Skip to content

Commit 837cbc5

Browse files
m8rmclarenm8rmclaren
authored
Merge pull request #3 from Keyfactor/helm
feat(helm): Create Helm Chart for Command External Issuer for cert-manager
2 parents 40c7b3e + ecadc15 commit 837cbc5

File tree

16 files changed

+736
-2
lines changed

16 files changed

+736
-2
lines changed

‎.github/workflows/release.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: helm_release
2+
on:
3+
pull_request:
4+
branches:
5+
- 'v*'
6+
types:
7+
- closed
8+
jobs:
9+
helm:
10+
runs-on: ubuntu-latest
11+
if: github.event.pull_request.merged == true
12+
steps:
13+
- name: Extract Version Tag
14+
id: extract_version
15+
run: /bin/bash -c 'echo ::set-output name=VERSION::$(echo ${GITHUB_REF##*/} | cut -c2-)'
16+
17+
- name: Checkout
18+
uses: actions/checkout@v3
19+
20+
# Change version and appVersion in Chart.yaml to the tag in the closed PR
21+
- name: Update Helm App/Chart Version
22+
shell: bash
23+
run: |
24+
sed -i "s/^version: .*/version: ${{ steps.extract_version.outputs.VERSION }}/g" deploy/charts/ejbca-cert-manager-issuer/Chart.yaml
25+
sed -i "s/^appVersion: .*/appVersion: \"${{ steps.extract_version.outputs.VERSION }}\"/g" deploy/charts/ejbca-cert-manager-issuer/Chart.yaml
26+
27+
- name: Configure Git
28+
run: |
29+
git config user.name "$GITHUB_ACTOR"
30+
git config user.email "[email protected]"
31+
32+
- name: Install Helm
33+
uses: azure/setup-helm@v3
34+
35+
- name: Run chart-releaser
36+
uses: helm/[email protected]
37+
env:
38+
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
39+
with:
40+
pages_branch: gh-pages
41+
charts_dir: deploy/charts
42+
mark_as_latest: true
43+
packages_with_index: true

‎.gitignore‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ vendor/
1616
.idea
1717
bin
1818

19-
# q: How to remove staged directory from git
20-
# a: git rm -r --cached .
19+
# Helm
20+
*.tgz
21+
2122
.DS_Store

‎deploy/charts/command-cert-manager-issuer/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎deploy/charts/command-cert-manager-issuer/Chart.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v2
2+
3+
name: command-cert-manager-issuer
4+
description: A helm chart to deploy the cert-manager issuer for the Keyfactor Command platform for Certificate Lifecycle Management
5+
type: application
6+
7+
home: https://github.com/Keyfactor/command-cert-manager-issuer
8+
maintainers:
9+
- name: Hayden Roszell
10+
email: [email protected]
11+
sources: ["https://github.com/Keyfactor/command-cert-manager-issuer"]
12+
13+
version: 0.1.0
14+
appVersion: "1.0.3"

‎deploy/charts/command-cert-manager-issuer/README.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<a href="https://kubernetes.io">
2+
<img src="https://raw.githubusercontent.com/cert-manager/cert-manager/d53c0b9270f8cd90d908460d69502694e1838f5f/logo/logo-small.png" alt="Terraform logo" title="K8s" align="left" height="50" />
3+
</a>
4+
5+
# Keyfactor Command Issuer for cert-manager
6+
7+
[![Go Report Card](https://goreportcard.com/badge/github.com/Keyfactor/command-cert-manager-issuer)](https://goreportcard.com/report/github.com/Keyfactor/command-cert-manager-issuer)
8+
[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://img.shields.io/badge/License-Apache%202.0-blue.svg)
9+
![Version: v0.1.0](https://img.shields.io/badge/Version-v0.1.0-informational?style=flat-square)
10+
![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
11+
![AppVersion: v1.0.3](https://img.shields.io/badge/AppVersion-v1.0.3-informational?style=flat-square)
12+
13+
A Helm chart for the Keyfactor Command External Issuer for cert-manager.
14+
15+
The Command external issuer for cert-manager allows users to enroll certificates from Keyfactor Command using cert-manager.
16+
17+
## Configuration
18+
19+
The following table lists the configurable parameters of the `command-cert-manager-issuer` chart and their default values.
20+
21+
| Parameter | Description | Default |
22+
|-----------------------------------|-----------------------------------------------------|--------------------------------------------------------------|
23+
| `replicaCount` | Number of replica command-cert-manager-issuers to run | `1` |
24+
| `image.repository` | Image repository | `m8rmclarenkf/command-cert-manager-external-issuer-controller` |
25+
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
26+
| `image.tag` | Image tag | `v1.3.1` |
27+
| `imagePullSecrets` | Image pull secrets | `[]` |
28+
| `nameOverride` | Name override | `""` |
29+
| `fullnameOverride` | Full name override | `""` |
30+
| `crd.create` | Specifies if CRDs will be created | `true` |
31+
| `crd.annotations` | Annotations to add to the CRD | `{}` |
32+
| `serviceAccount.create` | Specifies if a service account should be created | `true` |
33+
| `serviceAccount.annotations` | Annotations to add to the service account | `{}` |
34+
| `serviceAccount.name` | Name of the service account to use | `""` (uses the fullname template if `create` is true) |
35+
| `podAnnotations` | Annotations for the pod | `{}` |
36+
| `podSecurityContext.runAsNonRoot` | Run pod as non-root | `true` |
37+
| `securityContext` | Security context for the pod | `{}` (with commented out options) |
38+
| `resources` | CPU/Memory resource requests/limits | `{}` (with commented out options) |
39+
| `nodeSelector` | Node labels for pod assignment | `{}` |
40+
| `tolerations` | Tolerations for pod assignment | `[]` |

‎deploy/charts/command-cert-manager-issuer/templates/_helpers.tpl‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "command-cert-manager-issuer.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "command-cert-manager-issuer.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "command-cert-manager-issuer.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "command-cert-manager-issuer.labels" -}}
37+
helm.sh/chart: {{ include "command-cert-manager-issuer.chart" . }}
38+
{{ include "command-cert-manager-issuer.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "command-cert-manager-issuer.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "command-cert-manager-issuer.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+
53+
{{/*
54+
Create the name of the service account to use
55+
*/}}
56+
{{- define "command-cert-manager-issuer.serviceAccountName" -}}
57+
{{- if .Values.serviceAccount.create }}
58+
{{- default (include "command-cert-manager-issuer.fullname" .) .Values.serviceAccount.name }}
59+
{{- else }}
60+
{{- default "default" .Values.serviceAccount.name }}
61+
{{- end }}
62+
{{- end }}

‎deploy/charts/command-cert-manager-issuer/templates/clusterrole.yaml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
labels:
5+
{{- include "command-cert-manager-issuer.labels" . | nindent 4 }}
6+
name: {{ include "command-cert-manager-issuer.name" . }}-manager-role
7+
rules:
8+
- apiGroups:
9+
- ""
10+
resources:
11+
- secrets
12+
verbs:
13+
- get
14+
- list
15+
- watch
16+
- apiGroups:
17+
- cert-manager.io
18+
resources:
19+
- certificaterequests
20+
verbs:
21+
- get
22+
- list
23+
- watch
24+
- apiGroups:
25+
- cert-manager.io
26+
resources:
27+
- certificaterequests/status
28+
verbs:
29+
- get
30+
- patch
31+
- update
32+
- apiGroups:
33+
- command-issuer.keyfactor.com
34+
resources:
35+
- clusterissuers
36+
- issuers
37+
verbs:
38+
- get
39+
- list
40+
- watch
41+
- apiGroups:
42+
- command-issuer.keyfactor.com
43+
resources:
44+
- clusterissuers/status
45+
- issuers/status
46+
verbs:
47+
- get
48+
- patch
49+
- update
50+
- apiGroups:
51+
- command-issuer.keyfactor.com
52+
resources:
53+
- issuers/finalizers
54+
verbs:
55+
- update
56+
---
57+
apiVersion: rbac.authorization.k8s.io/v1
58+
kind: ClusterRole
59+
metadata:
60+
labels:
61+
{{- include "command-cert-manager-issuer.labels" . | nindent 4 }}
62+
name: {{ include "command-cert-manager-issuer.name" . }}-proxy-role
63+
rules:
64+
- apiGroups:
65+
- authentication.k8s.io
66+
resources:
67+
- tokenreviews
68+
verbs:
69+
- create
70+
- apiGroups:
71+
- authorization.k8s.io
72+
resources:
73+
- subjectaccessreviews
74+
verbs:
75+
- create
76+
---
77+
apiVersion: rbac.authorization.k8s.io/v1
78+
kind: ClusterRole
79+
metadata:
80+
labels:
81+
{{- include "command-cert-manager-issuer.labels" . | nindent 4 }}
82+
name: {{ include "command-cert-manager-issuer.name" . }}-metrics-reader
83+
rules:
84+
- nonResourceURLs:
85+
- /metrics
86+
verbs:
87+
- get

‎deploy/charts/command-cert-manager-issuer/templates/clusterrolebinding.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
labels:
5+
{{- include "command-cert-manager-issuer.labels" . | nindent 4 }}
6+
name: {{ include "command-cert-manager-issuer.name" . }}-manager-rolebinding
7+
roleRef:
8+
apiGroup: rbac.authorization.k8s.io
9+
kind: ClusterRole
10+
name: {{ include "command-cert-manager-issuer.name" . }}-manager-role
11+
subjects:
12+
- kind: ServiceAccount
13+
name: {{ include "command-cert-manager-issuer.serviceAccountName" . }}
14+
namespace: {{ .Release.Namespace }}
15+
---
16+
apiVersion: rbac.authorization.k8s.io/v1
17+
kind: ClusterRoleBinding
18+
metadata:
19+
labels:
20+
{{- include "command-cert-manager-issuer.labels" . | nindent 4 }}
21+
name: {{ include "command-cert-manager-issuer.name" . }}-proxy-rolebinding
22+
roleRef:
23+
apiGroup: rbac.authorization.k8s.io
24+
kind: ClusterRole
25+
name: {{ include "command-cert-manager-issuer.name" . }}-proxy-role
26+
subjects:
27+
- kind: ServiceAccount
28+
name: {{ include "command-cert-manager-issuer.serviceAccountName" . }}
29+
namespace: {{ .Release.Namespace }}

0 commit comments

Comments
 (0)