Adding DNSimple cert-manager dns01 webhook.
This commit is contained in:
parent
dde047a6e2
commit
8b39dc81fc
7 changed files with 263 additions and 0 deletions
|
@ -7,3 +7,4 @@ resources:
|
||||||
- ./namespace.yaml
|
- ./namespace.yaml
|
||||||
# Flux-Kustomizations
|
# Flux-Kustomizations
|
||||||
- ./cert-manager/ks.yaml
|
- ./cert-manager/ks.yaml
|
||||||
|
- ./webhook-dnsimple/ks.yaml
|
||||||
|
|
|
@ -0,0 +1,16 @@
|
||||||
|
apiVersion: apiregistration.k8s.io/v1
|
||||||
|
kind: APIService
|
||||||
|
metadata:
|
||||||
|
name: v1alpha1.acme.hsn.dev
|
||||||
|
labels:
|
||||||
|
app: cert-manager-webhook-dnsimple
|
||||||
|
annotations:
|
||||||
|
cert-manager.io/inject-ca-from: "cert-manager/webhook-dnsimple-webhook-tls"
|
||||||
|
spec:
|
||||||
|
group: acme.hsn.dev
|
||||||
|
groupPriorityMinimum: 1000
|
||||||
|
versionPriority: 15
|
||||||
|
service:
|
||||||
|
name: webhook-dnsimple
|
||||||
|
namespace: cert-manager
|
||||||
|
version: v1alpha1
|
|
@ -0,0 +1,59 @@
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2beta2.schema.json
|
||||||
|
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||||
|
kind: HelmRelease
|
||||||
|
metadata:
|
||||||
|
name: webhook-dnsimple
|
||||||
|
spec:
|
||||||
|
chart:
|
||||||
|
spec:
|
||||||
|
chart: app-template
|
||||||
|
version: 3.0.4
|
||||||
|
interval: 30m
|
||||||
|
sourceRef:
|
||||||
|
kind: HelmRepository
|
||||||
|
name: bjw-s
|
||||||
|
namespace: flux-system
|
||||||
|
interval: 30m
|
||||||
|
install:
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
upgrade:
|
||||||
|
cleanupOnFail: true
|
||||||
|
remediation:
|
||||||
|
retries: 3
|
||||||
|
strategy: rollback
|
||||||
|
values:
|
||||||
|
controllers:
|
||||||
|
webhook-dnsimple:
|
||||||
|
strategy: RollingUpdate
|
||||||
|
annotations:
|
||||||
|
reloader.stakater.com/auto: "true"
|
||||||
|
containers:
|
||||||
|
app:
|
||||||
|
image:
|
||||||
|
repository: git.hsn.dev/jahanson/cert-manager-webhook-dnsimple
|
||||||
|
tag: v0.0.1
|
||||||
|
args:
|
||||||
|
- --secure-port=8443
|
||||||
|
- --tls-cert-file=/tls/tls.crt
|
||||||
|
- --tls-private-key-file=/tls/tls.key
|
||||||
|
env:
|
||||||
|
- name: GROUP_NAME
|
||||||
|
value: "acme.hsn.dev"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 23m
|
||||||
|
memory: 249M
|
||||||
|
probes:
|
||||||
|
liveness:
|
||||||
|
enabled: true
|
||||||
|
readiness:
|
||||||
|
enabled: true
|
||||||
|
persistence:
|
||||||
|
certs:
|
||||||
|
type: secret
|
||||||
|
name: webhook-dnsimple-webhook-tls
|
||||||
|
globalMounts:
|
||||||
|
- path: /tls
|
||||||
|
readOnly: true
|
|
@ -0,0 +1,9 @@
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://json.schemastore.org/kustomization.json
|
||||||
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||||
|
kind: Kustomization
|
||||||
|
namespace: cert-manager
|
||||||
|
resources:
|
||||||
|
- ./apiservice.yaml
|
||||||
|
- ./helmrelease.yaml
|
||||||
|
- ./pki.yaml
|
62
kubernetes/apps/cert-manager/webhook-dnsimple/app/pki.yaml
Normal file
62
kubernetes/apps/cert-manager/webhook-dnsimple/app/pki.yaml
Normal file
|
@ -0,0 +1,62 @@
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/issuer_v1.json
|
||||||
|
# Create a selfsigned Issuer, in order to create a root CA certificate for
|
||||||
|
# signing webhook serving certificates
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Issuer
|
||||||
|
metadata:
|
||||||
|
name: webhook-dnsimple-selfsign
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: cert-manager-webhook-dnsimple
|
||||||
|
spec:
|
||||||
|
selfSigned: {}
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/issuer_v1.json
|
||||||
|
# Create an Issuer that uses the above generated CA certificate to issue certs
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Issuer
|
||||||
|
metadata:
|
||||||
|
name: webhook-dnsimple-ca
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: cert-manager-webhook-dnsimple
|
||||||
|
spec:
|
||||||
|
ca:
|
||||||
|
secretName: webhook-dnsimple-ca
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/certificate_v1.json
|
||||||
|
# Generate a CA Certificate used to sign certificates for the webhook
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: webhook-dnsimple-ca
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: cert-manager-webhook-dnsimple
|
||||||
|
spec:
|
||||||
|
secretName: webhook-dnsimple-ca
|
||||||
|
duration: 43800h # 5y
|
||||||
|
issuerRef:
|
||||||
|
name: webhook-dnsimple-selfsign
|
||||||
|
commonName: "ca.dnsimple-webhook.cert-manager"
|
||||||
|
isCA: true
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://ks.hsn.dev/cert-manager.io/certificate_v1.json
|
||||||
|
# Finally, generate a serving certificate for the webhook to use
|
||||||
|
apiVersion: cert-manager.io/v1
|
||||||
|
kind: Certificate
|
||||||
|
metadata:
|
||||||
|
name: webhook-dnsimple-webhook-tls
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: cert-manager-webhook-dnsimple
|
||||||
|
spec:
|
||||||
|
secretName: webhook-dnsimple-webhook-tls
|
||||||
|
duration: 8760h # 1y
|
||||||
|
issuerRef:
|
||||||
|
name: webhook-dnsimple-ca
|
||||||
|
dnsNames:
|
||||||
|
- webhook-dnsimple
|
||||||
|
- webhook-dnsimple.cert-manager
|
||||||
|
- webhook-dnsimple.cert-manager.svc
|
101
kubernetes/apps/cert-manager/webhook-dnsimple/app/rbac.yaml
Normal file
101
kubernetes/apps/cert-manager/webhook-dnsimple/app/rbac.yaml
Normal file
|
@ -0,0 +1,101 @@
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: webhook-dnsimple
|
||||||
|
namespace: "cert-manager"
|
||||||
|
labels:
|
||||||
|
app: cert-manager-webhook-dnsimple
|
||||||
|
---
|
||||||
|
# Grant cert-manager permission to validate using our apiserver
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: webhook-dnsimple:domain-solver
|
||||||
|
labels:
|
||||||
|
app: cert-manager-webhook-dnsimple
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- acme.hsn.dev
|
||||||
|
resources:
|
||||||
|
- '*'
|
||||||
|
verbs:
|
||||||
|
- 'create'
|
||||||
|
---
|
||||||
|
# apiserver gets the auth-delegator role to delegate auth decisions to the core apiserver
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: webhook-dnsimple:auth-delegator
|
||||||
|
labels:
|
||||||
|
app: cert-manager-webhook-dnsimple
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: system:auth-delegator
|
||||||
|
subjects:
|
||||||
|
- apiGroup: ""
|
||||||
|
kind: ServiceAccount
|
||||||
|
name: webhook-dnsimple
|
||||||
|
namespace: cert-manager
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: webhook-dnsimple:domain-solver
|
||||||
|
labels:
|
||||||
|
app: cert-manager-webhook-dnsimple
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: webhook-dnsimple:domain-solver
|
||||||
|
subjects:
|
||||||
|
- apiGroup: ""
|
||||||
|
kind: ServiceAccount
|
||||||
|
name: cert-manager
|
||||||
|
namespace: cert-manager
|
||||||
|
---
|
||||||
|
# Grant the webhook permission to read the api-token Secret in the specified namespace.
|
||||||
|
kind: Role
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
namespace: "cert-manager"
|
||||||
|
name: webhook-dnsimple:access-secret
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["secrets"]
|
||||||
|
verbs: ["get", "watch"]
|
||||||
|
---
|
||||||
|
kind: RoleBinding
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: webhook-dnsimple:access-secret
|
||||||
|
namespace: "cert-manager"
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: webhook-dnsimple
|
||||||
|
namespace: "cert-manager"
|
||||||
|
roleRef:
|
||||||
|
kind: Role
|
||||||
|
name: webhook-dnsimple:access-secret
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
---
|
||||||
|
# Grant the webhook permission to read the ConfigMap containing the Kubernetes
|
||||||
|
# apiserver's requestheader-ca-certificate.
|
||||||
|
# This ConfigMap is automatically created by the Kubernetes apiserver.
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
name: webhook-dnsimple:webhook-authentication-reader
|
||||||
|
namespace: kube-system
|
||||||
|
labels:
|
||||||
|
app: cert-manager-webhook-dnsimple
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: extension-apiserver-authentication-reader
|
||||||
|
subjects:
|
||||||
|
- apiGroup: ""
|
||||||
|
kind: ServiceAccount
|
||||||
|
name: webhook-dnsimple
|
||||||
|
namespace: cert-manager
|
15
kubernetes/apps/cert-manager/webhook-dnsimple/ks.yaml
Normal file
15
kubernetes/apps/cert-manager/webhook-dnsimple/ks.yaml
Normal file
|
@ -0,0 +1,15 @@
|
||||||
|
---
|
||||||
|
# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
|
||||||
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||||
|
kind: Kustomization
|
||||||
|
metadata:
|
||||||
|
name: cert-manager-webhook-dnsimple
|
||||||
|
namespace: flux-system
|
||||||
|
spec:
|
||||||
|
interval: 10m
|
||||||
|
path: "./kubernetes/apps/cert-manager/webhook-dnsimple/app"
|
||||||
|
prune: true
|
||||||
|
sourceRef:
|
||||||
|
kind: GitRepository
|
||||||
|
name: homelab
|
||||||
|
wait: true
|
Loading…
Reference in a new issue