added repo

2026-08-26 03:39:42 +05:30
parent 45c25a95af
commit b8575bb8b9
6889 changed files with 1217125 additions and 0 deletions
@@ -0,0 +1,99 @@
+{{- if and .Values.admissionController.certManager.enabled (not .Values.admissionController.createSelfSignedCert) -}}
+{{- $ns := include "kyverno.namespace" . -}}
+{{- $svcName := include "kyverno.admission-controller.serviceName" . -}}
+{{- $fullSvcName := printf "%s.%s.svc" $svcName $ns -}}
+{{- $algorithm := .Values.admissionController.certManager.algorithm | default "RSA" -}}
+{{- $size := .Values.admissionController.certManager.size | default 2048 -}}
+{{- $caIssuerName := printf "%s-ca-issuer" (include "kyverno.fullname" .) -}}
+{{- $selfSignedIssuerName := printf "%s-selfsigned-issuer" (include "kyverno.fullname" .) -}}
+---
+# Self-signed ClusterIssuer for generating the CA certificate
+{{- if .Values.admissionController.certManager.createSelfSignedIssuer }}
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ $selfSignedIssuerName }}
+  labels:
+    {{- include "kyverno.admission-controller.labels" . | nindent 4 }}
+spec:
+  selfSigned: {}
+---
+{{- end }}
+# CA Certificate for signing Kyverno admission controller TLS certificates
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "kyverno.fullname" . }}-admission-controller-ca
+  namespace: {{ $ns }}
+  labels:
+    {{- include "kyverno.admission-controller.labels" . | nindent 4 }}
+spec:
+  isCA: true
+  commonName: {{ include "kyverno.fullname" . }}-admission-controller-ca
+  # Use the exact secret name Kyverno expects for admission controller CA
+  secretName: {{ $fullSvcName }}.kyverno-tls-ca
+  duration: {{ .Values.admissionController.certManager.ca.duration | default "87600h" }}
+  renewBefore: {{ .Values.admissionController.certManager.ca.renewBefore | default "720h" }}
+  privateKey:
+    algorithm: {{ $algorithm }}
+    {{- if ne $algorithm "Ed25519" }}
+    size: {{ $size }}
+    {{- end }}
+  issuerRef:
+    {{- if .Values.admissionController.certManager.issuerRef.name }}
+    name: {{ .Values.admissionController.certManager.issuerRef.name }}
+    kind: {{ .Values.admissionController.certManager.issuerRef.kind | default "ClusterIssuer" }}
+    group: {{ .Values.admissionController.certManager.issuerRef.group | default "cert-manager.io" }}
+    {{- else if .Values.admissionController.certManager.createSelfSignedIssuer }}
+    name: {{ $selfSignedIssuerName }}
+    kind: ClusterIssuer
+    group: cert-manager.io
+    {{- else }}
+    {{- fail "Either certManager.issuerRef.name must be specified or certManager.createSelfSignedIssuer must be true" }}
+    {{- end }}
+---
+# CA Issuer using the CA certificate for signing TLS certificates
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: {{ $caIssuerName }}
+  namespace: {{ $ns }}
+  labels:
+    {{- include "kyverno.admission-controller.labels" . | nindent 4 }}
+spec:
+  ca:
+    # Reference the CA secret created by the CA certificate
+    secretName: {{ $fullSvcName }}.kyverno-tls-ca
+---
+# TLS Certificate for Kyverno Admission Controller
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ include "kyverno.fullname" . }}-admission-controller-tls
+  namespace: {{ $ns }}
+  labels:
+    {{- include "kyverno.admission-controller.labels" . | nindent 4 }}
+spec:
+  # Use the exact secret name Kyverno expects for admission controller TLS
+  secretName: {{ $fullSvcName }}.kyverno-tls-pair
+  duration: {{ .Values.admissionController.certManager.tls.duration | default "8760h" }}
+  renewBefore: {{ .Values.admissionController.certManager.tls.renewBefore | default "720h" }}
+  privateKey:
+    algorithm: {{ $algorithm }}
+    {{- if ne $algorithm "Ed25519" }}
+    size: {{ $size }}
+    {{- end }}
+  usages:
+    - server auth
+    - digital signature
+    - key encipherment
+  dnsNames:
+    - {{ $svcName }}
+    - {{ $svcName }}.{{ $ns }}
+    - {{ $svcName }}.{{ $ns }}.svc
+    - {{ $svcName }}.{{ $ns }}.svc.cluster.local
+  issuerRef:
+    name: {{ $caIssuerName }}
+    kind: Issuer
+    group: cert-manager.io
+{{- end -}}