Skip to content
This repository was archived by the owner on May 17, 2024. It is now read-only.

Commit 33a3efa

Browse files
JoshVanLJoshVanL
committed
Move cert-manager manifest changes out of vendor
Signed-off-by: JoshVanL <[email protected]>
1 parent 5db8554 commit 33a3efa

File tree

4 files changed

+153
-24
lines changed

4 files changed

+153
-24
lines changed

‎demo/config.dist.jsonnet

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ function(cloud='google') main {
55
// this will only run the google cluster
66
clouds: {
77
google: main.clouds.google,
8-
amazon: null,
9-
digitalocean: null,
8+
amazon: main.clouds.amazon,
9+
digitalocean: main.clouds.digitalocean,
1010
},
1111
base_domain: '.kubernetes.example.net',
1212
cert_manager+: {

‎demo/manifests/components/cert-manager.jsonnet

Lines changed: 53 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,19 @@
1-
local upstream_cert_manager = import '../vendor/kube-prod-runtime/components/cert-manager.jsonnet';
21
local kube = import '../vendor/kube-prod-runtime/lib/kube.libsonnet';
2+
local cert_manager_manifests = import './cert-manager/cert-manager.json';
33

44
local CERT_MANAGER_IMAGE = '';
55

6-
upstream_cert_manager {
6+
{
77
ca_secret_name:: 'ca-key-pair',
88

9+
p:: '',
10+
metadata:: {
11+
metadata+: {
12+
namespace: 'kubeprod',
13+
},
14+
},
15+
letsencrypt_contact_email:: error 'Letsencrypt contact e-mail is undefined',
16+
917
// create simple to use certificate resource
1018
Certificate(namespace, name, issuer, solver, domains):: kube._Object($.certCRD.spec.group + '/' + $.certCRD.spec.version, $.certCRD.spec.names.kind, name) + {
1119
metadata+: {
@@ -21,4 +29,47 @@ upstream_cert_manager {
2129
},
2230
},
2331
},
32+
33+
// Letsencrypt environments
34+
letsencrypt_environments:: {
35+
prod: $.letsencryptProd.metadata.name,
36+
staging: $.letsencryptStaging.metadata.name,
37+
},
38+
// Letsencrypt environment (defaults to the production one)
39+
letsencrypt_environment:: 'prod',
40+
41+
Issuer(name):: kube._Object('certmanager.k8s.io/v1alpha1', 'Issuer', name) {
42+
},
43+
44+
ClusterIssuer(name):: kube._Object('certmanager.k8s.io/v1alpha1', 'ClusterIssuer', name) {
45+
},
46+
47+
certCRD: kube.CustomResourceDefinition('certmanager.k8s.io', 'v1alpha1', 'Certificate') {
48+
spec+: { names+: { shortNames+: ['cert', 'certs'] } },
49+
},
50+
51+
deploy: cert_manager_manifests,
52+
53+
letsencryptStaging: $.ClusterIssuer($.p + 'letsencrypt-staging') {
54+
local this = self,
55+
spec+: {
56+
acme+: {
57+
server: 'https://acme-staging-v02.api.letsencrypt.org/directory',
58+
email: $.letsencrypt_contact_email,
59+
privateKeySecretRef: { name: this.metadata.name },
60+
http01: {},
61+
},
62+
},
63+
},
64+
65+
letsencryptProd: $.letsencryptStaging {
66+
metadata+: { name: $.p + 'letsencrypt-prod' },
67+
spec+: {
68+
acme+: {
69+
server: 'https://acme-v02.api.letsencrypt.org/directory',
70+
},
71+
},
72+
},
73+
74+
solvers+:: [],
2475
}

‎demo/manifests/vendor/kube-prod-runtime/components/cert-manager/cert-manager.json renamed to ‎demo/manifests/components/cert-manager/cert-manager.json

File renamed without changes.

‎demo/manifests/vendor/kube-prod-runtime/components/cert-manager.jsonnet

Lines changed: 98 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -17,58 +17,136 @@
1717
* limitations under the License.
1818
*/
1919

20-
local kube = import '../lib/kube.libsonnet';
21-
local cert_manager_manifests = import './cert-manager/cert-manager.json';
20+
local kube = import "../lib/kube.libsonnet";
21+
local CERT_MANAGER_IMAGE = (import "images.json")["cert-manager"];
2222

2323
{
24-
p:: '',
24+
p:: "",
2525
metadata:: {
2626
metadata+: {
27-
namespace: 'kubeprod',
27+
namespace: "kubeprod",
2828
},
2929
},
30-
letsencrypt_contact_email:: error 'Letsencrypt contact e-mail is undefined',
30+
letsencrypt_contact_email:: error "Letsencrypt contact e-mail is undefined",
3131

3232
// Letsencrypt environments
3333
letsencrypt_environments:: {
34-
prod: $.letsencryptProd.metadata.name,
35-
staging: $.letsencryptStaging.metadata.name,
34+
"prod": $.letsencryptProd.metadata.name,
35+
"staging": $.letsencryptStaging.metadata.name,
3636
},
3737
// Letsencrypt environment (defaults to the production one)
38-
letsencrypt_environment:: 'prod',
38+
letsencrypt_environment:: "prod",
3939

40-
Issuer(name):: kube._Object('certmanager.k8s.io/v1alpha1', 'Issuer', name) {
40+
Issuer(name):: kube._Object("certmanager.k8s.io/v1alpha1", "Issuer", name) {
4141
},
4242

43-
ClusterIssuer(name):: kube._Object('certmanager.k8s.io/v1alpha1', 'ClusterIssuer', name) {
43+
ClusterIssuer(name):: kube._Object("certmanager.k8s.io/v1alpha1", "ClusterIssuer", name) {
4444
},
4545

46-
certCRD: kube.CustomResourceDefinition('certmanager.k8s.io', 'v1alpha1', 'Certificate') {
47-
spec+: { names+: { shortNames+: ['cert', 'certs'] } },
46+
certCRD: kube.CustomResourceDefinition("certmanager.k8s.io", "v1alpha1", "Certificate") {
47+
spec+: { names+: { shortNames+: ["cert", "certs"] } },
48+
4849
},
4950

50-
deploy: cert_manager_manifests,
51+
issuerCRD: kube.CustomResourceDefinition("certmanager.k8s.io", "v1alpha1", "Issuer"),
52+
53+
clusterissuerCRD: kube.CustomResourceDefinition("certmanager.k8s.io", "v1alpha1", "ClusterIssuer") {
54+
spec+: {
55+
scope: "Cluster",
56+
},
57+
},
5158

52-
letsencryptStaging: $.ClusterIssuer($.p + 'letsencrypt-staging') {
59+
sa: kube.ServiceAccount($.p + "cert-manager") + $.metadata {
60+
},
61+
62+
clusterRole: kube.ClusterRole($.p + "cert-manager") {
63+
rules: [
64+
{
65+
apiGroups: ["certmanager.k8s.io"],
66+
resources: ["certificates", "issuers", "clusterissuers"],
67+
// FIXME: audit - the helm chart just has "*"
68+
verbs: ["get", "list", "watch", "create", "patch", "update", "delete"],
69+
},
70+
{
71+
apiGroups: [""],
72+
resources: ["secrets", "configmaps", "services", "pods"],
73+
// FIXME: audit - the helm chart just has "*"
74+
verbs: ["get", "list", "watch", "create", "patch", "update", "delete"],
75+
},
76+
{
77+
apiGroups: ["extensions"],
78+
resources: ["ingresses"],
79+
// FIXME: audit - the helm chart just has "*"
80+
verbs: ["get", "list", "watch", "create", "patch", "update", "delete"],
81+
},
82+
{
83+
apiGroups: [""],
84+
resources: ["events"],
85+
verbs: ["create", "patch", "update"],
86+
},
87+
],
88+
},
89+
90+
clusterRoleBinding: kube.ClusterRoleBinding($.p+"cert-manager") {
91+
roleRef_: $.clusterRole,
92+
subjects_+: [$.sa],
93+
},
94+
95+
deploy: kube.Deployment($.p+"cert-manager") + $.metadata {
96+
spec+: {
97+
template+: {
98+
metadata+: {
99+
annotations+: {
100+
"prometheus.io/scrape": "true",
101+
"prometheus.io/port": "9402",
102+
"prometheus.io/path": "/metrics",
103+
},
104+
},
105+
spec+: {
106+
serviceAccountName: $.sa.metadata.name,
107+
containers_+: {
108+
default: kube.Container("cert-manager") {
109+
image: CERT_MANAGER_IMAGE,
110+
args_+: {
111+
"cluster-resource-namespace": "$(POD_NAMESPACE)",
112+
"leader-election-namespace": "$(POD_NAMESPACE)",
113+
"default-issuer-name": $.letsencrypt_environments[$.letsencrypt_environment],
114+
"default-issuer-kind": "ClusterIssuer",
115+
},
116+
env_+: {
117+
POD_NAMESPACE: kube.FieldRef("metadata.namespace"),
118+
},
119+
ports_+: {
120+
prometheus: {containerPort: 9402},
121+
},
122+
resources: {
123+
requests: {cpu: "10m", memory: "32Mi"},
124+
},
125+
},
126+
},
127+
},
128+
},
129+
},
130+
},
131+
132+
letsencryptStaging: $.ClusterIssuer($.p+"letsencrypt-staging") {
53133
local this = self,
54134
spec+: {
55135
acme+: {
56-
server: 'https://acme-staging-v02.api.letsencrypt.org/directory',
136+
server: "https://acme-staging-v02.api.letsencrypt.org/directory",
57137
email: $.letsencrypt_contact_email,
58-
privateKeySecretRef: { name: this.metadata.name },
138+
privateKeySecretRef: {name: this.metadata.name},
59139
http01: {},
60140
},
61141
},
62142
},
63143

64144
letsencryptProd: $.letsencryptStaging {
65-
metadata+: { name: $.p + 'letsencrypt-prod' },
145+
metadata+: {name: $.p+"letsencrypt-prod"},
66146
spec+: {
67147
acme+: {
68-
server: 'https://acme-v02.api.letsencrypt.org/directory',
148+
server: "https://acme-v02.api.letsencrypt.org/directory",
69149
},
70150
},
71151
},
72-
73-
solvers+:: [],
74152
}

0 commit comments

Comments
 (0)