533 lines
18 KiB
YAML
533 lines
18 KiB
YAML
---
|
|
# Source: trust-manager/templates/serviceaccount.yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: trust-manager
|
|
labels:
|
|
app.kubernetes.io/name: trust-manager
|
|
helm.sh/chart: trust-manager-v0.4.0
|
|
app.kubernetes.io/instance: trust-manager
|
|
app.kubernetes.io/version: "v0.4.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
---
|
|
# Source: trust-manager/templates/trust.cert-manager.io_bundles.yaml
|
|
apiVersion: apiextensions.k8s.io/v1
|
|
kind: CustomResourceDefinition
|
|
metadata:
|
|
annotations:
|
|
controller-gen.kubebuilder.io/version: v0.8.0
|
|
creationTimestamp: null
|
|
name: bundles.trust.cert-manager.io
|
|
spec:
|
|
group: trust.cert-manager.io
|
|
names:
|
|
kind: Bundle
|
|
listKind: BundleList
|
|
plural: bundles
|
|
singular: bundle
|
|
scope: Cluster
|
|
versions:
|
|
- additionalPrinterColumns:
|
|
- description: Bundle Target Key
|
|
jsonPath: .status.target.configMap.key
|
|
name: Target
|
|
type: string
|
|
- description: Bundle has been synced
|
|
jsonPath: .status.conditions[?(@.type == "Synced")].status
|
|
name: Synced
|
|
type: string
|
|
- description: Reason Bundle has Synced status
|
|
jsonPath: .status.conditions[?(@.type == "Synced")].reason
|
|
name: Reason
|
|
type: string
|
|
- description: Timestamp Bundle was created
|
|
jsonPath: .metadata.creationTimestamp
|
|
name: Age
|
|
type: date
|
|
name: v1alpha1
|
|
schema:
|
|
openAPIV3Schema:
|
|
type: object
|
|
required:
|
|
- spec
|
|
properties:
|
|
apiVersion:
|
|
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
type: string
|
|
kind:
|
|
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
type: string
|
|
metadata:
|
|
type: object
|
|
spec:
|
|
description: Desired state of the Bundle resource.
|
|
type: object
|
|
required:
|
|
- sources
|
|
- target
|
|
properties:
|
|
sources:
|
|
description: Sources is a set of references to data whose data will sync to the target.
|
|
type: array
|
|
items:
|
|
description: BundleSource is the set of sources whose data will be appended and synced to the BundleTarget in all Namespaces.
|
|
type: object
|
|
properties:
|
|
configMap:
|
|
description: ConfigMap is a reference to a ConfigMap's `data` key, in the trust Namespace.
|
|
type: object
|
|
required:
|
|
- key
|
|
- name
|
|
properties:
|
|
key:
|
|
description: Key is the key of the entry in the object's `data` field to be used.
|
|
type: string
|
|
name:
|
|
description: Name is the name of the source object in the trust Namespace.
|
|
type: string
|
|
inLine:
|
|
description: InLine is a simple string to append as the source data.
|
|
type: string
|
|
secret:
|
|
description: Secret is a reference to a Secrets's `data` key, in the trust Namespace.
|
|
type: object
|
|
required:
|
|
- key
|
|
- name
|
|
properties:
|
|
key:
|
|
description: Key is the key of the entry in the object's `data` field to be used.
|
|
type: string
|
|
name:
|
|
description: Name is the name of the source object in the trust Namespace.
|
|
type: string
|
|
useDefaultCAs:
|
|
description: UseDefaultCAs, when true, requests the default CA bundle to be used as a source. Default CAs are available if trust-manager was installed via Helm or was otherwise set up to include a package-injecting init container by using the "--default-package-location" flag when starting the trust-manager controller. If default CAs were not configured at start-up, any request to use the default CAs will fail. The version of the default CA package which is used for a Bundle is stored in the defaultCAPackageVersion field of the Bundle's status field.
|
|
type: boolean
|
|
target:
|
|
description: Target is the target location in all namespaces to sync source data to.
|
|
type: object
|
|
properties:
|
|
configMap:
|
|
description: ConfigMap is the target ConfigMap in Namespaces that all Bundle source data will be synced to.
|
|
type: object
|
|
required:
|
|
- key
|
|
properties:
|
|
key:
|
|
description: Key is the key of the entry in the object's `data` field to be used.
|
|
type: string
|
|
namespaceSelector:
|
|
description: NamespaceSelector will, if set, only sync the target resource in Namespaces which match the selector.
|
|
type: object
|
|
properties:
|
|
matchLabels:
|
|
description: MatchLabels matches on the set of labels that must be present on a Namespace for the Bundle target to be synced there.
|
|
type: object
|
|
additionalProperties:
|
|
type: string
|
|
status:
|
|
description: Status of the Bundle. This is set and managed automatically.
|
|
type: object
|
|
properties:
|
|
conditions:
|
|
description: List of status conditions to indicate the status of the Bundle. Known condition types are `Bundle`.
|
|
type: array
|
|
items:
|
|
description: BundleCondition contains condition information for a Bundle.
|
|
type: object
|
|
required:
|
|
- status
|
|
- type
|
|
properties:
|
|
lastTransitionTime:
|
|
description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
|
|
type: string
|
|
format: date-time
|
|
message:
|
|
description: Message is a human readable description of the details of the last transition, complementing reason.
|
|
type: string
|
|
observedGeneration:
|
|
description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Bundle.
|
|
type: integer
|
|
format: int64
|
|
reason:
|
|
description: Reason is a brief machine readable explanation for the condition's last transition.
|
|
type: string
|
|
status:
|
|
description: Status of the condition, one of ('True', 'False', 'Unknown').
|
|
type: string
|
|
type:
|
|
description: Type of the condition, known values are (`Synced`).
|
|
type: string
|
|
defaultCAVersion:
|
|
description: DefaultCAPackageVersion, if set and non-empty, indicates the version information which was retrieved when the set of default CAs was requested in the bundle source. This should only be set if useDefaultCAs was set to "true" on a source, and will be the same for the same version of a bundle with identical certificates.
|
|
type: string
|
|
target:
|
|
description: Target is the current Target that the Bundle is attempting or has completed syncing the source data to.
|
|
type: object
|
|
properties:
|
|
configMap:
|
|
description: ConfigMap is the target ConfigMap in Namespaces that all Bundle source data will be synced to.
|
|
type: object
|
|
required:
|
|
- key
|
|
properties:
|
|
key:
|
|
description: Key is the key of the entry in the object's `data` field to be used.
|
|
type: string
|
|
namespaceSelector:
|
|
description: NamespaceSelector will, if set, only sync the target resource in Namespaces which match the selector.
|
|
type: object
|
|
properties:
|
|
matchLabels:
|
|
description: MatchLabels matches on the set of labels that must be present on a Namespace for the Bundle target to be synced there.
|
|
type: object
|
|
additionalProperties:
|
|
type: string
|
|
served: true
|
|
storage: true
|
|
subresources:
|
|
status: {}
|
|
status:
|
|
acceptedNames:
|
|
kind: ""
|
|
plural: ""
|
|
conditions: []
|
|
storedVersions: []
|
|
---
|
|
# Source: trust-manager/templates/clusterrole.yaml
|
|
kind: ClusterRole
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: trust-manager
|
|
helm.sh/chart: trust-manager-v0.4.0
|
|
app.kubernetes.io/instance: trust-manager
|
|
app.kubernetes.io/version: "v0.4.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
name: trust-manager
|
|
rules:
|
|
- apiGroups:
|
|
- "trust.cert-manager.io"
|
|
resources:
|
|
- "bundles"
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
# Permissions to update finalizers are required for trust-manager to work correctly
|
|
# on OpenShift, even though we don't directly use finalizers at the time of writing
|
|
- apiGroups:
|
|
- "trust.cert-manager.io"
|
|
resources:
|
|
- "bundles/finalizers"
|
|
verbs: ["update"]
|
|
|
|
- apiGroups:
|
|
- "trust.cert-manager.io"
|
|
resources:
|
|
- "bundles/status"
|
|
verbs: ["update"]
|
|
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- "configmaps"
|
|
verbs: ["get", "list", "create", "update", "watch", "delete"]
|
|
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- "namespaces"
|
|
verbs: ["get", "list", "watch"]
|
|
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- "events"
|
|
verbs: ["create", "patch"]
|
|
---
|
|
# Source: trust-manager/templates/clusterrolebinding.yaml
|
|
kind: ClusterRoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: trust-manager
|
|
helm.sh/chart: trust-manager-v0.4.0
|
|
app.kubernetes.io/instance: trust-manager
|
|
app.kubernetes.io/version: "v0.4.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
name: trust-manager
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: trust-manager
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: trust-manager
|
|
namespace: cert-manager
|
|
---
|
|
# Source: trust-manager/templates/role.yaml
|
|
kind: Role
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: trust-manager
|
|
namespace: cert-manager
|
|
labels:
|
|
app.kubernetes.io/name: trust-manager
|
|
helm.sh/chart: trust-manager-v0.4.0
|
|
app.kubernetes.io/instance: trust-manager
|
|
app.kubernetes.io/version: "v0.4.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- "secrets"
|
|
verbs:
|
|
- "get"
|
|
- "list"
|
|
- "watch"
|
|
- apiGroups:
|
|
- "coordination.k8s.io"
|
|
resources:
|
|
- "leases"
|
|
verbs:
|
|
- "get"
|
|
- "create"
|
|
- "update"
|
|
- "watch"
|
|
- "list"
|
|
---
|
|
# Source: trust-manager/templates/rolebinding.yaml
|
|
kind: RoleBinding
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
metadata:
|
|
name: trust-manager
|
|
namespace: cert-manager
|
|
labels:
|
|
app.kubernetes.io/name: trust-manager
|
|
helm.sh/chart: trust-manager-v0.4.0
|
|
app.kubernetes.io/instance: trust-manager
|
|
app.kubernetes.io/version: "v0.4.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: trust-manager
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: trust-manager
|
|
namespace: cert-manager
|
|
---
|
|
# Source: trust-manager/templates/metrics-service.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: trust-manager-metrics
|
|
labels:
|
|
app: trust-manager
|
|
app.kubernetes.io/name: trust-manager
|
|
helm.sh/chart: trust-manager-v0.4.0
|
|
app.kubernetes.io/instance: trust-manager
|
|
app.kubernetes.io/version: "v0.4.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- port: 9402
|
|
targetPort: 9402
|
|
protocol: TCP
|
|
name: metrics
|
|
selector:
|
|
app: trust-manager
|
|
---
|
|
# Source: trust-manager/templates/webhook.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: trust-manager
|
|
labels:
|
|
app: trust-manager
|
|
app.kubernetes.io/name: trust-manager
|
|
helm.sh/chart: trust-manager-v0.4.0
|
|
app.kubernetes.io/instance: trust-manager
|
|
app.kubernetes.io/version: "v0.4.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- port: 443
|
|
targetPort: 6443
|
|
protocol: TCP
|
|
name: webhook
|
|
selector:
|
|
app: trust-manager
|
|
---
|
|
# Source: trust-manager/templates/deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: trust-manager
|
|
labels:
|
|
app.kubernetes.io/name: trust-manager
|
|
helm.sh/chart: trust-manager-v0.4.0
|
|
app.kubernetes.io/instance: trust-manager
|
|
app.kubernetes.io/version: "v0.4.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: trust-manager
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: trust-manager
|
|
spec:
|
|
serviceAccountName: trust-manager
|
|
initContainers:
|
|
- name: cert-manager-package-debian
|
|
image: "quay.io/jetstack/cert-manager-package-debian:20210119.0"
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- "/copyandmaybepause"
|
|
- "/debian-package"
|
|
- "/packages"
|
|
volumeMounts:
|
|
- mountPath: /packages
|
|
name: packages
|
|
readOnly: false
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: trust-manager
|
|
image: "quay.io/jetstack/trust-manager:v0.4.0"
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- containerPort: 6443
|
|
- containerPort: 9402
|
|
readinessProbe:
|
|
httpGet:
|
|
port: 6060
|
|
path: /readyz
|
|
initialDelaySeconds: 3
|
|
periodSeconds: 7
|
|
command: ["trust-manager"]
|
|
args:
|
|
- "--log-level=1"
|
|
- "--metrics-port=9402"
|
|
- "--readiness-probe-port=6060"
|
|
- "--readiness-probe-path=/readyz"
|
|
# trust
|
|
- "--trust-namespace=cert-manager"
|
|
# webhook
|
|
- "--webhook-host=0.0.0.0"
|
|
- "--webhook-port=6443"
|
|
- "--webhook-certificate-dir=/tls"
|
|
- "--default-package-location=/packages/cert-manager-package-debian.json"
|
|
volumeMounts:
|
|
- mountPath: /tls
|
|
name: tls
|
|
readOnly: true
|
|
- mountPath: /packages
|
|
name: packages
|
|
readOnly: true
|
|
resources:
|
|
{}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumes:
|
|
- name: packages
|
|
emptyDir: {}
|
|
- name: tls
|
|
secret:
|
|
defaultMode: 420
|
|
secretName: trust-manager-tls
|
|
---
|
|
# Source: trust-manager/templates/certificate.yaml
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: trust-manager
|
|
labels:
|
|
app.kubernetes.io/name: trust-manager
|
|
helm.sh/chart: trust-manager-v0.4.0
|
|
app.kubernetes.io/instance: trust-manager
|
|
app.kubernetes.io/version: "v0.4.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
dnsNames:
|
|
- "trust-manager.cert-manager.svc"
|
|
secretName: trust-manager-tls
|
|
revisionHistoryLimit: 1
|
|
issuerRef:
|
|
name: trust-manager
|
|
kind: Issuer
|
|
group: cert-manager.io
|
|
---
|
|
# Source: trust-manager/templates/certificate.yaml
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Issuer
|
|
metadata:
|
|
name: trust-manager
|
|
labels:
|
|
app.kubernetes.io/name: trust-manager
|
|
helm.sh/chart: trust-manager-v0.4.0
|
|
app.kubernetes.io/instance: trust-manager
|
|
app.kubernetes.io/version: "v0.4.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
selfSigned: {}
|
|
---
|
|
# Source: trust-manager/templates/webhook.yaml
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingWebhookConfiguration
|
|
metadata:
|
|
name: trust-manager
|
|
labels:
|
|
app: trust-manager
|
|
app.kubernetes.io/name: trust-manager
|
|
helm.sh/chart: trust-manager-v0.4.0
|
|
app.kubernetes.io/instance: trust-manager
|
|
app.kubernetes.io/version: "v0.4.0"
|
|
app.kubernetes.io/managed-by: Helm
|
|
annotations:
|
|
cert-manager.io/inject-ca-from: "cert-manager/trust-manager"
|
|
|
|
webhooks:
|
|
- name: trust.cert-manager.io
|
|
rules:
|
|
- apiGroups:
|
|
- "trust.cert-manager.io"
|
|
apiVersions:
|
|
- "*"
|
|
operations:
|
|
- CREATE
|
|
- UPDATE
|
|
resources:
|
|
- "*/*"
|
|
admissionReviewVersions: ["v1"]
|
|
timeoutSeconds: 5
|
|
failurePolicy: Fail
|
|
sideEffects: None
|
|
clientConfig:
|
|
service:
|
|
name: trust-manager
|
|
namespace: "cert-manager"
|
|
path: /validate |