Skip to content

Commit f52b982

Browse files
jetstack-botjetstack-bot
authored
Merge pull request #35 from jetstack/use-jetstack-public-to-build
Use jetstack public to build and fix Application wrangling
2 parents 26626bf + c94fcf5 commit f52b982

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

42 files changed

+16808
-187
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ca.crt
2+
ca.key

‎README.md‎

Lines changed: 45 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,11 @@ When you are done, click the "Deploy" button:
102102
This will install Jetstack Secure for cert-manager, and will redirect to
103103
the [Applications](https://console.cloud.google.com/kubernetes/application) page:
104104

105-
<img src="https://user-images.githubusercontent.com/2195781/108228677-61a4ca00-713f-11eb-971a-7306b220db23.png" width="600px" alt="this screenshot is stored in this issue: https://github.com/jetstack/jetstack-secure-gcm/issues/21">
105+
<img src="https://user-images.githubusercontent.com/2195781/110791519-9acde700-8272-11eb-81f4-4f27fb8a174d.png" width="300" alt="The application page on GKE should show the test-1 application. The preflight deployment is failing because the user has not (yet) gone to http://platform.jetstack.io/ to register their cluster. This screenshot is stored in this issue: https://github.com/jetstack/jetstack-secure-gcm/issues/21">
106+
107+
**Note:** the preflight deploymnent is expected to be failing when the
108+
application is first deployed. After registering your cluster on
109+
<https://platform.jetstack.io>, the deployment will start working. To register your cluster, keep reading the [next section](#step-2-log-into-the-jetstack-secure-dashboard).
106110

107111
### Step 2: log into the Jetstack Secure dashboard
108112

@@ -185,8 +189,8 @@ gcloud container clusters get-credentials --zone=$LOCATION $CLUSTER
185189
You can then apply the Jetstack Secure agent configuration to your cluster:
186190

187191
```sh
188-
kubectl -n $NAMESPACE apply -f agent-config.yaml
189-
kubectl -n $NAMESPACE rollout restart deploy jetstack-secure-preflight
192+
cat agent-config.yaml | sed '/namespace:/d' | kubectl -n $NAMESPACE apply -f-
193+
kubectl -n $NAMESPACE rollout restart $(kubectl -n $NAMESPACE get deploy -oname | grep preflight)
190194
```
191195

192196
You may skip over the "Install agent" section:
@@ -225,6 +229,41 @@ You can now click on "View clusters" to monitor your certificates. The
225229
documentation about the Jetstack Secure platform is available at
226230
<https://platform.jetstack.io/docs>.
227231

232+
Let us try with an example. We can create a CA issuer and sign a
233+
certificate that only lasts for 30 days:
234+
235+
```sh
236+
docker run -it --rm -v "$(pwd)":/tmp frapsoft/openssl genrsa -out /tmp/ca.key 2048
237+
docker run -it --rm -v "$(pwd)":/tmp frapsoft/openssl req -x509 -new -nodes -key /tmp/ca.key -subj "/CN=example" -reqexts v3_req -extensions v3_ca -out /tmp/ca.crt
238+
kubectl create secret tls example-ca-key-pair --cert=ca.crt --key=ca.key
239+
kubectl apply -f- <<EOF
240+
apiVersion: cert-manager.io/v1
241+
kind: Issuer
242+
metadata:
243+
name: example-ca-issuer
244+
spec:
245+
ca:
246+
secretName: example-ca-key-pair
247+
---
248+
apiVersion: cert-manager.io/v1alpha2
249+
kind: Certificate
250+
metadata:
251+
name: example-cert
252+
spec:
253+
duration: 721h # very short time to live
254+
dnsNames:
255+
- example.com
256+
issuerRef:
257+
kind: Issuer
258+
name: example-ca-issuer
259+
secretName: example-tls
260+
```
261+
262+
A few seconds later, you will see the certificate `example-cert` appear in
263+
the Jetstack Secure Platform UI:
264+
265+
<img src="https://user-images.githubusercontent.com/2195781/110807883-bf7e8a80-8283-11eb-9d0d-57be5c063d3d.png" width="500" alt="The certificate example-cert shows in the UI at platform.jetstack.io. This screenshot is stored in this issue: https://github.com/jetstack/jetstack-secure-gcm/issues/21">
266+
228267
### Step 3 (optional): set up the Google Certificate Authority Service
229268
230269
[Google Certificate Authority Service][] is a highly available, scalable Google Cloud
@@ -494,8 +533,8 @@ helm template "$APP_INSTANCE_NAME" chart/jetstack-secure-gcm \
494533
--set preflight.image.tag="$TAG" \
495534
--set preflight.serviceAccount.create=true \
496535
--set preflight.rbac.create=true \
497-
--set ubbagent.image.tag="$TAG" \
498-
--set ubbagent.reportingSecretName=$APP_INSTANCE_NAME-license \
536+
--set cert-manager.ubbagent.image.tag="$TAG" \
537+
--set cert-manager.ubbagent.reportingSecretName=$APP_INSTANCE_NAME-license \
499538
> "${APP_INSTANCE_NAME}_manifest.yaml"
500539
```
501540

@@ -508,7 +547,7 @@ helm template "$APP_INSTANCE_NAME" chart/jetstack-secure-gcm \
508547
> --set cert-manager.webhook.image.repository=marketplace.gcr.io/jetstack-public/jetstack-secure-for-cert-manager/cert-manager-webhook
509548
> --set google-cas-issuer.image.repository=marketplace.gcr.io/jetstack-public/jetstack-secure-for-cert-manager/cert-manager-google-cas-issuer
510549
> --set preflight.image.repository=marketplace.gcr.io/jetstack-public/jetstack-secure-for-cert-manager/preflight
511-
> --set ubbagent.image.repository=marketplace.gcr.io/jetstack-public/jetstack-secure-for-cert-manager/ubbagent
550+
> --set cert-manager.ubbagent.image.repository=marketplace.gcr.io/jetstack-public/jetstack-secure-for-cert-manager/ubbagent
512551
> ```
513552
514553
#### Apply the manifest to your Kubernetes cluster

‎chart/jetstack-secure-gcm/charts/cert-manager-v1.1.0.tgz‎

-179 KB
Binary file not shown.

‎chart/jetstack-secure-gcm/charts/cert-manager/Chart.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
apiVersion: v1
2+
appVersion: v1.1.0
3+
description: A Helm chart for cert-manager
4+
home: https://github.com/jetstack/cert-manager
5+
icon: https://raw.githubusercontent.com/jetstack/cert-manager/master/logo/logo.png
6+
keywords:
7+
- cert-manager
8+
- kube-lego
9+
- letsencrypt
10+
- tls
11+
maintainers:
12+
- email: james@jetstack.io
13+
name: munnerz
14+
name: cert-manager
15+
sources:
16+
- https://github.com/jetstack/cert-manager
17+
version: v1.1.0

‎chart/jetstack-secure-gcm/charts/cert-manager/README.md‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
# cert-manager
2+
3+
cert-manager is a Kubernetes addon to automate the management and issuance of
4+
TLS certificates from various issuing sources.
5+
6+
It will ensure certificates are valid and up to date periodically, and attempt
7+
to renew certificates at an appropriate time before expiry.
8+
9+
## Prerequisites
10+
11+
- Kubernetes 1.11+
12+
13+
## Installing the Chart
14+
15+
Full installation instructions, including details on how to configure extra
16+
functionality in cert-manager can be found in the [installation docs](https://cert-manager.io/docs/installation/kubernetes/).
17+
18+
Before installing the chart, you must first install the cert-manager CustomResourceDefinition resources.
19+
This is performed in a separate step to allow you to easily uninstall and reinstall cert-manager without deleting your installed custom resources.
20+
21+
```bash
22+
# Kubernetes 1.15+
23+
$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.1.0/cert-manager.crds.yaml
24+
25+
# Kubernetes <1.15
26+
$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.1.0/cert-manager-legacy.crds.yaml
27+
```
28+
29+
> **Note**: If you're using a Kubernetes version below `v1.15` you will need to install the legacy version of the custom resource definitions.
30+
> This version does not have API version conversion enabled and only supports `cert-manager.io/v1` API resources.
31+
32+
To install the chart with the release name `my-release`:
33+
34+
```console
35+
## Add the Jetstack Helm repository
36+
$ helm repo add jetstack https://charts.jetstack.io
37+
38+
## Install the cert-manager helm chart
39+
$ helm install --name my-release --namespace cert-manager jetstack/cert-manager
40+
```
41+
42+
In order to begin issuing certificates, you will need to set up a ClusterIssuer
43+
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
44+
45+
More information on the different types of issuers and how to configure them
46+
can be found in [our documentation](https://cert-manager.io/docs/configuration/).
47+
48+
For information on how to configure cert-manager to automatically provision
49+
Certificates for Ingress resources, take a look at the
50+
[Securing Ingresses documentation](https://cert-manager.io/docs/usage/ingress/).
51+
52+
> **Tip**: List all releases using `helm list`
53+
54+
## Upgrading the Chart
55+
56+
Special considerations may be required when upgrading the Helm chart, and these
57+
are documented in our full [upgrading guide](https://cert-manager.io/docs/installation/upgrading/).
58+
59+
**Please check here before performing upgrades!**
60+
61+
## Uninstalling the Chart
62+
63+
To uninstall/delete the `my-release` deployment:
64+
65+
```console
66+
$ helm delete my-release
67+
```
68+
69+
The command removes all the Kubernetes components associated with the chart and deletes the release.
70+
71+
If you want to completely uninstall cert-manager from your cluster, you will also need to
72+
delete the previously installed CustomResourceDefinition resources:
73+
74+
```console
75+
# Kubernetes 1.15+
76+
$ kubectl delete -f https://github.com/jetstack/cert-manager/releases/download/v1.1.0/cert-manager.crds.yaml
77+
78+
# Kubernetes <1.15
79+
$ kubectl delete -f https://github.com/jetstack/cert-manager/releases/download/v1.1.0/cert-manager-legacy.crds.yaml
80+
```
81+
82+
## Configuration
83+
84+
The following table lists the configurable parameters of the cert-manager chart and their default values.
85+
86+
| Parameter | Description | Default |
87+
| --------- | ----------- | ------- |
88+
| `global.imagePullSecrets` | Reference to one or more secrets to be used when pulling images | `[]` |
89+
| `global.rbac.create` | If `true`, create and use RBAC resources (includes sub-charts) | `true` |
90+
| `global.priorityClassName`| Priority class name for cert-manager and webhook pods | `""` |
91+
| `global.podSecurityPolicy.enabled` | If `true`, create and use PodSecurityPolicy (includes sub-charts) | `false` |
92+
| `global.podSecurityPolicy.useAppArmor` | If `true`, use Apparmor seccomp profile in PSP | `true` |
93+
| `global.leaderElection.namespace` | Override the namespace used to store the ConfigMap for leader election | `kube-system` |
94+
| `installCRDs` | If true, CRD resources will be installed as part of the Helm chart. If enabled, when uninstalling CRD resources will be deleted causing all installed custom resources to be DELETED | `false` |
95+
| `image.repository` | Image repository | `quay.io/jetstack/cert-manager-controller` |
96+
| `image.tag` | Image tag | `v1.1.0` |
97+
| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
98+
| `replicaCount` | Number of cert-manager replicas | `1` |
99+
| `clusterResourceNamespace` | Override the namespace used to store DNS provider credentials etc. for ClusterIssuer resources | Same namespace as cert-manager pod |
100+
| `featureGates` | Comma-separated list of feature gates to enable on the controller pod | `` |
101+
| `extraArgs` | Optional flags for cert-manager | `[]` |
102+
| `extraEnv` | Optional environment variables for cert-manager | `[]` |
103+
| `serviceAccount.create` | If `true`, create a new service account | `true` |
104+
| `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template | |
105+
| `serviceAccount.annotations` | Annotations to add to the service account | |
106+
| `volumes` | Optional volumes for cert-manager | `[]` |
107+
| `volumeMounts` | Optional volume mounts for cert-manager | `[]` |
108+
| `resources` | CPU/memory resource requests/limits | `{}` |
109+
| `securityContext` | Optional security context. The yaml block should adhere to the [SecurityContext spec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.16/#securitycontext-v1-core) | `{}` |
110+
| `securityContext.enabled` | Deprecated (use `securityContext`) - Enable security context | `false` |
111+
| `containerSecurityContext` | Security context to be set on the controller component container | `{}` |
112+
| `nodeSelector` | Node labels for pod assignment | `{}` |
113+
| `affinity` | Node affinity for pod assignment | `{}` |
114+
| `tolerations` | Node tolerations for pod assignment | `[]` |
115+
| `ingressShim.defaultIssuerName` | Optional default issuer to use for ingress resources | |
116+
| `ingressShim.defaultIssuerKind` | Optional default issuer kind to use for ingress resources | |
117+
| `ingressShim.defaultIssuerGroup` | Optional default issuer group to use for ingress resources | |
118+
| `prometheus.enabled` | Enable Prometheus monitoring | `true` |
119+
| `prometheus.servicemonitor.enabled` | Enable Prometheus Operator ServiceMonitor monitoring | `false` |
120+
| `prometheus.servicemonitor.namespace` | Define namespace where to deploy the ServiceMonitor resource | (namespace where you are deploying) |
121+
| `prometheus.servicemonitor.prometheusInstance` | Prometheus Instance definition | `default` |
122+
| `prometheus.servicemonitor.targetPort` | Prometheus scrape port | `9402` |
123+
| `prometheus.servicemonitor.path` | Prometheus scrape path | `/metrics` |
124+
| `prometheus.servicemonitor.interval` | Prometheus scrape interval | `60s` |
125+
| `prometheus.servicemonitor.labels` | Add custom labels to ServiceMonitor | |
126+
| `prometheus.servicemonitor.scrapeTimeout` | Prometheus scrape timeout | `30s` |
127+
| `podAnnotations` | Annotations to add to the cert-manager pod | `{}` |
128+
| `deploymentAnnotations` | Annotations to add to the cert-manager deployment | `{}` |
129+
| `podDnsPolicy` | Optional cert-manager pod [DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods-dns-policy) | |
130+
| `podDnsConfig` | Optional cert-manager pod [DNS configurations](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods-dns-config) | |
131+
| `podLabels` | Labels to add to the cert-manager pod | `{}` |
132+
| `http_proxy` | Value of the `HTTP_PROXY` environment variable in the cert-manager pod | |
133+
| `https_proxy` | Value of the `HTTPS_PROXY` environment variable in the cert-manager pod | |
134+
| `no_proxy` | Value of the `NO_PROXY` environment variable in the cert-manager pod | |
135+
| `webhook.replicaCount` | Number of cert-manager webhook replicas | `1` |
136+
| `webhook.timeoutSeconds` | Seconds the API server should wait the webhook to respond before treating the call as a failure. | `10` |
137+
| `webhook.podAnnotations` | Annotations to add to the webhook pods | `{}` |
138+
| `webhook.podLabels` | Labels to add to the cert-manager webhook pod | `{}` |
139+
| `webhook.deploymentAnnotations` | Annotations to add to the webhook deployment | `{}` |
140+
| `webhook.mutatingWebhookConfigurationAnnotations` | Annotations to add to the mutating webhook configuration | `{}` |
141+
| `webhook.validatingWebhookConfigurationAnnotations` | Annotations to add to the validating webhook configuration | `{}` |
142+
| `webhook.extraArgs` | Optional flags for cert-manager webhook component | `[]` |
143+
| `webhook.serviceAccount.create` | If `true`, create a new service account for the webhook component | `true` |
144+
| `webhook.serviceAccount.name` | Service account for the webhook component to be used. If not set and `webhook.serviceAccount.create` is `true`, a name is generated using the fullname template | |
145+
| `webhook.serviceAccount.annotations` | Annotations to add to the service account for the webhook component | |
146+
| `webhook.resources` | CPU/memory resource requests/limits for the webhook pods | `{}` |
147+
| `webhook.nodeSelector` | Node labels for webhook pod assignment | `{}` |
148+
| `webhook.affinity` | Node affinity for webhook pod assignment | `{}` |
149+
| `webhook.tolerations` | Node tolerations for webhook pod assignment | `[]` |
150+
| `webhook.image.repository` | Webhook image repository | `quay.io/jetstack/cert-manager-webhook` |
151+
| `webhook.image.tag` | Webhook image tag | `v1.1.0` |
152+
| `webhook.image.pullPolicy` | Webhook image pull policy | `IfNotPresent` |
153+
| `webhook.securePort` | The port that the webhook should listen on for requests. | `10250` |
154+
| `webhook.securityContext` | Security context for webhook pod assignment | `{}` |
155+
| `webhook.containerSecurityContext` | Security context to be set on the webhook component container | `{}` |
156+
| `webhook.hostNetwork` | If `true`, run the Webhook on the host network. | `false` |
157+
| `webhook.livenessProbe.failureThreshold` | The livneness probe failure threshold | `3` |
158+
| `webhook.livenessProbe.initialDelaySeconds` | The livneness probe initial delay (in seconds) | `60` |
159+
| `webhook.livenessProbe.periodSeconds` | The livneness probe period (in seconds) | `10` |
160+
| `webhook.livenessProbe.successThreshold` | The livneness probe success threshold | `1` |
161+
| `webhook.livenessProbe.timeoutSeconds` | The livneness probe timeout (in seconds) | `1` |
162+
| `webhook.readinessProbe.failureThreshold` | The readiness probe failure threshold | `3` |
163+
| `webhook.readinessProbe.initialDelaySeconds` | The readiness probe initial delay (in seconds) | `5` |
164+
| `webhook.readinessProbe.periodSeconds` | The readiness probe period (in seconds) | `5` |
165+
| `webhook.readinessProbe.successThreshold` | The readiness probe success threshold | `1` |
166+
| `webhook.readinessProbe.timeoutSeconds` | The readiness probe timeout (in seconds) | `1` |
167+
| `cainjector.enabled` | Toggles whether the cainjector component should be installed (required for the webhook component to work) | `true` |
168+
| `cainjector.replicaCount` | Number of cert-manager cainjector replicas | `1` |
169+
| `cainjector.podAnnotations` | Annotations to add to the cainjector pods | `{}` |
170+
| `cainjector.podLabels` | Labels to add to the cert-manager cainjector pod | `{}` |
171+
| `cainjector.deploymentAnnotations` | Annotations to add to the cainjector deployment | `{}` |
172+
| `cainjector.extraArgs` | Optional flags for cert-manager cainjector component | `[]` |
173+
| `cainjector.serviceAccount.create` | If `true`, create a new service account for the cainjector component | `true` |
174+
| `cainjector.serviceAccount.name` | Service account for the cainjector component to be used. If not set and `cainjector.serviceAccount.create` is `true`, a name is generated using the fullname template | |
175+
| `cainjector.serviceAccount.annotations` | Annotations to add to the service account for the cainjector component | |
176+
| `cainjector.resources` | CPU/memory resource requests/limits for the cainjector pods | `{}` |
177+
| `cainjector.nodeSelector` | Node labels for cainjector pod assignment | `{}` |
178+
| `cainjector.affinity` | Node affinity for cainjector pod assignment | `{}` |
179+
| `cainjector.tolerations` | Node tolerations for cainjector pod assignment | `[]` |
180+
| `cainjector.image.repository` | cainjector image repository | `quay.io/jetstack/cert-manager-cainjector` |
181+
| `cainjector.image.tag` | cainjector image tag | `v1.1.0` |
182+
| `cainjector.image.pullPolicy` | cainjector image pull policy | `IfNotPresent` |
183+
| `cainjector.securityContext` | Security context for cainjector pod assignment | `{}` |
184+
| `cainjector.containerSecurityContext` | Security context to be set on cainjector component container | `{}` |
185+
186+
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
187+
188+
Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
189+
190+
```console
191+
$ helm install --name my-release -f values.yaml .
192+
```
193+
> **Tip**: You can use the default [values.yaml](https://github.com/jetstack/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml)
194+
195+
## Contributing
196+
197+
This chart is maintained at [github.com/jetstack/cert-manager](https://github.com/jetstack/cert-manager/tree/master/deploy/charts/cert-manager).

‎chart/jetstack-secure-gcm/charts/cert-manager/templates/NOTES.txt‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
cert-manager has been deployed successfully!
2+
3+
In order to begin issuing certificates, you will need to set up a ClusterIssuer
4+
or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
5+
6+
More information on the different types of issuers and how to configure them
7+
can be found in our documentation:
8+
9+
https://cert-manager.io/docs/configuration/
10+
11+
For information on how to configure cert-manager to automatically provision
12+
Certificates for Ingress resources, take a look at the `ingress-shim`
13+
documentation:
14+
15+
https://cert-manager.io/docs/usage/ingress/

0 commit comments

Comments
 (0)