added repo

2026-08-26 03:39:42 +05:30
parent 45c25a95af
commit b8575bb8b9
6889 changed files with 1217125 additions and 0 deletions
@@ -0,0 +1,16 @@
+apiVersion: v2
+name: contour-ca-issuer
+description: >-
+  Cluster-scoped cert-manager ClusterIssuer backed by the Contour shared Root
+  CA synced from Vault. Used by app namespaces (proxyless gRPC clients) to
+  request leaf client certificates signed by the same Root CA that Contour
+  uses for its own contourcert/envoycert.
+type: application
+version: 0.2.0
+appVersion: "1.0.0"
+keywords:
+  - cert-manager
+  - clusterissuer
+  - contour
+  - mtls
+  - proxyless-grpc
@@ -0,0 +1,20 @@
+{{- /*
+Cluster-scoped ca Issuer using the Root CA Secret synced from Vault.
+Resolvable from any namespace via `issuerRef.kind: ClusterIssuer`, so app
+namespaces can request leaf certs without copying the Root CA around.
+*/}}
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ .Values.issuerName }}
+  {{- with .Values.commonAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- with .Values.commonLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  ca:
+    secretName: {{ .Values.rootCASecretName }}
@@ -0,0 +1,37 @@
+{{- /*
+ESO → K8s Secret that holds the Root CA (cert + key).
+Lives in the cert-manager namespace so the private key stays off app
+namespaces; cert-manager reads it when the ClusterIssuer signs leaf certs.
+*/}}
+{{- if .Values.externalSecret.enabled }}
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: {{ .Values.rootCASecretName }}
+  namespace: {{ .Values.namespace }}
+  annotations:
+    argocd.argoproj.io/sync-wave: "-5"
+    {{- with .Values.commonAnnotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.commonLabels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  dataFrom:
+    - extract:
+        conversionStrategy: Default
+        key: {{ .Values.externalSecret.vaultPath }}
+        {{- if .Values.externalSecret.vaultVersion }}
+        version: {{ .Values.externalSecret.vaultVersion | quote }}
+        {{- end }}
+  refreshInterval: {{ .Values.externalSecret.refreshInterval | quote }}
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: {{ .Values.externalSecret.secretStoreRef.name }}
+  target:
+    name: {{ .Values.rootCASecretName }}
+    creationPolicy: Owner
+    deletionPolicy: Retain
+{{- end }}
@@ -0,0 +1,35 @@
+# Default values for contour-shared-ca-issuer.
+# Override per-cluster via helm-overrides/<cluster>/contour-shared-ca-issuer/custom-values.yaml.
+
+# Namespace where cert-manager is installed. The Root CA Secret and
+# ClusterIssuer's source Secret live here.
+namespace: cert-manager
+
+# ClusterIssuer name. Per-app Certificate CRs reference this via
+# `issuerRef.name` (with `kind: ClusterIssuer`). Must match the name used
+# by consumers — e.g. devops-helm-charts/2.0.0/templates/proxyless-grpc-cert.yaml.
+issuerName: contour-ca-issuer
+
+# Name of the K8s Secret (in `.namespace`) that holds the Root CA cert + key.
+# Populated by ESO from Vault. ClusterIssuer's `spec.ca.secretName` points here.
+rootCASecretName: contour-shared-ca
+
+externalSecret:
+  # Create ExternalSecret to sync the Root CA from Vault. Disable if the
+  # Secret is provisioned out-of-band (e.g. sealed-secrets or manual).
+  enabled: true
+  # Vault KV path holding the Root CA (expects keys: tls.crt, tls.key, ca.crt).
+  vaultPath: meesho/devops/contour/root-ca
+  # Optional pinned Vault KV version.
+  vaultVersion: ""
+  # ESO refresh interval. "0" disables periodic refresh — rotation is driven
+  # by `kubectl annotate externalsecret ... force-sync=...` (see runbook).
+  refreshInterval: "0"
+  secretStoreRef:
+    # Name of the ClusterSecretStore configured for Vault. Typical values:
+    #   vault-backend       — default central ClusterSecretStore
+    #   vault-backend-new   — used in some farmiso clusters
+    name: vault-backend
+
+commonLabels: {}
+commonAnnotations: {}