Skip to content

Commit 9c6b9a7

Browse files
nox-404nox-404
committed
feat: add manifest bundle
1 parent c290d8d commit 9c6b9a7

File tree

2 files changed

+260
-2
lines changed

2 files changed

+260
-2
lines changed

‎README.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,19 +26,22 @@ helm repo update
2626
- Install the chart
2727

2828
```bash
29-
helm install scaleway-webhook scaleway/scaleway-certmanager-webhook
29+
helm install scaleway-certmanager-webhook scaleway/scaleway-certmanager-webhook
3030
```
3131

3232
- Alternatively, you can install the webhook with default credentials with:
3333

3434
```bash
35-
helm install scaleway-webhook scaleway/scaleway-certmanager-webhook --set secret.accessKey=<YOUR-ACCESS-KEY> --set secret.secretKey=<YOUR-SECRET_KEY>
35+
helm install scaleway-certmanager-webhook scaleway/scaleway-certmanager-webhook --set secret.accessKey=<YOUR-ACCESS-KEY> --set secret.secretKey=<YOUR-SECRET_KEY>
3636
```
3737

3838
The Scaleway Webhook is now installed! :tada:
3939

4040
> Refer to the chart's [documentation](https://github.com/scaleway/helm-charts/blob/master/charts/scaleway-certmanager-webhook/README.md) for more configuration options.
4141
42+
> Alternatively, you may use the provided bundle for a basic install in the cert-manager namespace:
43+
> `kubectl apply -f https://raw.githubusercontent.com/scaleway/cert-manager-webhook-scaleway/main/deploy/bundle.yaml`
44+
4245
### How to use it
4346

4447
**Note**: It uses the [cert-manager webhook system](https://cert-manager.io/docs/configuration/acme/dns01/webhook/). Everything after the issuer is configured is just cert-manager. You can find out more in [their documentation](https://cert-manager.io/docs/usage/).

‎deploy/bundle.yaml‎

Lines changed: 255 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,255 @@
1+
---
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: scaleway-certmanager-webhook
6+
labels:
7+
app: scaleway-certmanager-webhook
8+
---
9+
# Grant cert-manager permission to validate using our apiserver
10+
apiVersion: rbac.authorization.k8s.io/v1
11+
kind: ClusterRole
12+
metadata:
13+
name: scaleway-certmanager-webhook:domain-solver
14+
labels:
15+
app: scaleway-certmanager-webhook
16+
rules:
17+
- apiGroups:
18+
- acme.scaleway.com
19+
resources:
20+
- '*'
21+
verbs:
22+
- 'create'
23+
---
24+
# apiserver gets the auth-delegator role to delegate auth decisions to
25+
# the core apiserver
26+
apiVersion: rbac.authorization.k8s.io/v1
27+
kind: ClusterRoleBinding
28+
metadata:
29+
name: scaleway-certmanager-webhook:auth-delegator
30+
labels:
31+
app: scaleway-certmanager-webhook
32+
roleRef:
33+
apiGroup: rbac.authorization.k8s.io
34+
kind: ClusterRole
35+
name: system:auth-delegator
36+
subjects:
37+
- apiGroup: ""
38+
kind: ServiceAccount
39+
name: scaleway-certmanager-webhook
40+
namespace: cert-manager
41+
---
42+
apiVersion: rbac.authorization.k8s.io/v1
43+
kind: ClusterRoleBinding
44+
metadata:
45+
name: scaleway-certmanager-webhook:domain-solver
46+
labels:
47+
app: scaleway-certmanager-webhook
48+
roleRef:
49+
apiGroup: rbac.authorization.k8s.io
50+
kind: ClusterRole
51+
name: scaleway-certmanager-webhook:domain-solver
52+
subjects:
53+
- apiGroup: ""
54+
kind: ServiceAccount
55+
name: cert-manager
56+
namespace: cert-manager
57+
---
58+
# Grant the webhook permission to read the secrets containing the credentials
59+
apiVersion: rbac.authorization.k8s.io/v1
60+
kind: Role
61+
metadata:
62+
name: scaleway-certmanager-webhook:secrets-reader
63+
namespace: cert-manager
64+
labels:
65+
app: scaleway-certmanager-webhook
66+
rules:
67+
- apiGroups:
68+
- ''
69+
resources:
70+
- 'secrets'
71+
verbs:
72+
- 'get'
73+
---
74+
# Grant the webhook permission to read the secrets containing the credentials
75+
apiVersion: rbac.authorization.k8s.io/v1
76+
kind: RoleBinding
77+
metadata:
78+
name: scaleway-certmanager-webhook:secrets-reader
79+
namespace: cert-manager
80+
labels:
81+
app: scaleway-certmanager-webhook
82+
roleRef:
83+
apiGroup: rbac.authorization.k8s.io
84+
kind: Role
85+
name: scaleway-certmanager-webhook:secrets-reader
86+
subjects:
87+
- apiGroup: ""
88+
kind: ServiceAccount
89+
name: scaleway-certmanager-webhook
90+
namespace: cert-manager
91+
---
92+
# Grant the webhook permission to read the ConfigMap containing the Kubernetes
93+
# apiserver's requestheader-ca-certificate.
94+
# This ConfigMap is automatically created by the Kubernetes apiserver.
95+
apiVersion: rbac.authorization.k8s.io/v1
96+
kind: RoleBinding
97+
metadata:
98+
name: scaleway-certmanager-webhook:webhook-authentication-reader
99+
namespace: kube-system
100+
labels:
101+
app: scaleway-certmanager-webhook
102+
roleRef:
103+
apiGroup: rbac.authorization.k8s.io
104+
kind: Role
105+
name: extension-apiserver-authentication-reader
106+
subjects:
107+
- apiGroup: ""
108+
kind: ServiceAccount
109+
name: scaleway-certmanager-webhook
110+
namespace: cert-manager
111+
---
112+
apiVersion: v1
113+
kind: Service
114+
metadata:
115+
name: scaleway-certmanager-webhook
116+
labels:
117+
app: scaleway-certmanager-webhook
118+
spec:
119+
type: ClusterIP
120+
ports:
121+
- port: 443
122+
targetPort: https
123+
protocol: TCP
124+
name: https
125+
selector:
126+
app: scaleway-certmanager-webhook
127+
---
128+
apiVersion: apps/v1
129+
kind: Deployment
130+
metadata:
131+
name: scaleway-certmanager-webhook
132+
labels:
133+
app: scaleway-certmanager-webhook
134+
spec:
135+
replicas: 1
136+
selector:
137+
matchLabels:
138+
app: scaleway-certmanager-webhook
139+
template:
140+
metadata:
141+
labels:
142+
app: scaleway-certmanager-webhook
143+
spec:
144+
serviceAccountName: scaleway-certmanager-webhook
145+
containers:
146+
- name: scaleway-certmanager-webhook
147+
image: "scaleway/cert-manager-webhook-scaleway:v0.1.0"
148+
imagePullPolicy: IfNotPresent
149+
args:
150+
- --tls-cert-file=/tls/tls.crt
151+
- --tls-private-key-file=/tls/tls.key
152+
env:
153+
- name: GROUP_NAME
154+
value: "acme.scaleway.com"
155+
156+
ports:
157+
- name: https
158+
containerPort: 443
159+
protocol: TCP
160+
livenessProbe:
161+
httpGet:
162+
scheme: HTTPS
163+
path: /healthz
164+
port: https
165+
readinessProbe:
166+
timeoutSeconds: 5
167+
httpGet:
168+
scheme: HTTPS
169+
path: /healthz
170+
port: https
171+
volumeMounts:
172+
- name: certs
173+
mountPath: /tls
174+
readOnly: true
175+
resources:
176+
{}
177+
volumes:
178+
- name: certs
179+
secret:
180+
secretName: scaleway-certmanager-webhook-webhook-tls
181+
---
182+
apiVersion: apiregistration.k8s.io/v1
183+
kind: APIService
184+
metadata:
185+
name: v1alpha1.acme.scaleway.com
186+
labels:
187+
app: scaleway-certmanager-webhook
188+
annotations:
189+
cert-manager.io/inject-ca-from: "cert-manager/scaleway-certmanager-webhook-webhook-tls"
190+
spec:
191+
group: acme.scaleway.com
192+
groupPriorityMinimum: 1000
193+
versionPriority: 15
194+
service:
195+
name: scaleway-certmanager-webhook
196+
namespace: cert-manager
197+
version: v1alpha1
198+
---
199+
# Generate a CA Certificate used to sign certificates for the webhook
200+
apiVersion: cert-manager.io/v1
201+
kind: Certificate
202+
metadata:
203+
name: scaleway-certmanager-webhook-ca
204+
namespace: "cert-manager"
205+
labels:
206+
app: scaleway-certmanager-webhook
207+
spec:
208+
secretName: scaleway-certmanager-webhook-ca
209+
duration: 43800h
210+
issuerRef:
211+
name: scaleway-certmanager-webhook-selfsign
212+
commonName: "ca.scaleway-webhook.cert-manager"
213+
isCA: true
214+
---
215+
# Finally, generate a serving certificate for the webhook to use
216+
apiVersion: cert-manager.io/v1
217+
kind: Certificate
218+
metadata:
219+
name: scaleway-certmanager-webhook-webhook-tls
220+
namespace: "cert-manager"
221+
labels:
222+
app: scaleway-certmanager-webhook
223+
spec:
224+
secretName: scaleway-certmanager-webhook-webhook-tls
225+
duration: 8760h
226+
issuerRef:
227+
name: scaleway-certmanager-webhook-ca
228+
dnsNames:
229+
- scaleway-certmanager-webhook
230+
- scaleway-certmanager-webhook.cert-manager
231+
- scaleway-certmanager-webhook.cert-manager.svc
232+
---
233+
# Create a selfsigned Issuer, in order to create a root CA certificate for
234+
# signing webhook serving certificates
235+
apiVersion: cert-manager.io/v1
236+
kind: Issuer
237+
metadata:
238+
name: scaleway-certmanager-webhook-selfsign
239+
namespace: "cert-manager"
240+
labels:
241+
app: scaleway-certmanager-webhook
242+
spec:
243+
selfSigned: {}
244+
---
245+
# Create an Issuer that uses the above generated CA certificate to issue certs
246+
apiVersion: cert-manager.io/v1
247+
kind: Issuer
248+
metadata:
249+
name: scaleway-certmanager-webhook-ca
250+
namespace: "cert-manager"
251+
labels:
252+
app: scaleway-certmanager-webhook
253+
spec:
254+
ca:
255+
secretName: scaleway-certmanager-webhook-ca

0 commit comments

Comments
 (0)