100 lines
3.8 KiB
YAML
100 lines
3.8 KiB
YAML
{{- if and .Values.admissionController.certManager.enabled (not .Values.admissionController.createSelfSignedCert) -}}
|
|
{{- $ns := include "kyverno.namespace" . -}}
|
|
{{- $svcName := include "kyverno.admission-controller.serviceName" . -}}
|
|
{{- $fullSvcName := printf "%s.%s.svc" $svcName $ns -}}
|
|
{{- $algorithm := .Values.admissionController.certManager.algorithm | default "RSA" -}}
|
|
{{- $size := .Values.admissionController.certManager.size | default 2048 -}}
|
|
{{- $caIssuerName := printf "%s-ca-issuer" (include "kyverno.fullname" .) -}}
|
|
{{- $selfSignedIssuerName := printf "%s-selfsigned-issuer" (include "kyverno.fullname" .) -}}
|
|
---
|
|
# Self-signed ClusterIssuer for generating the CA certificate
|
|
{{- if .Values.admissionController.certManager.createSelfSignedIssuer }}
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: {{ $selfSignedIssuerName }}
|
|
labels:
|
|
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
|
spec:
|
|
selfSigned: {}
|
|
---
|
|
{{- end }}
|
|
# CA Certificate for signing Kyverno admission controller TLS certificates
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: {{ include "kyverno.fullname" . }}-admission-controller-ca
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
|
spec:
|
|
isCA: true
|
|
commonName: {{ include "kyverno.fullname" . }}-admission-controller-ca
|
|
# Use the exact secret name Kyverno expects for admission controller CA
|
|
secretName: {{ $fullSvcName }}.kyverno-tls-ca
|
|
duration: {{ .Values.admissionController.certManager.ca.duration | default "87600h" }}
|
|
renewBefore: {{ .Values.admissionController.certManager.ca.renewBefore | default "720h" }}
|
|
privateKey:
|
|
algorithm: {{ $algorithm }}
|
|
{{- if ne $algorithm "Ed25519" }}
|
|
size: {{ $size }}
|
|
{{- end }}
|
|
issuerRef:
|
|
{{- if .Values.admissionController.certManager.issuerRef.name }}
|
|
name: {{ .Values.admissionController.certManager.issuerRef.name }}
|
|
kind: {{ .Values.admissionController.certManager.issuerRef.kind | default "ClusterIssuer" }}
|
|
group: {{ .Values.admissionController.certManager.issuerRef.group | default "cert-manager.io" }}
|
|
{{- else if .Values.admissionController.certManager.createSelfSignedIssuer }}
|
|
name: {{ $selfSignedIssuerName }}
|
|
kind: ClusterIssuer
|
|
group: cert-manager.io
|
|
{{- else }}
|
|
{{- fail "Either certManager.issuerRef.name must be specified or certManager.createSelfSignedIssuer must be true" }}
|
|
{{- end }}
|
|
---
|
|
# CA Issuer using the CA certificate for signing TLS certificates
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Issuer
|
|
metadata:
|
|
name: {{ $caIssuerName }}
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
|
spec:
|
|
ca:
|
|
# Reference the CA secret created by the CA certificate
|
|
secretName: {{ $fullSvcName }}.kyverno-tls-ca
|
|
---
|
|
# TLS Certificate for Kyverno Admission Controller
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: {{ include "kyverno.fullname" . }}-admission-controller-tls
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- include "kyverno.admission-controller.labels" . | nindent 4 }}
|
|
spec:
|
|
# Use the exact secret name Kyverno expects for admission controller TLS
|
|
secretName: {{ $fullSvcName }}.kyverno-tls-pair
|
|
duration: {{ .Values.admissionController.certManager.tls.duration | default "8760h" }}
|
|
renewBefore: {{ .Values.admissionController.certManager.tls.renewBefore | default "720h" }}
|
|
privateKey:
|
|
algorithm: {{ $algorithm }}
|
|
{{- if ne $algorithm "Ed25519" }}
|
|
size: {{ $size }}
|
|
{{- end }}
|
|
usages:
|
|
- server auth
|
|
- digital signature
|
|
- key encipherment
|
|
dnsNames:
|
|
- {{ $svcName }}
|
|
- {{ $svcName }}.{{ $ns }}
|
|
- {{ $svcName }}.{{ $ns }}.svc
|
|
- {{ $svcName }}.{{ $ns }}.svc.cluster.local
|
|
issuerRef:
|
|
name: {{ $caIssuerName }}
|
|
kind: Issuer
|
|
group: cert-manager.io
|
|
{{- end -}}
|