ingress
This commit is contained in:
16
app-of-apps/cert-manager.yaml
Normal file
16
app-of-apps/cert-manager.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: argocd
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
destination:
|
||||
namespace: cert-manager
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
path: cert-manager
|
||||
repoURL: https://build-node.undercloud.local/Undercloud/k8s-apps.git
|
||||
targetRevision: HEAD
|
||||
16
app-of-apps/ingress-external.yaml
Normal file
16
app-of-apps/ingress-external.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: ingress-external
|
||||
namespace: argocd
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
destination:
|
||||
namespace: ingress-external
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
path: ingress-external-devices
|
||||
repoURL: https://build-node.undercloud.local/Undercloud/k8s-apps.git
|
||||
targetRevision: HEAD
|
||||
16
app-of-apps/ingress.yaml
Normal file
16
app-of-apps/ingress.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: ingress
|
||||
namespace: argocd
|
||||
finalizers:
|
||||
- resources-finalizer.argocd.argoproj.io
|
||||
spec:
|
||||
destination:
|
||||
namespace: ingress-nginx
|
||||
server: https://kubernetes.default.svc
|
||||
project: default
|
||||
source:
|
||||
path: ingress-nginx
|
||||
repoURL: https://build-node.undercloud.local/Undercloud/k8s-apps.git
|
||||
targetRevision: HEAD
|
||||
BIN
cert-manager/.DS_Store
vendored
Normal file
BIN
cert-manager/.DS_Store
vendored
Normal file
Binary file not shown.
39
cert-manager/README.md
Normal file
39
cert-manager/README.md
Normal file
@@ -0,0 +1,39 @@
|
||||
# cert manager
|
||||
## creates (lets encrypt) certifcates automatically
|
||||
|
||||
### if anotated in an ingress definition
|
||||
|
||||
|
||||
#trust-manager
|
||||
trust-manager is the easiest way to manage trust bundles in Kubernetes and OpenShift clusters.
|
||||
|
||||
###
|
||||
important:
|
||||
cert manager is required and trust manager is being installed in the cert-manager namespace!!!
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
It orchestrates bundles of trusted X.509 certificates which are primarily used for validating certificates during a TLS handshake but can be used in other situations, too.
|
||||
|
||||
##Overview
|
||||
trust-manager is a small Kubernetes operator which aims to help reduce the overhead of managing TLS trust bundles in your clusters.
|
||||
|
||||
It adds the Bundle custom Kubernetes resource (CRD) which can read input from various sources and combine the resultant certificates into a bundle ready to be used by your applications.
|
||||
|
||||
trust-manager ensures that it's both quick and easy to keep your trusted certificates up-to-date and enables cluster administrators to easily automate providing a secure bundle without having to worry about rebuilding containers to update trust stores.
|
||||
|
||||
It's designed to complement cert-manager and works well when consuming CA certificates from a cert-manager Issuer or ClusterIssuer but can be used entirely independently from cert-manager if needed.
|
||||
|
||||
##Usage
|
||||
trust-manager is intentionally simple, and adds one new Kubernetes CustomResourceDefintion: Bundle.
|
||||
|
||||
A Bundle represents a set of PEM-encoded X.509 certificates that should be distributed and made available across the cluster. Bundles are cluster scoped.
|
||||
|
||||
Users specify a list of sources, which trust-manager will query and concatenate certificate data from. The only other required field is the target, which describes how and where the resulting bundle will be written.
|
||||
|
||||
improvements:
|
||||
metrics
|
||||
liveness probes
|
||||
resource limits
|
||||
16
cert-manager/bundles.yaml
Normal file
16
cert-manager/bundles.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: trust.cert-manager.io/v1alpha1
|
||||
kind: Bundle
|
||||
metadata:
|
||||
name: undercloud-ca-bundle
|
||||
spec:
|
||||
sources:
|
||||
- secret:
|
||||
name: "root-secret"
|
||||
key: "tls.crt"
|
||||
- useDefaultCAs: true
|
||||
target:
|
||||
configMap:
|
||||
key: "trust-bundle.pem"
|
||||
namespaceSelector:
|
||||
matchLabels:
|
||||
undercloud.cf/cert: "ca"
|
||||
412
cert-manager/cert-manager.yaml
Normal file
412
cert-manager/cert-manager.yaml
Normal file
@@ -0,0 +1,412 @@
|
||||
# Copyright 2022 The cert-manager Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
|
||||
|
||||
# Source: cert-manager/templates/webhook-config.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: cert-manager-webhook
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
data:
|
||||
---
|
||||
# Source: cert-manager/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ipFamilies:
|
||||
- IPv6
|
||||
- IPv4
|
||||
ipFamilyPolicy: PreferDualStack
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 9402
|
||||
name: tcp-prometheus-servicemonitor
|
||||
targetPort: 9402
|
||||
selector:
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
---
|
||||
# Source: cert-manager/templates/webhook-service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: cert-manager-webhook
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ipFamilies:
|
||||
- IPv6
|
||||
- IPv4
|
||||
ipFamilyPolicy: PreferDualStack
|
||||
ports:
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: "https"
|
||||
selector:
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
---
|
||||
# Source: cert-manager/templates/cainjector-deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: cert-manager-cainjector
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app: cainjector
|
||||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: cainjector
|
||||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
spec:
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "1"
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "1"
|
||||
serviceAccountName: cert-manager-cainjector
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: cert-manager-cainjector
|
||||
image: "quay.io/jetstack/cert-manager-cainjector:v1.11.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --v=2
|
||||
- --leader-election-namespace=kube-system
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
---
|
||||
# Source: cert-manager/templates/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
annotations:
|
||||
prometheus.io/path: "/metrics"
|
||||
prometheus.io/scrape: 'true'
|
||||
prometheus.io/port: '9402'
|
||||
spec:
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "1"
|
||||
hostAliases:
|
||||
- ip: "2001:470:72f0:f:1::b492"
|
||||
hostnames:
|
||||
- "ldap.undercloud.cf"
|
||||
- "mail.undercloud.cf"
|
||||
- "smtp.undercloud.cf"
|
||||
- "imap.undercloud.cf"
|
||||
- "autoconfig.undercloud.cf"
|
||||
- "autodiscover.undercloud.cf"
|
||||
- ip: "10.0.91.211"
|
||||
hostnames:
|
||||
- "ldap.undercloud.cf"
|
||||
- "mail.undercloud.cf"
|
||||
- "smtp.undercloud.cf"
|
||||
- "imap.undercloud.cf"
|
||||
- "autoconfig.undercloud.cf"
|
||||
- "autodiscover.undercloud.cf"
|
||||
serviceAccountName: cert-manager
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: cert-manager-controller
|
||||
image: "quay.io/jetstack/cert-manager-controller:v1.11.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --v=2
|
||||
- --cluster-resource-namespace=$(POD_NAMESPACE)
|
||||
- --leader-election-namespace=kube-system
|
||||
- --acme-http01-solver-image=quay.io/jetstack/cert-manager-acmesolver:v1.11.0
|
||||
- --max-concurrent-challenges=60
|
||||
ports:
|
||||
- containerPort: 9402
|
||||
name: http-metrics
|
||||
protocol: TCP
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
---
|
||||
# Source: cert-manager/templates/webhook-deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: cert-manager-webhook
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
spec:
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "1"
|
||||
serviceAccountName: cert-manager-webhook
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: cert-manager-webhook
|
||||
image: "quay.io/jetstack/cert-manager-webhook:v1.11.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --v=2
|
||||
- --secure-port=10250
|
||||
- --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
|
||||
- --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
|
||||
- --dynamic-serving-dns-names=cert-manager-webhook
|
||||
- --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE)
|
||||
- --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc
|
||||
|
||||
ports:
|
||||
- name: https
|
||||
protocol: TCP
|
||||
containerPort: 10250
|
||||
- name: healthcheck
|
||||
protocol: TCP
|
||||
containerPort: 6080
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /livez
|
||||
port: 6080
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 1
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 6080
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 1
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
---
|
||||
# Source: cert-manager/templates/webhook-mutating-webhook.yaml
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
name: cert-manager-webhook
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca"
|
||||
webhooks:
|
||||
- name: webhook.cert-manager.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "cert-manager.io"
|
||||
- "acme.cert-manager.io"
|
||||
apiVersions:
|
||||
- "v1"
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- "*/*"
|
||||
admissionReviewVersions: ["v1"]
|
||||
# This webhook only accepts v1 cert-manager resources.
|
||||
# Equivalent matchPolicy ensures that non-v1 resource requests are sent to
|
||||
# this webhook (after the resources have been converted to v1).
|
||||
matchPolicy: Equivalent
|
||||
timeoutSeconds: 10
|
||||
failurePolicy: Fail
|
||||
# Only include 'sideEffects' field in Kubernetes 1.12+
|
||||
sideEffects: None
|
||||
clientConfig:
|
||||
service:
|
||||
name: cert-manager-webhook
|
||||
namespace: cert-manager
|
||||
path: /mutate
|
||||
---
|
||||
# Source: cert-manager/templates/webhook-validating-webhook.yaml
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: cert-manager-webhook
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-webhook-ca"
|
||||
webhooks:
|
||||
- name: webhook.cert-manager.io
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
- key: "cert-manager.io/disable-validation"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- "true"
|
||||
- key: "name"
|
||||
operator: "NotIn"
|
||||
values:
|
||||
- cert-manager
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "cert-manager.io"
|
||||
- "acme.cert-manager.io"
|
||||
apiVersions:
|
||||
- "v1"
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- "*/*"
|
||||
admissionReviewVersions: ["v1"]
|
||||
# This webhook only accepts v1 cert-manager resources.
|
||||
# Equivalent matchPolicy ensures that non-v1 resource requests are sent to
|
||||
# this webhook (after the resources have been converted to v1).
|
||||
matchPolicy: Equivalent
|
||||
timeoutSeconds: 10
|
||||
failurePolicy: Fail
|
||||
sideEffects: None
|
||||
clientConfig:
|
||||
service:
|
||||
name: cert-manager-webhook
|
||||
namespace: cert-manager
|
||||
path: /validate
|
||||
4409
cert-manager/crds.yaml
Normal file
4409
cert-manager/crds.yaml
Normal file
File diff suppressed because it is too large
Load Diff
72
cert-manager/issuers.yaml
Normal file
72
cert-manager/issuers.yaml
Normal file
@@ -0,0 +1,72 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: selfsigned
|
||||
spec:
|
||||
selfSigned: {}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: selfsigned-ca
|
||||
spec:
|
||||
subject:
|
||||
organizations:
|
||||
- undercloud
|
||||
isCA: true
|
||||
commonName: selfsigned-ca
|
||||
secretName: root-secret
|
||||
privateKey:
|
||||
algorithm: ECDSA
|
||||
size: 256
|
||||
issuerRef:
|
||||
name: selfsigned
|
||||
kind: ClusterIssuer
|
||||
group: cert-manager.io
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: ca
|
||||
spec:
|
||||
ca:
|
||||
secretName: root-secret
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-staging
|
||||
spec:
|
||||
acme:
|
||||
email: thrawn235@gmail.com
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
privateKeySecretRef:
|
||||
# Secret resource that will be used to store the account's private key.
|
||||
name: letsencrypt-staging
|
||||
# Add a single challenge solver, HTTP01 using nginx
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: nginx
|
||||
serviceType: ClusterIP
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt
|
||||
spec:
|
||||
acme:
|
||||
# You must replace this email address with your own.
|
||||
# Let's Encrypt will use this to contact you about expiring
|
||||
# certificates, and issues related to your account.
|
||||
email: thrawn235@gmail.com
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
privateKeySecretRef:
|
||||
# Secret resource that will be used to store the account's private key.
|
||||
name: letsencrypt
|
||||
# Add a single challenge solver, HTTP01 using nginx
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: nginx
|
||||
serviceType: ClusterIP
|
||||
7
cert-manager/namespace.yaml
Normal file
7
cert-manager/namespace.yaml
Normal file
@@ -0,0 +1,7 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: cert-manager
|
||||
labels:
|
||||
prometheus: prometheus
|
||||
---
|
||||
704
cert-manager/rbac.yaml
Normal file
704
cert-manager/rbac.yaml
Normal file
@@ -0,0 +1,704 @@
|
||||
# Source: cert-manager/templates/cainjector-rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-cainjector
|
||||
labels:
|
||||
app: cainjector
|
||||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["get", "create", "update", "patch"]
|
||||
- apiGroups: ["admissionregistration.k8s.io"]
|
||||
resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["apiregistration.k8s.io"]
|
||||
resources: ["apiservices"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["apiextensions.k8s.io"]
|
||||
resources: ["customresourcedefinitions"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
# Issuer controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-controller-issuers
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["issuers", "issuers/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
# ClusterIssuer controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-controller-clusterissuers
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["clusterissuers", "clusterissuers/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["clusterissuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
# Certificates controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-controller-certificates
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificates/status", "certificaterequests", "certificaterequests/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "clusterissuers", "issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates/finalizers", "certificaterequests/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders"]
|
||||
verbs: ["create", "delete", "get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
# Orders controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-controller-orders
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders", "orders/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders", "challenges"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["clusterissuers", "issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges"]
|
||||
verbs: ["create", "delete"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["orders/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
# Challenges controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-controller-challenges
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
# Use to update challenge resource status
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges", "challenges/status"]
|
||||
verbs: ["update", "patch"]
|
||||
# Used to watch challenge resources
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# Used to watch challenges, issuer and clusterissuer resources
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["issuers", "clusterissuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# Need to be able to retrieve ACME account private key to complete challenges
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# Used to create events
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
# HTTP01 rules
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services"]
|
||||
verbs: ["get", "list", "watch", "create", "delete"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch", "create", "delete", "update"]
|
||||
- apiGroups: [ "gateway.networking.k8s.io" ]
|
||||
resources: [ "httproutes" ]
|
||||
verbs: ["get", "list", "watch", "create", "delete", "update"]
|
||||
# We require the ability to specify a custom hostname when we are creating
|
||||
# new ingress resources.
|
||||
# See: https://github.com/openshift/origin/blob/21f191775636f9acadb44fa42beeb4f75b255532/pkg/route/apiserver/admission/ingress_admission.go#L84-L148
|
||||
- apiGroups: ["route.openshift.io"]
|
||||
resources: ["routes/custom-host"]
|
||||
verbs: ["create"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges/finalizers"]
|
||||
verbs: ["update"]
|
||||
# DNS01 rules (duplicated above)
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
# ingress-shim controller role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-controller-ingress-shim
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests"]
|
||||
verbs: ["create", "update", "delete"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "issuers", "clusterissuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
# We require these rules to support users with the OwnerReferencesPermissionEnforcement
|
||||
# admission controller enabled:
|
||||
# https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#ownerreferencespermissionenforcement
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["gateway.networking.k8s.io"]
|
||||
resources: ["gateways", "httproutes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["gateway.networking.k8s.io"]
|
||||
resources: ["gateways/finalizers", "httproutes/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-view
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "issuers"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges", "orders"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-edit
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates", "certificaterequests", "issuers"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["certificates/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["acme.cert-manager.io"]
|
||||
resources: ["challenges", "orders"]
|
||||
verbs: ["create", "delete", "deletecollection", "patch", "update"]
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
# Permission to approve CertificateRequests referencing cert-manager.io Issuers and ClusterIssuers
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-controller-approve:cert-manager-io
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cert-manager"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
- apiGroups: ["cert-manager.io"]
|
||||
resources: ["signers"]
|
||||
verbs: ["approve"]
|
||||
resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
# Permission to:
|
||||
# - Update and sign CertificatSigningeRequests referencing cert-manager.io Issuers and ClusterIssuers
|
||||
# - Perform SubjectAccessReviews to test whether users are able to reference Namespaced Issuers
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-controller-certificatesigningrequests
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cert-manager"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources: ["certificatesigningrequests"]
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources: ["certificatesigningrequests/status"]
|
||||
verbs: ["update", "patch"]
|
||||
- apiGroups: ["certificates.k8s.io"]
|
||||
resources: ["signers"]
|
||||
resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
|
||||
verbs: ["sign"]
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
---
|
||||
# Source: cert-manager/templates/webhook-rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cert-manager-webhook:subjectaccessreviews
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
- apiGroups: ["authorization.k8s.io"]
|
||||
resources: ["subjectaccessreviews"]
|
||||
verbs: ["create"]
|
||||
---
|
||||
# Source: cert-manager/templates/cainjector-rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cert-manager-cainjector
|
||||
labels:
|
||||
app: cainjector
|
||||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cert-manager-cainjector
|
||||
subjects:
|
||||
- name: cert-manager-cainjector
|
||||
namespace: cert-manager
|
||||
kind: ServiceAccount
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cert-manager-controller-issuers
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cert-manager-controller-issuers
|
||||
subjects:
|
||||
- name: cert-manager
|
||||
namespace: cert-manager
|
||||
kind: ServiceAccount
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cert-manager-controller-clusterissuers
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cert-manager-controller-clusterissuers
|
||||
subjects:
|
||||
- name: cert-manager
|
||||
namespace: cert-manager
|
||||
kind: ServiceAccount
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cert-manager-controller-certificates
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cert-manager-controller-certificates
|
||||
subjects:
|
||||
- name: cert-manager
|
||||
namespace: cert-manager
|
||||
kind: ServiceAccount
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cert-manager-controller-orders
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cert-manager-controller-orders
|
||||
subjects:
|
||||
- name: cert-manager
|
||||
namespace: cert-manager
|
||||
kind: ServiceAccount
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cert-manager-controller-challenges
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cert-manager-controller-challenges
|
||||
subjects:
|
||||
- name: cert-manager
|
||||
namespace: cert-manager
|
||||
kind: ServiceAccount
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cert-manager-controller-ingress-shim
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cert-manager-controller-ingress-shim
|
||||
subjects:
|
||||
- name: cert-manager
|
||||
namespace: cert-manager
|
||||
kind: ServiceAccount
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cert-manager-controller-approve:cert-manager-io
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cert-manager"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cert-manager-controller-approve:cert-manager-io
|
||||
subjects:
|
||||
- name: cert-manager
|
||||
namespace: cert-manager
|
||||
kind: ServiceAccount
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cert-manager-controller-certificatesigningrequests
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cert-manager"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cert-manager-controller-certificatesigningrequests
|
||||
subjects:
|
||||
- name: cert-manager
|
||||
namespace: cert-manager
|
||||
kind: ServiceAccount
|
||||
---
|
||||
# Source: cert-manager/templates/webhook-rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: cert-manager-webhook:subjectaccessreviews
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cert-manager-webhook:subjectaccessreviews
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: cert-manager-webhook
|
||||
namespace: cert-manager
|
||||
---
|
||||
# Source: cert-manager/templates/cainjector-rbac.yaml
|
||||
# leader election rules
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: cert-manager-cainjector:leaderelection
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: cainjector
|
||||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
# Used for leader election by the controller
|
||||
# cert-manager-cainjector-leader-election is used by the CertificateBased injector controller
|
||||
# see cmd/cainjector/start.go#L113
|
||||
# cert-manager-cainjector-leader-election-core is used by the SecretBased injector controller
|
||||
# see cmd/cainjector/start.go#L137
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
resourceNames: ["cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"]
|
||||
verbs: ["get", "update", "patch"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["create"]
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: cert-manager:leaderelection
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
resourceNames: ["cert-manager-controller"]
|
||||
verbs: ["get", "update", "patch"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["create"]
|
||||
---
|
||||
# Source: cert-manager/templates/webhook-rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: cert-manager-webhook:dynamic-serving
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
resourceNames:
|
||||
- 'cert-manager-webhook-ca'
|
||||
verbs: ["get", "list", "watch", "update"]
|
||||
# It's not possible to grant CREATE permission on a single resourceName.
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
verbs: ["create"]
|
||||
---
|
||||
# Source: cert-manager/templates/cainjector-rbac.yaml
|
||||
# grant cert-manager permission to manage the leaderelection configmap in the
|
||||
# leader election namespace
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: cert-manager-cainjector:leaderelection
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: cainjector
|
||||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: cert-manager-cainjector:leaderelection
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: cert-manager-cainjector
|
||||
namespace: cert-manager
|
||||
---
|
||||
# Source: cert-manager/templates/rbac.yaml
|
||||
# grant cert-manager permission to manage the leaderelection configmap in the
|
||||
# leader election namespace
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: cert-manager:leaderelection
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: cert-manager:leaderelection
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: cert-manager
|
||||
namespace: cert-manager
|
||||
---
|
||||
# Source: cert-manager/templates/webhook-rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: cert-manager-webhook:dynamic-serving
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: cert-manager-webhook:dynamic-serving
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: cert-manager-webhook
|
||||
namespace: cert-manager
|
||||
---
|
||||
37
cert-manager/service-monitor.yaml
Normal file
37
cert-manager/service-monitor.yaml
Normal file
@@ -0,0 +1,37 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
team: undercloud
|
||||
spec:
|
||||
#namespaceSelector:
|
||||
# matchNames:
|
||||
# - argocd-metrics
|
||||
selector:
|
||||
matchLabels:
|
||||
app: cert-manager
|
||||
endpoints:
|
||||
- port: tcp-prometheus-servicemonitor
|
||||
#path: /metrics
|
||||
interval: 5s
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: trust-manager
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
team: undercloud
|
||||
spec:
|
||||
#namespaceSelector:
|
||||
# matchNames:
|
||||
# - argocd-metrics
|
||||
selector:
|
||||
matchLabels:
|
||||
app: trust-manager
|
||||
endpoints:
|
||||
- port: metrics
|
||||
#path: /metrics
|
||||
interval: 5s
|
||||
42
cert-manager/serviceaccounts.yaml
Normal file
42
cert-manager/serviceaccounts.yaml
Normal file
@@ -0,0 +1,42 @@
|
||||
# Source: cert-manager/templates/cainjector-serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
automountServiceAccountToken: true
|
||||
metadata:
|
||||
name: cert-manager-cainjector
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app: cainjector
|
||||
app.kubernetes.io/name: cainjector
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "cainjector"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
---
|
||||
# Source: cert-manager/templates/serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
automountServiceAccountToken: true
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app: cert-manager
|
||||
app.kubernetes.io/name: cert-manager
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "controller"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
---
|
||||
# Source: cert-manager/templates/webhook-serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
automountServiceAccountToken: true
|
||||
metadata:
|
||||
name: cert-manager-webhook
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app: webhook
|
||||
app.kubernetes.io/name: webhook
|
||||
app.kubernetes.io/instance: cert-manager
|
||||
app.kubernetes.io/component: "webhook"
|
||||
app.kubernetes.io/version: "v1.11.0"
|
||||
---
|
||||
533
cert-manager/trust-manager.yaml
Normal file
533
cert-manager/trust-manager.yaml
Normal file
@@ -0,0 +1,533 @@
|
||||
---
|
||||
# Source: trust-manager/templates/serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: trust-manager
|
||||
labels:
|
||||
app.kubernetes.io/name: trust-manager
|
||||
helm.sh/chart: trust-manager-v0.4.0
|
||||
app.kubernetes.io/instance: trust-manager
|
||||
app.kubernetes.io/version: "v0.4.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
---
|
||||
# Source: trust-manager/templates/trust.cert-manager.io_bundles.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.8.0
|
||||
creationTimestamp: null
|
||||
name: bundles.trust.cert-manager.io
|
||||
spec:
|
||||
group: trust.cert-manager.io
|
||||
names:
|
||||
kind: Bundle
|
||||
listKind: BundleList
|
||||
plural: bundles
|
||||
singular: bundle
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- description: Bundle Target Key
|
||||
jsonPath: .status.target.configMap.key
|
||||
name: Target
|
||||
type: string
|
||||
- description: Bundle has been synced
|
||||
jsonPath: .status.conditions[?(@.type == "Synced")].status
|
||||
name: Synced
|
||||
type: string
|
||||
- description: Reason Bundle has Synced status
|
||||
jsonPath: .status.conditions[?(@.type == "Synced")].reason
|
||||
name: Reason
|
||||
type: string
|
||||
- description: Timestamp Bundle was created
|
||||
jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
properties:
|
||||
apiVersion:
|
||||
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
||||
type: string
|
||||
kind:
|
||||
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Desired state of the Bundle resource.
|
||||
type: object
|
||||
required:
|
||||
- sources
|
||||
- target
|
||||
properties:
|
||||
sources:
|
||||
description: Sources is a set of references to data whose data will sync to the target.
|
||||
type: array
|
||||
items:
|
||||
description: BundleSource is the set of sources whose data will be appended and synced to the BundleTarget in all Namespaces.
|
||||
type: object
|
||||
properties:
|
||||
configMap:
|
||||
description: ConfigMap is a reference to a ConfigMap's `data` key, in the trust Namespace.
|
||||
type: object
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
properties:
|
||||
key:
|
||||
description: Key is the key of the entry in the object's `data` field to be used.
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the source object in the trust Namespace.
|
||||
type: string
|
||||
inLine:
|
||||
description: InLine is a simple string to append as the source data.
|
||||
type: string
|
||||
secret:
|
||||
description: Secret is a reference to a Secrets's `data` key, in the trust Namespace.
|
||||
type: object
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
properties:
|
||||
key:
|
||||
description: Key is the key of the entry in the object's `data` field to be used.
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the source object in the trust Namespace.
|
||||
type: string
|
||||
useDefaultCAs:
|
||||
description: UseDefaultCAs, when true, requests the default CA bundle to be used as a source. Default CAs are available if trust-manager was installed via Helm or was otherwise set up to include a package-injecting init container by using the "--default-package-location" flag when starting the trust-manager controller. If default CAs were not configured at start-up, any request to use the default CAs will fail. The version of the default CA package which is used for a Bundle is stored in the defaultCAPackageVersion field of the Bundle's status field.
|
||||
type: boolean
|
||||
target:
|
||||
description: Target is the target location in all namespaces to sync source data to.
|
||||
type: object
|
||||
properties:
|
||||
configMap:
|
||||
description: ConfigMap is the target ConfigMap in Namespaces that all Bundle source data will be synced to.
|
||||
type: object
|
||||
required:
|
||||
- key
|
||||
properties:
|
||||
key:
|
||||
description: Key is the key of the entry in the object's `data` field to be used.
|
||||
type: string
|
||||
namespaceSelector:
|
||||
description: NamespaceSelector will, if set, only sync the target resource in Namespaces which match the selector.
|
||||
type: object
|
||||
properties:
|
||||
matchLabels:
|
||||
description: MatchLabels matches on the set of labels that must be present on a Namespace for the Bundle target to be synced there.
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
status:
|
||||
description: Status of the Bundle. This is set and managed automatically.
|
||||
type: object
|
||||
properties:
|
||||
conditions:
|
||||
description: List of status conditions to indicate the status of the Bundle. Known condition types are `Bundle`.
|
||||
type: array
|
||||
items:
|
||||
description: BundleCondition contains condition information for a Bundle.
|
||||
type: object
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
|
||||
type: string
|
||||
format: date-time
|
||||
message:
|
||||
description: Message is a human readable description of the details of the last transition, complementing reason.
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Bundle.
|
||||
type: integer
|
||||
format: int64
|
||||
reason:
|
||||
description: Reason is a brief machine readable explanation for the condition's last transition.
|
||||
type: string
|
||||
status:
|
||||
description: Status of the condition, one of ('True', 'False', 'Unknown').
|
||||
type: string
|
||||
type:
|
||||
description: Type of the condition, known values are (`Synced`).
|
||||
type: string
|
||||
defaultCAVersion:
|
||||
description: DefaultCAPackageVersion, if set and non-empty, indicates the version information which was retrieved when the set of default CAs was requested in the bundle source. This should only be set if useDefaultCAs was set to "true" on a source, and will be the same for the same version of a bundle with identical certificates.
|
||||
type: string
|
||||
target:
|
||||
description: Target is the current Target that the Bundle is attempting or has completed syncing the source data to.
|
||||
type: object
|
||||
properties:
|
||||
configMap:
|
||||
description: ConfigMap is the target ConfigMap in Namespaces that all Bundle source data will be synced to.
|
||||
type: object
|
||||
required:
|
||||
- key
|
||||
properties:
|
||||
key:
|
||||
description: Key is the key of the entry in the object's `data` field to be used.
|
||||
type: string
|
||||
namespaceSelector:
|
||||
description: NamespaceSelector will, if set, only sync the target resource in Namespaces which match the selector.
|
||||
type: object
|
||||
properties:
|
||||
matchLabels:
|
||||
description: MatchLabels matches on the set of labels that must be present on a Namespace for the Bundle target to be synced there.
|
||||
type: object
|
||||
additionalProperties:
|
||||
type: string
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
status:
|
||||
acceptedNames:
|
||||
kind: ""
|
||||
plural: ""
|
||||
conditions: []
|
||||
storedVersions: []
|
||||
---
|
||||
# Source: trust-manager/templates/clusterrole.yaml
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: trust-manager
|
||||
helm.sh/chart: trust-manager-v0.4.0
|
||||
app.kubernetes.io/instance: trust-manager
|
||||
app.kubernetes.io/version: "v0.4.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
name: trust-manager
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "trust.cert-manager.io"
|
||||
resources:
|
||||
- "bundles"
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
# Permissions to update finalizers are required for trust-manager to work correctly
|
||||
# on OpenShift, even though we don't directly use finalizers at the time of writing
|
||||
- apiGroups:
|
||||
- "trust.cert-manager.io"
|
||||
resources:
|
||||
- "bundles/finalizers"
|
||||
verbs: ["update"]
|
||||
|
||||
- apiGroups:
|
||||
- "trust.cert-manager.io"
|
||||
resources:
|
||||
- "bundles/status"
|
||||
verbs: ["update"]
|
||||
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "configmaps"
|
||||
verbs: ["get", "list", "create", "update", "watch", "delete"]
|
||||
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "namespaces"
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "events"
|
||||
verbs: ["create", "patch"]
|
||||
---
|
||||
# Source: trust-manager/templates/clusterrolebinding.yaml
|
||||
kind: ClusterRoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: trust-manager
|
||||
helm.sh/chart: trust-manager-v0.4.0
|
||||
app.kubernetes.io/instance: trust-manager
|
||||
app.kubernetes.io/version: "v0.4.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
name: trust-manager
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: trust-manager
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: trust-manager
|
||||
namespace: cert-manager
|
||||
---
|
||||
# Source: trust-manager/templates/role.yaml
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: trust-manager
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app.kubernetes.io/name: trust-manager
|
||||
helm.sh/chart: trust-manager-v0.4.0
|
||||
app.kubernetes.io/instance: trust-manager
|
||||
app.kubernetes.io/version: "v0.4.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "secrets"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
- apiGroups:
|
||||
- "coordination.k8s.io"
|
||||
resources:
|
||||
- "leases"
|
||||
verbs:
|
||||
- "get"
|
||||
- "create"
|
||||
- "update"
|
||||
- "watch"
|
||||
- "list"
|
||||
---
|
||||
# Source: trust-manager/templates/rolebinding.yaml
|
||||
kind: RoleBinding
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
name: trust-manager
|
||||
namespace: cert-manager
|
||||
labels:
|
||||
app.kubernetes.io/name: trust-manager
|
||||
helm.sh/chart: trust-manager-v0.4.0
|
||||
app.kubernetes.io/instance: trust-manager
|
||||
app.kubernetes.io/version: "v0.4.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: trust-manager
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: trust-manager
|
||||
namespace: cert-manager
|
||||
---
|
||||
# Source: trust-manager/templates/metrics-service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: trust-manager-metrics
|
||||
labels:
|
||||
app: trust-manager
|
||||
app.kubernetes.io/name: trust-manager
|
||||
helm.sh/chart: trust-manager-v0.4.0
|
||||
app.kubernetes.io/instance: trust-manager
|
||||
app.kubernetes.io/version: "v0.4.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 9402
|
||||
targetPort: 9402
|
||||
protocol: TCP
|
||||
name: metrics
|
||||
selector:
|
||||
app: trust-manager
|
||||
---
|
||||
# Source: trust-manager/templates/webhook.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: trust-manager
|
||||
labels:
|
||||
app: trust-manager
|
||||
app.kubernetes.io/name: trust-manager
|
||||
helm.sh/chart: trust-manager-v0.4.0
|
||||
app.kubernetes.io/instance: trust-manager
|
||||
app.kubernetes.io/version: "v0.4.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 6443
|
||||
protocol: TCP
|
||||
name: webhook
|
||||
selector:
|
||||
app: trust-manager
|
||||
---
|
||||
# Source: trust-manager/templates/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: trust-manager
|
||||
labels:
|
||||
app.kubernetes.io/name: trust-manager
|
||||
helm.sh/chart: trust-manager-v0.4.0
|
||||
app.kubernetes.io/instance: trust-manager
|
||||
app.kubernetes.io/version: "v0.4.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: trust-manager
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: trust-manager
|
||||
spec:
|
||||
serviceAccountName: trust-manager
|
||||
initContainers:
|
||||
- name: cert-manager-package-debian
|
||||
image: "quay.io/jetstack/cert-manager-package-debian:20210119.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- "/copyandmaybepause"
|
||||
- "/debian-package"
|
||||
- "/packages"
|
||||
volumeMounts:
|
||||
- mountPath: /packages
|
||||
name: packages
|
||||
readOnly: false
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: trust-manager
|
||||
image: "quay.io/jetstack/trust-manager:v0.4.0"
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 6443
|
||||
- containerPort: 9402
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
port: 6060
|
||||
path: /readyz
|
||||
initialDelaySeconds: 3
|
||||
periodSeconds: 7
|
||||
command: ["trust-manager"]
|
||||
args:
|
||||
- "--log-level=1"
|
||||
- "--metrics-port=9402"
|
||||
- "--readiness-probe-port=6060"
|
||||
- "--readiness-probe-path=/readyz"
|
||||
# trust
|
||||
- "--trust-namespace=cert-manager"
|
||||
# webhook
|
||||
- "--webhook-host=0.0.0.0"
|
||||
- "--webhook-port=6443"
|
||||
- "--webhook-certificate-dir=/tls"
|
||||
- "--default-package-location=/packages/cert-manager-package-debian.json"
|
||||
volumeMounts:
|
||||
- mountPath: /tls
|
||||
name: tls
|
||||
readOnly: true
|
||||
- mountPath: /packages
|
||||
name: packages
|
||||
readOnly: true
|
||||
resources:
|
||||
{}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumes:
|
||||
- name: packages
|
||||
emptyDir: {}
|
||||
- name: tls
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: trust-manager-tls
|
||||
---
|
||||
# Source: trust-manager/templates/certificate.yaml
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: trust-manager
|
||||
labels:
|
||||
app.kubernetes.io/name: trust-manager
|
||||
helm.sh/chart: trust-manager-v0.4.0
|
||||
app.kubernetes.io/instance: trust-manager
|
||||
app.kubernetes.io/version: "v0.4.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
dnsNames:
|
||||
- "trust-manager.cert-manager.svc"
|
||||
secretName: trust-manager-tls
|
||||
revisionHistoryLimit: 1
|
||||
issuerRef:
|
||||
name: trust-manager
|
||||
kind: Issuer
|
||||
group: cert-manager.io
|
||||
---
|
||||
# Source: trust-manager/templates/certificate.yaml
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: trust-manager
|
||||
labels:
|
||||
app.kubernetes.io/name: trust-manager
|
||||
helm.sh/chart: trust-manager-v0.4.0
|
||||
app.kubernetes.io/instance: trust-manager
|
||||
app.kubernetes.io/version: "v0.4.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
selfSigned: {}
|
||||
---
|
||||
# Source: trust-manager/templates/webhook.yaml
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: trust-manager
|
||||
labels:
|
||||
app: trust-manager
|
||||
app.kubernetes.io/name: trust-manager
|
||||
helm.sh/chart: trust-manager-v0.4.0
|
||||
app.kubernetes.io/instance: trust-manager
|
||||
app.kubernetes.io/version: "v0.4.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: "cert-manager/trust-manager"
|
||||
|
||||
webhooks:
|
||||
- name: trust.cert-manager.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "trust.cert-manager.io"
|
||||
apiVersions:
|
||||
- "*"
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- "*/*"
|
||||
admissionReviewVersions: ["v1"]
|
||||
timeoutSeconds: 5
|
||||
failurePolicy: Fail
|
||||
sideEffects: None
|
||||
clientConfig:
|
||||
service:
|
||||
name: trust-manager
|
||||
namespace: "cert-manager"
|
||||
path: /validate
|
||||
5
ingress-external-devices/README.md
Normal file
5
ingress-external-devices/README.md
Normal file
@@ -0,0 +1,5 @@
|
||||
# Ingress-Nginx for external devices
|
||||
## ingress / reverse Proxy
|
||||
|
||||
### ingress ressources and service ressources for Devices that are not running in Kubernetes. Like the Firewall, switches, aux1 and aux2 etc.
|
||||
|
||||
155
ingress-external-devices/aux1.yaml
Normal file
155
ingress-external-devices/aux1.yaml
Normal file
@@ -0,0 +1,155 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: aux1-cockpit
|
||||
namespace: ingress-external
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: aux1.undercloud.cf. # eg example.example.com
|
||||
ports:
|
||||
- port: 9090
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: aux1-cockpit
|
||||
namespace: ingress-external
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||||
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- aux1-cockpit.undercloud.cf
|
||||
secretName: aux1-cockpit-tls
|
||||
rules:
|
||||
- host: aux1-cockpit.undercloud.cf
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: aux1-cockpit
|
||||
port:
|
||||
number: 9090
|
||||
---
|
||||
#Unifi Controller 8443
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: aux1-unifi
|
||||
namespace: ingress-external
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: aux1.undercloud.cf # eg example.example.com
|
||||
ports:
|
||||
- port: 8443
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: aux1-unifi
|
||||
namespace: ingress-external
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- aux1-unifi.undercloud.cf
|
||||
secretName: aux1-unifi-tls
|
||||
rules:
|
||||
- host: aux1-unifi.undercloud.cf
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: aux1-unifi
|
||||
port:
|
||||
number: 8443
|
||||
---
|
||||
#gitea:3000
|
||||
#apiVersion: v1
|
||||
#kind: Service
|
||||
#metadata:
|
||||
# name: aux1-gitea
|
||||
# namespace: ingress-external
|
||||
#spec:
|
||||
# type: ExternalName
|
||||
# externalName: aux1.undercloud.cf # eg example.example.com
|
||||
# ports:
|
||||
# - port: 3000
|
||||
#---
|
||||
#apiVersion: networking.k8s.io/v1
|
||||
#kind: Ingress
|
||||
#metadata:
|
||||
# name: aux1-gitea
|
||||
# namespace: ingress-external
|
||||
# annotations:
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# cert-manager.io/cluster-issuer: letsencrypt
|
||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
|
||||
#
|
||||
#spec:
|
||||
# tls:
|
||||
# - hosts:
|
||||
# - aux1-gitea.undercloud.cf
|
||||
# secretName: aux1-gitea-tls
|
||||
# rules:
|
||||
# - host: aux1-gitea.undercloud.cf
|
||||
# http:
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: aux1-gitea
|
||||
# port:
|
||||
# number: 3000
|
||||
#---
|
||||
#portainer:9443
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: aux1-portainer
|
||||
namespace: ingress-external
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: aux1.undercloud.cf # eg example.example.com
|
||||
ports:
|
||||
- port: 9443
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: aux1-portainer
|
||||
namespace: ingress-external
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- aux1-portainer.undercloud.cf
|
||||
secretName: aux1-portainer-tls
|
||||
rules:
|
||||
- host: aux1-portainer.undercloud.cf
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: aux1-portainer
|
||||
port:
|
||||
number: 9443
|
||||
155
ingress-external-devices/aux2.yaml
Normal file
155
ingress-external-devices/aux2.yaml
Normal file
@@ -0,0 +1,155 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: aux2-cockpit
|
||||
namespace: ingress-external
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: aux2.undercloud.cf. # eg example.example.com
|
||||
ports:
|
||||
- port: 9090
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: aux2-cockpit
|
||||
namespace: ingress-external
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||||
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- aux2-cockpit.undercloud.cf
|
||||
secretName: aux2-cockpit-tls
|
||||
rules:
|
||||
- host: aux2-cockpit.undercloud.cf
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: aux2-cockpit
|
||||
port:
|
||||
number: 9090
|
||||
---
|
||||
#Unifi Controller 8443
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: aux2-unifi
|
||||
namespace: ingress-external
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: aux2.undercloud.cf # eg example.example.com
|
||||
ports:
|
||||
- port: 8443
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: aux2-unifi
|
||||
namespace: ingress-external
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- aux2-unifi.undercloud.cf
|
||||
secretName: aux2-unifi-tls
|
||||
rules:
|
||||
- host: aux2-unifi.undercloud.cf
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: aux2-unifi
|
||||
port:
|
||||
number: 8443
|
||||
---
|
||||
#gitea:3000
|
||||
#apiVersion: v1
|
||||
#kind: Service
|
||||
#metadata:
|
||||
# name: aux2-gitea
|
||||
# namespace: ingress-external
|
||||
#spec:
|
||||
# type: ExternalName
|
||||
# externalName: aux2.undercloud.cf # eg example.example.com
|
||||
# ports:
|
||||
# - port: 3000
|
||||
#---
|
||||
#apiVersion: networking.k8s.io/v1
|
||||
#kind: Ingress
|
||||
#metadata:
|
||||
# name: aux2-gitea
|
||||
# namespace: ingress-external
|
||||
# annotations:
|
||||
# kubernetes.io/ingress.class: nginx
|
||||
# cert-manager.io/cluster-issuer: letsencrypt
|
||||
# nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
|
||||
#
|
||||
#spec:
|
||||
# tls:
|
||||
# - hosts:
|
||||
# - aux2-gitea.undercloud.cf
|
||||
# secretName: aux2-gitea-tls
|
||||
# rules:
|
||||
# - host: aux2-gitea.undercloud.cf
|
||||
# http:
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: aux2-gitea
|
||||
# port:
|
||||
# number: 3000
|
||||
#---
|
||||
#portainer:9443
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: aux2-portainer
|
||||
namespace: ingress-external
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: aux2.undercloud.cf # eg example.example.com
|
||||
ports:
|
||||
- port: 9443
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: aux2-portainer
|
||||
namespace: ingress-external
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- aux2-portainer.undercloud.cf
|
||||
secretName: aux2-portainer-tls
|
||||
rules:
|
||||
- host: aux2-portainer.undercloud.cf
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: aux2-portainer
|
||||
port:
|
||||
number: 9443
|
||||
75
ingress-external-devices/firewall.yaml
Normal file
75
ingress-external-devices/firewall.yaml
Normal file
@@ -0,0 +1,75 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: firewall-admin
|
||||
namespace: ingress-external
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: firewall.undercloud.cf # eg example.example.com
|
||||
ports:
|
||||
- port: 4444
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: firewall-admin
|
||||
namespace: ingress-external
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- firewall-admin.undercloud.cf
|
||||
secretName: firewall-admin-tls
|
||||
rules:
|
||||
- host: firewall-admin.undercloud.cf
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: firewall-admin
|
||||
port:
|
||||
number: 4444
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: firewall-userportal
|
||||
namespace: ingress-external
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: firewall.undercloud.cf # eg example.example.com
|
||||
ports:
|
||||
- port: 4443
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: firewall-userportal
|
||||
namespace: ingress-external
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
|
||||
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- firewall-userportal.undercloud.cf
|
||||
secretName: firewall-userportal-tls
|
||||
rules:
|
||||
- host: firewall-userportal.undercloud.cf
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: firewall-userportal
|
||||
port:
|
||||
number: 4443
|
||||
37
ingress-external-devices/lancom.yaml
Normal file
37
ingress-external-devices/lancom.yaml
Normal file
@@ -0,0 +1,37 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: lancom-admin
|
||||
namespace: ingress-external
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: lancom.admin.undercloud.cf # eg example.example.com
|
||||
ports:
|
||||
- port: 80
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: lancom-admin
|
||||
namespace: ingress-external
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
|
||||
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- lancom-admin.undercloud.cf
|
||||
secretName: lancom-admin-tls
|
||||
rules:
|
||||
- host: lancom-admin.undercloud.cf
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: lancom-admin
|
||||
port:
|
||||
number: 80
|
||||
4
ingress-external-devices/namespace.yaml
Normal file
4
ingress-external-devices/namespace.yaml
Normal file
@@ -0,0 +1,4 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: ingress-external
|
||||
BIN
ingress-nginx/.DS_Store
vendored
Normal file
BIN
ingress-nginx/.DS_Store
vendored
Normal file
Binary file not shown.
12
ingress-nginx/README.md
Normal file
12
ingress-nginx/README.md
Normal file
@@ -0,0 +1,12 @@
|
||||
# Ingress-Nginx
|
||||
## ingress / reverse Proxy
|
||||
|
||||
### nginx reverse proxy with kubernetes integration
|
||||
|
||||
reverse proxy
|
||||
uses Ingress ressources to connect the outside to a kubernetes service
|
||||
|
||||
there is specific configuration for openldap
|
||||
see:
|
||||
https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/
|
||||
or the readme in the openldap folder
|
||||
13
ingress-nginx/configmaps.yaml
Normal file
13
ingress-nginx/configmaps.yaml
Normal file
@@ -0,0 +1,13 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: tcp-services
|
||||
namespace: ingress-nginx
|
||||
data:
|
||||
636: "openldap/ldap:636"
|
||||
389: "openldap/ldap:389"
|
||||
25: "docker-mailserver/docker-mailserver:25::PROXY"
|
||||
465: "docker-mailserver/docker-mailserver:465::PROXY"
|
||||
587: "docker-mailserver/docker-mailserver:587::PROXY"
|
||||
993: "docker-mailserver/docker-mailserver:993::PROXY"
|
||||
143: "docker-mailserver/docker-mailserver:143::PROXY"
|
||||
707
ingress-nginx/ingress-nginx.yaml
Normal file
707
ingress-nginx/ingress-nginx.yaml
Normal file
@@ -0,0 +1,707 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
prometheus: prometheus
|
||||
name: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
automountServiceAccountToken: true
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- pods
|
||||
- secrets
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- endpoints
|
||||
- nodes
|
||||
- pods
|
||||
- secrets
|
||||
- namespaces
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
allow-snippet-annotations: "true"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
clusterIP: '2001:470:72f0:f:1::b492'
|
||||
clusterIPs:
|
||||
- '2001:470:72f0:f:1::b492'
|
||||
- 10.0.91.211
|
||||
#externalTrafficPolicy: Local
|
||||
ipFamilies:
|
||||
- IPv6
|
||||
- IPv4
|
||||
ipFamilyPolicy: PreferDualStack
|
||||
ports:
|
||||
- appProtocol: http
|
||||
name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
- appProtocol: https
|
||||
name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
- name: ldap
|
||||
port: 389
|
||||
protocol: TCP
|
||||
targetPort: 389
|
||||
- name: ldaps
|
||||
port: 636
|
||||
protocol: TCP
|
||||
targetPort: 636
|
||||
selector:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: ingress-nginx-metrics
|
||||
name: ingress-nginx-metrics
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
ipFamilies:
|
||||
- IPv6
|
||||
- IPv4
|
||||
ipFamilyPolicy: PreferDualStack
|
||||
ports:
|
||||
- name: metrics
|
||||
port: 10254
|
||||
protocol: TCP
|
||||
targetPort: 10254
|
||||
selector:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
#ipFamilies:
|
||||
#- IPv6
|
||||
#- IPv4
|
||||
#ipFamilyPolicy: PreferDualStack
|
||||
ports:
|
||||
- appProtocol: https
|
||||
name: https-webhook
|
||||
port: 443
|
||||
targetPort: webhook
|
||||
selector:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
minReadySeconds: 0
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
spec:
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "1"
|
||||
containers:
|
||||
- args:
|
||||
- /nginx-ingress-controller
|
||||
- --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||
- --election-id=ingress-nginx-leader
|
||||
- --controller-class=k8s.io/ingress-nginx
|
||||
- --ingress-class=nginx
|
||||
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
|
||||
- --validating-webhook=:8443
|
||||
- --validating-webhook-certificate=/usr/local/certificates/cert
|
||||
- --validating-webhook-key=/usr/local/certificates/key
|
||||
- --enable-metrics
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /wait-shutdown
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
name: controller
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 443
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: webhook
|
||||
protocol: TCP
|
||||
- name: prometheus
|
||||
containerPort: 10254
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 90Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: true
|
||||
capabilities:
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
drop:
|
||||
- ALL
|
||||
runAsUser: 101
|
||||
volumeMounts:
|
||||
- mountPath: /usr/local/certificates/
|
||||
name: webhook-cert
|
||||
readOnly: true
|
||||
dnsPolicy: ClusterFirst
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
serviceAccountName: ingress-nginx
|
||||
terminationGracePeriodSeconds: 300
|
||||
volumes:
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
secretName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- create
|
||||
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --secret-name=ingress-nginx-admission
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: create
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
fsGroup: 2000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 2000
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- patch
|
||||
- --webhook-name=ingress-nginx-admission
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --patch-mutating=false
|
||||
- --secret-name=ingress-nginx-admission
|
||||
- --patch-failure-policy=Fail
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: patch
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
fsGroup: 2000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 2000
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: IngressClass
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
path: /networking/v1/ingresses
|
||||
failurePolicy: Fail
|
||||
matchPolicy: Equivalent
|
||||
name: validate.nginx.ingress.kubernetes.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingresses
|
||||
sideEffects: None
|
||||
18
ingress-nginx/service-monitor.yaml
Normal file
18
ingress-nginx/service-monitor.yaml
Normal file
@@ -0,0 +1,18 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
labels:
|
||||
team: undercloud
|
||||
spec:
|
||||
#namespaceSelector:
|
||||
# matchNames:
|
||||
# - argocd-metrics
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: ingress-nginx-metrics
|
||||
endpoints:
|
||||
- port: metrics
|
||||
#path: /metrics
|
||||
interval: 5s
|
||||
Reference in New Issue
Block a user