Skip to content

Commit e7f1634

Browse files
YuryHrytsukYuryHrytsuk
committed
First policy draft
1 parent bb22fc6 commit e7f1634

File tree

10 files changed

+250
-131
lines changed

10 files changed

+250
-131
lines changed

‎charts/cert-manager/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/cert-manager/Chart.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
apiVersion: v2
2+
name: cert-manager
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 1.15.3
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "1.15.3"
25+
26+
dependencies:
27+
- name: cert-manager
28+
version: 1.15.3
29+
repository: "https://charts.jetstack.io"

‎charts/cert-manager/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
## Network policy

‎charts/cert-manager/templates/NOTES.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
This is a wrap around the cert-manager Helm chart.

‎charts/cert-manager/templates/networkpolicy.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# https://cert-manager.io/docs/installation/best-practice/#network-requirements
2+
apiVersion: projectcalico.org/v3
3+
kind: NetworkPolicy
4+
metadata:
5+
name: cert-manager-network-policy
6+
spec:
7+
ingress:
8+
# 2. TCP: Kubernetes (API server) -> cert-manager (webhook)
9+
- action: Allow
10+
protocol: TCP
11+
source:
12+
selector: 'component == "kube-apiserver"'
13+
destination:
14+
selector: 'app.kubernetes.io/component == "webhook"'
15+
ports:
16+
- {{ .Values.cert-manager.webhook.securePort }}
17+
egress:
18+
# 3. TCP: cert-manager (webhook, controller, cainjector, startupapicheck) -> Kubernetes API server
19+
- action: Allow
20+
protocol: TCP
21+
destination:
22+
nets:
23+
- 10.0.0.0/8
24+
- 172.16.0.0/12
25+
- 192.168.0.0/16
26+
ports:
27+
- 6443
28+
# 6. TCP: cert-manager (controller) -> DNS API endpoints (for ACME DNS01)
29+
- action: Allow
30+
protocol: TCP
31+
source:
32+
selector: 'app.kubernetes.io/component == "controller"'
33+
destination:
34+
ports:
35+
- 443
36+
# 7. UDP / TCP: cert-manager (controller) -> External DNS
37+
- action: Allow
38+
protocol: UDP
39+
source:
40+
selector: 'app.kubernetes.io/component == "controller"'
41+
destination:
42+
ports:
43+
- 53

‎charts/cert-manager/templates/tests/test-connection.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: "{{ include "cert-manager.fullname" . }}-test-connection"
5+
labels:
6+
{{- include "cert-manager.labels" . | nindent 4 }}
7+
annotations:
8+
"helm.sh/hook": test
9+
spec:
10+
containers:
11+
- name: wget
12+
image: busybox
13+
command: ['wget']
14+
args: ['{{ include "cert-manager.fullname" . }}:{{ .Values.service.port }}']
15+
restartPolicy: Never

‎charts/cert-manager/values.common.yaml.gotmpl‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1-
crds:
2-
enabled: true
3-
keep: true
1+
cert-manager:
2+
crds:
3+
enabled: true
4+
keep: true
45

5-
nodeSelector:
6-
ops: "true"
6+
nodeSelector:
7+
ops: "true"
8+
9+
webhook:
10+
securePort: 10250

‎charts/cert-manager/values.rfc2136.yaml.gotmpl‎

Lines changed: 36 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,36 @@
1-
extraObjects:
2-
- |
3-
apiVersion: v1
4-
kind: Secret
5-
metadata:
6-
name: rfc2136-credentials
7-
namespace: {{ .Release.Namespace }} # secret must be in same namespace as Cert Manager deployment
8-
type: Opaque
9-
data:
10-
tsig-secret-key: {{ requiredEnv "RFC2136_TSIG_SECRET" | b64enc }} # Base64 encoded Secret Access Key
11-
- |
12-
apiVersion: cert-manager.io/v1
13-
kind: ClusterIssuer
14-
metadata:
15-
name: cert-issuer
16-
namespace: {{ .Release.Namespace }}
17-
annotations:
18-
# ClusterIssuer depends on cert-manager CRDs. We need to wait for them to be installed before creating the ClusterIssuer
19-
"helm.sh/hook": post-install,post-upgrade
20-
"helm.sh/hook-weight": "1"
21-
spec:
22-
acme:
23-
email: {{ requiredEnv "OSPARC_DEVOPS_MAIL_ADRESS" }}
24-
server: {{ requiredEnv "DNS_CHALLENGE_ACME_SERVER" }}
25-
privateKeySecretRef:
26-
name: cert-manager-acme-private-key
27-
solvers:
28-
- dns01:
29-
rfc2136:
30-
nameserver: {{ requiredEnv "RFC2136_NAMESERVER" }}
31-
tsigKeyName: {{ requiredEnv "RFC2136_TSIG_KEY" }}
32-
tsigAlgorithm: {{ requiredEnv "RFC2136_TSIG_ALGORITHM_CERT_MANAGER" }}
33-
tsigSecretSecretRef:
34-
name: rfc2136-credentials
35-
key: tsig-secret-key
1+
cert-manager:
2+
extraObjects:
3+
- |
4+
apiVersion: v1
5+
kind: Secret
6+
metadata:
7+
name: rfc2136-credentials
8+
namespace: {{ .Release.Namespace }} # secret must be in same namespace as Cert Manager deployment
9+
type: Opaque
10+
data:
11+
tsig-secret-key: {{ requiredEnv "RFC2136_TSIG_SECRET" | b64enc }} # Base64 encoded Secret Access Key
12+
- |
13+
apiVersion: cert-manager.io/v1
14+
kind: ClusterIssuer
15+
metadata:
16+
name: cert-issuer
17+
namespace: {{ .Release.Namespace }}
18+
annotations:
19+
# ClusterIssuer depends on cert-manager CRDs. We need to wait for them to be installed before creating the ClusterIssuer
20+
"helm.sh/hook": post-install,post-upgrade
21+
"helm.sh/hook-weight": "1"
22+
spec:
23+
acme:
24+
email: {{ requiredEnv "OSPARC_DEVOPS_MAIL_ADRESS" }}
25+
server: {{ requiredEnv "DNS_CHALLENGE_ACME_SERVER" }}
26+
privateKeySecretRef:
27+
name: cert-manager-acme-private-key
28+
solvers:
29+
- dns01:
30+
rfc2136:
31+
nameserver: {{ requiredEnv "RFC2136_NAMESERVER" }}
32+
tsigKeyName: {{ requiredEnv "RFC2136_TSIG_KEY" }}
33+
tsigAlgorithm: {{ requiredEnv "RFC2136_TSIG_ALGORITHM_CERT_MANAGER" }}
34+
tsigSecretSecretRef:
35+
name: rfc2136-credentials
36+
key: tsig-secret-key

‎charts/cert-manager/values.route53.yaml.gotmpl‎

Lines changed: 38 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,38 @@
1-
extraObjects:
2-
- |
3-
apiVersion: v1
4-
kind: Secret
5-
metadata:
6-
name: route53-credentials
7-
namespace: {{ .Release.Namespace }} # secret must be in same namespace as Cert Manager deployment
8-
type: Opaque
9-
data:
10-
access-key-id: {{ requiredEnv "DNS_CHALLENGE_AWS_ACCESS_KEY_ID" | b64enc }}
11-
secret-access-key: {{ requiredEnv "DNS_CHALLENGE_AWS_SECRET_ACCESS_KEY" | b64enc }}
12-
- |
13-
apiVersion: cert-manager.io/v1
14-
kind: ClusterIssuer
15-
metadata:
16-
name: cert-issuer
17-
namespace: {{ .Release.Namespace }}
18-
annotations:
19-
# ClusterIssuer depends on cert-manager CRDs. We need to wait for them to be installed before creating the ClusterIssuer
20-
"helm.sh/hook": post-install,post-upgrade
21-
"helm.sh/hook-weight": "1"
22-
spec:
23-
acme:
24-
email: {{ requiredEnv "OSPARC_DEVOPS_MAIL_ADRESS" }}
25-
server: {{ requiredEnv "DNS_CHALLENGE_ACME_SERVER" }}
26-
privateKeySecretRef:
27-
name: cert-manager-acme-private-key
28-
solvers:
29-
- dns01:
30-
route53:
31-
region: {{ requiredEnv "DNS_CHALLENGE_AWS_REGION" }}
32-
accessKeyIDSecretRef:
33-
name: route53-credentials
34-
key: access-key-id
35-
secretAccessKeySecretRef:
36-
name: route53-credentials
37-
key: secret-access-key
1+
cert-manager:
2+
extraObjects:
3+
- |
4+
apiVersion: v1
5+
kind: Secret
6+
metadata:
7+
name: route53-credentials
8+
namespace: {{ .Release.Namespace }} # secret must be in same namespace as Cert Manager deployment
9+
type: Opaque
10+
data:
11+
access-key-id: {{ requiredEnv "DNS_CHALLENGE_AWS_ACCESS_KEY_ID" | b64enc }}
12+
secret-access-key: {{ requiredEnv "DNS_CHALLENGE_AWS_SECRET_ACCESS_KEY" | b64enc }}
13+
- |
14+
apiVersion: cert-manager.io/v1
15+
kind: ClusterIssuer
16+
metadata:
17+
name: cert-issuer
18+
namespace: {{ .Release.Namespace }}
19+
annotations:
20+
# ClusterIssuer depends on cert-manager CRDs. We need to wait for them to be installed before creating the ClusterIssuer
21+
"helm.sh/hook": post-install,post-upgrade
22+
"helm.sh/hook-weight": "1"
23+
spec:
24+
acme:
25+
email: {{ requiredEnv "OSPARC_DEVOPS_MAIL_ADRESS" }}
26+
server: {{ requiredEnv "DNS_CHALLENGE_ACME_SERVER" }}
27+
privateKeySecretRef:
28+
name: cert-manager-acme-private-key
29+
solvers:
30+
- dns01:
31+
route53:
32+
region: {{ requiredEnv "DNS_CHALLENGE_AWS_REGION" }}
33+
accessKeyIDSecretRef:
34+
name: route53-credentials
35+
key: access-key-id
36+
secretAccessKeySecretRef:
37+
name: route53-credentials
38+
key: secret-access-key

‎charts/cert-manager/values.selfsigned.yaml.gotmpl‎

Lines changed: 55 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,56 +1,57 @@
1-
extraObjects:
2-
- |
3-
apiVersion: cert-manager.io/v1
4-
kind: ClusterIssuer
5-
metadata:
6-
name: selfsigned-issuer
7-
namespace: {{ .Release.Namespace }}
8-
annotations:
9-
# It depends on cert-manager CRDs. We need to wait for CRDs to be installed
10-
"helm.sh/hook": post-install,post-upgrade
11-
"helm.sh/hook-weight": "1"
12-
spec:
13-
selfSigned: {}
14-
- |
15-
apiVersion: cert-manager.io/v1
16-
kind: Certificate
17-
metadata:
18-
name: local-ca
19-
namespace: {{ .Release.Namespace }}
20-
annotations:
21-
# It depends on cert-manager CRDs. We need to wait for CRDs to be installed
22-
"helm.sh/hook": post-install,post-upgrade
23-
"helm.sh/hook-weight": "1"
24-
spec:
25-
secretTemplate:
26-
annotations:
27-
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
28-
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "" # Control destination namespaces: emptystring means all
29-
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" # Auto create reflection for matching namespaces
30-
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "" # Control auto-reflection namespaces
31-
isCA: true
32-
commonName: local-ca
33-
subject:
34-
organizations:
35-
- Z43
36-
secretName: local-ca-secret
37-
privateKey:
38-
algorithm: ECDSA
39-
size: 256
40-
issuerRef:
1+
cert-manager:
2+
extraObjects:
3+
- |
4+
apiVersion: cert-manager.io/v1
5+
kind: ClusterIssuer
6+
metadata:
417
name: selfsigned-issuer
42-
kind: ClusterIssuer
43-
group: cert-manager.io
44-
- |
45-
apiVersion: cert-manager.io/v1
46-
kind: ClusterIssuer
47-
metadata:
48-
name: cert-issuer
49-
namespace: {{ .Release.Namespace }}
50-
annotations:
51-
# It depends on cert-manager CRDs. We need to wait for CRDs to be installed
52-
"helm.sh/hook": post-install,post-upgrade
53-
"helm.sh/hook-weight": "1"
54-
spec:
55-
ca:
8+
namespace: {{ .Release.Namespace }}
9+
annotations:
10+
# It depends on cert-manager CRDs. We need to wait for CRDs to be installed
11+
"helm.sh/hook": post-install,post-upgrade
12+
"helm.sh/hook-weight": "1"
13+
spec:
14+
selfSigned: {}
15+
- |
16+
apiVersion: cert-manager.io/v1
17+
kind: Certificate
18+
metadata:
19+
name: local-ca
20+
namespace: {{ .Release.Namespace }}
21+
annotations:
22+
# It depends on cert-manager CRDs. We need to wait for CRDs to be installed
23+
"helm.sh/hook": post-install,post-upgrade
24+
"helm.sh/hook-weight": "1"
25+
spec:
26+
secretTemplate:
27+
annotations:
28+
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
29+
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "" # Control destination namespaces: emptystring means all
30+
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true" # Auto create reflection for matching namespaces
31+
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "" # Control auto-reflection namespaces
32+
isCA: true
33+
commonName: local-ca
34+
subject:
35+
organizations:
36+
- Z43
5637
secretName: local-ca-secret
38+
privateKey:
39+
algorithm: ECDSA
40+
size: 256
41+
issuerRef:
42+
name: selfsigned-issuer
43+
kind: ClusterIssuer
44+
group: cert-manager.io
45+
- |
46+
apiVersion: cert-manager.io/v1
47+
kind: ClusterIssuer
48+
metadata:
49+
name: cert-issuer
50+
namespace: {{ .Release.Namespace }}
51+
annotations:
52+
# It depends on cert-manager CRDs. We need to wait for CRDs to be installed
53+
"helm.sh/hook": post-install,post-upgrade
54+
"helm.sh/hook-weight": "1"
55+
spec:
56+
ca:
57+
secretName: local-ca-secret

0 commit comments

Comments
 (0)