100 lines
3.8 KiB
YAML
100 lines
3.8 KiB
YAML
{{- if and .Values.cleanupController.enabled .Values.cleanupController.certManager.enabled (not .Values.cleanupController.createSelfSignedCert) -}}
|
|
{{- $ns := include "kyverno.namespace" . -}}
|
|
{{- $name := include "kyverno.cleanup-controller.name" . -}}
|
|
{{- $fullSvcName := printf "%s.%s.svc" $name $ns -}}
|
|
{{- $algorithm := .Values.cleanupController.certManager.algorithm | default "RSA" -}}
|
|
{{- $size := .Values.cleanupController.certManager.size | default 2048 -}}
|
|
{{- $caIssuerName := printf "%s-cleanup-ca-issuer" (include "kyverno.fullname" .) -}}
|
|
{{- $selfSignedIssuerName := printf "%s-cleanup-selfsigned-issuer" (include "kyverno.fullname" .) -}}
|
|
---
|
|
# Self-signed ClusterIssuer for generating the CA certificate
|
|
{{- if .Values.cleanupController.certManager.createSelfSignedIssuer }}
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: {{ $selfSignedIssuerName }}
|
|
labels:
|
|
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
|
spec:
|
|
selfSigned: {}
|
|
---
|
|
{{- end }}
|
|
# CA Certificate for signing Kyverno cleanup controller TLS certificates
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: {{ include "kyverno.fullname" . }}-cleanup-controller-ca
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
|
spec:
|
|
isCA: true
|
|
commonName: {{ include "kyverno.fullname" . }}-cleanup-controller-ca
|
|
# Use the exact secret name Kyverno expects for cleanup controller CA
|
|
secretName: {{ $fullSvcName }}.kyverno-tls-ca
|
|
duration: {{ .Values.cleanupController.certManager.ca.duration | default "87600h" }}
|
|
renewBefore: {{ .Values.cleanupController.certManager.ca.renewBefore | default "720h" }}
|
|
privateKey:
|
|
algorithm: {{ $algorithm }}
|
|
{{- if ne $algorithm "Ed25519" }}
|
|
size: {{ $size }}
|
|
{{- end }}
|
|
issuerRef:
|
|
{{- if .Values.cleanupController.certManager.issuerRef.name }}
|
|
name: {{ .Values.cleanupController.certManager.issuerRef.name }}
|
|
kind: {{ .Values.cleanupController.certManager.issuerRef.kind | default "ClusterIssuer" }}
|
|
group: {{ .Values.cleanupController.certManager.issuerRef.group | default "cert-manager.io" }}
|
|
{{- else if .Values.cleanupController.certManager.createSelfSignedIssuer }}
|
|
name: {{ $selfSignedIssuerName }}
|
|
kind: ClusterIssuer
|
|
group: cert-manager.io
|
|
{{- else }}
|
|
{{- fail "Either cleanupController.certManager.issuerRef.name must be specified or cleanupController.certManager.createSelfSignedIssuer must be true" }}
|
|
{{- end }}
|
|
---
|
|
# CA Issuer using the CA certificate for signing TLS certificates
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Issuer
|
|
metadata:
|
|
name: {{ $caIssuerName }}
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
|
spec:
|
|
ca:
|
|
# Reference the CA secret created by the CA certificate
|
|
secretName: {{ $fullSvcName }}.kyverno-tls-ca
|
|
---
|
|
# TLS Certificate for Kyverno Cleanup Controller
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: {{ include "kyverno.fullname" . }}-cleanup-controller-tls
|
|
namespace: {{ $ns }}
|
|
labels:
|
|
{{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
|
|
spec:
|
|
# Use the exact secret name Kyverno expects for cleanup controller TLS
|
|
secretName: {{ $fullSvcName }}.kyverno-tls-pair
|
|
duration: {{ .Values.cleanupController.certManager.tls.duration | default "8760h" }}
|
|
renewBefore: {{ .Values.cleanupController.certManager.tls.renewBefore | default "720h" }}
|
|
privateKey:
|
|
algorithm: {{ $algorithm }}
|
|
{{- if ne $algorithm "Ed25519" }}
|
|
size: {{ $size }}
|
|
{{- end }}
|
|
usages:
|
|
- server auth
|
|
- digital signature
|
|
- key encipherment
|
|
dnsNames:
|
|
- {{ $name }}
|
|
- {{ $name }}.{{ $ns }}
|
|
- {{ $name }}.{{ $ns }}.svc
|
|
- {{ $name }}.{{ $ns }}.svc.cluster.local
|
|
issuerRef:
|
|
name: {{ $caIssuerName }}
|
|
kind: Issuer
|
|
group: cert-manager.io
|
|
{{- end -}}
|