|
||||||
{{- if not (.Values.certificates.certManager.enabled) }}
|
|
||||||
caBundle: {{ .Values.certificates.caBundle }}
|
|
||||||
{{- end }}
|
|
||||||
service:
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
path: /validate-service
|
|
||||||
failurePolicy: Ignore
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}.{{ .Release.Namespace }}.svc
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
apiVersions:
|
|
||||||
- v1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- services
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
{{- if and (.Values.metrics.enabled) (.Values.metrics.authProxy.enabled) -}}
|
|
||||||
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}-proxy-role
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- authentication.k8s.io
|
|
||||||
resources:
|
|
||||||
- tokenreviews
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- apiGroups:
|
|
||||||
- authorization.k8s.io
|
|
||||||
resources:
|
|
||||||
- subjectaccessreviews
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}-metrics-reader
|
|
||||||
rules:
|
|
||||||
- nonResourceURLs:
|
|
||||||
- /metrics
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,31 +0,0 @@
|
||||||
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}-cluster-view
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: view
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
{{- if and (.Values.metrics.enabled) (.Values.metrics.authProxy.enabled) }}
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/{{ .Values.rbac.apiVersion }}
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}-proxy-rolebinding
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}-proxy-role
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,107 +0,0 @@
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
seccomp.security.alpha.kubernetes.io/pod: runtime/default
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
spec:
|
|
||||||
replicas: {{ .Values.replicas }}
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: {{ template "externalip-webhook.name" . }}
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
seccomp.security.alpha.kubernetes.io/pod: runtime/default
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 8 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
{{- if and (.Values.metrics.enabled) (.Values.metrics.authProxy.enabled) }}
|
|
||||||
- name: {{ template "externalip-webhook.fullname" . }}-auth-proxy
|
|
||||||
args:
|
|
||||||
- --secure-listen-address=0.0.0.0:{{ .Values.metrics.port }}
|
|
||||||
- --upstream=http://127.0.0.1:{{ .Values.metrics.authProxy.port }}/
|
|
||||||
- --logtostderr=true
|
|
||||||
- --v=10
|
|
||||||
image: {{ template "system_default_registry" . }}{{ .Values.metrics.authProxy.image.repository}}:{{ .Values.metrics.authProxy.image.tag }}
|
|
||||||
imagePullPolicy: "{{ .Values.metrics.authProxy.image.pullPolicy }}"
|
|
||||||
ports:
|
|
||||||
- containerPort: {{ .Values.metrics.port }}
|
|
||||||
name: webhook-metrics
|
|
||||||
protocol: TCP
|
|
||||||
resources:
|
|
||||||
{{ toYaml .Values.metrics.authProxy.resources | indent 10 }}
|
|
||||||
readinessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: webhook-metrics
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
livenessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: webhook-metrics
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
failureThreshold: 10
|
|
||||||
periodSeconds: 30
|
|
||||||
{{- end }}
|
|
||||||
- name: {{ template "externalip-webhook.fullname" . }}
|
|
||||||
image: {{ template "system_default_registry" . }}{{ .Values.image.repository}}:{{ default .Chart.AppVersion .Values.image.tag }}
|
|
||||||
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
|
||||||
command:
|
|
||||||
- /webhook
|
|
||||||
args:
|
|
||||||
- --webhook-port={{ .Values.webhookPort }}
|
|
||||||
{{- if .Values.allowedExternalIPCidrs }}
|
|
||||||
- --allowed-external-ip-cidrs={{ .Values.allowedExternalIPCidrs }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.metrics.enabled }}
|
|
||||||
{{- if .Values.metrics.authProxy.enabled }}
|
|
||||||
- --metrics-addr=127.0.0.1:{{ .Values.metrics.authProxy.port }}
|
|
||||||
{{- else }}
|
|
||||||
- --metrics-addr=0.0.0.0:{{ .Values.metrics.port }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
ports:
|
|
||||||
- containerPort: {{ .Values.webhookPort }}
|
|
||||||
name: webhook-server
|
|
||||||
protocol: TCP
|
|
||||||
{{- if and (.Values.metrics.enabled) (not (.Values.metrics.authProxy.enabled)) }}
|
|
||||||
- containerPort: {{ .Values.metrics.port }}
|
|
||||||
name: webhook-metrics
|
|
||||||
protocol: TCP
|
|
||||||
{{- end }}
|
|
||||||
volumeMounts:
|
|
||||||
- name: server-cert
|
|
||||||
mountPath: /tmp/k8s-webhook-server/serving-certs
|
|
||||||
readOnly: true
|
|
||||||
resources:
|
|
||||||
{{ toYaml .Values.resources | indent 10 }}
|
|
||||||
readinessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: webhook-server
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
failureThreshold: 10
|
|
||||||
periodSeconds: 30
|
|
||||||
livenessProbe:
|
|
||||||
tcpSocket:
|
|
||||||
port: webhook-server
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
failureThreshold: 10
|
|
||||||
periodSeconds: 30
|
|
||||||
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
|
|
||||||
{{- if .Values.nodeSelector }}
|
|
||||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
|
||||||
{{- end }}
|
|
||||||
tolerations: {{ include "linux-node-tolerations" . | nindent 6}}
|
|
||||||
{{- if .Values.tolerations }}
|
|
||||||
{{ toYaml .Values.tolerations | indent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
serviceAccountName: {{ template "externalip-webhook.fullname" . }}
|
|
||||||
volumes:
|
|
||||||
- name: server-cert
|
|
||||||
secret:
|
|
||||||
defaultMode: 420
|
|
||||||
secretName: {{ .Values.certificates.secretName }}
|
|
||||||
|
|
@ -1,52 +0,0 @@
|
||||||
{{- if .Values.certificates.certManager.enabled -}}
|
|
||||||
{{- $certmanagerVer := split "." .Values.certificates.certManager.version -}}
|
|
||||||
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 1) (ge (int $certmanagerVer._1) 0)) }}
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
|
|
||||||
apiVersion: cert-manager.io/v1beta1
|
|
||||||
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
|
|
||||||
apiVersion: cert-manager.io/v1alpha2
|
|
||||||
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
|
|
||||||
apiVersion: certmanager.k8s.io/v1alpha1
|
|
||||||
{{- else }}
|
|
||||||
# Setting latest version as default
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
{{- end }}
|
|
||||||
kind: Certificate
|
|
||||||
metadata:
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}-server-cert
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
spec:
|
|
||||||
dnsNames:
|
|
||||||
- {{ template "externalip-webhook.fullname" . }}.{{ .Release.Namespace }}.svc
|
|
||||||
- {{ template "externalip-webhook.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
|
|
||||||
issuerRef:
|
|
||||||
kind: Issuer
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}-issuer
|
|
||||||
secretName: {{ .Values.certificates.secretName }}
|
|
||||||
---
|
|
||||||
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 1) (ge (int $certmanagerVer._1) 0)) }}
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
|
|
||||||
apiVersion: cert-manager.io/v1beta1
|
|
||||||
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
|
|
||||||
apiVersion: cert-manager.io/v1alpha2
|
|
||||||
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
|
|
||||||
apiVersion: certmanager.k8s.io/v1alpha1
|
|
||||||
{{- else }}
|
|
||||||
# Setting latest version as default
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
{{- end }}
|
|
||||||
kind: Issuer
|
|
||||||
metadata:
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}-issuer
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
spec:
|
|
||||||
selfSigned: {}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: webhook-server
|
|
||||||
port: {{ .Values.service.webhookPort }}
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: {{ .Values.webhookPort }}
|
|
||||||
selector:
|
|
||||||
app: {{ template "externalip-webhook.name" . }}
|
|
||||||
type: "ClusterIP"
|
|
||||||
{{- if .Values.metrics.enabled }}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}-metrics-service
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: webhook-metrics
|
|
||||||
port: {{ .Values.service.metricsPort }}
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: {{ .Values.metrics.port }}
|
|
||||||
selector:
|
|
||||||
app: {{ template "externalip-webhook.name" . }}
|
|
||||||
type: "ClusterIP"
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
{{- if and (.Values.metrics.enabled) (.Values.metrics.prometheusExport) -}}
|
|
||||||
apiVersion: monitoring.coreos.com/v1
|
|
||||||
kind: ServiceMonitor
|
|
||||||
metadata:
|
|
||||||
labels: {{ include "externalip-webhook.labels" . | indent 4 }}
|
|
||||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
|
||||||
name: {{ template "externalip-webhook.fullname" . }}-monitor
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
spec:
|
|
||||||
endpoints:
|
|
||||||
- path: /metrics
|
|
||||||
port: https
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: {{ template "externalip-webhook.name" . }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,32 +0,0 @@
|
||||||
suite: Test Admission Registration
|
|
||||||
templates:
|
|
||||||
- admissionregistration.yaml
|
|
||||||
tests:
|
|
||||||
- it: should render Admission Registration
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: admissionregistration.k8s.io/v1beta1
|
|
||||||
- it: should render Admission Registration annotation and not caBundle if certificates.certManager.enabled = true
|
|
||||||
release:
|
|
||||||
name: rancher-externalip-webhook
|
|
||||||
namespace: test
|
|
||||||
set:
|
|
||||||
certificates.certManager.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: metadata.annotations
|
|
||||||
value:
|
|
||||||
cert-manager.io/inject-ca-from: test/rancher-externalip-webhook-server-cert
|
|
||||||
- isNull:
|
|
||||||
path: webhooks[0].clientConfig.caBundle
|
|
||||||
- it: should render Admission Registration caBundle and not annotation if certificates.certManager.enabled = false
|
|
||||||
set:
|
|
||||||
certificates.caBundle: test
|
|
||||||
certificates.certManager.enabled: false
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: webhooks[0].clientConfig.caBundle
|
|
||||||
value: test
|
|
||||||
- isNull:
|
|
||||||
path: metadata.annotations
|
|
||||||
|
|
@ -1,37 +0,0 @@
|
||||||
suite: Test Cluster Roles
|
|
||||||
templates:
|
|
||||||
- clusterrole.yaml
|
|
||||||
tests:
|
|
||||||
- it: should not render Cluster Roles if metrics.enabled = false or metrics.authProxy.enabled = false
|
|
||||||
set:
|
|
||||||
metrics.enabled: false
|
|
||||||
metrics.authProxy.enabled: false
|
|
||||||
asserts:
|
|
||||||
- hasDocuments:
|
|
||||||
count: 0
|
|
||||||
template: clusterrole.yaml
|
|
||||||
- it: should render Cluster Roles if metrics.enabled = true and metrics.authProxy.enabled = true
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
metrics.authProxy.enabled: true
|
|
||||||
asserts:
|
|
||||||
- hasDocuments:
|
|
||||||
count: 2
|
|
||||||
template: clusterrole.yaml
|
|
||||||
- it: should render Cluster Roles with default rbac api version if metrics.enabled = true and metrics.authProxy.enabled = true
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
metrics.authProxy.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: rbac.authorization.k8s.io/v1
|
|
||||||
- it: should render Cluster Roles with custom rbac api version if metrics.enabled = true and metrics.authProxy.enabled = true
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
metrics.authProxy.enabled: true
|
|
||||||
rbac.apiVersion: v1beta
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: rbac.authorization.k8s.io/v1beta
|
|
||||||
|
|
@ -1,42 +0,0 @@
|
||||||
suite: Test Cluster Role Bindings
|
|
||||||
templates:
|
|
||||||
- clusterrolebinding.yaml
|
|
||||||
tests:
|
|
||||||
- it: should render Cluster Role Bindings with default rbac api version
|
|
||||||
set:
|
|
||||||
rbac.apiVersion: v1
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: rbac.authorization.k8s.io/v1
|
|
||||||
- it: should render Cluster Role Bindings with custom rbac api version
|
|
||||||
set:
|
|
||||||
rbac.apiVersion: v1beta
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: rbac.authorization.k8s.io/v1beta
|
|
||||||
- it: should not render Cluster Role Binding proxy if metrics.enabled = false or metrics.authProxy.enabled = false
|
|
||||||
set:
|
|
||||||
metrics.enabled: false
|
|
||||||
metrics.authProxy.enabled: false
|
|
||||||
asserts:
|
|
||||||
- hasDocuments:
|
|
||||||
count: 1
|
|
||||||
template: clusterrolebinding.yaml
|
|
||||||
- it: should render Cluster Role Bindings proxy if metrics.enabled = true and metrics.authProxy.enabled = true
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
metrics.authProxy.enabled: true
|
|
||||||
asserts:
|
|
||||||
- hasDocuments:
|
|
||||||
count: 2
|
|
||||||
template: clusterrolebinding.yaml
|
|
||||||
- it: should render Cluster Role Bindings with default rbac api version if metrics.enabled = true and metrics.authProxy.enabled = true
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
metrics.authProxy.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: rbac.authorization.k8s.io/v1
|
|
||||||
|
|
@ -1,202 +0,0 @@
|
||||||
suite: Test Deployments
|
|
||||||
templates:
|
|
||||||
- deployment.yaml
|
|
||||||
tests:
|
|
||||||
- it: should render Deployment with allowed-external-ip-cidrs arg if allowedExternalIPCidrs is set
|
|
||||||
release:
|
|
||||||
name: rancher-externalip-webhook
|
|
||||||
set:
|
|
||||||
allowedExternalIPCidrs: "1,2"
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].args[1]
|
|
||||||
value: --allowed-external-ip-cidrs=1,2
|
|
||||||
- it: should render Deployment with default port, nodeSelector and tolerations if metrics.enabled = false and metrics.authProxy.enabled = false
|
|
||||||
release:
|
|
||||||
name: rancher-externalip-webhook
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].name
|
|
||||||
value: rancher-externalip-webhook
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].ports[0]
|
|
||||||
value:
|
|
||||||
containerPort: 9443
|
|
||||||
name: webhook-server
|
|
||||||
protocol: TCP
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.tolerations[0]
|
|
||||||
value:
|
|
||||||
key: "cattle.io/os"
|
|
||||||
value: "linux"
|
|
||||||
effect: "NoSchedule"
|
|
||||||
operator: "Equal"
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.nodeSelector
|
|
||||||
value:
|
|
||||||
kubernetes.io/os: linux
|
|
||||||
- it: should render Deployment with default port and custom nodeSelector and tolerations if metrics.enabled = false and metrics.authProxy.enabled = false
|
|
||||||
release:
|
|
||||||
name: rancher-externalip-webhook
|
|
||||||
set:
|
|
||||||
tolerations:
|
|
||||||
- key: "cattle.io/test"
|
|
||||||
value: "linux"
|
|
||||||
effect: "NoSchedule"
|
|
||||||
operator: "Equal"
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/test: linux
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].name
|
|
||||||
value: rancher-externalip-webhook
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].ports[0]
|
|
||||||
value:
|
|
||||||
containerPort: 9443
|
|
||||||
name: webhook-server
|
|
||||||
protocol: TCP
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.tolerations[0]
|
|
||||||
value:
|
|
||||||
key: "cattle.io/os"
|
|
||||||
value: "linux"
|
|
||||||
effect: "NoSchedule"
|
|
||||||
operator: "Equal"
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.tolerations[1]
|
|
||||||
value:
|
|
||||||
key: "cattle.io/test"
|
|
||||||
value: "linux"
|
|
||||||
effect: "NoSchedule"
|
|
||||||
operator: "Equal"
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.nodeSelector
|
|
||||||
value:
|
|
||||||
kubernetes.io/os: linux
|
|
||||||
kubernetes.io/test: linux
|
|
||||||
- it: should render Deployment with custom port and image if metrics.enabled = false and metrics.authProxy.enabled = false
|
|
||||||
release:
|
|
||||||
name: rancher-externalip-webhook
|
|
||||||
set:
|
|
||||||
webhookPort: 9000
|
|
||||||
image.repository: test
|
|
||||||
image.tag: dev-test
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].name
|
|
||||||
value: rancher-externalip-webhook
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].image
|
|
||||||
value: test:dev-test
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].ports[0]
|
|
||||||
value:
|
|
||||||
containerPort: 9000
|
|
||||||
name: webhook-server
|
|
||||||
protocol: TCP
|
|
||||||
- it: should render Deployment with default metrics port if metrics.enabled = true and metrics.authProxy.enabled = false
|
|
||||||
release:
|
|
||||||
name: rancher-externalip-webhook
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].name
|
|
||||||
value: rancher-externalip-webhook
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].ports[0]
|
|
||||||
value:
|
|
||||||
containerPort: 9443
|
|
||||||
name: webhook-server
|
|
||||||
protocol: TCP
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].ports[1]
|
|
||||||
value:
|
|
||||||
containerPort: 8443
|
|
||||||
name: webhook-metrics
|
|
||||||
protocol: TCP
|
|
||||||
- it: should render Deployment with custom metrics port if metrics.enabled = true and metrics.authProxy.enabled = false
|
|
||||||
release:
|
|
||||||
name: rancher-externalip-webhook
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
metrics.port: 8000
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].name
|
|
||||||
value: rancher-externalip-webhook
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].ports[0]
|
|
||||||
value:
|
|
||||||
containerPort: 9443
|
|
||||||
name: webhook-server
|
|
||||||
protocol: TCP
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].ports[1]
|
|
||||||
value:
|
|
||||||
containerPort: 8000
|
|
||||||
name: webhook-metrics
|
|
||||||
protocol: TCP
|
|
||||||
- it: should render Deployment with default metrics port if metrics.enabled = true and metrics.authProxy.enabled = true
|
|
||||||
release:
|
|
||||||
name: rancher-externalip-webhook
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
metrics.authProxy.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].name
|
|
||||||
value: rancher-externalip-webhook-auth-proxy
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].ports[0]
|
|
||||||
value:
|
|
||||||
containerPort: 8443
|
|
||||||
name: webhook-metrics
|
|
||||||
protocol: TCP
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[1].name
|
|
||||||
value: rancher-externalip-webhook
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[1].ports[0]
|
|
||||||
value:
|
|
||||||
containerPort: 9443
|
|
||||||
name: webhook-server
|
|
||||||
protocol: TCP
|
|
||||||
- it: should render Deployment with custom metrics port and image if metrics.enabled = true and metrics.authProxy.enabled = true
|
|
||||||
release:
|
|
||||||
name: rancher-externalip-webhook
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
metrics.authProxy.enabled: true
|
|
||||||
metrics.port: 8000
|
|
||||||
webhookPort: 9000
|
|
||||||
image.repository: test
|
|
||||||
image.tag: dev-test
|
|
||||||
metrics.authProxy.image.repository: auth
|
|
||||||
metrics.authProxy.image.tag: auth-test
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].name
|
|
||||||
value: rancher-externalip-webhook-auth-proxy
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].image
|
|
||||||
value: auth:auth-test
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[0].ports[0]
|
|
||||||
value:
|
|
||||||
containerPort: 8000
|
|
||||||
name: webhook-metrics
|
|
||||||
protocol: TCP
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[1].name
|
|
||||||
value: rancher-externalip-webhook
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[1].image
|
|
||||||
value: test:dev-test
|
|
||||||
- equal:
|
|
||||||
path: spec.template.spec.containers[1].ports[0]
|
|
||||||
value:
|
|
||||||
containerPort: 9000
|
|
||||||
name: webhook-server
|
|
||||||
protocol: TCP
|
|
||||||
|
|
@ -1,106 +0,0 @@
|
||||||
suite: Test Issuers
|
|
||||||
templates:
|
|
||||||
- issuer.yaml
|
|
||||||
tests:
|
|
||||||
- it: should not render issuer if certificates.certManager.enabled = false
|
|
||||||
set:
|
|
||||||
certificates.certManager.enabled: false
|
|
||||||
asserts:
|
|
||||||
- hasDocuments:
|
|
||||||
count: 0
|
|
||||||
template: issuer.yaml
|
|
||||||
- it: should render issuer if certificates.certManager.enabled = true
|
|
||||||
set:
|
|
||||||
certificates.certManager.enabled: true
|
|
||||||
asserts:
|
|
||||||
- hasDocuments:
|
|
||||||
count: 2
|
|
||||||
template: issuer.yaml
|
|
||||||
- it: should set issuer apiVersion with default cert-manager
|
|
||||||
set:
|
|
||||||
certificates.certManager.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: cert-manager.io/v1
|
|
||||||
template: issuer.yaml
|
|
||||||
- it: should set issuer apiVersion with cert-manager >= 1.0.0 using capabilities
|
|
||||||
capabilities:
|
|
||||||
apiversions:
|
|
||||||
- cert-manager.io/v1
|
|
||||||
set:
|
|
||||||
certificates.certManager.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: cert-manager.io/v1
|
|
||||||
template: issuer.yaml
|
|
||||||
- it: should set issuer apiVersion with cert-manager >= 0.16.0 using capabilities
|
|
||||||
capabilities:
|
|
||||||
apiversions:
|
|
||||||
- cert-manager.io/v1beta1
|
|
||||||
set:
|
|
||||||
certificates.certManager.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: cert-manager.io/v1beta1
|
|
||||||
template: issuer.yaml
|
|
||||||
- it: should set issuer apiVersion with cert-manager >= 0.11.0 using capabilities
|
|
||||||
capabilities:
|
|
||||||
apiversions:
|
|
||||||
- cert-manager.io/v1alpha2
|
|
||||||
set:
|
|
||||||
certificates.certManager.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: cert-manager.io/v1alpha2
|
|
||||||
template: issuer.yaml
|
|
||||||
- it: should set issuer apiVersion with cert-manager < 0.11.0 using capabilities
|
|
||||||
capabilities:
|
|
||||||
apiversions:
|
|
||||||
- certmanager.k8s.io/v1alpha1
|
|
||||||
set:
|
|
||||||
certificates.certManager.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: certmanager.k8s.io/v1alpha1
|
|
||||||
template: issuer.yaml
|
|
||||||
- it: should set issuer apiVersion with cert-manager >= 1.0.0 using parameter
|
|
||||||
set:
|
|
||||||
certificates.certManager.version: 1.0.0
|
|
||||||
certificates.certManager.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: cert-manager.io/v1
|
|
||||||
template: issuer.yaml
|
|
||||||
- it: should set issuer apiVersion with cert-manager >= 0.16.0 using parameter
|
|
||||||
set:
|
|
||||||
certificates.certManager.version: 0.16.0
|
|
||||||
certificates.certManager.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: cert-manager.io/v1beta1
|
|
||||||
template: issuer.yaml
|
|
||||||
- it: should set issuer apiVersion with cert-manager >= 0.11.0 using parameter
|
|
||||||
set:
|
|
||||||
certificates.certManager.version: 0.11.0
|
|
||||||
certificates.certManager.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: cert-manager.io/v1alpha2
|
|
||||||
template: issuer.yaml
|
|
||||||
- it: should set letsEncrypt apiVersion with cert-manager < 0.11.0 using parameter
|
|
||||||
set:
|
|
||||||
certificates.certManager.version: 0.9.0
|
|
||||||
certificates.certManager.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: apiVersion
|
|
||||||
value: certmanager.k8s.io/v1alpha1
|
|
||||||
template: issuer.yaml
|
|
||||||
|
|
@ -1,69 +0,0 @@
|
||||||
suite: Test Services
|
|
||||||
templates:
|
|
||||||
- service.yaml
|
|
||||||
tests:
|
|
||||||
- it: should render webhook-server service with default webhookPort if metrics.enabled = false
|
|
||||||
set:
|
|
||||||
metrics.enabled: false
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.ports[0]
|
|
||||||
value:
|
|
||||||
name: webhook-server
|
|
||||||
port: 443
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 9443
|
|
||||||
- it: should render webhook-server service with custom webhookPort if metrics.enabled = false
|
|
||||||
set:
|
|
||||||
metrics.enabled: false
|
|
||||||
webhookPort: 9000
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.ports[0]
|
|
||||||
value:
|
|
||||||
name: webhook-server
|
|
||||||
port: 443
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 9000
|
|
||||||
- it: should render webhook-server and webhook-metrics services with default webhookPort and metrics.port, if metrics.enabled = true
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.ports[0]
|
|
||||||
value:
|
|
||||||
name: webhook-server
|
|
||||||
port: 443
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 9443
|
|
||||||
documentIndex: 0
|
|
||||||
- equal:
|
|
||||||
path: spec.ports[0]
|
|
||||||
value:
|
|
||||||
name: webhook-metrics
|
|
||||||
port: 8443
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 8443
|
|
||||||
documentIndex: 1
|
|
||||||
- it: should render webhook-server and webhook-metrics services with custom webhookPort and metrics.port, if metrics.enabled = true
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
metrics.port: 8000
|
|
||||||
webhookPort: 9000
|
|
||||||
asserts:
|
|
||||||
- equal:
|
|
||||||
path: spec.ports[0]
|
|
||||||
value:
|
|
||||||
name: webhook-server
|
|
||||||
port: 443
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 9000
|
|
||||||
documentIndex: 0
|
|
||||||
- equal:
|
|
||||||
path: spec.ports[0]
|
|
||||||
value:
|
|
||||||
name: webhook-metrics
|
|
||||||
port: 8443
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 8000
|
|
||||||
documentIndex: 1
|
|
||||||
|
|
@ -1,9 +0,0 @@
|
||||||
suite: Test Service Accounts
|
|
||||||
templates:
|
|
||||||
- serviceaccount.yaml
|
|
||||||
tests:
|
|
||||||
- it: should render Service Account
|
|
||||||
asserts:
|
|
||||||
- hasDocuments:
|
|
||||||
count: 1
|
|
||||||
template: serviceaccount.yaml
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
suite: Test Service Monitors
|
|
||||||
templates:
|
|
||||||
- servicemonitor.yaml
|
|
||||||
tests:
|
|
||||||
- it: should not render Service Monitor if metrics.enabled = false or metrics.prometheusExport = false
|
|
||||||
set:
|
|
||||||
metrics.enabled: false
|
|
||||||
metrics.prometheusExport: false
|
|
||||||
asserts:
|
|
||||||
- hasDocuments:
|
|
||||||
count: 0
|
|
||||||
template: servicemonitor.yaml
|
|
||||||
- it: should render Service Account if metrics.enabled = true and metrics.authProxy.enabled = true
|
|
||||||
set:
|
|
||||||
metrics.enabled: true
|
|
||||||
metrics.prometheusExport: true
|
|
||||||
asserts:
|
|
||||||
- hasDocuments:
|
|
||||||
count: 1
|
|
||||||
template: servicemonitor.yaml
|
|
||||||
|
|
@ -1,68 +0,0 @@
|
||||||
## Allowed external IP cidrs
|
|
||||||
allowedExternalIPCidrs: ""
|
|
||||||
## Certificates generation for webhook
|
|
||||||
certificates:
|
|
||||||
certManager:
|
|
||||||
# Enable cert manager integration. Cert manager should be already installed at the k8s cluster
|
|
||||||
enabled: true
|
|
||||||
version: ""
|
|
||||||
# If cert-manager integration is disabled, add self signed ca.crt in base64 format
|
|
||||||
caBundle: ""
|
|
||||||
# If cert-manager integration is disabled, upload certs data (ca.crt, tls.crt and tls.key) as k8s secretName in the namespace
|
|
||||||
secretName: webhook-server-cert
|
|
||||||
## Details about the image to be pulled.
|
|
||||||
image:
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
pullSecrets: []
|
|
||||||
repository: rancher/externalip-webhook
|
|
||||||
tag: v1.0.1
|
|
||||||
## Enabling metrics endpoint
|
|
||||||
# Webhook emits `webhook_failed_request_count` metrics whenever it rejects service creation or update operation
|
|
||||||
metrics:
|
|
||||||
enabled: false
|
|
||||||
port: 8443
|
|
||||||
# Enable webhook metrics export to Prometheus
|
|
||||||
prometheusExport: false
|
|
||||||
# Webhook metrics auth proxy. This option is just available for amd64 arch
|
|
||||||
authProxy:
|
|
||||||
enabled: false
|
|
||||||
port: 8080
|
|
||||||
image:
|
|
||||||
pullPolicy: IfNotPresent
|
|
||||||
pullSecrets: []
|
|
||||||
repository: rancher/mirrored-kube-rbac-proxy
|
|
||||||
tag: v0.5.0
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
memory: 30Mi
|
|
||||||
cpu: 100m
|
|
||||||
requests:
|
|
||||||
memory: 20Mi
|
|
||||||
cpu: 100m
|
|
||||||
## Node labels for pod assignment
|
|
||||||
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
|
||||||
##
|
|
||||||
nodeSelector: {}
|
|
||||||
## RBAC
|
|
||||||
rbac:
|
|
||||||
apiVersion: v1
|
|
||||||
## CPU and Memory limit and request for externalip-webhook
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
memory: 30Mi
|
|
||||||
cpu: 100m
|
|
||||||
requests:
|
|
||||||
memory: 20Mi
|
|
||||||
cpu: 100m
|
|
||||||
service:
|
|
||||||
metricsPort: 8443
|
|
||||||
webhookPort: 443
|
|
||||||
## Webhook serviceAccountName. Just used if metrics.authProxy.enabled = false
|
|
||||||
serviceAccountName: default
|
|
||||||
## List of node taints to tolerate (requires Kubernetes >= 1.6)
|
|
||||||
tolerations: []
|
|
||||||
## Webhook server pod port
|
|
||||||
webhookPort: 9443
|
|
||||||
global:
|
|
||||||
cattle:
|
|
||||||
systemDefaultRegistry: ""
|
|
||||||
33
index.yaml
33
index.yaml
|
|
@ -4147,39 +4147,6 @@ entries:
|
||||||
- assets/rancher-eks-operator-crd/rancher-eks-operator-crd-100.0.0+up1.1.1.tgz
|
- assets/rancher-eks-operator-crd/rancher-eks-operator-crd-100.0.0+up1.1.1.tgz
|
||||||
version: 100.0.0+up1.1.1
|
version: 100.0.0+up1.1.1
|
||||||
rancher-external-ip-webhook:
|
rancher-external-ip-webhook:
|
||||||
- annotations:
|
|
||||||
catalog.cattle.io/certified: rancher
|
|
||||||
catalog.cattle.io/display-name: External IP Webhook
|
|
||||||
catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.22.0-0'
|
|
||||||
catalog.cattle.io/namespace: cattle-externalip-system
|
|
||||||
catalog.cattle.io/os: linux
|
|
||||||
catalog.cattle.io/permits-os: linux,windows
|
|
||||||
catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0'
|
|
||||||
catalog.cattle.io/release-name: rancher-external-ip-webhook
|
|
||||||
catalog.cattle.io/ui-component: rancher-external-ip-webhook
|
|
||||||
catalog.cattle.io/upstream-version: 1.0.1
|
|
||||||
apiVersion: v1
|
|
||||||
appVersion: v1.0.1
|
|
||||||
created: "2022-09-22T08:28:58.214603-04:00"
|
|
||||||
description: |
|
|
||||||
Deploy the external-ip-webhook to mitigate k8s CVE-2020-8554
|
|
||||||
digest: 3c239ed2e9eb65c9e65fd4c4e915669469b1fdd08265e3ff7a4f92a22efab718
|
|
||||||
home: https://github.com/rancher/externalip-webhook
|
|
||||||
keywords:
|
|
||||||
- cve
|
|
||||||
- externalip
|
|
||||||
- webhook
|
|
||||||
- security
|
|
||||||
kubeVersion: < 1.22.0
|
|
||||||
maintainers:
|
|
||||||
- email: raul@rancher.com
|
|
||||||
name: rawmind0
|
|
||||||
name: rancher-external-ip-webhook
|
|
||||||
sources:
|
|
||||||
- https://github.com/rancher/externalip-webhook
|
|
||||||
urls:
|
|
||||||
- assets/rancher-external-ip-webhook/rancher-external-ip-webhook-101.0.0+up1.0.1.tgz
|
|
||||||
version: 101.0.0+up1.0.1
|
|
||||||
- annotations:
|
- annotations:
|
||||||
catalog.cattle.io/certified: rancher
|
catalog.cattle.io/certified: rancher
|
||||||
catalog.cattle.io/display-name: External IP Webhook
|
catalog.cattle.io/display-name: External IP Webhook
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue