added repo

2026-08-26 03:39:42 +05:30
parent 45c25a95af
commit b8575bb8b9
6889 changed files with 1217125 additions and 0 deletions
@@ -0,0 +1,58 @@
+{{- /*
+Root CA for Contour mTLS.
+Supports two modes:
+  1. "external" (default) — Root CA secret is pre-created (e.g., via ESO from Vault)
+  2. "generate" — cert-manager creates a self-signed Root CA (for dev/testing)
+
+Chain: Root CA → Leaf Certs (contourcert, envoycert)
+*/}}
+
+{{- if .Values.useCertManager }}
+
+{{- if eq .Values.certManager.rootCA.mode "generate" }}
+## Self-Signed Issuer (only used to bootstrap Root CA in "generate" mode)
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ printf "%s-selfsigned" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+spec:
+  selfSigned: {}
+---
+## Root CA Certificate (self-signed, long-lived)
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ printf "%s-root-ca" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+spec:
+  secretName: {{ .Values.certManager.rootCA.secretName }}
+  commonName: "Contour Root CA"
+  duration: {{ .Values.certManager.rootCA.duration }}
+  isCA: true
+  usages:
+    - cert sign
+    - crl sign
+  privateKey:
+    algorithm: RSA
+    size: 4096
+  issuerRef:
+    name: {{ printf "%s-selfsigned" (include "common.names.fullname" .) }}
+    kind: Issuer
+{{- end }}
+
+---
+## Root CA Issuer (signs leaf certs directly)
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ printf "%s-root-ca-issuer" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+spec:
+  ca:
+    secretName: {{ .Values.certManager.rootCA.secretName }}
+
+{{- end }}
@@ -0,0 +1,36 @@
+{{- /*
+Contour server leaf certificate.
+Signed by Root CA directly.
+Used for Contour's xDS gRPC server — Envoy connects to this.
+*/}}
+
+{{- if .Values.useCertManager }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ printf "%s-contour-cert" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: contour
+spec:
+  secretName: contourcert
+  commonName: "contour"
+  dnsNames:
+    - "contour"
+    - {{ include "common.names.fullname" . | quote }}
+    - {{ printf "%s-contour" (include "common.names.fullname" .) | quote }}
+    - {{ printf "%s.%s.svc" (include "common.names.fullname" .) (include "common.names.namespace" .) | quote }}
+    - {{ printf "%s.%s.svc.cluster.local" (include "common.names.fullname" .) (include "common.names.namespace" .) | quote }}
+  duration: {{ .Values.certManager.leafCerts.duration }}
+  renewBefore: {{ .Values.certManager.leafCerts.renewBefore }}
+  usages:
+    - server auth
+    - digital signature
+    - key encipherment
+  privateKey:
+    algorithm: {{ .Values.certManager.leafCerts.algorithm }}
+    size: {{ .Values.certManager.leafCerts.size }}
+  issuerRef:
+    name: {{ printf "%s-root-ca-issuer" (include "common.names.fullname" .) }}
+    kind: Issuer
+{{- end }}
@@ -0,0 +1,30 @@
+{{- /*
+Envoy client leaf certificate.
+Signed by Root CA directly.
+Used for Envoy's mTLS client identity when connecting to Contour's xDS server.
+*/}}
+
+{{- if .Values.useCertManager }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ printf "%s-envoy-cert" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+    app.kubernetes.io/component: envoy
+spec:
+  secretName: envoycert
+  commonName: "envoy"
+  duration: {{ .Values.certManager.leafCerts.duration }}
+  renewBefore: {{ .Values.certManager.leafCerts.renewBefore }}
+  usages:
+    - client auth
+    - digital signature
+    - key encipherment
+  privateKey:
+    algorithm: {{ .Values.certManager.leafCerts.algorithm }}
+    size: {{ .Values.certManager.leafCerts.size }}
+  issuerRef:
+    name: {{ printf "%s-root-ca-issuer" (include "common.names.fullname" .) }}
+    kind: Issuer
+{{- end }}
@@ -0,0 +1,36 @@
+{{- /*
+ExternalSecret to sync Root CA from Vault via ESO.
+Creates the Root CA K8s Secret that cert-manager's Root CA Issuer references.
+Only needed when rootCA.mode is "external" and externalSecret.enabled is true.
+Uses dataFrom.extract to pull all keys from a single Vault path.
+*/}}
+
+{{- if and .Values.useCertManager (eq .Values.certManager.rootCA.mode "external") .Values.certManager.externalSecret.enabled }}
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: {{ printf "%s-root-ca" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  annotations:
+    argocd.argoproj.io/sync-wave: "-5"
+    {{- if .Values.commonAnnotations }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+    {{- end }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+spec:
+  dataFrom:
+    - extract:
+        conversionStrategy: Default
+        key: {{ .Values.certManager.externalSecret.vaultPath }}
+        {{- if .Values.certManager.externalSecret.vaultVersion }}
+        version: {{ .Values.certManager.externalSecret.vaultVersion | quote }}
+        {{- end }}
+  refreshInterval: {{ .Values.certManager.externalSecret.refreshInterval | quote }}
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: {{ .Values.certManager.externalSecret.secretStoreRef.name }}
+  target:
+    name: {{ .Values.certManager.rootCA.secretName }}
+    creationPolicy: Owner
+    deletionPolicy: Retain
+{{- end }}