mirror of
https://github.com/cert-manager/webhook-example.git
synced 2026-03-16 18:02:51 +01:00
fix: remove global namespace configuration from webhook
This commit is contained in:
Marc Singer
parent
f6c70562bc
commit
537ffcc184
7 changed files with 67 additions and 73 deletions
|
|
@ -2,7 +2,7 @@
|
|||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "example-webhook.name" -}}
|
||||
{{- define "cert-manager-desec-webhook.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
|
|
@ -11,7 +11,7 @@ Create a default fully qualified app name.
|
|||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "example-webhook.fullname" -}}
|
||||
{{- define "cert-manager-desec-webhook.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
|
|
@ -27,22 +27,22 @@ If release name contains chart name it will be used as a full name.
|
|||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "example-webhook.chart" -}}
|
||||
{{- define "cert-manager-desec-webhook.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "example-webhook.selfSignedIssuer" -}}
|
||||
{{ printf "%s-selfsign" (include "example-webhook.fullname" .) }}
|
||||
{{- define "cert-manager-desec-webhook.selfSignedIssuer" -}}
|
||||
{{ printf "%s-selfsign" (include "cert-manager-desec-webhook.fullname" .) }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "example-webhook.rootCAIssuer" -}}
|
||||
{{ printf "%s-ca" (include "example-webhook.fullname" .) }}
|
||||
{{- define "cert-manager-desec-webhook.rootCAIssuer" -}}
|
||||
{{ printf "%s-ca" (include "cert-manager-desec-webhook.fullname" .) }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "example-webhook.rootCACertificate" -}}
|
||||
{{ printf "%s-ca" (include "example-webhook.fullname" .) }}
|
||||
{{- define "cert-manager-desec-webhook.rootCACertificate" -}}
|
||||
{{ printf "%s-ca" (include "cert-manager-desec-webhook.fullname" .) }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "example-webhook.servingCertificate" -}}
|
||||
{{ printf "%s-webhook-tls" (include "example-webhook.fullname" .) }}
|
||||
{{- define "cert-manager-desec-webhook.servingCertificate" -}}
|
||||
{{ printf "%s-webhook-tls" (include "cert-manager-desec-webhook.fullname" .) }}
|
||||
{{- end -}}
|
||||
|
|
|
|||
|
|
@ -3,17 +3,17 @@ kind: APIService
|
|||
metadata:
|
||||
name: v1alpha1.{{ .Values.groupName }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "example-webhook.servingCertificate" . }}"
|
||||
cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "cert-manager-desec-webhook.servingCertificate" . }}"
|
||||
spec:
|
||||
group: {{ .Values.groupName }}
|
||||
groupPriorityMinimum: 1000
|
||||
versionPriority: 15
|
||||
service:
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
name: {{ include "cert-manager-desec-webhook.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
version: v1alpha1
|
||||
|
|
|
|||
|
|
@ -1,26 +1,26 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
name: {{ include "cert-manager-desec-webhook.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
spec:
|
||||
serviceAccountName: {{ include "example-webhook.fullname" . }}
|
||||
serviceAccountName: {{ include "cert-manager-desec-webhook.fullname" . }}
|
||||
containers:
|
||||
- name: {{ .Chart.Name }}
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
|
|
@ -54,7 +54,7 @@ spec:
|
|||
volumes:
|
||||
- name: certs
|
||||
secret:
|
||||
secretName: {{ include "example-webhook.servingCertificate" . }}
|
||||
secretName: {{ include "cert-manager-desec-webhook.servingCertificate" . }}
|
||||
{{- with .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml . | indent 8 }}
|
||||
|
|
|
|||
|
|
@ -4,11 +4,11 @@
|
|||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ include "example-webhook.selfSignedIssuer" . }}
|
||||
name: {{ include "cert-manager-desec-webhook.selfSignedIssuer" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
|
|
@ -20,19 +20,19 @@ spec:
|
|||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ include "example-webhook.rootCACertificate" . }}
|
||||
name: {{ include "cert-manager-desec-webhook.rootCACertificate" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
secretName: {{ include "example-webhook.rootCACertificate" . }}
|
||||
secretName: {{ include "cert-manager-desec-webhook.rootCACertificate" . }}
|
||||
duration: 43800h # 5y
|
||||
issuerRef:
|
||||
name: {{ include "example-webhook.selfSignedIssuer" . }}
|
||||
commonName: "ca.example-webhook.cert-manager"
|
||||
name: {{ include "cert-manager-desec-webhook.selfSignedIssuer" . }}
|
||||
commonName: "ca.cert-manager-desec-webhook.cert-manager"
|
||||
isCA: true
|
||||
|
||||
---
|
||||
|
|
@ -41,16 +41,16 @@ spec:
|
|||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ include "example-webhook.rootCAIssuer" . }}
|
||||
name: {{ include "cert-manager-desec-webhook.rootCAIssuer" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
ca:
|
||||
secretName: {{ include "example-webhook.rootCACertificate" . }}
|
||||
secretName: {{ include "cert-manager-desec-webhook.rootCACertificate" . }}
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -58,19 +58,19 @@ spec:
|
|||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ include "example-webhook.servingCertificate" . }}
|
||||
name: {{ include "cert-manager-desec-webhook.servingCertificate" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
secretName: {{ include "example-webhook.servingCertificate" . }}
|
||||
secretName: {{ include "cert-manager-desec-webhook.servingCertificate" . }}
|
||||
duration: 8760h # 1y
|
||||
issuerRef:
|
||||
name: {{ include "example-webhook.rootCAIssuer" . }}
|
||||
name: {{ include "cert-manager-desec-webhook.rootCAIssuer" . }}
|
||||
dnsNames:
|
||||
- {{ include "example-webhook.fullname" . }}
|
||||
- {{ include "example-webhook.fullname" . }}.{{ .Release.Namespace }}
|
||||
- {{ include "example-webhook.fullname" . }}.{{ .Release.Namespace }}.svc
|
||||
- {{ include "cert-manager-desec-webhook.fullname" . }}
|
||||
- {{ include "cert-manager-desec-webhook.fullname" . }}.{{ .Release.Namespace }}
|
||||
- {{ include "cert-manager-desec-webhook.fullname" . }}.{{ .Release.Namespace }}.svc
|
||||
|
|
|
|||
|
|
@ -1,11 +1,11 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
name: {{ include "cert-manager-desec-webhook.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
---
|
||||
|
|
@ -15,11 +15,11 @@ metadata:
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}:webhook-authentication-reader
|
||||
name: {{ include "cert-manager-desec-webhook.fullname" . }}:webhook-authentication-reader
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
roleRef:
|
||||
|
|
@ -29,7 +29,7 @@ roleRef:
|
|||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
name: {{ include "cert-manager-desec-webhook.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
# apiserver gets the auth-delegator role to delegate auth decisions to
|
||||
|
|
@ -37,10 +37,10 @@ subjects:
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}:auth-delegator
|
||||
name: {{ include "cert-manager-desec-webhook.fullname" . }}:auth-delegator
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
roleRef:
|
||||
|
|
@ -50,17 +50,17 @@ roleRef:
|
|||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
name: {{ include "cert-manager-desec-webhook.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
---
|
||||
# Grant cert-manager permission to validate using our apiserver
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}:domain-solver
|
||||
name: {{ include "cert-manager-desec-webhook.fullname" . }}:domain-solver
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
rules:
|
||||
|
|
@ -74,16 +74,16 @@ rules:
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}:domain-solver
|
||||
name: {{ include "cert-manager-desec-webhook.fullname" . }}:domain-solver
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ include "example-webhook.fullname" . }}:domain-solver
|
||||
name: {{ include "cert-manager-desec-webhook.fullname" . }}:domain-solver
|
||||
subjects:
|
||||
- apiGroup: ""
|
||||
kind: ServiceAccount
|
||||
|
|
|
|||
|
|
@ -1,11 +1,11 @@
|
|||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "example-webhook.fullname" . }}
|
||||
name: {{ include "cert-manager-desec-webhook.fullname" . }}
|
||||
namespace: {{ .Release.Namespace | quote }}
|
||||
labels:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
chart: {{ include "example-webhook.chart" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
chart: {{ include "cert-manager-desec-webhook.chart" . }}
|
||||
release: {{ .Release.Name }}
|
||||
heritage: {{ .Release.Service }}
|
||||
spec:
|
||||
|
|
@ -16,5 +16,5 @@ spec:
|
|||
protocol: TCP
|
||||
name: https
|
||||
selector:
|
||||
app: {{ include "example-webhook.name" . }}
|
||||
app: {{ include "cert-manager-desec-webhook.name" . }}
|
||||
release: {{ .Release.Name }}
|
||||
|
|
|
|||
|
|
@ -18,8 +18,7 @@ import (
|
|||
type DeSECDNSProviderSolverConfig struct {
|
||||
// Reference to the kubernetes secret containing the API token for deSEC
|
||||
APIKeySecretRef v1.SecretKeySelector `json:"apiKeySecretRef"`
|
||||
// Reference to the kubernetes namespace containing the secret
|
||||
APIKeySecretRefNamespace string `json:"apiKeySecretRefNamespace"`
|
||||
// A global namespace (e.g APIKeySecretRefNamespace is not required, because ClusterIssuer provides the cert-manager namespace as default value for global issuers)
|
||||
}
|
||||
|
||||
// A DNS-01 challenge solver for the DeSEC DNS Provider
|
||||
|
|
@ -35,6 +34,7 @@ func (s *DeSECDNSProviderSolver) Name() string {
|
|||
|
||||
// Initializes a new client
|
||||
func (s *DeSECDNSProviderSolver) getClient(config *apiextensionsv1.JSON, namespace string) (*desec.Client, error) {
|
||||
// Check if configuration is empty or was not parsed
|
||||
if config == nil {
|
||||
return nil, fmt.Errorf("missing configuration in issuer found; webhook configuration requires apiKeySecretRef containing deSEC API token")
|
||||
}
|
||||
|
|
@ -43,12 +43,6 @@ func (s *DeSECDNSProviderSolver) getClient(config *apiextensionsv1.JSON, namespa
|
|||
if err := json.Unmarshal(config.Raw, &solverConfig); err != nil {
|
||||
return nil, fmt.Errorf("invalid configuration in issuer found; webhook configuration requires apiKeySecretRef containing deSEC API token")
|
||||
}
|
||||
// Check if the namespace has been provided within the configuration
|
||||
// Otherwise use the namespace from the request
|
||||
if solverConfig.APIKeySecretRefNamespace != "" {
|
||||
fmt.Sprintf("k8s secret namespace has been overwritten in webhook configuration apiKeySecretRefNamespace from %s to %s", namespace, solverConfig.APIKeySecretRefNamespace)
|
||||
namespace = solverConfig.APIKeySecretRefNamespace
|
||||
}
|
||||
// Check if the k8s client has been initialized
|
||||
// This should never happen as cert-manager calls s.Initialize() which assigns the k8s client
|
||||
if s.k8s == nil {
|
||||
|
|
|
|||
Loading…
Reference in a new issue