ZeroDownTime/KubeZero
3
0
Fork 0
Code Issues 1 Pull Requests 25 Packages Projects Releases Wiki Activity

Revert annotations for cert-manager, enable selfheal for cert-manager to work around bootstrap issues

Browse Source
This commit is contained in:
Stefan Reimer 2020-06-14 17:59:56 +01:00
parent 2602953c01
commit 819ebf4cf8
8 changed files with 42 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
charts/kubezero-app/Chart.yaml
View File

@ -2,7 +2,7 @@ apiVersion: v2
name: kubezero-app
description: KubeZero ArgoCD Application - Root chart of the KubeZero
type: application
version: 0.2.3
version: 0.2.4
home: https://kubezero.com
icon: https://cdn.zero-downtime.net/assets/kubezero/logo-small-64.png
keywords:

2
charts/kubezero-app/README.md
View File

@ -2,7 +2,7 @@ kubezero-app
============
KubeZero ArgoCD Application - Root chart of the KubeZero
Current chart version is `0.2.2`
Current chart version is `0.2.4`
Source code can be found [here](https://kubezero.com)

4
charts/kubezero-app/templates/_app.yaml
View File

@ -35,5 +35,7 @@ spec:
syncPolicy:
automated:
prune: true
selfHeal: false
{{- if .selfheal }}
selfHeal: true
{{- end }}
{{- end }}

2
charts/kubezero-app/templates/cert-manager.yaml
View File

@ -1,5 +1,5 @@
{{- if index .Values "cert-manager" "enabled" }}
{{ template "kubezero-app.app" dict "root" . "name" "cert-manager" "type" "helm" "namespace" "cert-manager" }}
{{ template "kubezero-app.app" dict "root" . "name" "cert-manager" "type" "helm" "namespace" "cert-manager" "selfheal" "true" }}
---
apiVersion: v1
kind: Namespace

16
charts/kubezero-cert-manager/README.md
View File

@ -2,7 +2,7 @@ kubezero-cert-manager
=====================
KubeZero Umbrella Chart for cert-manager
Current chart version is `0.3.3`
Current chart version is `0.3.4`
Source code can be found [here](https://kubezero.com)
@ -10,9 +10,19 @@ Source code can be found [here](https://kubezero.com)
| Repository | Name | Version |
|------------|------|---------|
| https://charts.jetstack.io | cert-manager | 0.15.0 |
| https://charts.jetstack.io | cert-manager | 0.15.1 |
| https://zero-down-time.github.io/kubezero/ | kubezero-lib | >= 0.1.1 |
## AWS - IAM Role
If you use kiam or kube2iam and restrict access on nodes running cert-manager please adjust:
```
cert-manager.podAnnotations:
iam.amazonaws.com/role: <ROLE>
```
## Resolver Secrets
If your resolvers need additional sercrets like CloudFlare API tokens etc. make sure to provide these secrets separatly matching your defined issuers.
## Chart Values
| Key | Type | Default | Description |
@ -25,7 +35,7 @@ Source code can be found [here](https://kubezero.com)
| cert-manager.ingressShim.defaultIssuerName | string | `"letsencrypt-dns-prod"` | |
| cert-manager.installCRDs | bool | `true` | |
| cert-manager.nodeSelector."node-role.kubernetes.io/master" | string | `""` | |
| cert-manager.podAnnotations."iam.amazonaws.com/role" | string | `""` | IAM role ARN the cert-manager might use via kiam eg."arn:aws:iam::123456789012:role/certManagerRoleArn" |
| cert-manager.podAnnotations | object | `{}` | "iam.amazonaws.com/roleIAM:" role ARN the cert-manager might use via kiam eg."arn:aws:iam::123456789012:role/certManagerRoleArn" |
| cert-manager.prometheus.servicemonitor.enabled | bool | `false` | |
| cert-manager.tolerations[0].effect | string | `"NoSchedule"` | |
| cert-manager.tolerations[0].key | string | `"node-role.kubernetes.io/master"` | |

20
charts/kubezero-cert-manager/README.md.gotmpl Normal file
View File

@ -0,0 +1,20 @@
{{ template "chart.header" . }}
{{ template "chart.description" . }}
{{ template "chart.versionLine" . }}
{{ template "chart.sourceLinkLine" . }}
{{ template "chart.requirementsSection" . }}
## AWS - IAM Role
If you use kiam or kube2iam and restrict access on nodes running cert-manager please adjust:
```
cert-manager.podAnnotations:
iam.amazonaws.com/role: <ROLE>
```
## Resolver Secrets
If your resolvers need additional sercrets like CloudFlare API tokens etc. make sure to provide these secrets separatly matching your defined issuers.
{{ template "chart.valuesSection" . }}

8
charts/kubezero-cert-manager/templates/cluster-ca.yaml
View File

@ -9,8 +9,6 @@ metadata:
namespace: kube-system
labels:
{{ include "kubezero-lib.labels" . | indent 4 }}
annotations:
"helm.sh/hook": "post-install"
spec:
selfSigned: {}
---
@ -21,8 +19,6 @@ metadata:
namespace: kube-system
labels:
{{ include "kubezero-lib.labels" . | indent 4 }}
annotations:
"helm.sh/hook": "post-install"
spec:
secretName: kubezero-ca-tls
commonName: "kubezero-local-ca"
@ -41,8 +37,6 @@ metadata:
namespace: kube-system
labels:
{{ include "kubezero-lib.labels" . | indent 4 }}
annotations:
"helm.sh/hook": "post-install"
data:
tls.crt: {{ .Values.localCA.ca.crt | b64enc }}
tls.key: {{ .Values.localCA.ca.key | b64enc }}
@ -56,8 +50,6 @@ metadata:
namespace: kube-system
labels:
{{ include "kubezero-lib.labels" . | indent 4 }}
annotations:
"helm.sh/hook": "post-install"
spec:
ca:
secretName: kubezero-ca-tls

6
charts/kubezero-cert-manager/values.yaml
View File

@ -45,6 +45,6 @@ cert-manager:
prometheus:
servicemonitor:
enabled: false
# cert-manager.podAnnotations."iam.amazonaws.com/role" -- IAM role ARN the cert-manager might use via kiam eg."arn:aws:iam::123456789012:role/certManagerRoleArn"
podAnnotations:
iam.amazonaws.com/role: ""
# cert-manager.podAnnotations -- "iam.amazonaws.com/roleIAM:" role ARN the cert-manager might use via kiam eg."arn:aws:iam::123456789012:role/certManagerRoleArn"
podAnnotations: {}
# iam.amazonaws.com/role: ""