added repo

2026-08-26 03:39:42 +05:30
parent 45c25a95af
commit b8575bb8b9
6889 changed files with 1217125 additions and 0 deletions
@@ -0,0 +1,58 @@
+{{- /*
+Root CA for Contour mTLS.
+Supports two modes:
+  1. "external" (default) — Root CA secret is pre-created (e.g., via ESO from Vault)
+  2. "generate" — cert-manager creates a self-signed Root CA (for dev/testing)
+
+Chain: Root CA → Leaf Certs (contourcert, envoycert)
+*/}}
+
+{{- if .Values.useCertManager }}
+
+{{- if eq .Values.certManager.rootCA.mode "generate" }}
+## Self-Signed Issuer (only used to bootstrap Root CA in "generate" mode)
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ printf "%s-selfsigned" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+spec:
+  selfSigned: {}
+---
+## Root CA Certificate (self-signed, long-lived)
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ printf "%s-root-ca" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+spec:
+  secretName: {{ .Values.certManager.rootCA.secretName }}
+  commonName: "Contour Root CA"
+  duration: {{ .Values.certManager.rootCA.duration }}
+  isCA: true
+  usages:
+    - cert sign
+    - crl sign
+  privateKey:
+    algorithm: RSA
+    size: 4096
+  issuerRef:
+    name: {{ printf "%s-selfsigned" (include "common.names.fullname" .) }}
+    kind: Issuer
+{{- end }}
+
+---
+## Root CA Issuer (signs leaf certs directly)
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ printf "%s-root-ca-issuer" (include "common.names.fullname" .) }}
+  namespace: {{ include "common.names.namespace" . | quote }}
+  labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
+spec:
+  ca:
+    secretName: {{ .Values.certManager.rootCA.secretName }}
+
+{{- end }}