Merge pull request #778 from nflondo/bugfix/remove-gitlab-chart
Removing gitlab helm chart as part of fix for issuepull/779/head
alex-isv
GitHub
commit
2dfc9a62d1
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
File diff suppressed because it is too large
Load Diff
|
|
@ -1,178 +0,0 @@
|
|||
## Contributing
|
||||
|
||||
Thank you for your interest in contributing to this GitLab project! We welcome
|
||||
all contributions. By participating in this project, you agree to abide by the
|
||||
[code of conduct](#code-of-conduct).
|
||||
|
||||
## Developer Certificate of Origin + License
|
||||
|
||||
By contributing to GitLab B.V., You accept and agree to the following terms and
|
||||
conditions for Your present and future Contributions submitted to GitLab B.V.
|
||||
Except for the license granted herein to GitLab B.V. and recipients of software
|
||||
distributed by GitLab B.V., You reserve all right, title, and interest in and to
|
||||
Your Contributions. All Contributions are subject to the following DCO + License
|
||||
terms.
|
||||
|
||||
[DCO + License](https://gitlab.com/gitlab-org/dco/blob/master/README.md)
|
||||
|
||||
_This notice should stay as the first item in the CONTRIBUTING.md file._
|
||||
|
||||
## Merge requests
|
||||
|
||||
We welcome merge requests with fixes and improvements to GitLab code, tests,
|
||||
and/or documentation. The issues that are specifically suitable for
|
||||
community contributions are listed with the label
|
||||
[`Accepting Merge Requests` on our issue tracker][accepting-mrs], but you are
|
||||
free to contribute to any other issue you want.
|
||||
|
||||
Please note that if an issue is marked for the current milestone either before
|
||||
or while you are working on it, a team member may take over the merge request
|
||||
in order to ensure the work is finished before the release date.
|
||||
|
||||
If you want to add a new feature that is not labeled it is best to first create
|
||||
a feedback issue (if there isn't one already) and leave a comment asking for it
|
||||
to be marked as `Accepting Merge Requests`.
|
||||
|
||||
Merge requests should be opened at [GitLab.com][gitlab-mr-tracker].
|
||||
|
||||
### Merge request guidelines
|
||||
|
||||
If you can, please submit a merge request with the fix or improvements
|
||||
including tests. If you don't know how to fix the issue but can write a test
|
||||
that exposes the issue we will accept that as well. In general bug fixes that
|
||||
include a regression test are merged quickly while new features without proper
|
||||
tests are least likely to receive timely feedback. The workflow to make a merge
|
||||
request is as follows:
|
||||
|
||||
1. Fork the project into your personal space on GitLab.com
|
||||
1. Create a feature branch, branch away from `master`
|
||||
1. Write code and charts changes.
|
||||
1. If deemed necessary, provide MR to the [Cloud Native GitLab containers][CNG].
|
||||
- Provide the related Issue and MR link from that repository.
|
||||
1. [Generate a changelog entry with `bin/changelog`][changelog]
|
||||
1. If you have multiple commits please combine them into a few logically
|
||||
organized commits by [squashing them][git-squash]
|
||||
1. Push the commit(s) to your fork
|
||||
1. Submit a merge request (MR) to the `master` branch
|
||||
1. Ensure the MR description uses the `General Change` template, and the appropriate
|
||||
items are checked off.
|
||||
1. Your merge request needs at least 1 approval but feel free to require more.
|
||||
For instance if you're touching multiple charts, replacing a provider, or
|
||||
altering an behavior on a global level.
|
||||
1. You don't have to select any approvers, but you can if you really want
|
||||
specific people to approve your merge request.
|
||||
1. The MR title should describe the change you want to make
|
||||
1. The MR description should give a motive for your change and the method you
|
||||
used to achieve it.
|
||||
1. If you are contributing code, fill in the template already provided in the
|
||||
"Description" field.
|
||||
1. If you are contributing documentation
|
||||
1. Choose `Documentation` from the "Choose a template" menu and fill in the template.
|
||||
1. Ensure the branch name starts with `docs-` or ends with `-docs`
|
||||
1. Mention the issue(s) your merge request solves, using the `Solves #XXX` or
|
||||
`Closes #XXX` syntax to auto-close the issue(s) once the merge request will
|
||||
be merged.
|
||||
1. If you're allowed to, set a relevant milestone and labels
|
||||
1. Be prepared to answer questions and incorporate feedback even if requests
|
||||
for this arrive weeks or months after your MR submission
|
||||
1. If a discussion has been addressed, select the "Resolve discussion" button
|
||||
beneath it to mark it resolved.
|
||||
1. When writing commit messages please follow
|
||||
[these](http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html)
|
||||
[guidelines](http://chris.beams.io/posts/git-commit/).
|
||||
|
||||
Please keep the change in a single MR **as small as possible**. If you want to
|
||||
contribute a large feature think very hard what the minimum viable change is.
|
||||
Can you split the functionality? Can you do part of the refactor? The increased
|
||||
reviewability of small MRs that leads to higher code quality is more important
|
||||
to us than having a minimal commit log. The smaller an MR is the more likely it
|
||||
is it will be merged (quickly). After that you can send more MRs to enhance it.
|
||||
The ['How to get faster PR reviews' document of Kubernetes](https://github.com/kubernetes/community/blob/master/contributors/devel/faster_reviews.md) also has some great points regarding this.
|
||||
|
||||
For examples of feedback on merge requests please look at already
|
||||
[closed merge requests][closed-merge-requests].
|
||||
Please ensure that your merge request meets the contribution acceptance criteria.
|
||||
|
||||
### Contribution acceptance criteria
|
||||
|
||||
1. The change is as small as possible
|
||||
1. If you suspect a failing CI build is unrelated to your contribution, you may
|
||||
try and restart the failing CI job or ask a developer to fix the
|
||||
aforementioned failing test
|
||||
1. Your MR initially contains a single commit (please use `git rebase -i` to
|
||||
squash commits)
|
||||
1. Your changes can merge without problems (if not please rebase if you're the
|
||||
only one working on your feature branch, otherwise, merge `master`)
|
||||
1. Does not break any existing functionality
|
||||
1. Fixes one specific issue or implements one specific feature (do not combine
|
||||
things, send separate merge requests if needed)
|
||||
1. Keeps the GitLab chart clean and well structured
|
||||
1. Contains functionality we think other users will benefit from too
|
||||
1. Changes do not adversely degrade configuration experience.
|
||||
- If a change would affect the experience of a user of this chart by increased
|
||||
complexity, at install or re-configuration, a strong case must be presented.
|
||||
1. Changes do not adversely degrade performance.
|
||||
- Performance within the chart refers to several factors, the most
|
||||
significant being installation and restart times.
|
||||
1. Changes after submitting the merge request should be in separate commits
|
||||
(no squashing).
|
||||
1. It conforms to the [developer documentation](doc/development/README.md).
|
||||
1. The merge request meets the [definition of done](#definition-of-done).
|
||||
|
||||
## Definition of done
|
||||
|
||||
If you contribute to GitLab please know that changes involve more than just
|
||||
code. We have the following [definition of done][definition-of-done]. Please ensure you support
|
||||
the feature you contribute through all of these steps.
|
||||
|
||||
1. Description explaining the relevancy (see following item)
|
||||
1. Working and clean code that is commented where needed
|
||||
1. Deployment and QA pass on the CI cluster
|
||||
1. Performance/scalability implications have been considered, addressed, and tested
|
||||
1. Documented in the `/doc` directory
|
||||
1. [Changelog entry added][changelog], if necessary
|
||||
1. Reviewed and any concerns are addressed
|
||||
1. Merged by a project maintainer
|
||||
1. Added to the release blog article, if relevant
|
||||
1. Added to [the website](https://gitlab.com/gitlab-com/www-gitlab-com/), if relevant
|
||||
1. Community questions answered
|
||||
1. Answers to questions radiated (in docs/wiki/support etc.)
|
||||
|
||||
## Code of conduct
|
||||
|
||||
As contributors and maintainers of this project, we pledge to respect all people
|
||||
who contribute through reporting issues, posting feature requests, updating
|
||||
documentation, submitting pull requests or patches, and other activities.
|
||||
|
||||
We are committed to making participation in this project a harassment-free
|
||||
experience for everyone, regardless of level of experience, gender, gender
|
||||
identity and expression, sexual orientation, disability, personal appearance,
|
||||
body size, race, ethnicity, age, or religion.
|
||||
|
||||
Examples of unacceptable behavior by participants include the use of sexual
|
||||
language or imagery, derogatory comments or personal attacks, trolling, public
|
||||
or private harassment, insults, or other unprofessional conduct.
|
||||
|
||||
Project maintainers have the right and responsibility to remove, edit, or reject
|
||||
comments, commits, code, wiki edits, issues, and other contributions that are
|
||||
not aligned to this Code of Conduct. Project maintainers who do not follow the
|
||||
Code of Conduct may be removed from the project team.
|
||||
|
||||
This code of conduct applies both within project spaces and in public spaces
|
||||
when an individual is representing the project or its community.
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior can be
|
||||
reported by emailing contact@gitlab.com.
|
||||
|
||||
This Code of Conduct is adapted from the [Contributor Covenant][contributor-covenant], version 1.1.0,
|
||||
available at [http://contributor-covenant.org/version/1/1/0/](http://contributor-covenant.org/version/1/1/0/).
|
||||
|
||||
[accepting-mrs]: https://gitlab.com/gitlab-org/charts/gitlab/-/issues?label_name=Accepting+Merge+Requests
|
||||
[gitlab-mr-tracker]: https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests
|
||||
[closed-merge-requests]: https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests?assignee_id=&label_name=&milestone_id=&scope=&sort=&state=closed
|
||||
[contributor-covenant]: http://contributor-covenant.org
|
||||
[changelog]: doc/development/changelog.md "Generate a changelog entry"
|
||||
[git-squash]: https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits
|
||||
[definition-of-done]: http://guide.agilealliance.org/guide/definition-of-done.html
|
||||
[contributor-covenant]: http://contributor-covenant.org
|
||||
[CNG]: https://gitlab.com/gitlab-org/build/CNG/
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
annotations:
|
||||
catalog.cattle.io/certified: partner
|
||||
catalog.cattle.io/display-name: GitLab
|
||||
catalog.cattle.io/release-name: gitlab
|
||||
apiVersion: v1
|
||||
appVersion: v16.0.1
|
||||
description: The One DevOps Platform
|
||||
home: https://about.gitlab.com/
|
||||
icon: https://gitlab.com/gitlab-com/gitlab-artwork/raw/master/logo/logo-square.png
|
||||
keywords:
|
||||
- gitlab
|
||||
maintainers:
|
||||
- email: support@gitlab.com
|
||||
name: GitLab Inc.
|
||||
name: gitlab
|
||||
sources:
|
||||
- https://gitlab.com/gitlab-org/charts/gitlab
|
||||
version: 7.0.1
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
Copyright (c) 2011-2017 GitLab B.V.
|
||||
|
||||
With regard to the GitLab Software:
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in
|
||||
all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
THE SOFTWARE.
|
||||
|
||||
For all third party components incorporated into the GitLab Software, those
|
||||
components are licensed under the original license provided by the owner of the
|
||||
applicable component.
|
||||
|
|
@ -1,49 +0,0 @@
|
|||
[](https://gitlab.com/gitlab-org/charts/gitlab/pipelines)
|
||||
|
||||
# Cloud Native GitLab Helm Chart
|
||||
|
||||
The `gitlab` chart is the best way to operate GitLab on Kubernetes. It contains
|
||||
all the required components to get started, and can scale to large deployments.
|
||||
|
||||
Some of the key benefits of this chart and [corresponding containers](https://gitlab.com/gitlab-org/build/CNG) are:
|
||||
|
||||
- Improved scalability and reliability.
|
||||
- No requirement for root privileges.
|
||||
- Utilization of object storage instead of NFS for storage.
|
||||
|
||||
## Detailed documentation
|
||||
|
||||
See the [repository documentation](doc/index.md) for how to install GitLab and
|
||||
other information on charts, tools, and advanced configuration.
|
||||
|
||||
For easy of reading, you can find this documentation rendered on
|
||||
[docs.gitlab.com/charts](https://docs.gitlab.com/charts).
|
||||
|
||||
### Configuration Properties
|
||||
|
||||
We're often asked to put a table of all possible properties directly into this README.
|
||||
These charts are _massive_ in scale, and as such the number of properties exceeds
|
||||
the amount of context we're comfortable placing here. Please see our (nearly)
|
||||
[comprehensive list of properties and defaults](doc/installation/command-line-options.md).
|
||||
|
||||
**Note:** We _strongly recommend_ following our complete documentation, as opposed to
|
||||
jumping directly into the settings list.
|
||||
|
||||
## Architecture and goals
|
||||
|
||||
See [architecture documentation](doc/architecture/index.md) for an overview
|
||||
of this project goals and architecture.
|
||||
|
||||
## Known issues and limitations
|
||||
|
||||
See [limitations](doc/index.md#limitations).
|
||||
|
||||
## Release Notes
|
||||
|
||||
Check the [releases documentation](doc/releases/index.md) for information on important releases,
|
||||
and see the [changelog](CHANGELOG.md) for the full details on any release.
|
||||
|
||||
## Contributing
|
||||
|
||||
See the [contribution guidelines](CONTRIBUTING.md) and then check out the
|
||||
[development styleguide](doc/development/index.md).
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
annotations:
|
||||
artifacthub.io/prerelease: "false"
|
||||
artifacthub.io/signKey: |
|
||||
fingerprint: 1020CF3C033D4F35BAE1C19E1226061C665DF13E
|
||||
url: https://cert-manager.io/public-keys/cert-manager-keyring-2021-09-20-1020CF3C033D4F35BAE1C19E1226061C665DF13E.gpg
|
||||
apiVersion: v1
|
||||
appVersion: v1.11.1
|
||||
description: A Helm chart for cert-manager
|
||||
home: https://github.com/cert-manager/cert-manager
|
||||
icon: https://raw.githubusercontent.com/cert-manager/cert-manager/d53c0b9270f8cd90d908460d69502694e1838f5f/logo/logo-small.png
|
||||
keywords:
|
||||
- cert-manager
|
||||
- kube-lego
|
||||
- letsencrypt
|
||||
- tls
|
||||
kubeVersion: '>= 1.21.0-0'
|
||||
maintainers:
|
||||
- email: cert-manager-maintainers@googlegroups.com
|
||||
name: cert-manager-maintainers
|
||||
url: https://cert-manager.io
|
||||
name: cert-manager
|
||||
sources:
|
||||
- https://github.com/cert-manager/cert-manager
|
||||
version: v1.11.1
|
||||
|
|
@ -1,252 +0,0 @@
|
|||
# cert-manager
|
||||
|
||||
cert-manager is a Kubernetes addon to automate the management and issuance of
|
||||
TLS certificates from various issuing sources.
|
||||
|
||||
It will ensure certificates are valid and up to date periodically, and attempt
|
||||
to renew certificates at an appropriate time before expiry.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.20+
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
Full installation instructions, including details on how to configure extra
|
||||
functionality in cert-manager can be found in the [installation docs](https://cert-manager.io/docs/installation/kubernetes/).
|
||||
|
||||
Before installing the chart, you must first install the cert-manager CustomResourceDefinition resources.
|
||||
This is performed in a separate step to allow you to easily uninstall and reinstall cert-manager without deleting your installed custom resources.
|
||||
|
||||
```bash
|
||||
$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.1/cert-manager.crds.yaml
|
||||
```
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```console
|
||||
## Add the Jetstack Helm repository
|
||||
$ helm repo add jetstack https://charts.jetstack.io
|
||||
|
||||
## Install the cert-manager helm chart
|
||||
$ helm install my-release --namespace cert-manager --version v1.11.1 jetstack/cert-manager
|
||||
```
|
||||
|
||||
In order to begin issuing certificates, you will need to set up a ClusterIssuer
|
||||
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
|
||||
|
||||
More information on the different types of issuers and how to configure them
|
||||
can be found in [our documentation](https://cert-manager.io/docs/configuration/).
|
||||
|
||||
For information on how to configure cert-manager to automatically provision
|
||||
Certificates for Ingress resources, take a look at the
|
||||
[Securing Ingresses documentation](https://cert-manager.io/docs/usage/ingress/).
|
||||
|
||||
> **Tip**: List all releases using `helm list`
|
||||
|
||||
## Upgrading the Chart
|
||||
|
||||
Special considerations may be required when upgrading the Helm chart, and these
|
||||
are documented in our full [upgrading guide](https://cert-manager.io/docs/installation/upgrading/).
|
||||
|
||||
**Please check here before performing upgrades!**
|
||||
|
||||
## Uninstalling the Chart
|
||||
|
||||
To uninstall/delete the `my-release` deployment:
|
||||
|
||||
```console
|
||||
$ helm delete my-release
|
||||
```
|
||||
|
||||
The command removes all the Kubernetes components associated with the chart and deletes the release.
|
||||
|
||||
If you want to completely uninstall cert-manager from your cluster, you will also need to
|
||||
delete the previously installed CustomResourceDefinition resources:
|
||||
|
||||
```console
|
||||
$ kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.1/cert-manager.crds.yaml
|
||||
```
|
||||
|
||||
## Configuration
|
||||
|
||||
The following table lists the configurable parameters of the cert-manager chart and their default values.
|
||||
|
||||
| Parameter | Description | Default |
|
||||
| --------- | ----------- | ------- |
|
||||
| `global.imagePullSecrets` | Reference to one or more secrets to be used when pulling images | `[]` |
|
||||
| `global.commonLabels` | Labels to apply to all resources | `{}` |
|
||||
| `global.rbac.create` | If `true`, create and use RBAC resources (includes sub-charts) | `true` |
|
||||
| `global.priorityClassName`| Priority class name for cert-manager and webhook pods | `""` |
|
||||
| `global.podSecurityPolicy.enabled` | If `true`, create and use PodSecurityPolicy (includes sub-charts) | `false` |
|
||||
| `global.podSecurityPolicy.useAppArmor` | If `true`, use Apparmor seccomp profile in PSP | `true` |
|
||||
| `global.leaderElection.namespace` | Override the namespace used to store the ConfigMap for leader election | `kube-system` |
|
||||
| `global.leaderElection.leaseDuration` | The duration that non-leader candidates will wait after observing a leadership renewal until attempting to acquire leadership of a led but unrenewed leader slot. This is effectively the maximum duration that a leader can be stopped before it is replaced by another candidate | |
|
||||
| `global.leaderElection.renewDeadline` | The interval between attempts by the acting master to renew a leadership slot before it stops leading. This must be less than or equal to the lease duration | |
|
||||
| `global.leaderElection.retryPeriod` | The duration the clients should wait between attempting acquisition and renewal of a leadership | |
|
||||
| `installCRDs` | If true, CRD resources will be installed as part of the Helm chart. If enabled, when uninstalling CRD resources will be deleted causing all installed custom resources to be DELETED | `false` |
|
||||
| `image.repository` | Image repository | `quay.io/jetstack/cert-manager-controller` |
|
||||
| `image.tag` | Image tag | `v1.11.1` |
|
||||
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
|
||||
| `replicaCount` | Number of cert-manager replicas | `1` |
|
||||
| `clusterResourceNamespace` | Override the namespace used to store DNS provider credentials etc. for ClusterIssuer resources | Same namespace as cert-manager pod |
|
||||
| `featureGates` | Set of comma-separated key=value pairs that describe feature gates on the controller. Some feature gates may also have to be enabled on other components, and can be set supplying the `feature-gate` flag to `<component>.extraArgs` | `` |
|
||||
| `extraArgs` | Optional flags for cert-manager | `[]` |
|
||||
| `extraEnv` | Optional environment variables for cert-manager | `[]` |
|
||||
| `serviceAccount.create` | If `true`, create a new service account | `true` |
|
||||
| `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template | |
|
||||
| `serviceAccount.annotations` | Annotations to add to the service account | |
|
||||
| `serviceAccount.automountServiceAccountToken` | Automount API credentials for the Service Account | `true` |
|
||||
| `volumes` | Optional volumes for cert-manager | `[]` |
|
||||
| `volumeMounts` | Optional volume mounts for cert-manager | `[]` |
|
||||
| `resources` | CPU/memory resource requests/limits | `{}` |
|
||||
| `securityContext` | Security context for the controller pod assignment | refer to [Default Security Contexts](#default-security-contexts) |
|
||||
| `containerSecurityContext` | Security context to be set on the controller component container | refer to [Default Security Contexts](#default-security-contexts) |
|
||||
| `nodeSelector` | Node labels for pod assignment | `{}` |
|
||||
| `affinity` | Node affinity for pod assignment | `{}` |
|
||||
| `tolerations` | Node tolerations for pod assignment | `[]` |
|
||||
| `topologySpreadConstraints` | Topology spread constraints for pod assignment | `[]` |
|
||||
| `ingressShim.defaultIssuerName` | Optional default issuer to use for ingress resources | |
|
||||
| `ingressShim.defaultIssuerKind` | Optional default issuer kind to use for ingress resources | |
|
||||
| `ingressShim.defaultIssuerGroup` | Optional default issuer group to use for ingress resources | |
|
||||
| `prometheus.enabled` | Enable Prometheus monitoring | `true` |
|
||||
| `prometheus.servicemonitor.enabled` | Enable Prometheus Operator ServiceMonitor monitoring | `false` |
|
||||
| `prometheus.servicemonitor.namespace` | Define namespace where to deploy the ServiceMonitor resource | (namespace where you are deploying) |
|
||||
| `prometheus.servicemonitor.prometheusInstance` | Prometheus Instance definition | `default` |
|
||||
| `prometheus.servicemonitor.targetPort` | Prometheus scrape port | `9402` |
|
||||
| `prometheus.servicemonitor.path` | Prometheus scrape path | `/metrics` |
|
||||
| `prometheus.servicemonitor.interval` | Prometheus scrape interval | `60s` |
|
||||
| `prometheus.servicemonitor.labels` | Add custom labels to ServiceMonitor | |
|
||||
| `prometheus.servicemonitor.scrapeTimeout` | Prometheus scrape timeout | `30s` |
|
||||
| `prometheus.servicemonitor.honorLabels` | Enable label honoring for metrics scraped by Prometheus (see [Prometheus scrape config docs](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config) for details). By setting `honorLabels` to `true`, Prometheus will prefer label contents given by cert-manager on conflicts. Can be used to remove the "exported_namespace" label for example. | `false` |
|
||||
| `podAnnotations` | Annotations to add to the cert-manager pod | `{}` |
|
||||
| `deploymentAnnotations` | Annotations to add to the cert-manager deployment | `{}` |
|
||||
| `podDnsPolicy` | Optional cert-manager pod [DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods-dns-policy) | |
|
||||
| `podDnsConfig` | Optional cert-manager pod [DNS configurations](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods-dns-config) | |
|
||||
| `podLabels` | Labels to add to the cert-manager pod | `{}` |
|
||||
| `serviceLabels` | Labels to add to the cert-manager controller service | `{}` |
|
||||
| `serviceAnnotations` | Annotations to add to the cert-manager service | `{}` |
|
||||
| `http_proxy` | Value of the `HTTP_PROXY` environment variable in the cert-manager pod | |
|
||||
| `https_proxy` | Value of the `HTTPS_PROXY` environment variable in the cert-manager pod | |
|
||||
| `no_proxy` | Value of the `NO_PROXY` environment variable in the cert-manager pod | |
|
||||
| `webhook.replicaCount` | Number of cert-manager webhook replicas | `1` |
|
||||
| `webhook.timeoutSeconds` | Seconds the API server should wait the webhook to respond before treating the call as a failure. | `10` |
|
||||
| `webhook.podAnnotations` | Annotations to add to the webhook pods | `{}` |
|
||||
| `webhook.podLabels` | Labels to add to the cert-manager webhook pod | `{}` |
|
||||
| `webhook.serviceLabels` | Labels to add to the cert-manager webhook service | `{}` |
|
||||
| `webhook.deploymentAnnotations` | Annotations to add to the webhook deployment | `{}` |
|
||||
| `webhook.mutatingWebhookConfigurationAnnotations` | Annotations to add to the mutating webhook configuration | `{}` |
|
||||
| `webhook.validatingWebhookConfigurationAnnotations` | Annotations to add to the validating webhook configuration | `{}` |
|
||||
| `webhook.serviceAnnotations` | Annotations to add to the webhook service | `{}` |
|
||||
| `webhook.config` | WebhookConfiguration YAML used to configure flags for the webhook. Generates a ConfigMap containing contents of the field. See `values.yaml` for example. | `{}` |
|
||||
| `webhook.extraArgs` | Optional flags for cert-manager webhook component | `[]` |
|
||||
| `webhook.serviceAccount.create` | If `true`, create a new service account for the webhook component | `true` |
|
||||
| `webhook.serviceAccount.name` | Service account for the webhook component to be used. If not set and `webhook.serviceAccount.create` is `true`, a name is generated using the fullname template | |
|
||||
| `webhook.serviceAccount.annotations` | Annotations to add to the service account for the webhook component | |
|
||||
| `webhook.serviceAccount.automountServiceAccountToken` | Automount API credentials for the webhook Service Account | |
|
||||
| `webhook.resources` | CPU/memory resource requests/limits for the webhook pods | `{}` |
|
||||
| `webhook.nodeSelector` | Node labels for webhook pod assignment | `{}` |
|
||||
| `webhook.networkPolicy.enabled` | Enable default network policies for webhooks egress and ingress traffic | `false` |
|
||||
| `webhook.networkPolicy.ingress` | Sets ingress policy block. See NetworkPolicy documentation. See `values.yaml` for example. | `{}` |
|
||||
| `webhook.networkPolicy.egress` | Sets ingress policy block. See NetworkPolicy documentation. See `values.yaml` for example. | `{}` |
|
||||
| `webhook.affinity` | Node affinity for webhook pod assignment | `{}` |
|
||||
| `webhook.tolerations` | Node tolerations for webhook pod assignment | `[]` |
|
||||
| `webhook.topologySpreadConstraints` | Topology spread constraints for webhook pod assignment | `[]` |
|
||||
| `webhook.image.repository` | Webhook image repository | `quay.io/jetstack/cert-manager-webhook` |
|
||||
| `webhook.image.tag` | Webhook image tag | `v1.11.1` |
|
||||
| `webhook.image.pullPolicy` | Webhook image pull policy | `IfNotPresent` |
|
||||
| `webhook.securePort` | The port that the webhook should listen on for requests. | `10250` |
|
||||
| `webhook.securityContext` | Security context for webhook pod assignment | refer to [Default Security Contexts](#default-security-contexts) |
|
||||
| `webhook.containerSecurityContext` | Security context to be set on the webhook component container | refer to [Default Security Contexts](#default-security-contexts) |
|
||||
| `webhook.hostNetwork` | If `true`, run the Webhook on the host network. | `false` |
|
||||
| `webhook.serviceType` | The type of the `Service`. | `ClusterIP` |
|
||||
| `webhook.loadBalancerIP` | The specific load balancer IP to use (when `serviceType` is `LoadBalancer`). | |
|
||||
| `webhook.url.host` | The host to use to reach the webhook, instead of using internal cluster DNS for the service. | |
|
||||
| `webhook.livenessProbe.failureThreshold` | The liveness probe failure threshold | `3` |
|
||||
| `webhook.livenessProbe.initialDelaySeconds` | The liveness probe initial delay (in seconds) | `60` |
|
||||
| `webhook.livenessProbe.periodSeconds` | The liveness probe period (in seconds) | `10` |
|
||||
| `webhook.livenessProbe.successThreshold` | The liveness probe success threshold | `1` |
|
||||
| `webhook.livenessProbe.timeoutSeconds` | The liveness probe timeout (in seconds) | `1` |
|
||||
| `webhook.readinessProbe.failureThreshold` | The readiness probe failure threshold | `3` |
|
||||
| `webhook.readinessProbe.initialDelaySeconds` | The readiness probe initial delay (in seconds) | `5` |
|
||||
| `webhook.readinessProbe.periodSeconds` | The readiness probe period (in seconds) | `5` |
|
||||
| `webhook.readinessProbe.successThreshold` | The readiness probe success threshold | `1` |
|
||||
| `webhook.readinessProbe.timeoutSeconds` | The readiness probe timeout (in seconds) | `1` |
|
||||
| `cainjector.enabled` | Toggles whether the cainjector component should be installed (required for the webhook component to work) | `true` |
|
||||
| `cainjector.replicaCount` | Number of cert-manager cainjector replicas | `1` |
|
||||
| `cainjector.podAnnotations` | Annotations to add to the cainjector pods | `{}` |
|
||||
| `cainjector.podLabels` | Labels to add to the cert-manager cainjector pod | `{}` |
|
||||
| `cainjector.deploymentAnnotations` | Annotations to add to the cainjector deployment | `{}` |
|
||||
| `cainjector.extraArgs` | Optional flags for cert-manager cainjector component | `[]` |
|
||||
| `cainjector.serviceAccount.create` | If `true`, create a new service account for the cainjector component | `true` |
|
||||
| `cainjector.serviceAccount.name` | Service account for the cainjector component to be used. If not set and `cainjector.serviceAccount.create` is `true`, a name is generated using the fullname template | |
|
||||
| `cainjector.serviceAccount.annotations` | Annotations to add to the service account for the cainjector component | |
|
||||
| `cainjector.serviceAccount.automountServiceAccountToken` | Automount API credentials for the cainjector Service Account | `true` |
|
||||
| `cainjector.resources` | CPU/memory resource requests/limits for the cainjector pods | `{}` |
|
||||
| `cainjector.nodeSelector` | Node labels for cainjector pod assignment | `{}` |
|
||||
| `cainjector.affinity` | Node affinity for cainjector pod assignment | `{}` |
|
||||
| `cainjector.tolerations` | Node tolerations for cainjector pod assignment | `[]` |
|
||||
| `cainjector.topologySpreadConstraints` | Topology spread constraints for cainjector pod assignment | `[]` |
|
||||
| `cainjector.image.repository` | cainjector image repository | `quay.io/jetstack/cert-manager-cainjector` |
|
||||
| `cainjector.image.tag` | cainjector image tag | `v1.11.1` |
|
||||
| `cainjector.image.pullPolicy` | cainjector image pull policy | `IfNotPresent` |
|
||||
| `cainjector.securityContext` | Security context for cainjector pod assignment | refer to [Default Security Contexts](#default-security-contexts) |
|
||||
| `cainjector.containerSecurityContext` | Security context to be set on cainjector component container | refer to [Default Security Contexts](#default-security-contexts) |
|
||||
| `acmesolver.image.repository` | acmesolver image repository | `quay.io/jetstack/cert-manager-acmesolver` |
|
||||
| `acmesolver.image.tag` | acmesolver image tag | `v1.11.1` |
|
||||
| `acmesolver.image.pullPolicy` | acmesolver image pull policy | `IfNotPresent` |
|
||||
| `startupapicheck.enabled` | Toggles whether the startupapicheck Job should be installed | `true` |
|
||||
| `startupapicheck.securityContext` | Security context for startupapicheck pod assignment | refer to [Default Security Contexts](#default-security-contexts) |
|
||||
| `startupapicheck.containerSecurityContext` | Security context to be set on startupapicheck component container | refer to [Default Security Contexts](#default-security-contexts) |
|
||||
| `startupapicheck.timeout` | Timeout for 'kubectl check api' command | `1m` |
|
||||
| `startupapicheck.backoffLimit` | Job backoffLimit | `4` |
|
||||
| `startupapicheck.jobAnnotations` | Optional additional annotations to add to the startupapicheck Job | `{}` |
|
||||
| `startupapicheck.podAnnotations` | Optional additional annotations to add to the startupapicheck Pods | `{}` |
|
||||
| `startupapicheck.extraArgs` | Optional additional arguments for startupapicheck | `[]` |
|
||||
| `startupapicheck.resources` | CPU/memory resource requests/limits for the startupapicheck pod | `{}` |
|
||||
| `startupapicheck.nodeSelector` | Node labels for startupapicheck pod assignment | `{}` |
|
||||
| `startupapicheck.affinity` | Node affinity for startupapicheck pod assignment | `{}` |
|
||||
| `startupapicheck.tolerations` | Node tolerations for startupapicheck pod assignment | `[]` |
|
||||
| `startupapicheck.podLabels` | Optional additional labels to add to the startupapicheck Pods | `{}` |
|
||||
| `startupapicheck.image.repository` | startupapicheck image repository | `quay.io/jetstack/cert-manager-ctl` |
|
||||
| `startupapicheck.image.tag` | startupapicheck image tag | `v1.11.1` |
|
||||
| `startupapicheck.image.pullPolicy` | startupapicheck image pull policy | `IfNotPresent` |
|
||||
| `startupapicheck.serviceAccount.create` | If `true`, create a new service account for the startupapicheck component | `true` |
|
||||
| `startupapicheck.serviceAccount.name` | Service account for the startupapicheck component to be used. If not set and `startupapicheck.serviceAccount.create` is `true`, a name is generated using the fullname template | |
|
||||
| `startupapicheck.serviceAccount.annotations` | Annotations to add to the service account for the startupapicheck component | |
|
||||
| `startupapicheck.serviceAccount.automountServiceAccountToken` | Automount API credentials for the startupapicheck Service Account | `true` |
|
||||
| `maxConcurrentChallenges` | The maximum number of challenges that can be scheduled as 'processing' at once | `60` |
|
||||
|
||||
### Default Security Contexts
|
||||
|
||||
The default pod-level and container-level security contexts, below, adhere to the [restricted](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) Pod Security Standards policies.
|
||||
|
||||
Default pod-level securityContext:
|
||||
```yaml
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
```
|
||||
|
||||
Default containerSecurityContext:
|
||||
```yaml
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
```
|
||||
|
||||
### Assigning Values
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
|
||||
|
||||
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
|
||||
|
||||
```console
|
||||
$ helm install my-release -f values.yaml .
|
||||
```
|
||||
> **Tip**: You can use the default [values.yaml](https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml)
|
||||
|
||||
## Contributing
|
||||
|
||||
This chart is maintained at [github.com/cert-manager/cert-manager](https://github.com/cert-manager/cert-manager/tree/master/deploy/charts/cert-manager).
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
cert-manager {{ .Chart.AppVersion }} has been deployed successfully!
|
||||
|
||||
In order to begin issuing certificates, you will need to set up a ClusterIssuer
|
||||
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
|
||||
|
||||
More information on the different types of issuers and how to configure them
|
||||
can be found in our documentation:
|
||||
|
||||
https://cert-manager.io/docs/configuration/
|
||||
|
||||
For information on how to configure cert-manager to automatically provision
|
||||
Certificates for Ingress resources, take a look at the `ingress-shim`
|
||||
documentation:
|
||||
|
||||
https://cert-manager.io/docs/usage/ingress/
|
||||
|
|
@ -1,174 +0,0 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "cert-manager.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "cert-manager.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if contains $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "cert-manager.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create -}}
|
||||
{{ default (include "cert-manager.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Webhook templates
|
||||
*/}}
|
||||
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
Manually fix the 'app' and 'name' labels to 'webhook' to maintain
|
||||
compatibility with the v0.9 deployment selector.
|
||||
*/}}
|
||||
{{- define "webhook.name" -}}
|
||||
{{- printf "webhook" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "webhook.fullname" -}}
|
||||
{{- $trimmedName := printf "%s" (include "cert-manager.fullname" .) | trunc 55 | trimSuffix "-" -}}
|
||||
{{- printf "%s-webhook" $trimmedName | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "webhook.caRef" -}}
|
||||
{{- template "cert-manager.namespace" }}/{{ template "webhook.fullname" . }}-ca
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "webhook.serviceAccountName" -}}
|
||||
{{- if .Values.webhook.serviceAccount.create -}}
|
||||
{{ default (include "webhook.fullname" .) .Values.webhook.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.webhook.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
cainjector templates
|
||||
*/}}
|
||||
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
Manually fix the 'app' and 'name' labels to 'cainjector' to maintain
|
||||
compatibility with the v0.9 deployment selector.
|
||||
*/}}
|
||||
{{- define "cainjector.name" -}}
|
||||
{{- printf "cainjector" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "cainjector.fullname" -}}
|
||||
{{- $trimmedName := printf "%s" (include "cert-manager.fullname" .) | trunc 52 | trimSuffix "-" -}}
|
||||
{{- printf "%s-cainjector" $trimmedName | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "cainjector.serviceAccountName" -}}
|
||||
{{- if .Values.cainjector.serviceAccount.create -}}
|
||||
{{ default (include "cainjector.fullname" .) .Values.cainjector.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.cainjector.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
startupapicheck templates
|
||||
*/}}
|
||||
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
Manually fix the 'app' and 'name' labels to 'startupapicheck' to maintain
|
||||
compatibility with the v0.9 deployment selector.
|
||||
*/}}
|
||||
{{- define "startupapicheck.name" -}}
|
||||
{{- printf "startupapicheck" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "startupapicheck.fullname" -}}
|
||||
{{- $trimmedName := printf "%s" (include "cert-manager.fullname" .) | trunc 52 | trimSuffix "-" -}}
|
||||
{{- printf "%s-startupapicheck" $trimmedName | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "startupapicheck.serviceAccountName" -}}
|
||||
{{- if .Values.startupapicheck.serviceAccount.create -}}
|
||||
{{ default (include "startupapicheck.fullname" .) .Values.startupapicheck.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.startupapicheck.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "chartName" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Labels that should be added on each resource
|
||||
*/}}
|
||||
{{- define "labels" -}}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- if eq (default "helm" .Values.creator) "helm" }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
helm.sh/chart: {{ include "chartName" . }}
|
||||
{{- end -}}
|
||||
{{- if .Values.global.commonLabels}}
|
||||
{{ toYaml .Values.global.commonLabels }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Namespace for all resources to be installed into
|
||||
If not defined in values file then the helm release namespace is used
|
||||
By default this is not set so the helm release namespace will be used
|
||||
|
||||
This gets around an problem within helm discussed here
|
||||
https://github.com/helm/helm/issues/5358
|
||||
*/}}
|
||||
{{- define "cert-manager.namespace" -}}
|
||||
{{ .Values.namespace | default .Release.Namespace }}
|
||||
{{- end -}}
|
||||
|
|
@ -1,109 +0,0 @@
|
|||
{{- if .Values.cainjector.enabled }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "cainjector.fullname" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
labels:
|
||||
app: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.cainjector.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.cainjector.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
{{- with .Values.cainjector.strategy }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
{{- include "labels" . | nindent 8 }}
|
||||
{{- with .Values.cainjector.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cainjector.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "cainjector.serviceAccountName" . }}
|
||||
{{- if hasKey .Values.cainjector "automountServiceAccountToken" }}
|
||||
automountServiceAccountToken: {{ .Values.cainjector.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
{{- with .Values.global.priorityClassName }}
|
||||
priorityClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.cainjector.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}-cainjector
|
||||
{{- with .Values.cainjector.image }}
|
||||
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.cainjector.image.pullPolicy }}
|
||||
args:
|
||||
{{- if .Values.global.logLevel }}
|
||||
- --v={{ .Values.global.logLevel }}
|
||||
{{- end }}
|
||||
{{- with .Values.global.leaderElection }}
|
||||
- --leader-election-namespace={{ .namespace }}
|
||||
{{- if .leaseDuration }}
|
||||
- --leader-election-lease-duration={{ .leaseDuration }}
|
||||
{{- end }}
|
||||
{{- if .renewDeadline }}
|
||||
- --leader-election-renew-deadline={{ .renewDeadline }}
|
||||
{{- end }}
|
||||
{{- if .retryPeriod }}
|
||||
- --leader-election-retry-period={{ .retryPeriod }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.cainjector.extraArgs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- with .Values.cainjector.containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cainjector.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cainjector.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cainjector.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cainjector.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.cainjector.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
{{- if .Values.cainjector.enabled }}
|
||||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "cainjector.fullname" . }}-psp
|
||||
labels:
|
||||
app: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ['policy']
|
||||
resources: ['podsecuritypolicies']
|
||||
verbs: ['use']
|
||||
resourceNames:
|
||||
- {{ template "cainjector.fullname" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
{{- if .Values.cainjector.enabled }}
|
||||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "cainjector.fullname" . }}-psp
|
||||
labels:
|
||||
app: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "cainjector.fullname" . }}-psp
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "cainjector.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,51 +0,0 @@
|
|||
{{- if .Values.cainjector.enabled }}
|
||||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ template "cainjector.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||
{{- if .Values.global.podSecurityPolicy.useAppArmor }}
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
{{- end }}
|
||||
spec:
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
allowedCapabilities: [] # default set of capabilities are implicitly allowed
|
||||
volumes:
|
||||
- 'configMap'
|
||||
- 'emptyDir'
|
||||
- 'projected'
|
||||
- 'secret'
|
||||
- 'downwardAPI'
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
fsGroup:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,103 +0,0 @@
|
|||
{{- if .Values.cainjector.enabled }}
|
||||
{{- if .Values.global.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "cainjector.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["get", "create", "update", "patch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["apiregistration.k8s.io"]
|
||||
resources: ["apiservices"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "cainjector.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "cainjector.fullname" . }}
|
||||
subjects:
|
||||
- name: {{ template "cainjector.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
kind: ServiceAccount
|
||||
|
||||
---
|
||||
# leader election rules
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "cainjector.fullname" . }}:leaderelection
|
||||
namespace: {{ .Values.global.leaderElection.namespace }}
|
||||
labels:
|
||||
app: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
# Used for leader election by the controller
|
||||
# cert-manager-cainjector-leader-election is used by the CertificateBased injector controller
|
||||
# see cmd/cainjector/start.go#L113
|
||||
# cert-manager-cainjector-leader-election-core is used by the SecretBased injector controller
|
||||
# see cmd/cainjector/start.go#L137
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
resourceNames: ["cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"]
|
||||
verbs: ["get", "update", "patch"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["create"]
|
||||
|
||||
---
|
||||
|
||||
# grant cert-manager permission to manage the leaderelection configmap in the
|
||||
# leader election namespace
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "cainjector.fullname" . }}:leaderelection
|
||||
namespace: {{ .Values.global.leaderElection.namespace }}
|
||||
labels:
|
||||
app: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "cainjector.fullname" . }}:leaderelection
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "cainjector.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
{{- if .Values.cainjector.enabled }}
|
||||
{{- if .Values.cainjector.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
automountServiceAccountToken: {{ .Values.cainjector.serviceAccount.automountServiceAccountToken }}
|
||||
metadata:
|
||||
name: {{ template "cainjector.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- with .Values.cainjector.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cainjector.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.cainjector.serviceAccount.labels }}
|
||||
{{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,174 +0,0 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
labels:
|
||||
app: {{ template "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- with .Values.strategy }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 8 }}
|
||||
{{- with .Values.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.prometheus.enabled (not .Values.prometheus.servicemonitor.enabled) }}
|
||||
{{- if not .Values.podAnnotations }}
|
||||
annotations:
|
||||
{{- end }}
|
||||
prometheus.io/path: "/metrics"
|
||||
prometheus.io/scrape: 'true'
|
||||
prometheus.io/port: '9402'
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "cert-manager.serviceAccountName" . }}
|
||||
{{- if hasKey .Values "automountServiceAccountToken" }}
|
||||
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
{{- with .Values.global.priorityClassName }}
|
||||
priorityClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}-controller
|
||||
{{- with .Values.image }}
|
||||
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
args:
|
||||
{{- if .Values.global.logLevel }}
|
||||
- --v={{ .Values.global.logLevel }}
|
||||
{{- end }}
|
||||
{{- if .Values.clusterResourceNamespace }}
|
||||
- --cluster-resource-namespace={{ .Values.clusterResourceNamespace }}
|
||||
{{- else }}
|
||||
- --cluster-resource-namespace=$(POD_NAMESPACE)
|
||||
{{- end }}
|
||||
{{- with .Values.global.leaderElection }}
|
||||
- --leader-election-namespace={{ .namespace }}
|
||||
{{- if .leaseDuration }}
|
||||
- --leader-election-lease-duration={{ .leaseDuration }}
|
||||
{{- end }}
|
||||
{{- if .renewDeadline }}
|
||||
- --leader-election-renew-deadline={{ .renewDeadline }}
|
||||
{{- end }}
|
||||
{{- if .retryPeriod }}
|
||||
- --leader-election-retry-period={{ .retryPeriod }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.acmesolver.image }}
|
||||
- --acme-http01-solver-image={{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}
|
||||
{{- end }}
|
||||
{{- with .Values.extraArgs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.ingressShim }}
|
||||
{{- if .defaultIssuerName }}
|
||||
- --default-issuer-name={{ .defaultIssuerName }}
|
||||
{{- end }}
|
||||
{{- if .defaultIssuerKind }}
|
||||
- --default-issuer-kind={{ .defaultIssuerKind }}
|
||||
{{- end }}
|
||||
{{- if .defaultIssuerGroup }}
|
||||
- --default-issuer-group={{ .defaultIssuerGroup }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.featureGates }}
|
||||
- --feature-gates={{ .Values.featureGates }}
|
||||
{{- end }}
|
||||
{{- if .Values.maxConcurrentChallenges }}
|
||||
- --max-concurrent-challenges={{ .Values.maxConcurrentChallenges }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 9402
|
||||
name: http-metrics
|
||||
protocol: TCP
|
||||
{{- with .Values.containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- with .Values.extraEnv }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.http_proxy }}
|
||||
- name: HTTP_PROXY
|
||||
value: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.https_proxy }}
|
||||
- name: HTTPS_PROXY
|
||||
value: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.no_proxy }}
|
||||
- name: NO_PROXY
|
||||
value: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.podDnsPolicy }}
|
||||
dnsPolicy: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.podDnsConfig }}
|
||||
dnsConfig:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
{{- if .Values.webhook.networkPolicy.enabled }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ template "webhook.fullname" . }}-allow-egress
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
spec:
|
||||
egress:
|
||||
{{- with .Values.webhook.networkPolicy.egress }}
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- with .Values.webhook.podLabels }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
policyTypes:
|
||||
- Egress
|
||||
{{- end }}
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
{{- if .Values.webhook.networkPolicy.enabled }}
|
||||
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: {{ template "webhook.fullname" . }}-allow-ingress
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
spec:
|
||||
ingress:
|
||||
{{- with .Values.webhook.networkPolicy.ingress }}
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- with .Values.webhook.podLabels }}
|
||||
{{- toYaml . | nindent 6 }}
|
||||
{{- end }}
|
||||
policyTypes:
|
||||
- Ingress
|
||||
|
||||
{{- end }}
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-psp
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ['policy']
|
||||
resources: ['podsecuritypolicies']
|
||||
verbs: ['use']
|
||||
resourceNames:
|
||||
- {{ template "cert-manager.fullname" . }}
|
||||
{{- end }}
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-psp
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "cert-manager.fullname" . }}-psp
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "cert-manager.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- end }}
|
||||
|
|
@ -1,49 +0,0 @@
|
|||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||
{{- if .Values.global.podSecurityPolicy.useAppArmor }}
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
{{- end }}
|
||||
spec:
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
allowedCapabilities: [] # default set of capabilities are implicitly allowed
|
||||
volumes:
|
||||
- 'configMap'
|
||||
- 'emptyDir'
|
||||
- 'projected'
|
||||
- 'secret'
|
||||
- 'downwardAPI'
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
fsGroup:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
{{- end }}
|
||||
|
|
@ -1,545 +0,0 @@
|
|||
{{- if .Values.global.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}:leaderelection
|
||||
namespace: {{ .Values.global.leaderElection.namespace }}
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
resourceNames: ["cert-manager-controller"]
|
||||
verbs: ["get", "update", "patch"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["create"]
|
||||
|
||||
---
|
||||
|
||||
# grant cert-manager permission to manage the leaderelection configmap in the
|
||||
# leader election namespace
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "cert-manager.fullname" . }}:leaderelection
|
||||
namespace: {{ .Values.global.leaderElection.namespace }}
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "cert-manager.fullname" . }}:leaderelection
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: {{ template "cert-manager.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
|
||||
---
|
||||
|
||||
# Issuer controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-issuers
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["issuers", "issuers/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
|
||||
---
|
||||
|
||||
# ClusterIssuer controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-clusterissuers
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["clusterissuers", "clusterissuers/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["clusterissuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
|
||||
---
|
||||
|
||||
# Certificates controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-certificates
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "clusterissuers", "issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates/finalizers", "certificaterequests/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders"]
|
||||
verbs: ["create", "delete", "get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
|
||||
---
|
||||
|
||||
# Orders controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-orders
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders", "orders/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders", "challenges"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["clusterissuers", "issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges"]
|
||||
verbs: ["create", "delete"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
|
||||
---
|
||||
|
||||
# Challenges controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-challenges
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
# Use to update challenge resource status
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges", "challenges/status"]
|
||||
verbs: ["update", "patch"]
|
||||
# Used to watch challenge resources
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# Used to watch challenges, issuer and clusterissuer resources
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["issuers", "clusterissuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# Need to be able to retrieve ACME account private key to complete challenges
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# Used to create events
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
# HTTP01 rules
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services"]
|
||||
verbs: ["get", "list", "watch", "create", "delete"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch", "create", "delete", "update"]
|
||||
- apiGroups: [ "gateway.networking.k8s.io" ]
|
||||
resources: [ "httproutes" ]
|
||||
verbs: ["get", "list", "watch", "create", "delete", "update"]
|
||||
# We require the ability to specify a custom hostname when we are creating
|
||||
# new ingress resources.
|
||||
# See: https://github.com/openshift/origin/blob/21f191775636f9acadb44fa42beeb4f75b255532/pkg/route/apiserver/admission/ingress_admission.go#L84-L148
|
||||
- apiGroups: ["route.openshift.io"]
|
||||
resources: ["routes/custom-host"]
|
||||
verbs: ["create"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges/finalizers"]
|
||||
verbs: ["update"]
|
||||
# DNS01 rules (duplicated above)
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
---
|
||||
|
||||
# ingress-shim controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-ingress-shim
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests"]
|
||||
verbs: ["create", "update", "delete"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["gateway.networking.k8s.io"]
|
||||
resources: ["gateways", "httproutes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["gateway.networking.k8s.io"]
|
||||
resources: ["gateways/finalizers", "httproutes/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-issuers
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-issuers
|
||||
subjects:
|
||||
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
kind: ServiceAccount
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-clusterissuers
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-clusterissuers
|
||||
subjects:
|
||||
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
kind: ServiceAccount
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-certificates
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-certificates
|
||||
subjects:
|
||||
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
kind: ServiceAccount
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-orders
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-orders
|
||||
subjects:
|
||||
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
kind: ServiceAccount
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-challenges
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-challenges
|
||||
subjects:
|
||||
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
kind: ServiceAccount
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-ingress-shim
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-ingress-shim
|
||||
subjects:
|
||||
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
kind: ServiceAccount
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-view
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- if .Values.global.rbac.aggregateClusterRoles }}
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges", "orders"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-edit
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- if .Values.global.rbac.aggregateClusterRoles }}
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "issuers"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges", "orders"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
|
||||
---
|
||||
|
||||
# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-approve:cert-manager-io
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cert-manager"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["signers"]
|
||||
verbs: ["approve"]
|
||||
resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-approve:cert-manager-io
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cert-manager"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-approve:cert-manager-io
|
||||
subjects:
|
||||
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
kind: ServiceAccount
|
||||
|
||||
---
|
||||
|
||||
# Permission to:
|
||||
# - Update and sign CertificatSigningeRequests referencing cert-manager.io Issuers and ClusterIssuers
|
||||
# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-certificatesigningrequests
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cert-manager"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources: ["certificatesigningrequests"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources: ["certificatesigningrequests/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources: ["signers"]
|
||||
resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
|
||||
verbs: ["sign"]
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-certificatesigningrequests
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "cert-manager"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "cert-manager.fullname" . }}-controller-certificatesigningrequests
|
||||
subjects:
|
||||
- name: {{ template "cert-manager.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
kind: ServiceAccount
|
||||
{{- end }}
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
{{- if .Values.prometheus.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- with .Values.serviceAnnotations }}
|
||||
annotations:
|
||||
{{ toYaml . | indent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9402
|
||||
name: tcp-prometheus-servicemonitor
|
||||
targetPort: {{ .Values.prometheus.servicemonitor.targetPort }}
|
||||
selector:
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- end }}
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
{{- if .Values.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
{{- with .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
|
||||
metadata:
|
||||
name: {{ template "cert-manager.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- with .Values.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.serviceAccount.labels }}
|
||||
{{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
{{- if and .Values.prometheus.enabled .Values.prometheus.servicemonitor.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ template "cert-manager.fullname" . }}
|
||||
{{- if .Values.prometheus.servicemonitor.namespace }}
|
||||
namespace: {{ .Values.prometheus.servicemonitor.namespace }}
|
||||
{{- else }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/name: {{ include "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
prometheus: {{ .Values.prometheus.servicemonitor.prometheusInstance }}
|
||||
{{- with .Values.prometheus.servicemonitor.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.prometheus.servicemonitor.annotations }}
|
||||
annotations:
|
||||
{{- with .Values.prometheus.servicemonitor.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
jobLabel: {{ template "cert-manager.fullname" . }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: {{ template "cert-manager.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "controller"
|
||||
{{- if .Values.prometheus.servicemonitor.namespace }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "cert-manager.namespace" . }}
|
||||
{{- end }}
|
||||
endpoints:
|
||||
- targetPort: {{ .Values.prometheus.servicemonitor.targetPort }}
|
||||
path: {{ .Values.prometheus.servicemonitor.path }}
|
||||
interval: {{ .Values.prometheus.servicemonitor.interval }}
|
||||
scrapeTimeout: {{ .Values.prometheus.servicemonitor.scrapeTimeout }}
|
||||
honorLabels: {{ .Values.prometheus.servicemonitor.honorLabels }}
|
||||
{{- end }}
|
||||
|
|
@ -1,77 +0,0 @@
|
|||
{{- if .Values.startupapicheck.enabled }}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ include "startupapicheck.fullname" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
labels:
|
||||
app: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "startupapicheck"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.startupapicheck.jobAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
backoffLimit: {{ .Values.startupapicheck.backoffLimit }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "startupapicheck"
|
||||
{{- include "labels" . | nindent 8 }}
|
||||
{{- with .Values.startupapicheck.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.startupapicheck.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
serviceAccountName: {{ template "startupapicheck.serviceAccountName" . }}
|
||||
{{- with .Values.global.priorityClassName }}
|
||||
priorityClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.startupapicheck.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}-startupapicheck
|
||||
{{- with .Values.startupapicheck.image }}
|
||||
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.startupapicheck.image.pullPolicy }}
|
||||
args:
|
||||
- check
|
||||
- api
|
||||
- --wait={{ .Values.startupapicheck.timeout }}
|
||||
{{- with .Values.startupapicheck.extraArgs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- with .Values.startupapicheck.containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.startupapicheck.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.startupapicheck.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.startupapicheck.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.startupapicheck.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
{{- if .Values.startupapicheck.enabled }}
|
||||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "startupapicheck.fullname" . }}-psp
|
||||
labels:
|
||||
app: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "startupapicheck"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.startupapicheck.rbac.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: ['policy']
|
||||
resources: ['podsecuritypolicies']
|
||||
verbs: ['use']
|
||||
resourceNames:
|
||||
- {{ template "startupapicheck.fullname" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
{{- if .Values.startupapicheck.enabled }}
|
||||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "startupapicheck.fullname" . }}-psp
|
||||
labels:
|
||||
app: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "startupapicheck"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.startupapicheck.rbac.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "startupapicheck.fullname" . }}-psp
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "startupapicheck.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,51 +0,0 @@
|
|||
{{- if .Values.startupapicheck.enabled }}
|
||||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ template "startupapicheck.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "startupapicheck"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||
{{- if .Values.global.podSecurityPolicy.useAppArmor }}
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
{{- end }}
|
||||
{{- with .Values.startupapicheck.rbac.annotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
allowedCapabilities: [] # default set of capabilities are implicitly allowed
|
||||
volumes:
|
||||
- 'projected'
|
||||
- 'secret'
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
fsGroup:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,48 +0,0 @@
|
|||
{{- if .Values.startupapicheck.enabled }}
|
||||
{{- if .Values.global.rbac.create }}
|
||||
# create certificate role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "startupapicheck.fullname" . }}:create-cert
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
labels:
|
||||
app: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "startupapicheck"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.startupapicheck.rbac.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates"]
|
||||
verbs: ["create"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "startupapicheck.fullname" . }}:create-cert
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
labels:
|
||||
app: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "startupapicheck"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.startupapicheck.rbac.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "startupapicheck.fullname" . }}:create-cert
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "startupapicheck.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
{{- if .Values.startupapicheck.enabled }}
|
||||
{{- if .Values.startupapicheck.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
automountServiceAccountToken: {{ .Values.startupapicheck.serviceAccount.automountServiceAccountToken }}
|
||||
metadata:
|
||||
name: {{ template "startupapicheck.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- with .Values.startupapicheck.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/name: {{ include "startupapicheck.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "startupapicheck"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.startupapicheck.serviceAccount.labels }}
|
||||
{{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
{{- if .Values.webhook.config -}}
|
||||
{{- if not .Values.webhook.config.apiVersion -}}
|
||||
{{- fail "webhook.config.apiVersion must be set" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if not .Values.webhook.config.kind -}}
|
||||
{{- fail "webhook.config.kind must be set" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "webhook.fullname" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
data:
|
||||
{{- if .Values.webhook.config }}
|
||||
config.yaml: |
|
||||
{{ .Values.webhook.config | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
|
|
@ -1,175 +0,0 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "webhook.fullname" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.webhook.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.webhook.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- with .Values.webhook.strategy }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 8 }}
|
||||
{{- with .Values.webhook.podLabels }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.podAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
serviceAccountName: {{ template "webhook.serviceAccountName" . }}
|
||||
{{- if hasKey .Values.webhook "automountServiceAccountToken" }}
|
||||
automountServiceAccountToken: {{ .Values.webhook.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
{{- with .Values.global.priorityClassName }}
|
||||
priorityClassName: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.securityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.webhook.hostNetwork }}
|
||||
hostNetwork: true
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}-webhook
|
||||
{{- with .Values.webhook.image }}
|
||||
image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
|
||||
args:
|
||||
{{- if .Values.global.logLevel }}
|
||||
- --v={{ .Values.global.logLevel }}
|
||||
{{- end }}
|
||||
{{- if .Values.webhook.config }}
|
||||
- --config=/var/cert-manager/config/config.yaml
|
||||
{{- end }}
|
||||
{{- $config := default .Values.webhook.config "" }}
|
||||
{{ if not $config.securePort -}}
|
||||
- --secure-port={{ .Values.webhook.securePort }}
|
||||
{{- end }}
|
||||
{{- if .Values.featureGates }}
|
||||
- --feature-gates={{ .Values.featureGates }}
|
||||
{{- end }}
|
||||
{{- $tlsConfig := default $config.tlsConfig "" }}
|
||||
{{ if or (not $config.tlsConfig) (and (not $tlsConfig.dynamic) (not $tlsConfig.filesystem) ) -}}
|
||||
- --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
|
||||
- --dynamic-serving-ca-secret-name={{ template "webhook.fullname" . }}-ca
|
||||
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}
|
||||
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}.$(POD_NAMESPACE)
|
||||
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}.$(POD_NAMESPACE).svc
|
||||
{{ if .Values.webhook.url.host }}
|
||||
- --dynamic-serving-dns-names={{ .Values.webhook.url.host }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.extraArgs }}
|
||||
{{- toYaml . | nindent 10 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
protocol: TCP
|
||||
{{- if $config.securePort }}
|
||||
containerPort: {{ $config.securePort }}
|
||||
{{- else if .Values.webhook.securePort }}
|
||||
containerPort: {{ .Values.webhook.securePort }}
|
||||
{{- else }}
|
||||
containerPort: 6443
|
||||
{{- end }}
|
||||
- name: healthcheck
|
||||
protocol: TCP
|
||||
{{- if $config.healthzPort }}
|
||||
containerPort: {{ $config.healthzPort }}
|
||||
{{- else }}
|
||||
containerPort: 6080
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /livez
|
||||
{{- if $config.healthzPort }}
|
||||
port: {{ $config.healthzPort }}
|
||||
{{- else }}
|
||||
port: 6080
|
||||
{{- end }}
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: {{ .Values.webhook.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.webhook.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.webhook.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.webhook.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.webhook.livenessProbe.failureThreshold }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
{{- if $config.healthzPort }}
|
||||
port: {{ $config.healthzPort }}
|
||||
{{- else }}
|
||||
port: 6080
|
||||
{{- end }}
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: {{ .Values.webhook.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.webhook.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.webhook.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.webhook.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.webhook.readinessProbe.failureThreshold }}
|
||||
{{- with .Values.webhook.containerSecurityContext }}
|
||||
securityContext:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- with .Values.webhook.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.webhook.config }}
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /var/cert-manager/config
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.webhook.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.webhook.config }}
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: {{ include "webhook.fullname" . }}
|
||||
{{- end }}
|
||||
|
|
@ -1,46 +0,0 @@
|
|||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "webhook.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from-secret: {{ printf "%s/%s-ca" (include "cert-manager.namespace" .) (include "webhook.fullname" .) | quote }}
|
||||
{{- with .Values.webhook.mutatingWebhookConfigurationAnnotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
webhooks:
|
||||
- name: webhook.cert-manager.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "cert-manager.io"
|
||||
- "acme.cert-manager.io"
|
||||
apiVersions:
|
||||
- "v1"
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- "*/*"
|
||||
admissionReviewVersions: ["v1"]
|
||||
# This webhook only accepts v1 cert-manager resources.
|
||||
# Equivalent matchPolicy ensures that non-v1 resource requests are sent to
|
||||
# this webhook (after the resources have been converted to v1).
|
||||
matchPolicy: Equivalent
|
||||
timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
|
||||
failurePolicy: Fail
|
||||
# Only include 'sideEffects' field in Kubernetes 1.12+
|
||||
sideEffects: None
|
||||
clientConfig:
|
||||
{{- if .Values.webhook.url.host }}
|
||||
url: https://{{ .Values.webhook.url.host }}/mutate
|
||||
{{- else }}
|
||||
service:
|
||||
name: {{ template "webhook.fullname" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
path: /mutate
|
||||
{{- end }}
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "webhook.fullname" . }}-psp
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ['policy']
|
||||
resources: ['podsecuritypolicies']
|
||||
verbs: ['use']
|
||||
resourceNames:
|
||||
- {{ template "webhook.fullname" . }}
|
||||
{{- end }}
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "webhook.fullname" . }}-psp
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "webhook.fullname" . }}-psp
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "webhook.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- end }}
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
{{- if .Values.global.podSecurityPolicy.enabled }}
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: {{ template "webhook.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
|
||||
{{- if .Values.global.podSecurityPolicy.useAppArmor }}
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
{{- end }}
|
||||
spec:
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
allowedCapabilities: [] # default set of capabilities are implicitly allowed
|
||||
volumes:
|
||||
- 'configMap'
|
||||
- 'emptyDir'
|
||||
- 'projected'
|
||||
- 'secret'
|
||||
- 'downwardAPI'
|
||||
hostNetwork: {{ .Values.webhook.hostNetwork }}
|
||||
{{- if .Values.webhook.hostNetwork }}
|
||||
hostPorts:
|
||||
- max: {{ .Values.webhook.securePort }}
|
||||
min: {{ .Values.webhook.securePort }}
|
||||
{{- end }}
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
fsGroup:
|
||||
rule: 'MustRunAs'
|
||||
ranges:
|
||||
- min: 1000
|
||||
max: 1000
|
||||
{{- end }}
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
{{- if .Values.global.rbac.create }}
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ template "webhook.fullname" . }}:dynamic-serving
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
resourceNames:
|
||||
- '{{ template "webhook.fullname" . }}-ca'
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
# It's not possible to grant CREATE permission on a single resourceName.
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["create"]
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "webhook.fullname" . }}:dynamic-serving
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "webhook.fullname" . }}:dynamic-serving
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: {{ template "webhook.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ template "webhook.fullname" . }}:subjectaccessreviews
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
rules:
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ template "webhook.fullname" . }}:subjectaccessreviews
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ template "webhook.fullname" . }}:subjectaccessreviews
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: {{ template "webhook.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- end }}
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ template "webhook.fullname" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- with .Values.webhook.serviceAnnotations }}
|
||||
annotations:
|
||||
{{ toYaml . | indent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.webhook.serviceLabels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.webhook.serviceType }}
|
||||
{{- with .Values.webhook.loadBalancerIP }}
|
||||
loadBalancerIP: {{ . }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: "https"
|
||||
selector:
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
{{- if .Values.webhook.serviceAccount.create }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
automountServiceAccountToken: {{ .Values.webhook.serviceAccount.automountServiceAccountToken }}
|
||||
metadata:
|
||||
name: {{ template "webhook.serviceAccountName" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
{{- with .Values.webhook.serviceAccount.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
{{- with .Values.webhook.serviceAccount.labels }}
|
||||
{{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- with .Values.global.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 2 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,55 +0,0 @@
|
|||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: {{ include "webhook.fullname" . }}
|
||||
labels:
|
||||
app: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/name: {{ include "webhook.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/component: "webhook"
|
||||
{{- include "labels" . | nindent 4 }}
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from-secret: {{ printf "%s/%s-ca" (include "cert-manager.namespace" .) (include "webhook.fullname" .) | quote}}
|
||||
{{- with .Values.webhook.validatingWebhookConfigurationAnnotations }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
webhooks:
|
||||
- name: webhook.cert-manager.io
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: "cert-manager.io/disable-validation"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- "true"
|
||||
- key: "name"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- {{ include "cert-manager.namespace" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "cert-manager.io"
|
||||
- "acme.cert-manager.io"
|
||||
apiVersions:
|
||||
- "v1"
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- "*/*"
|
||||
admissionReviewVersions: ["v1"]
|
||||
# This webhook only accepts v1 cert-manager resources.
|
||||
# Equivalent matchPolicy ensures that non-v1 resource requests are sent to
|
||||
# this webhook (after the resources have been converted to v1).
|
||||
matchPolicy: Equivalent
|
||||
timeoutSeconds: {{ .Values.webhook.timeoutSeconds }}
|
||||
failurePolicy: Fail
|
||||
sideEffects: None
|
||||
clientConfig:
|
||||
{{- if .Values.webhook.url.host }}
|
||||
url: https://{{ .Values.webhook.url.host }}/validate
|
||||
{{- else }}
|
||||
service:
|
||||
name: {{ template "webhook.fullname" . }}
|
||||
namespace: {{ include "cert-manager.namespace" . }}
|
||||
path: /validate
|
||||
{{- end }}
|
||||
|
|
@ -1,619 +0,0 @@
|
|||
# Default values for cert-manager.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
global:
|
||||
# Reference to one or more secrets to be used when pulling images
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
imagePullSecrets: []
|
||||
# - name: "image-pull-secret"
|
||||
|
||||
# Labels to apply to all resources
|
||||
# Please note that this does not add labels to the resources created dynamically by the controllers.
|
||||
# For these resources, you have to add the labels in the template in the cert-manager custom resource:
|
||||
# eg. podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress
|
||||
# ref: https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress
|
||||
# eg. secretTemplate in CertificateSpec
|
||||
# ref: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
|
||||
commonLabels: {}
|
||||
# team_name: dev
|
||||
|
||||
# Optional priority class to be used for the cert-manager pods
|
||||
priorityClassName: ""
|
||||
rbac:
|
||||
create: true
|
||||
# Aggregate ClusterRoles to Kubernetes default user-facing roles. Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
|
||||
aggregateClusterRoles: true
|
||||
|
||||
podSecurityPolicy:
|
||||
enabled: false
|
||||
useAppArmor: true
|
||||
|
||||
# Set the verbosity of cert-manager. Range of 0 - 6 with 6 being the most verbose.
|
||||
logLevel: 2
|
||||
|
||||
leaderElection:
|
||||
# Override the namespace used for the leader election lease
|
||||
namespace: "kube-system"
|
||||
|
||||
# The duration that non-leader candidates will wait after observing a
|
||||
# leadership renewal until attempting to acquire leadership of a led but
|
||||
# unrenewed leader slot. This is effectively the maximum duration that a
|
||||
# leader can be stopped before it is replaced by another candidate.
|
||||
# leaseDuration: 60s
|
||||
|
||||
# The interval between attempts by the acting master to renew a leadership
|
||||
# slot before it stops leading. This must be less than or equal to the
|
||||
# lease duration.
|
||||
# renewDeadline: 40s
|
||||
|
||||
# The duration the clients should wait between attempting acquisition and
|
||||
# renewal of a leadership.
|
||||
# retryPeriod: 15s
|
||||
|
||||
installCRDs: false
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
strategy: {}
|
||||
# type: RollingUpdate
|
||||
# rollingUpdate:
|
||||
# maxSurge: 0
|
||||
# maxUnavailable: 1
|
||||
|
||||
# Comma separated list of feature gates that should be enabled on the
|
||||
# controller pod & webhook pod.
|
||||
featureGates: ""
|
||||
|
||||
# The maximum number of challenges that can be scheduled as 'processing' at once
|
||||
maxConcurrentChallenges: 60
|
||||
|
||||
image:
|
||||
repository: quay.io/jetstack/cert-manager-controller
|
||||
# You can manage a registry with
|
||||
# registry: quay.io
|
||||
# repository: jetstack/cert-manager-controller
|
||||
|
||||
# Override the image tag to deploy by setting this variable.
|
||||
# If no value is set, the chart's appVersion will be used.
|
||||
# tag: canary
|
||||
|
||||
# Setting a digest will override any tag
|
||||
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer
|
||||
# resources. By default, the same namespace as cert-manager is deployed within is
|
||||
# used. This namespace will not be automatically created by the Helm chart.
|
||||
clusterResourceNamespace: ""
|
||||
|
||||
# This namespace allows you to define where the services will be installed into
|
||||
# if not set then they will use the namespace of the release
|
||||
# This is helpful when installing cert manager as a chart dependency (sub chart)
|
||||
namespace: ""
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
# name: ""
|
||||
# Optional additional annotations to add to the controller's ServiceAccount
|
||||
# annotations: {}
|
||||
# Automount API credentials for a Service Account.
|
||||
# Optional additional labels to add to the controller's ServiceAccount
|
||||
# labels: {}
|
||||
automountServiceAccountToken: true
|
||||
|
||||
# Automounting API credentials for a particular pod
|
||||
# automountServiceAccountToken: true
|
||||
|
||||
# Additional command line flags to pass to cert-manager controller binary.
|
||||
# To see all available flags run docker run quay.io/jetstack/cert-manager-controller:<version> --help
|
||||
extraArgs: []
|
||||
# When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted
|
||||
# - --enable-certificate-owner-ref=true
|
||||
# Use this flag to enable or disable arbitrary controllers, for example, disable the CertificiateRequests approver
|
||||
# - --controllers=*,-certificaterequests-approver
|
||||
|
||||
extraEnv: []
|
||||
# - name: SOME_VAR
|
||||
# value: 'some value'
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# cpu: 10m
|
||||
# memory: 32Mi
|
||||
|
||||
# Pod Security Context
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
# Container Security Context to be set on the controller component container
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
|
||||
|
||||
volumes: []
|
||||
|
||||
volumeMounts: []
|
||||
|
||||
# Optional additional annotations to add to the controller Deployment
|
||||
# deploymentAnnotations: {}
|
||||
|
||||
# Optional additional annotations to add to the controller Pods
|
||||
# podAnnotations: {}
|
||||
|
||||
podLabels: {}
|
||||
|
||||
# Optional annotations to add to the controller Service
|
||||
# serviceAnnotations: {}
|
||||
|
||||
# Optional additional labels to add to the controller Service
|
||||
# serviceLabels: {}
|
||||
|
||||
# Optional DNS settings, useful if you have a public and private DNS zone for
|
||||
# the same domain on Route 53. What follows is an example of ensuring
|
||||
# cert-manager can access an ingress or DNS TXT records at all times.
|
||||
# NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
|
||||
# the cluster to work.
|
||||
# podDnsPolicy: "None"
|
||||
# podDnsConfig:
|
||||
# nameservers:
|
||||
# - "1.1.1.1"
|
||||
# - "8.8.8.8"
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
|
||||
ingressShim: {}
|
||||
# defaultIssuerName: ""
|
||||
# defaultIssuerKind: ""
|
||||
# defaultIssuerGroup: ""
|
||||
|
||||
prometheus:
|
||||
enabled: true
|
||||
servicemonitor:
|
||||
enabled: false
|
||||
prometheusInstance: default
|
||||
targetPort: 9402
|
||||
path: /metrics
|
||||
interval: 60s
|
||||
scrapeTimeout: 30s
|
||||
labels: {}
|
||||
annotations: {}
|
||||
honorLabels: false
|
||||
|
||||
# Use these variables to configure the HTTP_PROXY environment variables
|
||||
# http_proxy: "http://proxy:8080"
|
||||
# https_proxy: "https://proxy:8080"
|
||||
# no_proxy: 127.0.0.1,localhost
|
||||
|
||||
# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#affinity-v1-core
|
||||
# for example:
|
||||
# affinity:
|
||||
# nodeAffinity:
|
||||
# requiredDuringSchedulingIgnoredDuringExecution:
|
||||
# nodeSelectorTerms:
|
||||
# - matchExpressions:
|
||||
# - key: foo.bar.com/role
|
||||
# operator: In
|
||||
# values:
|
||||
# - master
|
||||
affinity: {}
|
||||
|
||||
# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#toleration-v1-core
|
||||
# for example:
|
||||
# tolerations:
|
||||
# - key: foo.bar.com/role
|
||||
# operator: Equal
|
||||
# value: master
|
||||
# effect: NoSchedule
|
||||
tolerations: []
|
||||
|
||||
# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#topologyspreadconstraint-v1-core
|
||||
# for example:
|
||||
# topologySpreadConstraints:
|
||||
# - maxSkew: 2
|
||||
# topologyKey: topology.kubernetes.io/zone
|
||||
# whenUnsatisfiable: ScheduleAnyway
|
||||
# labelSelector:
|
||||
# matchLabels:
|
||||
# app.kubernetes.io/instance: cert-manager
|
||||
# app.kubernetes.io/component: controller
|
||||
topologySpreadConstraints: []
|
||||
|
||||
webhook:
|
||||
replicaCount: 1
|
||||
timeoutSeconds: 10
|
||||
|
||||
# Used to configure options for the webhook pod.
|
||||
# This allows setting options that'd usually be provided via flags.
|
||||
# An APIVersion and Kind must be specified in your values.yaml file.
|
||||
# Flags will override options that are set here.
|
||||
config:
|
||||
# apiVersion: webhook.config.cert-manager.io/v1alpha1
|
||||
# kind: WebhookConfiguration
|
||||
|
||||
# The port that the webhook should listen on for requests.
|
||||
# In GKE private clusters, by default kubernetes apiservers are allowed to
|
||||
# talk to the cluster nodes only on 443 and 10250. so configuring
|
||||
# securePort: 10250, will work out of the box without needing to add firewall
|
||||
# rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000.
|
||||
# This should be uncommented and set as a default by the chart once we graduate
|
||||
# the apiVersion of WebhookConfiguration past v1alpha1.
|
||||
# securePort: 10250
|
||||
|
||||
strategy: {}
|
||||
# type: RollingUpdate
|
||||
# rollingUpdate:
|
||||
# maxSurge: 0
|
||||
# maxUnavailable: 1
|
||||
|
||||
# Pod Security Context to be set on the webhook component Pod
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
# Container Security Context to be set on the webhook component container
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
|
||||
# Optional additional annotations to add to the webhook Deployment
|
||||
# deploymentAnnotations: {}
|
||||
|
||||
# Optional additional annotations to add to the webhook Pods
|
||||
# podAnnotations: {}
|
||||
|
||||
# Optional additional annotations to add to the webhook Service
|
||||
# serviceAnnotations: {}
|
||||
|
||||
# Optional additional annotations to add to the webhook MutatingWebhookConfiguration
|
||||
# mutatingWebhookConfigurationAnnotations: {}
|
||||
|
||||
# Optional additional annotations to add to the webhook ValidatingWebhookConfiguration
|
||||
# validatingWebhookConfigurationAnnotations: {}
|
||||
|
||||
# Additional command line flags to pass to cert-manager webhook binary.
|
||||
# To see all available flags run docker run quay.io/jetstack/cert-manager-webhook:<version> --help
|
||||
extraArgs: []
|
||||
# Path to a file containing a WebhookConfiguration object used to configure the webhook
|
||||
# - --config=<path-to-config-file>
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# cpu: 10m
|
||||
# memory: 32Mi
|
||||
|
||||
## Liveness and readiness probe values
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
|
||||
##
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
|
||||
affinity: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
# Optional additional labels to add to the Webhook Pods
|
||||
podLabels: {}
|
||||
|
||||
# Optional additional labels to add to the Webhook Service
|
||||
serviceLabels: {}
|
||||
|
||||
image:
|
||||
repository: quay.io/jetstack/cert-manager-webhook
|
||||
# You can manage a registry with
|
||||
# registry: quay.io
|
||||
# repository: jetstack/cert-manager-webhook
|
||||
|
||||
# Override the image tag to deploy by setting this variable.
|
||||
# If no value is set, the chart's appVersion will be used.
|
||||
# tag: canary
|
||||
|
||||
# Setting a digest will override any tag
|
||||
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
|
||||
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
# name: ""
|
||||
# Optional additional annotations to add to the controller's ServiceAccount
|
||||
# annotations: {}
|
||||
# Optional additional labels to add to the webhook's ServiceAccount
|
||||
# labels: {}
|
||||
# Automount API credentials for a Service Account.
|
||||
automountServiceAccountToken: true
|
||||
|
||||
# Automounting API credentials for a particular pod
|
||||
# automountServiceAccountToken: true
|
||||
|
||||
# The port that the webhook should listen on for requests.
|
||||
# In GKE private clusters, by default kubernetes apiservers are allowed to
|
||||
# talk to the cluster nodes only on 443 and 10250. so configuring
|
||||
# securePort: 10250, will work out of the box without needing to add firewall
|
||||
# rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000
|
||||
securePort: 10250
|
||||
|
||||
# Specifies if the webhook should be started in hostNetwork mode.
|
||||
#
|
||||
# Required for use in some managed kubernetes clusters (such as AWS EKS) with custom
|
||||
# CNI (such as calico), because control-plane managed by AWS cannot communicate
|
||||
# with pods' IP CIDR and admission webhooks are not working
|
||||
#
|
||||
# Since the default port for the webhook conflicts with kubelet on the host
|
||||
# network, `webhook.securePort` should be changed to an available port if
|
||||
# running in hostNetwork mode.
|
||||
hostNetwork: false
|
||||
|
||||
# Specifies how the service should be handled. Useful if you want to expose the
|
||||
# webhook to outside of the cluster. In some cases, the control plane cannot
|
||||
# reach internal services.
|
||||
serviceType: ClusterIP
|
||||
# loadBalancerIP:
|
||||
|
||||
# Overrides the mutating webhook and validating webhook so they reach the webhook
|
||||
# service using the `url` field instead of a service.
|
||||
url: {}
|
||||
# host:
|
||||
|
||||
# Enables default network policies for webhooks.
|
||||
networkPolicy:
|
||||
enabled: false
|
||||
ingress:
|
||||
- from:
|
||||
- ipBlock:
|
||||
cidr: 0.0.0.0/0
|
||||
egress:
|
||||
- ports:
|
||||
- port: 80
|
||||
protocol: TCP
|
||||
- port: 443
|
||||
protocol: TCP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
to:
|
||||
- ipBlock:
|
||||
cidr: 0.0.0.0/0
|
||||
|
||||
cainjector:
|
||||
enabled: true
|
||||
replicaCount: 1
|
||||
|
||||
strategy: {}
|
||||
# type: RollingUpdate
|
||||
# rollingUpdate:
|
||||
# maxSurge: 0
|
||||
# maxUnavailable: 1
|
||||
|
||||
# Pod Security Context to be set on the cainjector component Pod
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
# Container Security Context to be set on the cainjector component container
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
|
||||
|
||||
# Optional additional annotations to add to the cainjector Deployment
|
||||
# deploymentAnnotations: {}
|
||||
|
||||
# Optional additional annotations to add to the cainjector Pods
|
||||
# podAnnotations: {}
|
||||
|
||||
# Additional command line flags to pass to cert-manager cainjector binary.
|
||||
# To see all available flags run docker run quay.io/jetstack/cert-manager-cainjector:<version> --help
|
||||
extraArgs: []
|
||||
# Enable profiling for cainjector
|
||||
# - --enable-profiling=true
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# cpu: 10m
|
||||
# memory: 32Mi
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
|
||||
affinity: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
topologySpreadConstraints: []
|
||||
|
||||
# Optional additional labels to add to the CA Injector Pods
|
||||
podLabels: {}
|
||||
|
||||
image:
|
||||
repository: quay.io/jetstack/cert-manager-cainjector
|
||||
# You can manage a registry with
|
||||
# registry: quay.io
|
||||
# repository: jetstack/cert-manager-cainjector
|
||||
|
||||
# Override the image tag to deploy by setting this variable.
|
||||
# If no value is set, the chart's appVersion will be used.
|
||||
# tag: canary
|
||||
|
||||
# Setting a digest will override any tag
|
||||
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
|
||||
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
# name: ""
|
||||
# Optional additional annotations to add to the controller's ServiceAccount
|
||||
# annotations: {}
|
||||
# Automount API credentials for a Service Account.
|
||||
# Optional additional labels to add to the cainjector's ServiceAccount
|
||||
# labels: {}
|
||||
automountServiceAccountToken: true
|
||||
|
||||
# Automounting API credentials for a particular pod
|
||||
# automountServiceAccountToken: true
|
||||
|
||||
acmesolver:
|
||||
image:
|
||||
repository: quay.io/jetstack/cert-manager-acmesolver
|
||||
# You can manage a registry with
|
||||
# registry: quay.io
|
||||
# repository: jetstack/cert-manager-acmesolver
|
||||
|
||||
# Override the image tag to deploy by setting this variable.
|
||||
# If no value is set, the chart's appVersion will be used.
|
||||
# tag: canary
|
||||
|
||||
# Setting a digest will override any tag
|
||||
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
|
||||
|
||||
# This startupapicheck is a Helm post-install hook that waits for the webhook
|
||||
# endpoints to become available.
|
||||
# The check is implemented using a Kubernetes Job- if you are injecting mesh
|
||||
# sidecar proxies into cert-manager pods, you probably want to ensure that they
|
||||
# are not injected into this Job's pod. Otherwise the installation may time out
|
||||
# due to the Job never being completed because the sidecar proxy does not exit.
|
||||
# See https://github.com/cert-manager/cert-manager/pull/4414 for context.
|
||||
startupapicheck:
|
||||
enabled: true
|
||||
|
||||
# Pod Security Context to be set on the startupapicheck component Pod
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
|
||||
# Container Security Context to be set on the controller component container
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
|
||||
# Timeout for 'kubectl check api' command
|
||||
timeout: 1m
|
||||
|
||||
# Job backoffLimit
|
||||
backoffLimit: 4
|
||||
|
||||
# Optional additional annotations to add to the startupapicheck Job
|
||||
jobAnnotations:
|
||||
helm.sh/hook: post-install
|
||||
helm.sh/hook-weight: "1"
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||
|
||||
# Optional additional annotations to add to the startupapicheck Pods
|
||||
# podAnnotations: {}
|
||||
|
||||
# Additional command line flags to pass to startupapicheck binary.
|
||||
# To see all available flags run docker run quay.io/jetstack/cert-manager-ctl:<version> --help
|
||||
extraArgs: []
|
||||
|
||||
resources: {}
|
||||
# requests:
|
||||
# cpu: 10m
|
||||
# memory: 32Mi
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
|
||||
affinity: {}
|
||||
|
||||
tolerations: []
|
||||
|
||||
# Optional additional labels to add to the startupapicheck Pods
|
||||
podLabels: {}
|
||||
|
||||
image:
|
||||
repository: quay.io/jetstack/cert-manager-ctl
|
||||
# You can manage a registry with
|
||||
# registry: quay.io
|
||||
# repository: jetstack/cert-manager-ctl
|
||||
|
||||
# Override the image tag to deploy by setting this variable.
|
||||
# If no value is set, the chart's appVersion will be used.
|
||||
# tag: canary
|
||||
|
||||
# Setting a digest will override any tag
|
||||
# digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20
|
||||
|
||||
pullPolicy: IfNotPresent
|
||||
|
||||
rbac:
|
||||
# annotations for the startup API Check job RBAC and PSP resources
|
||||
annotations:
|
||||
helm.sh/hook: post-install
|
||||
helm.sh/hook-weight: "-5"
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||
|
||||
serviceAccount:
|
||||
# Specifies whether a service account should be created
|
||||
create: true
|
||||
|
||||
# The name of the service account to use.
|
||||
# If not set and create is true, a name is generated using the fullname template
|
||||
# name: ""
|
||||
|
||||
# Optional additional annotations to add to the Job's ServiceAccount
|
||||
annotations:
|
||||
helm.sh/hook: post-install
|
||||
helm.sh/hook-weight: "-5"
|
||||
helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
|
||||
|
||||
# Automount API credentials for a Service Account.
|
||||
automountServiceAccountToken: true
|
||||
|
||||
# Optional additional labels to add to the startupapicheck's ServiceAccount
|
||||
# labels: {}
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
apiVersion: v1
|
||||
appVersion: 0.2.2
|
||||
description: Configuration Job to add LetsEncrypt Issuer to cert-manager
|
||||
home: https://about.gitlab.com/
|
||||
icon: https://gitlab.com/gitlab-com/gitlab-artwork/raw/master/logo/logo-square.svg
|
||||
keywords:
|
||||
- gitlab
|
||||
- cert-manager
|
||||
- tls
|
||||
- letsencrypt
|
||||
maintainers:
|
||||
- email: support@gitlab.com
|
||||
name: GitLab Inc.
|
||||
name: certmanager-issuer
|
||||
sources:
|
||||
- https://gitlab.com/gitlab-org/charts/gitlab/tree/master/charts/certmanager-issuer
|
||||
- https://gitlab.com/gitlab-org/build/CNG/tree/master/kubectl
|
||||
- https://github.com/jetstack/cert-manager
|
||||
version: 0.1.0
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
#!/bin/bash
|
||||
set -e ;
|
||||
|
||||
issuer_file=$1
|
||||
namespace={{ .Release.Namespace }}
|
||||
|
||||
echo "Creating the certmanager issuer..."
|
||||
set +e ; # The CRD may not exist yet. We need to retry until this passes
|
||||
while ! kubectl --namespace=$namespace apply -f ${issuer_file:=issuer.yml}; do
|
||||
sleep 1;
|
||||
done ;
|
||||
set -e ; # reset `e` as active
|
||||
|
|
@ -1,40 +0,0 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "certmanager-issuer.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "certmanager-issuer.fullname" -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified job name.
|
||||
Due to the job only being allowed to run once, we add the chart revision so helm
|
||||
upgrades don't cause errors trying to create the already ran job.
|
||||
Due to the helm delete not cleaning up these jobs, we add a random value to
|
||||
reduce collision
|
||||
*/}}
|
||||
{{- define "certmanager-issuer.jobname" -}}
|
||||
{{- $name := printf "%s-issuer" .Release.Name | trunc 55 | trimSuffix "-" -}}
|
||||
{{- printf "%s-%d" $name .Release.Revision | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Returns the http01 solver's ingress class field. Takes the IngressClass as paramter.
|
||||
If the IngressClass is "none", the field is not set.
|
||||
See: https://cert-manager.io/docs/configuration/acme/http01/#class
|
||||
*/}}
|
||||
{{- define "certmanager-issuer.http01.ingress.class.field" -}}
|
||||
{{- $ingressClass := . | default "" -}}
|
||||
{{- if ne "none" $ingressClass -}}
|
||||
class: {{ $ingressClass }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
{{ if (pluck "configureCertmanager" .Values.global.ingress (dict "configureCertmanager" false) | first) }}
|
||||
{{- $ingressCfg := dict "global" $.Values.global.ingress "local" .ingress "context" $ -}}
|
||||
{{- $ingressClassName := include "ingress.class.name" $ingressCfg -}}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-issuer
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitlab.standardLabels" . | nindent 4 }}
|
||||
{{- include "gitlab.commonLabels" . | nindent 4 }}
|
||||
spec:
|
||||
acme:
|
||||
# The ACME server URL
|
||||
server: {{ .Values.server | quote }}
|
||||
# Email address used for ACME registration
|
||||
email: {{ required "You must provide an email to associate with your TLS certificates. Please set certmanager-issuer.email" .Values.email | quote }}
|
||||
# Name of a secret used to store the ACME account private key
|
||||
privateKeySecretRef:
|
||||
name: {{ .Release.Name }}-acme-key
|
||||
# Enable the HTTP-01 challenge provider
|
||||
solvers:
|
||||
- selector: {}
|
||||
http01:
|
||||
ingress:
|
||||
{{ include "certmanager-issuer.http01.ingress.class.field" $ingressClassName -}}
|
||||
{{ end }}
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
{{ if (pluck "configureCertmanager" .Values.global.ingress (dict "configureCertmanager" false) | first) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}-certmanager
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitlab.standardLabels" . | nindent 4 }}
|
||||
{{- include "gitlab.commonLabels" . | nindent 4 }}
|
||||
data:
|
||||
create-issuer: |
|
||||
{{ include (print $.Template.BasePath "/_create_issuer.sh") . | indent 4 }}
|
||||
issuer.yml: |
|
||||
{{ include (print $.Template.BasePath "/_issuer.yaml") . | indent 4 }}
|
||||
{{ end }}
|
||||
|
|
@ -1,43 +0,0 @@
|
|||
{{ if (pluck "configureCertmanager" .Values.global.ingress (dict "configureCertmanager" false) | first) }}
|
||||
{{- $imageCfg := dict "global" .Values.global.image "local" .Values.global.kubectl.image -}}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ template "certmanager-issuer.jobname" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitlab.standardLabels" . | nindent 4 }}
|
||||
{{- include "gitlab.commonLabels" . | nindent 4 }}
|
||||
spec:
|
||||
activeDeadlineSeconds: 300
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ template "name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
spec:
|
||||
{{- include "gitlab.nodeSelector" . | nindent 6 }}
|
||||
securityContext:
|
||||
runAsUser: {{ .Values.global.kubectl.securityContext.runAsUser }}
|
||||
fsGroup: {{ .Values.global.kubectl.securityContext.fsGroup }}
|
||||
{{- if .Values.rbac.create }}
|
||||
serviceAccountName: {{ template "fullname" . }}
|
||||
{{- end }}
|
||||
restartPolicy: OnFailure
|
||||
{{- include "gitlab.image.pullSecrets" $imageCfg | indent 6}}
|
||||
{{- include "gitlab.priorityClassName" . | nindent 6 }}
|
||||
containers:
|
||||
- name: create-issuer
|
||||
image: {{ include "gitlab.kubectl.image" . }}
|
||||
command: ['/bin/bash', '/scripts/create-issuer', '/scripts/issuer.yml']
|
||||
{{- include "gitlab.image.pullPolicy" $imageCfg | indent 10 }}
|
||||
volumeMounts:
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 12 }}
|
||||
volumes:
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: {{ template "fullname" . }}-certmanager
|
||||
{{- end }}
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
{{ if and .Values.rbac.create (pluck "configureCertmanager" .Values.global.ingress (dict "configureCertmanager" false) | first) }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
{{- include "gitlab.standardLabels" . | nindent 4 }}
|
||||
{{- include "gitlab.commonLabels" . | nindent 4 }}
|
||||
annotations:
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["issuers"]
|
||||
verbs: ["get", "list", "update", "create", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ template "fullname" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
labels:
|
||||
app: {{ template "name" . }}
|
||||
chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ template "fullname" . }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ template "fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- end }}
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# Configure an ACME Issuer in cert-manager. Only used if global.ingress.configureCertmanager is true.
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
|
||||
# Provide an email to associate with your TLS certificates
|
||||
# email:
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
|
||||
# Priority class assigned to pods
|
||||
priorityClassName: ""
|
||||
|
||||
common:
|
||||
labels: {}
|
||||
|
|
@ -1,177 +0,0 @@
|
|||
##############
|
||||
# Conditions #
|
||||
##############
|
||||
|
||||
.if-merge-request-pipeline: &if-merge-request-pipeline
|
||||
if: $CI_PIPELINE_SOURCE == "merge_request_event"
|
||||
|
||||
.if-default-branch: &if-default-branch
|
||||
if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
|
||||
|
||||
.if-stable-release-branch: &if-stable-release-branch
|
||||
if: $CI_COMMIT_REF_NAME =~ /\A[0-9]+-[0-9]+-stable\z/
|
||||
|
||||
.if-release-tag: &if-release-tag
|
||||
if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$/ && $CI_PROJECT_URL == "https://gitlab.com/gitlab-org/charts/gitlab-runner"'
|
||||
|
||||
.if-security-release-tag: &if-security-release-tag
|
||||
if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$/ && $CI_PROJECT_URL == "https://gitlab.com/gitlab-org/security/charts/gitlab-runner"'
|
||||
|
||||
#########
|
||||
# Rules #
|
||||
#########
|
||||
|
||||
.rules:default:
|
||||
rules:
|
||||
- <<: *if-merge-request-pipeline
|
||||
- <<: *if-default-branch
|
||||
- <<: *if-stable-release-branch
|
||||
- <<: *if-release-tag
|
||||
- <<: *if-security-release-tag
|
||||
|
||||
.rules:release:development:
|
||||
rules:
|
||||
- <<: *if-default-branch
|
||||
when: never
|
||||
- <<: *if-merge-request-pipeline
|
||||
when: manual
|
||||
|
||||
.rules:release:beta:
|
||||
rules:
|
||||
- <<: *if-default-branch
|
||||
|
||||
.rules:release:stable:
|
||||
rules:
|
||||
- <<: *if-release-tag
|
||||
- <<: *if-security-release-tag
|
||||
|
||||
############
|
||||
# Pipeline #
|
||||
############
|
||||
|
||||
default:
|
||||
image: registry.gitlab.com/gitlab-org/gitlab-build-images:gitlab-charts-build-base-helm-3.7
|
||||
tags:
|
||||
- gitlab-org
|
||||
|
||||
variables:
|
||||
GIT_CLONE_PATH: $CI_BUILDS_DIR/gitlab-runner
|
||||
|
||||
stages:
|
||||
- test
|
||||
- release
|
||||
- post-release
|
||||
|
||||
lint:
|
||||
extends:
|
||||
- .rules:default
|
||||
stage: test
|
||||
script:
|
||||
- helm lint .
|
||||
|
||||
integration test:
|
||||
extends:
|
||||
- .rules:default
|
||||
variables:
|
||||
DOCKER_HOST: "tcp://kubernetes:2375/"
|
||||
DOCKER_TLS_CERTDIR: ""
|
||||
DOCKER_DRIVER: overlay2
|
||||
INTEGRATION_RUNNER_NAME: integration-test-$CI_COMMIT_SHORT_SHA
|
||||
INTEGRATION_HELM_POD_RELEASE_LABEL: release=$INTEGRATION_RUNNER_NAME
|
||||
stage: test
|
||||
services:
|
||||
- name: docker:20.10.16-dind
|
||||
alias: kubernetes
|
||||
image: docker:20.10.16-git
|
||||
script:
|
||||
# Initialize KIND cluster
|
||||
- apk add --no-cache openssl curl bash curl-dev
|
||||
- curl -Lo /usr/local/bin/kubectl https://storage.googleapis.com/kubernetes-release/release/v1.20.4/bin/linux/amd64/kubectl && chmod +x /usr/local/bin/kubectl
|
||||
- curl -Lo /usr/local/bin/kind https://kind.sigs.k8s.io/dl/v0.11.1/kind-linux-amd64 && chmod +x /usr/local/bin/kind
|
||||
- kind create cluster --config=$(pwd)/scripts/kind-config.yaml
|
||||
- kind get kubeconfig|sed -e 's/0.0.0.0/kubernetes/g' > kubeconfig.yaml
|
||||
- export KUBECONFIG=$(pwd)/kubeconfig.yaml
|
||||
- kubectl version
|
||||
- kubectl cluster-info
|
||||
- bash -c "for _i in {0..60}; do kubectl -n default get serviceaccount default -o name > /dev/null 2>&1 && break; sleep 1; done"
|
||||
- bash -c "for _i in {0..60}; do kubectl get nodes|grep -w Ready > /dev/null 2>&1 && break; sleep 1; done"
|
||||
# Install helm latest version instead of pre-installed one in registry.gitlab.com/gitlab-org/gitlab-build-images image
|
||||
- curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
|
||||
# Run tests
|
||||
- bash -x scripts/integration.sh
|
||||
after_script:
|
||||
- export KUBECONFIG=$(pwd)/kubeconfig.yaml
|
||||
- bash -x scripts/integration_cleanup.sh
|
||||
tags:
|
||||
- gitlab-org-docker
|
||||
|
||||
release development:
|
||||
extends:
|
||||
- .rules:release:development
|
||||
stage: release
|
||||
script:
|
||||
- helm package .
|
||||
artifacts:
|
||||
paths:
|
||||
- gitlab-runner*.tgz
|
||||
expire_in: 7d
|
||||
allow_failure: true
|
||||
|
||||
release beta:
|
||||
extends:
|
||||
- .rules:release:beta
|
||||
stage: release
|
||||
variables:
|
||||
S3_URL: s3://${S3_BUCKET}${S3_PATH}
|
||||
REPO_URL: https://${S3_BUCKET}.s3.amazonaws.com${S3_PATH}
|
||||
script:
|
||||
- apk add --no-cache py-pip
|
||||
- pip install awscli
|
||||
- 'beta_info=$(git describe --long | sed -r "s/v[0-9\.]+(-rc[0-9]+)?-//")'
|
||||
- 'build_time=$(date +%s)'
|
||||
- 'sed -r "s/(version: [0-9\.]+-beta)/\1-${build_time}-${beta_info}/" -i Chart.yaml'
|
||||
- 'sed -r "s/appVersion: .*/appVersion: bleeding/" -i Chart.yaml'
|
||||
- 'sed -r "s/imagePullPolicy: IfNotPresent/imagePullPolicy: Always/" -i values.yaml'
|
||||
- mkdir -p public/
|
||||
- aws s3 cp ${S3_URL}/index.yaml public/index.yaml || true
|
||||
- (cd public; helm package ../)
|
||||
- helm repo index public --merge public/index.yaml --url ${REPO_URL}
|
||||
- aws s3 sync public ${S3_URL} --acl public-read
|
||||
- 'echo "To install repository run: helm repo add gitlab-runner-beta ${REPO_URL} && helm repo update"'
|
||||
|
||||
release stable:
|
||||
extends:
|
||||
- .rules:release:stable
|
||||
stage: release
|
||||
image: alpine:3.14
|
||||
script:
|
||||
- apk add --no-cache curl
|
||||
- curl --fail-with-body
|
||||
--request POST
|
||||
--form "token=$CI_JOB_TOKEN"
|
||||
--form ref=master
|
||||
--form "variables[CHART_NAME]=$CI_PROJECT_NAME"
|
||||
--form "variables[RELEASE_REF]=$CI_COMMIT_REF_NAME"
|
||||
https://gitlab.com/api/v4/projects/2860651/trigger/pipeline
|
||||
|
||||
trigger charts update:
|
||||
extends:
|
||||
- .rules:release:stable
|
||||
stage: post-release
|
||||
image: alpine:3.14
|
||||
script:
|
||||
- apk add --no-cache curl
|
||||
- curl --fail-with-body
|
||||
--request POST
|
||||
--form "token=${GITLAB_CHARTS_TRIGGER_TOKEN}"
|
||||
--form ref=master
|
||||
--form "variables[DEPS_PIPELINE]=true"
|
||||
https://gitlab.com/api/v4/projects/3828396/trigger/pipeline
|
||||
needs:
|
||||
- job: release stable
|
||||
|
||||
##############
|
||||
# Includes #
|
||||
##############
|
||||
include:
|
||||
- template: Security/Dependency-Scanning.gitlab-ci.yml
|
||||
|
|
@ -1,58 +0,0 @@
|
|||
.new-runner-version-changelog: &new-runner-version-changelog
|
||||
changelog_entry:
|
||||
scope: new-feature
|
||||
entry: Update GitLab Runner version to v{{ .Release.AppVersion }}
|
||||
|
||||
.update-chart-versions: &update-chart-versions
|
||||
write:
|
||||
file: Chart.yaml
|
||||
contents: |
|
||||
apiVersion: v1
|
||||
name: gitlab-runner
|
||||
version: {{ .Release.Version }}
|
||||
appVersion: {{ .Release.AppVersion }}
|
||||
description: GitLab Runner
|
||||
keywords:
|
||||
- git
|
||||
- ci
|
||||
- deploy
|
||||
sources:
|
||||
- https://gitlab.com/gitlab-org/charts/gitlab-runner
|
||||
- https://gitlab.com/gitlab-org/gitlab-runner
|
||||
- https://docs.gitlab.com/runner/
|
||||
icon: https://gitlab.com/uploads/-/system/project/avatar/250833/runner_logo.png
|
||||
maintainers:
|
||||
- name: GitLab Inc.
|
||||
email: support@gitlab.com
|
||||
|
||||
.commit-chart-versions: &commit-chart-versions
|
||||
commit:
|
||||
files: [Chart.yaml]
|
||||
message: Update Chart version to v{{ .Release.Version }} and used GitLab Runner version to v{{ .Release.AppVersion }}
|
||||
|
||||
.update-chart-versions-after-merge: &update-chart-versions-after-merge
|
||||
write:
|
||||
file: Chart.yaml
|
||||
contents: |
|
||||
apiVersion: v1
|
||||
name: gitlab-runner
|
||||
version: {{ .Release.VersionObject.NextMinor }}-beta
|
||||
appVersion: bleeding
|
||||
description: GitLab Runner
|
||||
keywords:
|
||||
- git
|
||||
- ci
|
||||
- deploy
|
||||
sources:
|
||||
- https://gitlab.com/gitlab-org/charts/gitlab-runner
|
||||
- https://gitlab.com/gitlab-org/gitlab-runner
|
||||
- https://docs.gitlab.com/runner/
|
||||
icon: https://gitlab.com/uploads/-/system/project/avatar/250833/runner_logo.png
|
||||
maintainers:
|
||||
- name: GitLab Inc.
|
||||
email: support@gitlab.com
|
||||
|
||||
.commit-chart-versions-after-merge: &commit-chart-versions-after-merge
|
||||
commit:
|
||||
files: [Chart.yaml]
|
||||
message: Update Chart version to v{{ .Release.VersionObject.NextMinor }}-beta and used GitLab Runner version to bleeding
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
include:
|
||||
- .common.release.yml
|
||||
|
||||
actions:
|
||||
- *new-runner-version-changelog
|
||||
- *update-chart-versions
|
||||
- *commit-chart-versions
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
include:
|
||||
- .common.release.yml
|
||||
|
||||
actions:
|
||||
- *new-runner-version-changelog
|
||||
|
|
@ -1,53 +0,0 @@
|
|||
default_scope: other
|
||||
names:
|
||||
new-feature: New features
|
||||
security-fix: Security fixes
|
||||
fix: Bug fixes
|
||||
maintenance: Maintenance
|
||||
runner-distribution: GitLab Runner distribution
|
||||
documentation: Documentation changes
|
||||
other: Other changes
|
||||
order:
|
||||
- new-feature
|
||||
- security-fix
|
||||
- fix
|
||||
- maintenance
|
||||
- runner-distribution
|
||||
- documentation
|
||||
- other
|
||||
label_matchers:
|
||||
- labels:
|
||||
- runner-distribution
|
||||
scope: runner-distribution
|
||||
- labels:
|
||||
- feature::addition
|
||||
scope: new-feature
|
||||
- labels:
|
||||
- security
|
||||
scope: security-fix
|
||||
- labels:
|
||||
- type::bug
|
||||
scope: fix
|
||||
- labels:
|
||||
- type::maintenance
|
||||
scope: maintenance
|
||||
- labels:
|
||||
- feature::enhancement
|
||||
scope: new-feature
|
||||
- labels:
|
||||
- maintenance::refactor
|
||||
scope: maintenance
|
||||
- labels:
|
||||
- maintenance::pipelines
|
||||
scope: maintenance
|
||||
- labels:
|
||||
- maintenance::workflow
|
||||
scope: maintenance
|
||||
- labels:
|
||||
- documentation
|
||||
scope: documentation
|
||||
authorship_labels:
|
||||
- Community contribution
|
||||
skip_changelog_labels:
|
||||
- skip-changelog
|
||||
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
include:
|
||||
- .common.release.yml
|
||||
|
||||
actions:
|
||||
- *update-chart-versions-after-merge
|
||||
- *commit-chart-versions-after-merge
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
|
||||
gitlab-runner*.tgz
|
||||
scripts/
|
||||
|
|
@ -1,568 +0,0 @@
|
|||
## v0.52.0 (2023-04-22)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to v15.11.0
|
||||
|
||||
### Bug fixes
|
||||
|
||||
- Enable ability to use tini instead of dumb-init !385
|
||||
- Invalid yaml when creating service account with no annotations !381 (Zev Isert @zevisert)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Fix failure in integration tests !390
|
||||
- Add merge release config to be executed after stable branches are merged into the main branch !387
|
||||
|
||||
## v0.48.0 (2022-12-17)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 15.7.0
|
||||
|
||||
## v0.47.0 (2022-11-22)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 15.6.0
|
||||
|
||||
## v0.46.0 (2022-10-21)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 15.5.0
|
||||
|
||||
## v0.45.0 (2022-09-21)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 15.4.0
|
||||
- Add secrets update permission to RBAC example provided !349 (Tim Hobbs @hobti01)
|
||||
|
||||
### Bug fixes
|
||||
|
||||
- Revert "Merge branch 'feature/unregister-one-runner' into 'main'" !362
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Fix the pipeline being blocked by development release !357
|
||||
- Docs: Update values.yaml comments to reference kubernetes service accounts docs !310
|
||||
|
||||
## v0.44.0 (2022-08-19)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 15.3.0
|
||||
- Add secrets update permission to RBAC example provided !349 (Tim Hobbs @hobti01)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Fix the pipeline being blocked by development release !357
|
||||
|
||||
### Documentation changes
|
||||
|
||||
- Docs: Update values.yaml comments to reference kubernetes service accounts docs !310
|
||||
|
||||
## v0.43.0 (2022-07-20)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 15.2.0
|
||||
|
||||
### Documentation changes
|
||||
|
||||
- Fix some dead links !356 (Ben Bodenmiller @bbodenmiller)
|
||||
|
||||
## v0.42.0 (2022-06-20)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 15.1.0
|
||||
- Add priority classname !350
|
||||
- Update namespaces to be consistent across manifests !343 (blacktide @blacktide)
|
||||
- Add freely configurable securityContext to deployment !354
|
||||
- Add possibility to overwrite default image registry !351 (Patrik Votoček @vrtak-cz)
|
||||
- Make session server service annotations configurable !336 (Matthias Baur @m.baur)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Add volume and volumeMount support to runner deployment !348
|
||||
- ci: Update Helm from 3.4.1 to 3.7.2 !347 (Takuya Noguchi @tnir)
|
||||
- Update Docker to 20.10 on integration test !346 (Takuya Noguchi @tnir)
|
||||
- Update default registry to GitLab Runner registry !345
|
||||
- Update casing of GitLab in values YAML file !344 (Ben Bodenmiller @bbodenmiller)
|
||||
- Remove unneeded rbac role !335 (Matthias Baur @m.baur)
|
||||
|
||||
## v0.41.0 (2022-05-19)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 15.0.0
|
||||
- Add the ability to unregister only one runner !329 (LAKostis @LAKostis)
|
||||
- Remove init container and instead project secrets !312
|
||||
- Don't repeat chart name if release name starts with the chart name !232 (Ahmadali Shafiee @ahmadalli)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Use Helm 3 instead of 2.16.9 on lint/release jobs !342 (Takuya Noguchi @tnir)
|
||||
|
||||
## v0.40.0 (2022-04-20)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 14.10.0
|
||||
- Add the possibility to configure maximum timeout that will be set for jobs when using the runner !341 (Adrien Gooris @adrien.gooris)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Add a post-release CI job to trigger a deps pipeline in Charts repo !339
|
||||
- Add helm install integration test !326
|
||||
- Make loadBalancerSourceRanges of Session Server configurable !334 (Matthias Baur @m.baur)
|
||||
|
||||
## v0.39.0 (2022-03-21)
|
||||
|
||||
### New Features
|
||||
|
||||
- Update GitLab Runner version to 14.9.0
|
||||
|
||||
### Bug fixes
|
||||
|
||||
- Disable metrics endpoint by default !337
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Update labels according to latest taxonomy !338
|
||||
|
||||
## v0.38.1 (2022-03-02)
|
||||
|
||||
### New Features
|
||||
|
||||
- Update GitLab Runner version to 14.8.2
|
||||
|
||||
## v0.38.0 (2022-02-21)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Fix urls with runners configuration information !314 (Dmitriy Stoyanov @DmitriyStoyanov)
|
||||
- k8s rbac: add more resources in comment. !307 (Chen Yufei @cyfdecyf)
|
||||
- Add dependency scanning to Runner Helm Chart project !331
|
||||
|
||||
## v0.37.2 (2022-01-24)
|
||||
|
||||
### Bug fixes
|
||||
|
||||
- Fix appVersion to 14.7.0
|
||||
|
||||
## v0.37.1 (2022-01-20)
|
||||
|
||||
### Bug fixes
|
||||
|
||||
- Set sessionServer to false by default !332
|
||||
|
||||
## v0.37.0 (2022-01-19)
|
||||
|
||||
### New Features
|
||||
|
||||
- Update GitLab Runner version to 14.7.0
|
||||
- Add support for interactive web terminal !320
|
||||
|
||||
## v0.36.0 (2021-12-18)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 14.6.0
|
||||
|
||||
### Bug fixes
|
||||
|
||||
- Fix prometheus annotation unquoted value !323
|
||||
|
||||
### GitLab Runner distribution
|
||||
|
||||
- Fix the security release rule in .gitlab-ci.yml !324
|
||||
- Fail the stable release job on curl failures !322
|
||||
|
||||
## v0.35.3 (2021-12-13)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Fix prometheus annotation unquoted value !323
|
||||
|
||||
## v0.35.2 (2021-12-10)
|
||||
|
||||
### Security
|
||||
|
||||
- Update GitLab Runner version to 14.5.2
|
||||
|
||||
## v0.35.1 (2021-12-01)
|
||||
|
||||
### Security
|
||||
|
||||
- Update GitLab Runner version to 14.5.1
|
||||
|
||||
## v0.35.0 (2021-11-21)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 14.5.0
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Don't run pipelines only for MRs !318
|
||||
- Update changelog generator configuration !317
|
||||
- Adds configurable value probeTimeoutSeconds !306 (Kyle Wetzler @kwetzler1)
|
||||
|
||||
## v0.34.0-rc1 (2021-10-11)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 14.4.0-rc1
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Disallow setting both replicas and runnerToken !289
|
||||
|
||||
## v0.33.0 (2021-09-29)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 14.3.0
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Update container entrypoint to use `dumb-init` to avoid zombie processes !311 (Georg Lauterbach @georglauterbach)
|
||||
|
||||
## v0.32.0 (2021-08-22)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 14.2.0
|
||||
- Add support for revisionHistoryLimit !299 (Romain Grenet @romain.grenet1)
|
||||
|
||||
## v0.31.0 (2021-07-20)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 14.1.0
|
||||
|
||||
### Bug fixes
|
||||
|
||||
- Only add environment variables if values set !295 (Matthew Warman @mcwarman)
|
||||
|
||||
## v0.30.0 (2021-06-19)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 14.0.0
|
||||
|
||||
### Bug fixes
|
||||
|
||||
- Resolve runner ignores request_concurrency !296
|
||||
|
||||
### Maintenance
|
||||
|
||||
- refactor: change default brach references to main !298
|
||||
- Add support for specifying schedulerName on deployment podspec. !284 (Dominic Bevacqua @dbevacqua)
|
||||
|
||||
## v0.29.0 (2021-05-20)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 13.12.0
|
||||
|
||||
## v0.28.0 (2021-04-20)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 13.11.0
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Pass runners.config through the template engine !290 (Dmitriy @Nevoff89)
|
||||
- Add role support of individual verbs list for different resources !280 (Horatiu Eugen Vlad @hvlad)
|
||||
- Use runner namespace for role and role binding if it is specified !256 (Alex Sears @searsaw)
|
||||
- Add optional configuration values for pod security context `runAsUser` and `supplementalGroups` !242 (Horatiu Eugen Vlad @hvlad)
|
||||
|
||||
### Documentation changes
|
||||
|
||||
- docs: add notice that we run tpl on runner config !291
|
||||
- Add comment on imagePullPolicy !288
|
||||
|
||||
## v0.27.0 (2021-03-21)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 13.10.0
|
||||
- Allow setting deployment replicas !286
|
||||
- Add support for specify ConfigMaps for gitlab-runner deployment !285
|
||||
- Allow to mount arbitrary Kubernetes secrets !283
|
||||
|
||||
## v0.26.0 (2021-02-22)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 13.9.0
|
||||
- Make executor configurable !273 (Matthias Baur @m.baur)
|
||||
|
||||
### Other changes
|
||||
|
||||
- Typo fix !282 (Ben Bodenmiller @bbodenmiller)
|
||||
|
||||
## v0.25.0 (2021-01-20)
|
||||
|
||||
### New features
|
||||
|
||||
- Support secrets for Azure cache !277
|
||||
- Update GitLab Runner version to 13.8.0
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Fix release CI stage failing due to Helm stable deprecation !278
|
||||
- Update GitLab Changelog configuration !275
|
||||
|
||||
### Documentation changes
|
||||
|
||||
- Update link to doc in README.md !276
|
||||
|
||||
## v0.24.0 (2020-12-21)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 13.7.0
|
||||
- add optional 'imagePullSecrets' to deployment !269 (Christian Schoofs @schoofsc)
|
||||
|
||||
### Other changes
|
||||
|
||||
- Make description configruable !229 (Matthias Baur @m.baur)
|
||||
|
||||
## v0.23.0 (2020-11-21)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 13.6.0
|
||||
- Allow user to specify any runner configuraton !271
|
||||
|
||||
## v0.22.0 (2020-10-20)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 13.5.0
|
||||
- Add pull secrets to service account for runner image !241 (Horatiu Eugen Vlad @hvlad)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Set allowPrivilegeEscalation to false for gitlab-runner pod !243 (Horatiu Eugen Vlad @hvlad)
|
||||
|
||||
### Documentation changes
|
||||
|
||||
- Add comment on ubuntu image & securityContext !260
|
||||
|
||||
## v0.21.0 (2020-09-21)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Update GitLab Runner version to 13.4.0
|
||||
- Fix changelog generator config to catch all maintenance related labels !255
|
||||
|
||||
### Other changes
|
||||
|
||||
- Add scripts/security-harness script !258
|
||||
|
||||
## v0.20.0 (2020-08-20)
|
||||
|
||||
### New features
|
||||
|
||||
- Update GitLab Runner version to 13.3.0
|
||||
- Enable custom commands !250
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Add `release stable` job for security fork !252
|
||||
- Update changelog generator to accept new labels !249
|
||||
|
||||
## v0.19.0 (2020-07-20)
|
||||
|
||||
### New features
|
||||
|
||||
- Allow user to define PodSecurityPolicy !184 (Paweł Kalemba @pkalemba)
|
||||
- Update GitLab Runner version to 13.2.0
|
||||
|
||||
### Documentation changes
|
||||
|
||||
- Fix external links within values.yaml !248 (Alexandre Jardin @alexandre.jardin)
|
||||
|
||||
## v0.18.0 (2020-06-19)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Update GitLab Runner version to 13.1.0
|
||||
|
||||
### Other changes
|
||||
|
||||
- Fix unregister when using token secret !231 (Bernd @arabus)
|
||||
- Support specifying pod security context. !219 (Chen Yufei @cyfdecyf)
|
||||
|
||||
## v0.17.1 (2020-06-01)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Update GitLab Runner version to 13.0.1
|
||||
|
||||
## v0.17.0 (2020-05-20)
|
||||
|
||||
### New features
|
||||
|
||||
- Expose settings for kubernetes resource limits and requests overwrites !220 (Alexander Petermann @lexxxel)
|
||||
- Add support for setting Node Tolerations !188 (Zeyu Ye @Shuliyey)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Update GitLab Runner version to 13.0.0
|
||||
- Update package name in note !234
|
||||
- Pin CI jobs to gitlab-org runners !222
|
||||
|
||||
## v0.16.0 (2020-04-22)
|
||||
|
||||
### New features
|
||||
|
||||
- Add Service Account annotation support !211 (David Rosson @davidrosson)
|
||||
|
||||
### Bug fixes
|
||||
|
||||
- Support correct spelling of GCS secret !214 (Arthur Wiebe @arthur65)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Remove dependency of `gitlab-runner-builder` runner !221
|
||||
- Fix linting for forks with a different name than "gitlab-runner" !218
|
||||
- Install gitlab-changelog installation !217
|
||||
|
||||
### Other changes
|
||||
|
||||
- Update GitLab Runner version to 12.10.1
|
||||
- Change listen address to not force IPv6 !213 (Fábio Matavelli @fabiomatavelli)
|
||||
|
||||
## v0.15.0 (2020-03-20)
|
||||
|
||||
### Maintenance
|
||||
|
||||
- Update GitLab Runner version to 12.9.0
|
||||
- Update changelog generator configuration !212
|
||||
- Replace changelog entries generation script !209
|
||||
|
||||
### Other changes
|
||||
|
||||
- Fix values.yaml typo !210 (Brian Choy @bycEEE)
|
||||
|
||||
## v0.14.0 (2020-02-22)
|
||||
|
||||
- Update GitLab Runner version to 12.8.0
|
||||
|
||||
## v0.13.0 (2020-01-20)
|
||||
|
||||
- Add podLabels to the deployment !198
|
||||
- Mount custom-certs in configure init container !202
|
||||
|
||||
## v0.12.0 (2019-12-22)
|
||||
|
||||
- Add `apiVersion: v1` to chart.yaml !195
|
||||
- Add documentation to protected Runners !193
|
||||
- Make securityContext configurable !199
|
||||
- Update GitLab Runner version to 12.6.0
|
||||
|
||||
## v0.11.0 (2019-11-20)
|
||||
|
||||
- Variables for RUNNER_OUTPUT_LIMIT, and KUBERNETES_POLL_TIMEOUT !50
|
||||
- Add support for register protected Runners !185
|
||||
|
||||
## v0.10.1 (2019-10-28)
|
||||
|
||||
- Update GitLab Runner to 12.4.1
|
||||
|
||||
## v0.10.0 (2019-10-21)
|
||||
|
||||
- Updated GitLab Runner to 12.4.0
|
||||
- Use updated project path to release helm chart !172
|
||||
- Update resources API to stable verson !167
|
||||
- Add support for specifying log format !170
|
||||
- Use the cache.secret template to check if the secretName is set !166
|
||||
- Drop need for helm force update for now !181
|
||||
- Fix image version detection for old helm versions !173
|
||||
|
||||
## v0.9.0 (2019-09-20)
|
||||
|
||||
- Use updated project path to release helm chart !172
|
||||
- Enabling horizontal pod auto-scaling based on custom metrics !127
|
||||
- Change base image used for CI jobs !156
|
||||
- Remove DJ as a listed chart maintainer !160
|
||||
- Release beta version on master using Bleeding Edge image !155
|
||||
- Update definition of 'release beta' CI jobs !164
|
||||
- Fix certs path in the comment in values file !148
|
||||
- Implement support for run-untagged option !140
|
||||
- Use new location for helm charts repo !162
|
||||
- Follow-up to adding run-untagged support !165
|
||||
|
||||
## v0.8.0 (2019-08-22)
|
||||
|
||||
- Add suport for graceful stop !150
|
||||
|
||||
## v0.7.0 (2019-07-22)
|
||||
|
||||
- Fix broken anchor link for gcs cache docs !135
|
||||
- Allow user to set rbac roles !112
|
||||
- Bump used Runner version to 12.1.0 !149
|
||||
|
||||
## v0.6.0 (2019-06-24)
|
||||
|
||||
- Allow to manually build the package for development branches !120
|
||||
- When configuring cache: if no S3 secret assume IAM role !111
|
||||
- Allow to define request_concurrency value !121
|
||||
- Bump used Runner version to 12.0.0 !138
|
||||
|
||||
## v0.5.0 (2019-05-22)
|
||||
|
||||
- Bump used Runner version to 11.11.0 !126
|
||||
|
||||
## v0.4.1 (2019-04-24)
|
||||
|
||||
- Bump used Runner version to 11.10.1 !113
|
||||
|
||||
## v0.4.0 (2019-04-22)
|
||||
|
||||
- Bump used Runner version to 11.10.0-rc2 !108
|
||||
- Fix a typo in values.yaml !101
|
||||
- Add pod labels for jobs !98
|
||||
- add hostAliases for pod assignment !89
|
||||
- Configurable deployment annotations !44
|
||||
- Add pod annotations for jobs !97
|
||||
- Bump used Runner version to 11.10.0-rc1 !107
|
||||
|
||||
## v0.3.0 (2019-03-22)
|
||||
|
||||
- Change mount of secret with S3 distributed cache credentials !64
|
||||
- Add environment variables to runner !48
|
||||
- Replace S3_CACHE_INSECURE with CACHE_S3_INSECURE !90
|
||||
- Update values.yaml to remove invalid anchor in comments !85
|
||||
- Bump used Runner version to 11.9.0 !102
|
||||
|
||||
## v0.2.0 (2019-02-22)
|
||||
|
||||
- Fix the error caused by unset 'locked' value !79
|
||||
- Create LICENSE file !76
|
||||
- Add CONTRIBUTING.md file !81
|
||||
- Add plain MIT text into LICENSE and add NOTICE !80
|
||||
- Fix incorrect custom secret documentation !71
|
||||
- Add affinity, nodeSelector and tolerations for pod assignment !56
|
||||
- Ignore scripts directory when buildin helm chart !83
|
||||
- Bump used Runner version to 11.8.0-rc1 !87
|
||||
- Fix year in Changelog - it's already 2019 !84
|
||||
|
||||
## v0.1.45 (2019-01-22)
|
||||
|
||||
- Trigger release only for tagged versions !72
|
||||
- Fixes typos in values.yaml comments !60
|
||||
- Update chart to bring closer to helm standard template !43
|
||||
- Add nodeSelector config parameter for CI job pods !19
|
||||
- Prepare CHANGELOG management !75
|
||||
- Track app version in Chart.yaml !74
|
||||
- Fix the error caused by unset 'locked' value !79
|
||||
- Bump used Runner version to 11.7.0 !82
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
## Developer Certificate of Origin + License
|
||||
|
||||
By contributing to GitLab B.V., You accept and agree to the following terms and
|
||||
conditions for Your present and future Contributions submitted to GitLab B.V.
|
||||
Except for the license granted herein to GitLab B.V. and recipients of software
|
||||
distributed by GitLab B.V., You reserve all right, title, and interest in and to
|
||||
Your Contributions. All Contributions are subject to the following DCO + License
|
||||
terms.
|
||||
|
||||
[DCO + License](https://gitlab.com/gitlab-org/dco/blob/master/README.md)
|
||||
|
||||
All Documentation content that resides under the [docs/ directory](/docs) of this
|
||||
repository is licensed under Creative Commons:
|
||||
[CC BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/).
|
||||
|
||||
_This notice should stay as the first item in the CONTRIBUTING.md file._
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
apiVersion: v1
|
||||
appVersion: 15.11.0
|
||||
description: GitLab Runner
|
||||
icon: https://gitlab.com/uploads/-/system/project/avatar/250833/runner_logo.png
|
||||
keywords:
|
||||
- git
|
||||
- ci
|
||||
- deploy
|
||||
maintainers:
|
||||
- email: support@gitlab.com
|
||||
name: GitLab Inc.
|
||||
name: gitlab-runner
|
||||
sources:
|
||||
- https://gitlab.com/gitlab-org/charts/gitlab-runner
|
||||
- https://gitlab.com/gitlab-org/gitlab-runner
|
||||
- https://docs.gitlab.com/runner/
|
||||
version: 0.52.0
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
The MIT License (MIT)
|
||||
|
||||
Copyright (c) 2018-2019 GitLab B.V.
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in
|
||||
all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
THE SOFTWARE.
|
||||
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
GITLAB_CHANGELOG_VERSION ?= master
|
||||
GITLAB_CHANGELOG = .tmp/gitlab-changelog-$(GITLAB_CHANGELOG_VERSION)
|
||||
|
||||
.PHONY: generate_changelog
|
||||
generate_changelog: export CHANGELOG_RELEASE ?= dev
|
||||
generate_changelog: $(GITLAB_CHANGELOG)
|
||||
# Generating new changelog entries
|
||||
@$(GITLAB_CHANGELOG) -project-id 6329679 \
|
||||
-release $(CHANGELOG_RELEASE) \
|
||||
-starting-point-matcher "v[0-9]*.[0-9]*.[0-9]*" \
|
||||
-config-file .gitlab/changelog.yml \
|
||||
-changelog-file CHANGELOG.md
|
||||
|
||||
$(GITLAB_CHANGELOG): OS_TYPE ?= $(shell uname -s | tr '[:upper:]' '[:lower:]')
|
||||
$(GITLAB_CHANGELOG): DOWNLOAD_URL = "https://storage.googleapis.com/gitlab-runner-tools/gitlab-changelog/$(GITLAB_CHANGELOG_VERSION)/gitlab-changelog-$(OS_TYPE)-amd64"
|
||||
$(GITLAB_CHANGELOG):
|
||||
# Installing $(DOWNLOAD_URL) as $(GITLAB_CHANGELOG)
|
||||
@mkdir -p $(shell dirname $(GITLAB_CHANGELOG))
|
||||
@curl -sL "$(DOWNLOAD_URL)" -o "$(GITLAB_CHANGELOG)"
|
||||
@chmod +x "$(GITLAB_CHANGELOG)"
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
With regard to the GitLab Software:
|
||||
|
||||
The MIT License (MIT)
|
||||
|
||||
Copyright (c) 2018-2019 GitLab B.V.
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in
|
||||
all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
THE SOFTWARE.
|
||||
|
||||
---
|
||||
|
||||
For all third party components incorporated into the GitLab Software, those
|
||||
components are licensed under the original license provided by the owner of the
|
||||
applicable component.
|
||||
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
# GitLab Runner Helm Chart
|
||||
|
||||
This chart deploys a GitLab Runner instance into your Kubernetes
|
||||
cluster. For more information, please review [our documentation](https://docs.gitlab.com/charts/charts/gitlab/gitlab-runner).
|
||||
|
|
@ -1,36 +0,0 @@
|
|||
{{- if include "gitlab-runner.gitlabUrl" . }}
|
||||
Your GitLab Runner should now be registered against the GitLab instance reachable at: {{ include "gitlab-runner.gitlabUrl" . }}
|
||||
{{- else -}}
|
||||
#############################################################################################
|
||||
## WARNING: You did not specify an gitlabUrl in your 'helm install' call. ##
|
||||
#############################################################################################
|
||||
|
||||
This deployment will be incomplete until you provide the URL that your
|
||||
GitLab instance is reachable at:
|
||||
|
||||
helm upgrade {{ .Release.Name }} \
|
||||
--set gitlabUrl=http://gitlab.your-domain.com,runnerRegistrationToken=your-registration-token \
|
||||
gitlab/gitlab-runner
|
||||
{{- end -}}
|
||||
|
||||
{{- if not .Values.runners.config }}
|
||||
#############################################################################################
|
||||
## WARNING: You don't seem to be using the GitLab Runner config template functionality. ##
|
||||
## Configuring the GitLab Runner through that template is recommended as other ##
|
||||
## configuration options will be deprecated in Helm Chart 1.0. Read more at ##
|
||||
## https://docs.gitlab.com/runner/install/kubernetes.html#using-configuration-template. ##
|
||||
#############################################################################################
|
||||
{{- end }}
|
||||
|
||||
{{- $runnerNamespace := regexFind "\\s*namespace\\s*=.+\\s*" (tpl .Values.runners.config $) | regexFind "=.+" | trimPrefix "=" | trim -}}
|
||||
{{- if regexMatch "\\s*namespace\\s*=" .Values.runners.config }}
|
||||
|
||||
Runner namespace {{ $runnerNamespace }} was found in runners.config template.
|
||||
{{- if .Values.runners.namespace }}
|
||||
|
||||
#############################################################################################
|
||||
## WARNING: You have set the namespace in runners.config and also set in deprecated ##
|
||||
## runner.namespace element. The runners.config namespace will be ignored. ##
|
||||
#############################################################################################
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,28 +0,0 @@
|
|||
{{- define "gitlab-runner.cache" }}
|
||||
{{- if .Values.runners.cache.cacheType }}
|
||||
- name: CACHE_TYPE
|
||||
value: {{ default "" .Values.runners.cache.cacheType | quote }}
|
||||
- name: CACHE_PATH
|
||||
value: {{ coalesce .Values.runners.cache.cachePath .Values.runners.cache.s3CachePath | default "" | quote }}
|
||||
{{- if .Values.runners.cache.cacheShared }}
|
||||
- name: CACHE_SHARED
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if eq .Values.runners.cache.cacheType "s3" }}
|
||||
- name: CACHE_S3_SERVER_ADDRESS
|
||||
value: {{ include "gitlab-runner.cache.s3ServerAddress" . }}
|
||||
- name: CACHE_S3_BUCKET_NAME
|
||||
value: {{ default "" .Values.runners.cache.s3BucketName | quote }}
|
||||
- name: CACHE_S3_BUCKET_LOCATION
|
||||
value: {{ default "" .Values.runners.cache.s3BucketLocation | quote }}
|
||||
{{- if .Values.runners.cache.s3CacheInsecure }}
|
||||
- name: CACHE_S3_INSECURE
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.runners.cache.cacheType "gcs" }}
|
||||
- name: CACHE_GCS_BUCKET_NAME
|
||||
value: {{ default "" .Values.runners.cache.gcsBucketName | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
|
@ -1,145 +0,0 @@
|
|||
{{- define "gitlab-runner.runner-env-vars" }}
|
||||
- name: CI_SERVER_URL
|
||||
value: {{ include "gitlab-runner.gitlabUrl" . }}
|
||||
- name: CLONE_URL
|
||||
value: {{ default "" .Values.runners.cloneUrl | quote }}
|
||||
{{- if .Values.runners.requestConcurrency }}
|
||||
- name: RUNNER_REQUEST_CONCURRENCY
|
||||
value: {{ default 1 .Values.runners.requestConcurrency | quote }}
|
||||
{{- end }}
|
||||
- name: RUNNER_EXECUTOR
|
||||
value: {{ default "kubernetes" .Values.runners.executor | quote }}
|
||||
- name: REGISTER_LOCKED
|
||||
{{ if or (not (hasKey .Values.runners "locked")) .Values.runners.locked -}}
|
||||
value: "true"
|
||||
{{- else -}}
|
||||
value: "false"
|
||||
{{- end }}
|
||||
- name: RUNNER_TAG_LIST
|
||||
value: {{ default "" .Values.runners.tags | quote }}
|
||||
{{- if .Values.runners.outputLimit }}
|
||||
- name: RUNNER_OUTPUT_LIMIT
|
||||
value: {{ .Values.runners.outputLimit | quote }}
|
||||
{{- end}}
|
||||
{{- if eq (default "kubernetes" .Values.runners.executor) "kubernetes" }}
|
||||
{{- if .Values.runners.image }}
|
||||
- name: KUBERNETES_IMAGE
|
||||
value: {{ .Values.runners.image | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.privileged }}
|
||||
- name: KUBERNETES_PRIVILEGED
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if or .Values.runners.namespace (not (regexMatch "\\s*namespace\\s*=" .Values.runners.config)) }}
|
||||
- name: KUBERNETES_NAMESPACE
|
||||
value: {{ default .Release.Namespace .Values.runners.namespace | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.pollTimeout }}
|
||||
- name: KUBERNETES_POLL_TIMEOUT
|
||||
value: {{ .Values.runners.pollTimeout | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.builds.cpuLimit }}
|
||||
- name: KUBERNETES_CPU_LIMIT
|
||||
value: {{ .Values.runners.builds.cpuLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.builds.cpuLimitOverwriteMaxAllowed }}
|
||||
- name: KUBERNETES_CPU_LIMIT_OVERWRITE_MAX_ALLOWED
|
||||
value: {{ .Values.runners.builds.cpuLimitOverwriteMaxAllowed | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.builds.memoryLimit }}
|
||||
- name: KUBERNETES_MEMORY_LIMIT
|
||||
value: {{ .Values.runners.builds.memoryLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.builds.memoryLimitOverwriteMaxAllowed }}
|
||||
- name: KUBERNETES_MEMORY_LIMIT_OVERWRITE_MAX_ALLOWED
|
||||
value: {{ .Values.runners.builds.memoryLimitOverwriteMaxAllowed | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.builds.cpuRequests }}
|
||||
- name: KUBERNETES_CPU_REQUEST
|
||||
value: {{ .Values.runners.builds.cpuRequests | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.builds.cpuRequestsOverwriteMaxAllowed }}
|
||||
- name: KUBERNETES_CPU_REQUEST_OVERWRITE_MAX_ALLOWED
|
||||
value: {{ .Values.runners.builds.cpuRequestsOverwriteMaxAllowed | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.builds.memoryRequests }}
|
||||
- name: KUBERNETES_MEMORY_REQUEST
|
||||
value: {{ .Values.runners.builds.memoryRequests| quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.builds.memoryRequestsOverwriteMaxAllowed }}
|
||||
- name: KUBERNETES_MEMORY_REQUEST_OVERWRITE_MAX_ALLOWED
|
||||
value: {{ .Values.runners.builds.memoryRequestsOverwriteMaxAllowed | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.serviceAccountName }}
|
||||
- name: KUBERNETES_SERVICE_ACCOUNT
|
||||
value: {{ .Values.runners.serviceAccountName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.services.cpuLimit }}
|
||||
- name: KUBERNETES_SERVICE_CPU_LIMIT
|
||||
value: {{ .Values.runners.services.cpuLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.services.memoryLimit }}
|
||||
- name: KUBERNETES_SERVICE_MEMORY_LIMIT
|
||||
value: {{ .Values.runners.services.memoryLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.services.cpuRequests }}
|
||||
- name: KUBERNETES_SERVICE_CPU_REQUEST
|
||||
value: {{ .Values.runners.services.cpuRequests | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.services.memoryRequests }}
|
||||
- name: KUBERNETES_SERVICE_MEMORY_REQUEST
|
||||
value: {{ .Values.runners.services.memoryRequests | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.helpers.cpuLimit }}
|
||||
- name: KUBERNETES_HELPER_CPU_LIMIT
|
||||
value: {{ .Values.runners.helpers.cpuLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.helpers.memoryLimit }}
|
||||
- name: KUBERNETES_HELPER_MEMORY_LIMIT
|
||||
value: {{ .Values.runners.helpers.memoryLimit | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.helpers.cpuRequests }}
|
||||
- name: KUBERNETES_HELPER_CPU_REQUEST
|
||||
value: {{ .Values.runners.helpers.cpuRequests | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.helpers.memoryRequests }}
|
||||
- name: KUBERNETES_HELPER_MEMORY_REQUEST
|
||||
value: {{ .Values.runners.helpers.memoryRequests | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.helpers.image }}
|
||||
- name: KUBERNETES_HELPER_IMAGE
|
||||
value: {{ .Values.runners.helpers.image | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.imagePullPolicy }}
|
||||
- name: KUBERNETES_PULL_POLICY
|
||||
value: {{ .Values.runners.imagePullPolicy | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.pod_security_context }}
|
||||
{{- if .Values.runners.pod_security_context.run_as_non_root }}
|
||||
- name: KUBERNETES_POD_SECURITY_CONTEXT_RUN_AS_NON_ROOT
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.runners.pod_security_context.run_as_user }}
|
||||
- name: KUBERNETES_POD_SECURITY_CONTEXT_RUN_AS_USER
|
||||
value: {{ .Values.runners.pod_security_context.run_as_user | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.pod_security_context.run_as_group }}
|
||||
- name: KUBERNETES_POD_SECURITY_CONTEXT_RUN_AS_GROUP
|
||||
value: {{ .Values.runners.pod_security_context.run_as_group | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.pod_security_context.fs_group }}
|
||||
- name: KUBERNETES_POD_SECURITY_CONTEXT_FS_GROUP
|
||||
value: {{ .Values.runners.pod_security_context.fs_group | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.cache -}}
|
||||
{{ include "gitlab-runner.cache" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.envVars -}}
|
||||
{{ range .Values.envVars }}
|
||||
- name: {{ .name }}
|
||||
value: {{ .value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
|
@ -1,108 +0,0 @@
|
|||
{{/* vim: set filetype=mustache: */}}
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "gitlab-runner.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
*/}}
|
||||
{{- define "gitlab-runner.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- if hasPrefix $name .Release.Name -}}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "gitlab-runner.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Define the name of the secret containing the tokens
|
||||
*/}}
|
||||
{{- define "gitlab-runner.secret" -}}
|
||||
{{- default (include "gitlab-runner.fullname" .) .Values.runners.secret | quote -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Define the name of the s3 cache secret
|
||||
*/}}
|
||||
{{- define "gitlab-runner.cache.secret" -}}
|
||||
{{- if .Values.runners.cache.secretName -}}
|
||||
{{- .Values.runners.cache.secretName | quote -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Template for outputing the gitlabUrl
|
||||
*/}}
|
||||
{{- define "gitlab-runner.gitlabUrl" -}}
|
||||
{{- .Values.gitlabUrl | quote -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Template runners.cache.s3ServerAddress in order to allow overrides from external charts.
|
||||
*/}}
|
||||
{{- define "gitlab-runner.cache.s3ServerAddress" }}
|
||||
{{- default "" .Values.runners.cache.s3ServerAddress | quote -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Define the image, using .Chart.AppVersion and GitLab Runner image as a default value
|
||||
*/}}
|
||||
{{- define "gitlab-runner.image" }}
|
||||
{{- if kindIs "string" .Values.image -}}
|
||||
{{- .Values.image }}
|
||||
{{- else -}}
|
||||
{{- $appVersion := ternary "bleeding" (print "v" .Chart.AppVersion) (eq .Chart.AppVersion "bleeding") -}}
|
||||
{{- $appVersionImageTag := printf "alpine-%s" $appVersion -}}
|
||||
{{- $imageTag := default $appVersionImageTag .Values.image.tag -}}
|
||||
{{- printf "%s/%s:%s" .Values.image.registry .Values.image.image $imageTag }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Define the server session timeout, using 1800 as a default value
|
||||
*/}}
|
||||
{{- define "gitlab-runner.server-session-timeout" }}
|
||||
{{- default 1800 .Values.sessionServer.timeout }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Define the server session internal port, using 9000 as a default value
|
||||
*/}}
|
||||
{{- define "gitlab-runner.server-session-external-port" }}
|
||||
{{- default 9000 .Values.sessionServer.externalPort }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Define the server session external port, using 8093 as a default value
|
||||
*/}}
|
||||
{{- define "gitlab-runner.server-session-internal-port" }}
|
||||
{{- default 8093 .Values.sessionServer.internalPort }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Unregister runners on pod stop
|
||||
*/}}
|
||||
{{- define "gitlab-runner.unregisterRunners" -}}
|
||||
{{- if or (and (hasKey .Values "unregisterRunners") .Values.unregisterRunners) (and (not (hasKey .Values "unregisterRunners")) .Values.runnerRegistrationToken) -}}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command: ["/entrypoint", "unregister", "--all-runners"]
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
|
@ -1,236 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "gitlab-runner.fullname" . }}
|
||||
namespace: {{ default .Release.Namespace .Values.runners.namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "gitlab-runner.fullname" . }}
|
||||
chart: {{ include "gitlab-runner.chart" . }}
|
||||
release: "{{ .Release.Name }}"
|
||||
heritage: "{{ .Release.Service }}"
|
||||
data:
|
||||
entrypoint: |
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
mkdir -p /home/gitlab-runner/.gitlab-runner/
|
||||
|
||||
cp /configmaps/config.toml /home/gitlab-runner/.gitlab-runner/
|
||||
|
||||
{{- if and (eq (default 1.0 .Values.replicas) 1.0) .Values.sessionServer .Values.sessionServer.enabled }}
|
||||
quit() {
|
||||
kill -TERM "$child"
|
||||
}
|
||||
|
||||
trap quit QUIT TERM
|
||||
|
||||
sh /configmaps/set-session-server-address &
|
||||
child=$!
|
||||
wait "$child"
|
||||
{{- end }}
|
||||
|
||||
# Set up environment variables for cache
|
||||
if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then
|
||||
export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey)
|
||||
export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey)
|
||||
fi
|
||||
|
||||
if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then
|
||||
export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file"
|
||||
elif [[ -f /secrets/gcs-application-credentials-file ]]; then
|
||||
export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
|
||||
else
|
||||
if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then
|
||||
export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id)
|
||||
# echo -e used to make private key multiline (in google json auth key private key is oneline with \n)
|
||||
export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key))
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then
|
||||
export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name)
|
||||
export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key)
|
||||
fi
|
||||
|
||||
if [[ -f /secrets/runner-registration-token ]]; then
|
||||
export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token)
|
||||
fi
|
||||
|
||||
if [[ -f /secrets/runner-token ]]; then
|
||||
export CI_SERVER_TOKEN=$(cat /secrets/runner-token)
|
||||
fi
|
||||
|
||||
{{- if and (not (empty .Values.runnerToken)) (ne "1" ((default "1" .Values.replicas) | toString)) }}
|
||||
{{- fail "Using a runner token with more than 1 replica is not supported." }}
|
||||
{{- end }}
|
||||
|
||||
# Validate this also at runtime in case the user has set a custom secret
|
||||
if [[ ! -z "$CI_SERVER_TOKEN" && "{{ default 1 .Values.replicas }}" -ne "1" ]]; then
|
||||
echo "Using a runner token with more than 1 replica is not supported."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Register the runner
|
||||
if ! sh /configmaps/register-the-runner; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Run pre-entrypoint-script
|
||||
if ! bash /configmaps/pre-entrypoint-script; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Start the runner
|
||||
exec /entrypoint run --user=gitlab-runner \
|
||||
--working-directory=/home/gitlab-runner
|
||||
|
||||
config.toml: |
|
||||
concurrent = {{ .Values.concurrent }}
|
||||
check_interval = {{ .Values.checkInterval }}
|
||||
log_level = {{ default "info" .Values.logLevel | quote }}
|
||||
{{- if .Values.logFormat }}
|
||||
log_format = {{ .Values.logFormat | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
listen_address = ':9252'
|
||||
{{- end }}
|
||||
{{- if .Values.sentryDsn }}
|
||||
sentry_dsn = "{{ .Values.sentryDsn }}"
|
||||
{{- end }}
|
||||
{{- if and (eq (default 1.0 .Values.replicas) 1.0) .Values.sessionServer .Values.sessionServer.enabled }}
|
||||
[session_server]
|
||||
session_timeout = {{ include "gitlab-runner.server-session-timeout" . }}
|
||||
listen_address = "0.0.0.0:{{ include "gitlab-runner.server-session-internal-port" . }}"
|
||||
advertise_address = "SESSION_SERVER_IP:{{ include "gitlab-runner.server-session-external-port" . }}"
|
||||
{{- end }}
|
||||
|
||||
{{ if .Values.runners.config }}
|
||||
config.template.toml: {{ tpl (toYaml .Values.runners.config) $ | indent 2 }}
|
||||
{{ end }}
|
||||
|
||||
register-the-runner: |
|
||||
#!/bin/bash
|
||||
MAX_REGISTER_ATTEMPTS=30
|
||||
|
||||
for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do
|
||||
echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}"
|
||||
/entrypoint register \
|
||||
{{- range .Values.runners.imagePullSecrets }}
|
||||
--kubernetes-image-pull-secrets {{ . | quote }} \
|
||||
{{- end }}
|
||||
{{- range $key, $val := .Values.runners.nodeSelector }}
|
||||
--kubernetes-node-selector {{ $key | quote }}:{{ $val | quote }} \
|
||||
{{- end }}
|
||||
{{- range .Values.runners.nodeTolerations }}
|
||||
{{- $keyValue := .key }}
|
||||
{{- if eq (.operator | default "Equal") "Equal" }}
|
||||
{{- $keyValue = print $keyValue "=" (.value | default "" ) }}
|
||||
{{- end }}
|
||||
--kubernetes-node-tolerations {{ $keyValue }}:{{ .effect | quote }} \
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.runners.podLabels }}
|
||||
--kubernetes-pod-labels {{ $key | quote }}:{{ $value | quote }} \
|
||||
{{- end }}
|
||||
{{- range $key, $val := .Values.runners.podAnnotations }}
|
||||
--kubernetes-pod-annotations {{ $key | quote }}:{{ $val | quote }} \
|
||||
{{- end }}
|
||||
{{- if and (hasKey .Values.runners "name") .Values.runners.name }}
|
||||
--name={{ .Values.runners.name | quote -}} \
|
||||
{{- end }}
|
||||
{{- if and (hasKey .Values.runners "maximumTimeout") .Values.runners.maximumTimeout }}
|
||||
--maximum-timeout={{ .Values.runners.maximumTimeout | quote -}} \
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.runners.env }}
|
||||
--env {{ $key | quote -}} = {{- $value | quote }} \
|
||||
{{- end }}
|
||||
{{- if and (hasKey .Values.runners "runUntagged") .Values.runners.runUntagged }}
|
||||
--run-untagged=true \
|
||||
{{- end }}
|
||||
{{- if and (hasKey .Values.runners "protected") .Values.runners.protected }}
|
||||
--access-level="ref_protected" \
|
||||
{{- end }}
|
||||
{{- if .Values.runners.pod_security_context }}
|
||||
{{- if .Values.runners.pod_security_context.supplemental_groups }}
|
||||
{{- range $gid := .Values.runners.pod_security_context.supplemental_groups }}
|
||||
--kubernetes-pod-security-context-supplemental-groups {{ $gid | quote }} \
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.runners.config }}
|
||||
--template-config /configmaps/config.template.toml \
|
||||
{{- end }}
|
||||
--non-interactive
|
||||
|
||||
retval=$?
|
||||
|
||||
if [ ${retval} = 0 ]; then
|
||||
break
|
||||
elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
sleep 5
|
||||
done
|
||||
|
||||
exit 0
|
||||
|
||||
check-live: |
|
||||
#!/bin/bash
|
||||
if /usr/bin/pgrep -f .*register-the-runner; then
|
||||
exit 0
|
||||
elif /usr/bin/pgrep gitlab.*runner; then
|
||||
exit 0
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
|
||||
{{- if and (eq (default 1.0 .Values.replicas) 1.0) .Values.sessionServer .Values.sessionServer.enabled }}
|
||||
set-session-server-address: |
|
||||
#!/bin/bash
|
||||
|
||||
{{- if (not .Values.sessionServer.publicIP) }}
|
||||
APISERVER=https://kubernetes.default.svc \
|
||||
&& SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount \
|
||||
&& NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace) \
|
||||
&& TOKEN=$(cat ${SERVICEACCOUNT}/token) \
|
||||
&& CACERT=${SERVICEACCOUNT}/ca.crt \
|
||||
&& header="Authorization: Bearer ${TOKEN}"
|
||||
|
||||
SERVICEURL=${APISERVER}/api/v1/namespaces/${NAMESPACE}/services/{{ include "gitlab-runner.fullname" . }}-session-server
|
||||
|
||||
has_address=false
|
||||
while [ "${has_address}" = false ]; do
|
||||
SERVICEIP=$(curl —-silent \
|
||||
--cacert ${CACERT} \
|
||||
--header "${header}" \
|
||||
-X GET ${SERVICEURL} 2>/dev/null \
|
||||
| grep '"ip":' | cut -d ":" -f2 | xargs)
|
||||
|
||||
# for aws, the hostname is available but not the external IP
|
||||
SERVICEHOSTNAME=$(curl —-silent \
|
||||
--cacert ${CACERT} \
|
||||
--header "${header}" \
|
||||
-X GET ${SERVICEURL} 2>/dev/null \
|
||||
| grep '"hostname":' | cut -d ":" -f2 | xargs)
|
||||
|
||||
ADDRESS="${SERVICEHOSTNAME:-$SERVICEIP}"
|
||||
|
||||
if [ -z "${ADDRESS}" ]
|
||||
then
|
||||
echo "Service LoadBalancer External Address not yet available"
|
||||
has_address=false
|
||||
sleep 5
|
||||
else
|
||||
has_address=true
|
||||
sed -i -e "s/SESSION_SERVER_IP/${ADDRESS}/g" /home/gitlab-runner/.gitlab-runner/config.toml
|
||||
fi
|
||||
done
|
||||
{{- else }}
|
||||
sed -i -e "s/SESSION_SERVER_IP/{{ .Values.sessionServer.publicIP }}/g" /home/gitlab-runner/.gitlab-runner/config.toml
|
||||
{{- end}}
|
||||
{{ end }}
|
||||
|
||||
pre-entrypoint-script: |
|
||||
{{ .Values.preEntrypointScript | default "" | indent 4 }}
|
||||
|
||||
{{ if not (empty .Values.configMaps) }}{{ toYaml .Values.configMaps | indent 2 }}{{ end }}
|
||||
|
|
@ -1,174 +0,0 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "gitlab-runner.fullname" . }}
|
||||
namespace: {{ default .Release.Namespace .Values.runners.namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "gitlab-runner.fullname" . }}
|
||||
chart: {{ include "gitlab-runner.chart" . }}
|
||||
release: "{{ .Release.Name }}"
|
||||
heritage: "{{ .Release.Service }}"
|
||||
spec:
|
||||
{{- if not .Values.hpa}}
|
||||
replicas: {{ default 1 .Values.replicas }}
|
||||
{{- end}}
|
||||
revisionHistoryLimit: {{ default 10 .Values.revisionHistoryLimit }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ include "gitlab-runner.fullname" . }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ include "gitlab-runner.fullname" . }}
|
||||
chart: {{ include "gitlab-runner.chart" . }}
|
||||
release: "{{ .Release.Name }}"
|
||||
heritage: "{{ .Release.Service }}"
|
||||
{{- range $key, $value := .Values.podLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
annotations:
|
||||
checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
||||
checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }}
|
||||
{{- if .Values.metrics.enabled }}
|
||||
prometheus.io/scrape: 'true'
|
||||
prometheus.io/port: {{ .Values.metrics.port | quote }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .Values.podAnnotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.schedulerName }}
|
||||
schedulerName: {{ .Values.schedulerName }}
|
||||
{{- end }}
|
||||
securityContext: {{ toYaml .Values.podSecurityContext | nindent 8 }}
|
||||
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: {{ .Values.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ if .Values.rbac.create }}{{ include "gitlab-runner.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }}
|
||||
containers:
|
||||
- name: {{ include "gitlab-runner.fullname" . }}
|
||||
image: {{ include "gitlab-runner.image" . }}
|
||||
imagePullPolicy: {{ default "" .Values.imagePullPolicy | quote }}
|
||||
securityContext: {{ toYaml .Values.securityContext | nindent 10 }}
|
||||
{{- include "gitlab-runner.unregisterRunners" . | nindent 8 }}
|
||||
{{- if .Values.useTini }}
|
||||
command: ["/usr/local/bin/tini", "--", "/bin/bash", "/configmaps/entrypoint"]
|
||||
{{- else }}
|
||||
command: ["/usr/bin/dumb-init", "--", "/bin/bash", "/configmaps/entrypoint"]
|
||||
{{- end }}
|
||||
env:
|
||||
{{ include "gitlab-runner.runner-env-vars" . | indent 8 }}
|
||||
livenessProbe:
|
||||
exec:
|
||||
command: ["/bin/bash", "/configmaps/check-live"]
|
||||
initialDelaySeconds: 60
|
||||
timeoutSeconds: {{ default 1 .Values.probeTimeoutSeconds }}
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ["/usr/bin/pgrep","gitlab.*runner"]
|
||||
initialDelaySeconds: 10
|
||||
timeoutSeconds: {{ default 1 .Values.probeTimeoutSeconds }}
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
ports:
|
||||
- name: {{ .Values.metrics.portName | quote }}
|
||||
containerPort: {{ .Values.metrics.port }}
|
||||
{{- if and (eq (default 1.0 .Values.replicas) 1.0) .Values.sessionServer .Values.sessionServer.enabled }}
|
||||
- name: session-server
|
||||
containerPort: {{ include "gitlab-runner.server-session-internal-port" . }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: projected-secrets
|
||||
mountPath: /secrets
|
||||
- name: etc-gitlab-runner
|
||||
mountPath: /home/gitlab-runner/.gitlab-runner
|
||||
- name: configmaps
|
||||
mountPath: /configmaps
|
||||
{{- if .Values.certsSecretName }}
|
||||
- name: custom-certs
|
||||
readOnly: true
|
||||
mountPath: /home/gitlab-runner/.gitlab-runner/certs/
|
||||
{{- end }}
|
||||
{{- if .Values.volumeMounts }}
|
||||
{{ toYaml .Values.volumeMounts | indent 8 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 10 }}
|
||||
volumes:
|
||||
- name: runner-secrets
|
||||
emptyDir:
|
||||
medium: "Memory"
|
||||
- name: etc-gitlab-runner
|
||||
emptyDir:
|
||||
medium: "Memory"
|
||||
- name: projected-secrets
|
||||
projected:
|
||||
sources:
|
||||
{{- if .Values.runners.cache.cacheType }}
|
||||
# .Values.runners.cache.cacheType is deprecated: https://gitlab.com/gitlab-org/charts/gitlab-runner/-/issues/224
|
||||
{{- end }}
|
||||
|
||||
{{- if and .Values.runners.cache .Values.runners.cache.cacheType }}
|
||||
{{- if and (include "gitlab-runner.cache.secret" .) (eq .Values.runners.cache.cacheType "s3") }}
|
||||
- secret:
|
||||
name: {{ include "gitlab-runner.cache.secret" . }}
|
||||
{{- end }}
|
||||
{{- if eq .Values.runners.cache.cacheType "gcs"}}
|
||||
- secret:
|
||||
# Outdated default secret "s3access" kept for compatibilty with older installs using it.
|
||||
# Will be removed in next major release: https://gitlab.com/gitlab-org/charts/gitlab-runner/merge_requests/177
|
||||
name: {{ default "s3access" (include "gitlab-runner.cache.secret" .) }}
|
||||
{{- end }}
|
||||
{{- else if include "gitlab-runner.cache.secret" . }}
|
||||
- secret:
|
||||
name: {{ include "gitlab-runner.cache.secret" . }}
|
||||
{{- end }}
|
||||
- secret:
|
||||
name: {{ include "gitlab-runner.secret" . }}
|
||||
items:
|
||||
- key: runner-registration-token
|
||||
path: runner-registration-token
|
||||
- key: runner-token
|
||||
path: runner-token
|
||||
|
||||
{{- range .Values.secrets }}
|
||||
- secret:
|
||||
{{ toYaml . | indent 16 }}
|
||||
{{- end }}
|
||||
{{- if .Values.certsSecretName }}
|
||||
- name: custom-certs
|
||||
secret:
|
||||
secretName: {{ .Values.certsSecretName }}
|
||||
{{- end }}
|
||||
- name: configmaps
|
||||
configMap:
|
||||
name: {{ include "gitlab-runner.fullname" . }}
|
||||
{{- if .Values.volumes }}
|
||||
{{ toYaml .Values.volumes | indent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{ toYaml .Values.imagePullSecrets | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml .Values.affinity | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.hostAliases }}
|
||||
hostAliases:
|
||||
{{ toYaml .Values.hostAliases | indent 8 }}
|
||||
{{- end }}
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
{{- if .Values.hpa}}
|
||||
apiVersion: autoscaling/v2beta1
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ include "gitlab-runner.fullname" . }}
|
||||
namespace: {{ default .Release.Namespace .Values.runners.namespace | quote }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ include "gitlab-runner.fullname" . }}
|
||||
minReplicas: {{ default 1 .Values.hpa.minReplicas }}
|
||||
maxReplicas: {{ default 1 .Values.hpa.maxReplicas }}
|
||||
metrics:
|
||||
{{ toYaml .Values.hpa.metrics | indent 2 }}
|
||||
{{- end}}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue