Skip to content

Commit 0e32699

Browse files
mrnicegyu11mrnicegyu11
committed
Merge remote-tracking branch 'upstream/main'
2 parents 81ce9fb + 7de90da commit 0e32699

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+788
-204
lines changed

‎charts/calico-configuration/templates/globalpolicy.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ spec:
88
# "calico-system", "calico-apiserver", "tigera-operator" -- calico namespaces (when installed via scripts [local deployment])
99
# TODO: other namespaces are to be removed from this list (once appropriate network policies are created)
1010
namespaceSelector:
11-
kubernetes.io/metadata.name not in {"kube-public", "kube-system", "kube-node-lease", "calico-system", "calico-apiserver", "tigera-operator", "cert-manager", "reflector", "traefik", "victoria-logs", "csi-s3", "portainer", "topolvm", "local-path-storage", "longhorn"}
11+
kubernetes.io/metadata.name not in {"kube-public", "kube-system", "kube-node-lease", "calico-system", "calico-apiserver", "tigera-operator", "reflector", "traefik", "victoria-logs", "csi-s3", "portainer", "topolvm", "local-path-storage", "longhorn"}
1212
types:
1313
- Ingress
1414
- Egress

‎charts/cert-manager/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/cert-manager/Chart.lock‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
dependencies:
2+
- name: cert-manager
3+
repository: https://charts.jetstack.io
4+
version: v1.15.3
5+
digest: sha256:47142c9b5a4892f942219774d3a7c45368941163d17e56c577fb981da2abad0a
6+
generated: "2025-08-11T14:55:17.254100391+02:00"

‎charts/cert-manager/Chart.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
apiVersion: v2
2+
name: cert-manager
3+
description: A Helm chart for Kubernetes
4+
5+
# A chart can be either an 'application' or a 'library' chart.
6+
#
7+
# Application charts are a collection of templates that can be packaged into versioned archives
8+
# to be deployed.
9+
#
10+
# Library charts provide useful utilities or functions for the chart developer. They're included as
11+
# a dependency of application charts to inject those utilities and functions into the rendering
12+
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
13+
type: application
14+
15+
# This is the chart version. This version number should be incremented each time you make changes
16+
# to the chart and its templates, including the app version.
17+
# Versions are expected to follow Semantic Versioning (https://semver.org/)
18+
version: 1.15.3
19+
20+
# This is the version number of the application being deployed. This version number should be
21+
# incremented each time you make changes to the application. Versions are not expected to
22+
# follow Semantic Versioning. They should reflect the version the application is using.
23+
# It is recommended to use it with quotes.
24+
appVersion: "1.15.3"
25+
26+
dependencies:
27+
- name: cert-manager
28+
version: 1.15.3
29+
repository: "https://charts.jetstack.io"

‎charts/cert-manager/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
## Network policy
2+
3+
Read more https://cert-manager.io/docs/installation/best-practice/#network-requirements
4+
5+
Be aware that this might have an affect on cert manager webhook application that is called during installation of the cert manager helm chart. If network policy is misconfigured, this will affect installation (e.g. `certissuers` might be missing as they are installed via helm hooks that apparently require cert manager webhook to be reachable)

‎charts/cert-manager/templates/NOTES.txt‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
This is a wrap around the cert-manager Helm chart.
2+
3+
NOTE: on network policy change, manual restart of the cert-manager pods might be necessary to apply new rules.

‎charts/cert-manager/templates/networkpolicy.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# https://cert-manager.io/docs/installation/best-practice/#network-requirements
2+
apiVersion: projectcalico.org/v3
3+
kind: NetworkPolicy
4+
metadata:
5+
name: cert-manager-network-policy
6+
spec:
7+
ingress:
8+
# 2. TCP: Kubernetes (API server) -> cert-manager (webhook)
9+
- action: Allow
10+
protocol: TCP
11+
source:
12+
# both selectors below did not work
13+
# selector: 'component == "kube-apiserver"'
14+
# namespaceSelector: kubernetes.io/metadata.name == "kube-system"
15+
nets:
16+
- 10.0.0.0/8
17+
- 172.16.0.0/12
18+
- 192.168.0.0/16
19+
destination:
20+
selector: 'app.kubernetes.io/component == "webhook"'
21+
ports:
22+
# https://stackoverflow.com/a/63863410/12124525
23+
- {{ index .Values "cert-manager" "webhook" "securePort" }}
24+
egress:
25+
# 3. TCP: cert-manager (webhook, controller, cainjector, startupapicheck) -> Kubernetes API server
26+
- action: Allow
27+
protocol: TCP
28+
destination:
29+
nets:
30+
- 10.0.0.0/8
31+
- 172.16.0.0/12
32+
- 192.168.0.0/16
33+
ports:
34+
- 6443
35+
# 6. TCP: cert-manager (controller) -> DNS API endpoints (for ACME DNS01)
36+
- action: Allow
37+
protocol: TCP
38+
source:
39+
selector: 'app.kubernetes.io/component == "controller"'
40+
destination:
41+
ports:
42+
- 443
43+
# 7. UDP / TCP: cert-manager (controller) -> External DNS
44+
- action: Allow
45+
protocol: UDP
46+
source:
47+
selector: 'app.kubernetes.io/component == "controller"'
48+
destination:
49+
ports:
50+
- 53

‎charts/cert-manager/values.common.yaml.gotmpl‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1-
crds:
2-
enabled: true
3-
keep: true
1+
cert-manager:
2+
crds:
3+
enabled: true
4+
keep: true
45

5-
nodeSelector:
6-
ops: "true"
6+
nodeSelector:
7+
ops: "true"
8+
9+
webhook:
10+
securePort: 10250

‎charts/cert-manager/values.rfc2136.yaml.gotmpl‎

Lines changed: 36 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,36 @@
1-
extraObjects:
2-
- |
3-
apiVersion: v1
4-
kind: Secret
5-
metadata:
6-
name: rfc2136-credentials
7-
namespace: {{ .Release.Namespace }} # secret must be in same namespace as Cert Manager deployment
8-
type: Opaque
9-
data:
10-
tsig-secret-key: {{ requiredEnv "RFC2136_TSIG_SECRET" | b64enc }} # Base64 encoded Secret Access Key
11-
- |
12-
apiVersion: cert-manager.io/v1
13-
kind: ClusterIssuer
14-
metadata:
15-
name: cert-issuer
16-
namespace: {{ .Release.Namespace }}
17-
annotations:
18-
# ClusterIssuer depends on cert-manager CRDs. We need to wait for them to be installed before creating the ClusterIssuer
19-
"helm.sh/hook": post-install,post-upgrade
20-
"helm.sh/hook-weight": "1"
21-
spec:
22-
acme:
23-
email: {{ requiredEnv "OSPARC_DEVOPS_MAIL_ADRESS" }}
24-
server: {{ requiredEnv "DNS_CHALLENGE_ACME_SERVER" }}
25-
privateKeySecretRef:
26-
name: cert-manager-acme-private-key
27-
solvers:
28-
- dns01:
29-
rfc2136:
30-
nameserver: {{ requiredEnv "RFC2136_NAMESERVER" }}
31-
tsigKeyName: {{ requiredEnv "RFC2136_TSIG_KEY" }}
32-
tsigAlgorithm: {{ requiredEnv "RFC2136_TSIG_ALGORITHM_CERT_MANAGER" }}
33-
tsigSecretSecretRef:
34-
name: rfc2136-credentials
35-
key: tsig-secret-key
1+
cert-manager:
2+
extraObjects:
3+
- |
4+
apiVersion: v1
5+
kind: Secret
6+
metadata:
7+
name: rfc2136-credentials
8+
namespace: {{ .Release.Namespace }} # secret must be in same namespace as Cert Manager deployment
9+
type: Opaque
10+
data:
11+
tsig-secret-key: {{ requiredEnv "RFC2136_TSIG_SECRET" | b64enc }} # Base64 encoded Secret Access Key
12+
- |
13+
apiVersion: cert-manager.io/v1
14+
kind: ClusterIssuer
15+
metadata:
16+
name: cert-issuer
17+
namespace: {{ .Release.Namespace }}
18+
annotations:
19+
# ClusterIssuer depends on cert-manager CRDs. We need to wait for them to be installed before creating the ClusterIssuer
20+
"helm.sh/hook": post-install,post-upgrade
21+
"helm.sh/hook-weight": "1"
22+
spec:
23+
acme:
24+
email: {{ requiredEnv "OSPARC_DEVOPS_MAIL_ADRESS" }}
25+
server: {{ requiredEnv "DNS_CHALLENGE_ACME_SERVER" }}
26+
privateKeySecretRef:
27+
name: cert-manager-acme-private-key
28+
solvers:
29+
- dns01:
30+
rfc2136:
31+
nameserver: {{ requiredEnv "RFC2136_NAMESERVER" }}
32+
tsigKeyName: {{ requiredEnv "RFC2136_TSIG_KEY" }}
33+
tsigAlgorithm: {{ requiredEnv "RFC2136_TSIG_ALGORITHM_CERT_MANAGER" }}
34+
tsigSecretSecretRef:
35+
name: rfc2136-credentials
36+
key: tsig-secret-key

‎charts/cert-manager/values.route53.yaml.gotmpl‎

Lines changed: 38 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,38 @@
1-
extraObjects:
2-
- |
3-
apiVersion: v1
4-
kind: Secret
5-
metadata:
6-
name: route53-credentials
7-
namespace: {{ .Release.Namespace }} # secret must be in same namespace as Cert Manager deployment
8-
type: Opaque
9-
data:
10-
access-key-id: {{ requiredEnv "DNS_CHALLENGE_AWS_ACCESS_KEY_ID" | b64enc }}
11-
secret-access-key: {{ requiredEnv "DNS_CHALLENGE_AWS_SECRET_ACCESS_KEY" | b64enc }}
12-
- |
13-
apiVersion: cert-manager.io/v1
14-
kind: ClusterIssuer
15-
metadata:
16-
name: cert-issuer
17-
namespace: {{ .Release.Namespace }}
18-
annotations:
19-
# ClusterIssuer depends on cert-manager CRDs. We need to wait for them to be installed before creating the ClusterIssuer
20-
"helm.sh/hook": post-install,post-upgrade
21-
"helm.sh/hook-weight": "1"
22-
spec:
23-
acme:
24-
email: {{ requiredEnv "OSPARC_DEVOPS_MAIL_ADRESS" }}
25-
server: {{ requiredEnv "DNS_CHALLENGE_ACME_SERVER" }}
26-
privateKeySecretRef:
27-
name: cert-manager-acme-private-key
28-
solvers:
29-
- dns01:
30-
route53:
31-
region: {{ requiredEnv "DNS_CHALLENGE_AWS_REGION" }}
32-
accessKeyIDSecretRef:
33-
name: route53-credentials
34-
key: access-key-id
35-
secretAccessKeySecretRef:
36-
name: route53-credentials
37-
key: secret-access-key
1+
cert-manager:
2+
extraObjects:
3+
- |
4+
apiVersion: v1
5+
kind: Secret
6+
metadata:
7+
name: route53-credentials
8+
namespace: {{ .Release.Namespace }} # secret must be in same namespace as Cert Manager deployment
9+
type: Opaque
10+
data:
11+
access-key-id: {{ requiredEnv "DNS_CHALLENGE_AWS_ACCESS_KEY_ID" | b64enc }}
12+
secret-access-key: {{ requiredEnv "DNS_CHALLENGE_AWS_SECRET_ACCESS_KEY" | b64enc }}
13+
- |
14+
apiVersion: cert-manager.io/v1
15+
kind: ClusterIssuer
16+
metadata:
17+
name: cert-issuer
18+
namespace: {{ .Release.Namespace }}
19+
annotations:
20+
# ClusterIssuer depends on cert-manager CRDs. We need to wait for them to be installed before creating the ClusterIssuer
21+
"helm.sh/hook": post-install,post-upgrade
22+
"helm.sh/hook-weight": "1"
23+
spec:
24+
acme:
25+
email: {{ requiredEnv "OSPARC_DEVOPS_MAIL_ADRESS" }}
26+
server: {{ requiredEnv "DNS_CHALLENGE_ACME_SERVER" }}
27+
privateKeySecretRef:
28+
name: cert-manager-acme-private-key
29+
solvers:
30+
- dns01:
31+
route53:
32+
region: {{ requiredEnv "DNS_CHALLENGE_AWS_REGION" }}
33+
accessKeyIDSecretRef:
34+
name: route53-credentials
35+
key: access-key-id
36+
secretAccessKeySecretRef:
37+
name: route53-credentials
38+
key: secret-access-key

0 commit comments

Comments
 (0)