feat(shield): add support to cert-manager on cluster-shield (#2411)

Co-authored-by: Mike Yoder <[email protected]>

Author: francesco-furlan

charts/shield/Chart.yaml

@@ -13,5 +13,5 @@ maintainers:
   - name: mavimo
     email: [email protected]
 type: application
-version: 1.22.0
+version: 1.23.0
 appVersion: "1.0.0"

charts/shield/README.md

@@ -221,6 +221,17 @@ The following table lists the configurable parameters of the `shield` chart and
 | cluster.validatingwebhookconfiguration.create                                                       | Create the validatingwebhookconfiguration resources for the cluster shield                                                                                                                                                                                                                                                  | <code>true</code>                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | cluster.tls_certificates.create                                                                     | Create the TLS certificates for the cluster shield                                                                                                                                                                                                                                                                          | <code>true</code>                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | cluster.tls_certificates.secret_name                                                                | The name of the secret that contains the TLS certificates                                                                                                                                                                                                                                                                   | <code></code>                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| cluster.tls_certificates.cert_manager.enabled                                                       | Enable cert-manager for certificate management                                                                                                                                                                                                                                                                              | <code>false</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| cluster.tls_certificates.cert_manager.ca.create                                                     | Create the CA certificate using cert-manager                                                                                                                                                                                                                                                                                | <code>false</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| cluster.tls_certificates.cert_manager.ca.secret_template                                            | The template for the CA certificate secret (if create=true) will automatically add the annotation `cert-manager.io/allow-direct-injection: "true"` if not present                                                                                                                                                           | <code>{}</code>                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| cluster.tls_certificates.cert_manager.ca.secret_name                                                | The name of the existing CA certificate secret (if create=false) has to be annotated with `cert-manager.io/allow-direct-injection: "true"`                                                                                                                                                                                  | <code>""</code>                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| cluster.tls_certificates.cert_manager.ca.secret_namespace                                           | The namespace of the existing CA certificate secret (if create=false)                                                                                                                                                                                                                                                       | <code>""</code>                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| cluster.tls_certificates.cert_manager.issuer.create                                                 | Create the Issuer instead of using an existing one                                                                                                                                                                                                                                                                          | <code>false</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| cluster.tls_certificates.cert_manager.issuer.name                                                   | The name of the existing issuer                                                                                                                                                                                                                                                                                             | <code>""</code>                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| cluster.tls_certificates.cert_manager.issuer.kind                                                   | The kind of the existing issuer (Issuer, ClusterIssuer)                                                                                                                                                                                                                                                                     | <code>Issuer</code>                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| cluster.tls_certificates.cert_manager.issuer.group                                                  | The group of the existing issuer                                                                                                                                                                                                                                                                                            | <code>cert-manager.io</code>                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| cluster.tls_certificates.cert_manager.duration                                                      | Certificate duration (default: 30 days)                                                                                                                                                                                                                                                                                     | <code>"720h"</code>                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| cluster.tls_certificates.cert_manager.renew_before                                                  | How long before expiry to renew (default: 15 days)                                                                                                                                                                                                                                                                          | <code>"360h"</code>                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | cluster.resources.requests.cpu                                                                      | The CPU request for the cluster shield                                                                                                                                                                                                                                                                                      | <code>500m</code>                                                                                                                                                                                                                                                                                                                                                                                                                            |
 | cluster.resources.requests.memory                                                                   | The memory request for the cluster shield                                                                                                                                                                                                                                                                                   | <code>512Mi</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |
 | cluster.resources.limits.cpu                                                                        | The CPU limit for the cluster shield                                                                                                                                                                                                                                                                                        | <code>1500m</code>                                                                                                                                                                                                                                                                                                                                                                                                                           |