home/cert-manager
2
0
Fork 0
mirror of https://github.com/wahyd4/cert-manager.git synced 2026-08-11 06:06:26 +10:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3487 from meyskens/rm-legacy

Browse Source 
Remove the legacy release
This commit is contained in:
jetstack-bot
2020-12-09 11:53:16 +01:00
committed by GitHub
parent 7c53f88f19 22aa9e89fa
commit c195417ffa
15 changed files with 61 additions and 14076 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/charts/cert-manager/README.template.md
+1 -12
View File
@@ -19,16 +19,9 @@ Before installing the chart, you must first install the cert-manager CustomResou
This is performed in a separate step to allow you to easily uninstall and reinstall cert-manager without deleting your installed custom resources.
```bash
# Kubernetes 1.15+
$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/{{RELEASE_VERSION}}/cert-manager.crds.yaml
# Kubernetes <1.15
$ kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/{{RELEASE_VERSION}}/cert-manager-legacy.crds.yaml
$ kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/{{RELEASE_VERSION}}/cert-manager.crds.yaml
```
> **Note**: If you're using a Kubernetes version below `v1.15` you will need to install the legacy version of the custom resource definitions.
> This version does not have API version conversion enabled and only supports `cert-manager.io/v1` API resources.
To install the chart with the release name `my-release`:
```console
@@ -72,11 +65,7 @@ If you want to completely uninstall cert-manager from your cluster, you will als
delete the previously installed CustomResourceDefinition resources:
```console
# Kubernetes 1.15+
$ kubectl delete -f https://github.com/jetstack/cert-manager/releases/download/{{RELEASE_VERSION}}/cert-manager.crds.yaml
# Kubernetes <1.15
$ kubectl delete -f https://github.com/jetstack/cert-manager/releases/download/{{RELEASE_VERSION}}/cert-manager-legacy.crds.yaml
```
## Configuration
deploy/charts/cert-manager/templates/BUILD.bazel
+6 -23
View File
@@ -1,40 +1,23 @@
package(default_visibility = ["//visibility:public"])
load("//build:files.bzl", "modify_file")
modify_file(
genrule(
name = "crds",
src = "//deploy/crds:templates.regular",
out = "crds.yaml",
prefix = """{{- if (semverCompare ">=1.16-0" .Capabilities.KubeVersion.GitVersion) }}
{{- if .Values.installCRDs }}""",
suffix = """{{- end }}
{{- end }}""",
visibility = ["//visibility:private"],
)
modify_file(
name = "crds.legacy",
src = "//deploy/crds:templates.legacy",
out = "crds.legacy.yaml",
prefix = """{{- if (semverCompare "<1.16-0" .Capabilities.KubeVersion.GitVersion) }}
{{- if .Values.installCRDs }}""",
suffix = """{{- end }}
{{- end }}""",
visibility = ["//visibility:private"],
srcs = ["//deploy/crds:templates"],
outs = ["crds.yaml"],
cmd = "cp $< $@",
)
filegroup(
name = "chart-srcs",
srcs = [
"crds.yaml",
"crds.legacy.yaml",
":crds",
] + glob(
[
"*.yaml",
"*.txt",
],
),
visibility = ["//visibility:public"],
)
filegroup(
deploy/crds/BUILD.bazel
+9 -41
View File
@@ -1,11 +1,6 @@
load("//build:helm.bzl", "helm_pkg", "helm_tmpl")
load("//build:files.bzl", "concat_files")
variants = {
"regular": {},
"legacy": {},
}
crds = [
"certificaterequests",
"certificates",
@@ -17,39 +12,12 @@ crds = [
# A single file containing all the CRD templates concatenated together
concat_files(
name = "templates.regular",
name = "templates",
srcs = [":crd-%s.yaml" % crd for crd in crds],
separator = "---",
visibility = ["//visibility:public"],
)
# A single file containing all the CRD templates concatenated together
concat_files(
name = "templates.v1beta1",
srcs = [":crd-%s.v1beta1.yaml" % crd for crd in crds],
separator = "---",
visibility = ["//visibility:public"],
)
# Create a 'legacy' template by running the templates through filter-crd target
genrule(
name = "templates.legacy",
srcs = [
":templates.v1beta1",
],
outs = ["templates.legacy.out"],
cmd = " ".join([
"$(location //hack/filter-crd)",
"-variant=cert-manager-legacy",
"$(location :templates.v1beta1)",
"> $@",
]),
tools = [
"//hack/filter-crd",
],
visibility = ["//visibility:public"],
)
# Create Helm packages that contain only the CRDs named in this directory
# as the contents of 'templates/'.
# All other chart assets (e.g. Chart.yaml, values.yaml), will be sourced from
@@ -58,9 +26,9 @@ genrule(
# without rendering the entirety of the cert-manager installation.
# This means we can install the CRDs during integration tests, and also publish
# the 'static manifest' variants of the CRDs.
[helm_pkg(
name = "package.%s" % variant,
srcs = [":templates.%s" % variant],
helm_pkg(
name = "package",
srcs = [":templates"],
chart_name = "cert-manager",
chart_yaml = "//deploy/charts/cert-manager:Chart.yaml",
readme_file = "//deploy/charts/cert-manager:README.md",
@@ -69,17 +37,17 @@ genrule(
],
values_yaml = "//deploy/charts/cert-manager:values.yaml",
visibility = ["//visibility:private"],
) for (variant, meta) in variants.items()]
)
# Run 'helm template' against the chart containing only the CRDs that is
# constructed in the above 'helm_pkg' rule.
[helm_tmpl(
name = "crds.%s" % variant,
helm_pkg = ":package.%s" % variant,
helm_tmpl(
name = "crds",
helm_pkg = ":package",
release_name = "cert-manager",
release_namespace = "cert-manager",
visibility = ["//visibility:public"],
) for (variant, meta) in variants.items()]
)
[helm_pkg(
name = "crd-%s.package" % crd,
deploy/crds/README.md
+3 -5
View File
@@ -8,11 +8,9 @@ resources in a way that can be consumed by all our different deployment methods.
This package exposes a number of different Bazel targets:
* `templates.regular`: the Helm templates for the 'regular' CRD manifests
* `templates.legacy`: the Helm templates for the 'legacy' CRD manifests
* `crds.regular`: the templated 'regular' CRD manifests (after running `helm template`)
* `crds.legacy`: the templated 'legacy' CRD manifests (after running `helm template`)
* `crd-<crd-name>.templated`: for each CRD type, the one CRD after running `helm template`
* `templates`: the Helm templates for the CRD manifests
* `crds`: the templated CRD manifests (after running `helm template`)
* `crd.templated`: for each CRD type, the one CRD after running `helm template`
* `templated_files`: a filegroup containing all of the individual templated CRD files
Most users should never utilise the files in this directory directly. Instead, Bazel
deploy/crds/crd-certificaterequests.v1beta1.yaml
-559
View File
@@ -1,559 +0,0 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: certificaterequests.cert-manager.io
annotations:
cert-manager.io/inject-ca-from-secret: '{{ template "webhook.caRef" . }}'
labels:
app: '{{ template "cert-manager.name" . }}'
app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
app.kubernetes.io/instance: '{{ .Release.Name }}'
app.kubernetes.io/managed-by: '{{ .Release.Service }}'
helm.sh/chart: '{{ template "cert-manager.chart" . }}'
spec:
additionalPrinterColumns:
- JSONPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
priority: 1
type: string
- JSONPath: .status.conditions[?(@.type=="Ready")].message
name: Status
priority: 1
type: string
- JSONPath: .metadata.creationTimestamp
description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
name: Age
type: date
group: cert-manager.io
names:
kind: CertificateRequest
listKind: CertificateRequestList
plural: certificaterequests
shortNames:
- cr
- crs
singular: certificaterequest
preserveUnknownFields: false
conversion:
# a Webhook strategy instruct API server to call an external webhook for any conversion between custom resources.
strategy: Webhook
# webhookClientConfig is required when strategy is `Webhook` and it configures the webhook endpoint to be called by API server.
webhookClientConfig:
service:
namespace: '{{ .Release.Namespace }}'
name: '{{ template "webhook.fullname" . }}'
path: /convert
scope: Namespaced
subresources:
status: {}
version: v1
versions:
- name: v1alpha2
schema:
openAPIV3Schema:
description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a 'one-shot' resource, meaning it represents a single point in time request for a certificate and cannot be re-used."
type: object
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Desired state of the CertificateRequest resource.
type: object
required:
- csr
- issuerRef
properties:
csr:
description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing.
type: string
format: byte
duration:
description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types.
type: string
isCA:
description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`.
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this CertificateRequest. If the 'kind' field is not set, or set to 'Issuer', an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer with the provided name will be used. The 'name' field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to 'cert-manager.io' if empty.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
usages:
description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified.
type: array
items:
description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"'
type: string
enum:
- signing
- digital signature
- content commitment
- key encipherment
- key agreement
- data encipherment
- cert sign
- crl sign
- encipher only
- decipher only
- any
- server auth
- client auth
- code signing
- email protection
- s/mime
- ipsec end system
- ipsec tunnel
- ipsec user
- timestamping
- ocsp signing
- microsoft sgc
- netscape sgc
status:
description: Status of the CertificateRequest. This is set and managed automatically.
type: object
properties:
ca:
description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available.
type: string
format: byte
certificate:
description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field.
type: string
format: byte
conditions:
description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
type: array
items:
description: CertificateRequestCondition contains condition information for a CertificateRequest.
type: object
required:
- status
- type
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
type: string
format: date-time
message:
description: Message is a human readable description of the details of the last transition, complementing reason.
type: string
reason:
description: Reason is a brief machine readable explanation for the condition's last transition.
type: string
status:
description: Status of the condition, one of ('True', 'False', 'Unknown').
type: string
enum:
- "True"
- "False"
- Unknown
type:
description: Type of the condition, known values are ('Ready', 'InvalidRequest').
type: string
failureTime:
description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
served: true
storage: false
- name: v1alpha3
schema:
openAPIV3Schema:
description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a 'one-shot' resource, meaning it represents a single point in time request for a certificate and cannot be re-used."
type: object
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Desired state of the CertificateRequest resource.
type: object
required:
- csr
- issuerRef
properties:
csr:
description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing.
type: string
format: byte
duration:
description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types.
type: string
isCA:
description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`.
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this CertificateRequest. If the 'kind' field is not set, or set to 'Issuer', an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer with the provided name will be used. The 'name' field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to 'cert-manager.io' if empty.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
usages:
description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified.
type: array
items:
description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"'
type: string
enum:
- signing
- digital signature
- content commitment
- key encipherment
- key agreement
- data encipherment
- cert sign
- crl sign
- encipher only
- decipher only
- any
- server auth
- client auth
- code signing
- email protection
- s/mime
- ipsec end system
- ipsec tunnel
- ipsec user
- timestamping
- ocsp signing
- microsoft sgc
- netscape sgc
status:
description: Status of the CertificateRequest. This is set and managed automatically.
type: object
properties:
ca:
description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available.
type: string
format: byte
certificate:
description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field.
type: string
format: byte
conditions:
description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
type: array
items:
description: CertificateRequestCondition contains condition information for a CertificateRequest.
type: object
required:
- status
- type
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
type: string
format: date-time
message:
description: Message is a human readable description of the details of the last transition, complementing reason.
type: string
reason:
description: Reason is a brief machine readable explanation for the condition's last transition.
type: string
status:
description: Status of the condition, one of ('True', 'False', 'Unknown').
type: string
enum:
- "True"
- "False"
- Unknown
type:
description: Type of the condition, known values are ('Ready', 'InvalidRequest').
type: string
failureTime:
description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
served: true
storage: false
- name: v1beta1
schema:
openAPIV3Schema:
description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a 'one-shot' resource, meaning it represents a single point in time request for a certificate and cannot be re-used."
type: object
required:
- spec
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Desired state of the CertificateRequest resource.
type: object
required:
- issuerRef
- request
properties:
duration:
description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types.
type: string
isCA:
description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`.
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this CertificateRequest. If the 'kind' field is not set, or set to 'Issuer', an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer with the provided name will be used. The 'name' field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to 'cert-manager.io' if empty.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
request:
description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing.
type: string
format: byte
usages:
description: Usages is the set of x509 usages that are requested for the certificate. Defaults to `digital signature` and `key encipherment` if not specified.
type: array
items:
description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"'
type: string
enum:
- signing
- digital signature
- content commitment
- key encipherment
- key agreement
- data encipherment
- cert sign
- crl sign
- encipher only
- decipher only
- any
- server auth
- client auth
- code signing
- email protection
- s/mime
- ipsec end system
- ipsec tunnel
- ipsec user
- timestamping
- ocsp signing
- microsoft sgc
- netscape sgc
status:
description: Status of the CertificateRequest. This is set and managed automatically.
type: object
properties:
ca:
description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available.
type: string
format: byte
certificate:
description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field.
type: string
format: byte
conditions:
description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
type: array
items:
description: CertificateRequestCondition contains condition information for a CertificateRequest.
type: object
required:
- status
- type
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
type: string
format: date-time
message:
description: Message is a human readable description of the details of the last transition, complementing reason.
type: string
reason:
description: Reason is a brief machine readable explanation for the condition's last transition.
type: string
status:
description: Status of the condition, one of ('True', 'False', 'Unknown').
type: string
enum:
- "True"
- "False"
- Unknown
type:
description: Type of the condition, known values are ('Ready', 'InvalidRequest').
type: string
failureTime:
description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
served: true
storage: false
- name: v1
schema:
openAPIV3Schema:
description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a 'one-shot' resource, meaning it represents a single point in time request for a certificate and cannot be re-used."
type: object
required:
- spec
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Desired state of the CertificateRequest resource.
type: object
required:
- issuerRef
- request
properties:
duration:
description: The requested 'duration' (i.e. lifetime) of the Certificate. This option may be ignored/overridden by some issuer types.
type: string
isCA:
description: IsCA will request to mark the certificate as valid for certificate signing when submitting to the issuer. This will automatically add the `cert sign` usage to the list of `usages`.
type: boolean
issuerRef:
description: IssuerRef is a reference to the issuer for this CertificateRequest. If the 'kind' field is not set, or set to 'Issuer', an Issuer resource with the given name in the same namespace as the CertificateRequest will be used. If the 'kind' field is set to 'ClusterIssuer', a ClusterIssuer with the provided name will be used. The 'name' field in this stanza is required at all times. The group field refers to the API group of the issuer which defaults to 'cert-manager.io' if empty.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
request:
description: The PEM-encoded x509 certificate signing request to be submitted to the CA for signing.
type: string
format: byte
usages:
description: Usages is the set of x509 usages that are requested for the certificate. If usages are set they SHOULD be encoded inside the CSR spec Defaults to `digital signature` and `key encipherment` if not specified.
type: array
items:
description: 'KeyUsage specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3 https://tools.ietf.org/html/rfc5280#section-4.2.1.12 Valid KeyUsage values are as follows: "signing", "digital signature", "content commitment", "key encipherment", "key agreement", "data encipherment", "cert sign", "crl sign", "encipher only", "decipher only", "any", "server auth", "client auth", "code signing", "email protection", "s/mime", "ipsec end system", "ipsec tunnel", "ipsec user", "timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"'
type: string
enum:
- signing
- digital signature
- content commitment
- key encipherment
- key agreement
- data encipherment
- cert sign
- crl sign
- encipher only
- decipher only
- any
- server auth
- client auth
- code signing
- email protection
- s/mime
- ipsec end system
- ipsec tunnel
- ipsec user
- timestamping
- ocsp signing
- microsoft sgc
- netscape sgc
status:
description: Status of the CertificateRequest. This is set and managed automatically.
type: object
properties:
ca:
description: The PEM encoded x509 certificate of the signer, also known as the CA (Certificate Authority). This is set on a best-effort basis by different issuers. If not set, the CA is assumed to be unknown/not available.
type: string
format: byte
certificate:
description: The PEM encoded x509 certificate resulting from the certificate signing request. If not set, the CertificateRequest has either not been completed or has failed. More information on failure can be found by checking the `conditions` field.
type: string
format: byte
conditions:
description: List of status conditions to indicate the status of a CertificateRequest. Known condition types are `Ready` and `InvalidRequest`.
type: array
items:
description: CertificateRequestCondition contains condition information for a CertificateRequest.
type: object
required:
- status
- type
properties:
lastTransitionTime:
description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
type: string
format: date-time
message:
description: Message is a human readable description of the details of the last transition, complementing reason.
type: string
reason:
description: Reason is a brief machine readable explanation for the condition's last transition.
type: string
status:
description: Status of the condition, one of ('True', 'False', 'Unknown').
type: string
enum:
- "True"
- "False"
- Unknown
type:
description: Type of the condition, known values are ('Ready', 'InvalidRequest').
type: string
failureTime:
description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
served: true
storage: true
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []
deploy/crds/crd-certificates.v1beta1.yaml
-1170
View File
File diff suppressed because it is too large Load Diff
deploy/crds/crd-challenges.v1beta1.yaml
-3289
View File
File diff suppressed because it is too large Load Diff
deploy/crds/crd-clusterissuers.v1beta1.yaml
-4116
View File
File diff suppressed because it is too large Load Diff
deploy/crds/crd-issuers.v1beta1.yaml
-4116
View File
File diff suppressed because it is too large Load Diff
deploy/crds/crd-orders.v1beta1.yaml
-614
View File
@@ -1,614 +0,0 @@
apiVersion: apiextensions.k8s.io/v1beta1
kind: CustomResourceDefinition
metadata:
name: orders.acme.cert-manager.io
annotations:
cert-manager.io/inject-ca-from-secret: '{{ template "webhook.caRef" . }}'
labels:
app: '{{ template "cert-manager.name" . }}'
app.kubernetes.io/name: '{{ template "cert-manager.name" . }}'
app.kubernetes.io/instance: '{{ .Release.Name }}'
app.kubernetes.io/managed-by: '{{ .Release.Service }}'
helm.sh/chart: '{{ template "cert-manager.chart" . }}'
spec:
additionalPrinterColumns:
- JSONPath: .status.state
name: State
type: string
- JSONPath: .spec.issuerRef.name
name: Issuer
priority: 1
type: string
- JSONPath: .status.reason
name: Reason
priority: 1
type: string
- JSONPath: .metadata.creationTimestamp
description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
name: Age
type: date
group: acme.cert-manager.io
names:
kind: Order
listKind: OrderList
plural: orders
singular: order
preserveUnknownFields: false
conversion:
# a Webhook strategy instruct API server to call an external webhook for any conversion between custom resources.
strategy: Webhook
# webhookClientConfig is required when strategy is `Webhook` and it configures the webhook endpoint to be called by API server.
webhookClientConfig:
service:
namespace: '{{ .Release.Namespace }}'
name: '{{ template "webhook.fullname" . }}'
path: /convert
scope: Namespaced
subresources:
status: {}
version: v1
versions:
- name: v1alpha2
schema:
openAPIV3Schema:
description: Order is a type to represent an Order with an ACME server
type: object
required:
- metadata
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
type: object
required:
- csr
- issuerRef
properties:
commonName:
description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR.
type: string
csr:
description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order.
type: string
format: byte
dnsNames:
description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
type: array
items:
type: string
duration:
description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec.
type: string
ipAddresses:
description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
type: array
items:
type: string
issuerRef:
description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
status:
type: object
properties:
authorizations:
description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order.
type: array
items:
description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource.
type: object
required:
- url
properties:
challenges:
description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process.
type: array
items:
description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process.
type: object
required:
- token
- type
- url
properties:
token:
description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented.
type: string
type:
description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored.
type: string
url:
description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server.
type: string
identifier:
description: Identifier is the DNS name to be validated as part of this authorization
type: string
initialState:
description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created.
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL is the URL of the Authorization that must be completed
type: string
wildcard:
description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'.
type: boolean
certificate:
description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state.
type: string
format: byte
failureTime:
description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
finalizeURL:
description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed.
type: string
reason:
description: Reason optionally provides more information about a why the order is in the current state.
type: string
state:
description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final'
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set.
type: string
served: true
storage: false
- name: v1alpha3
schema:
openAPIV3Schema:
description: Order is a type to represent an Order with an ACME server
type: object
required:
- metadata
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
type: object
required:
- csr
- issuerRef
properties:
commonName:
description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR.
type: string
csr:
description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order.
type: string
format: byte
dnsNames:
description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
type: array
items:
type: string
duration:
description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec.
type: string
ipAddresses:
description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
type: array
items:
type: string
issuerRef:
description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
status:
type: object
properties:
authorizations:
description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order.
type: array
items:
description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource.
type: object
required:
- url
properties:
challenges:
description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process.
type: array
items:
description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process.
type: object
required:
- token
- type
- url
properties:
token:
description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented.
type: string
type:
description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored.
type: string
url:
description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server.
type: string
identifier:
description: Identifier is the DNS name to be validated as part of this authorization
type: string
initialState:
description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created.
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL is the URL of the Authorization that must be completed
type: string
wildcard:
description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'.
type: boolean
certificate:
description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state.
type: string
format: byte
failureTime:
description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
finalizeURL:
description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed.
type: string
reason:
description: Reason optionally provides more information about a why the order is in the current state.
type: string
state:
description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final'
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set.
type: string
served: true
storage: false
- name: v1beta1
schema:
openAPIV3Schema:
description: Order is a type to represent an Order with an ACME server
type: object
required:
- metadata
- spec
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
type: object
required:
- issuerRef
- request
properties:
commonName:
description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR.
type: string
dnsNames:
description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
type: array
items:
type: string
duration:
description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec.
type: string
ipAddresses:
description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
type: array
items:
type: string
issuerRef:
description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
request:
description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order.
type: string
format: byte
status:
type: object
properties:
authorizations:
description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order.
type: array
items:
description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource.
type: object
required:
- url
properties:
challenges:
description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process.
type: array
items:
description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process.
type: object
required:
- token
- type
- url
properties:
token:
description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented.
type: string
type:
description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored.
type: string
url:
description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server.
type: string
identifier:
description: Identifier is the DNS name to be validated as part of this authorization
type: string
initialState:
description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created.
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL is the URL of the Authorization that must be completed
type: string
wildcard:
description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'.
type: boolean
certificate:
description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state.
type: string
format: byte
failureTime:
description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
finalizeURL:
description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed.
type: string
reason:
description: Reason optionally provides more information about a why the order is in the current state.
type: string
state:
description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final'
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set.
type: string
served: true
storage: false
- name: v1
schema:
openAPIV3Schema:
description: Order is a type to represent an Order with an ACME server
type: object
required:
- metadata
- spec
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
type: object
required:
- issuerRef
- request
properties:
commonName:
description: CommonName is the common name as specified on the DER encoded CSR. If specified, this value must also be present in `dnsNames` or `ipAddresses`. This field must match the corresponding field on the DER encoded CSR.
type: string
dnsNames:
description: DNSNames is a list of DNS names that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
type: array
items:
type: string
duration:
description: Duration is the duration for the not after date for the requested certificate. this is set on order creation as pe the ACME spec.
type: string
ipAddresses:
description: IPAddresses is a list of IP addresses that should be included as part of the Order validation process. This field must match the corresponding field on the DER encoded CSR.
type: array
items:
type: string
issuerRef:
description: IssuerRef references a properly configured ACME-type Issuer which should be used to create this Order. If the Issuer does not exist, processing will be retried. If the Issuer is not an 'ACME' Issuer, an error will be returned and the Order will be marked as failed.
type: object
required:
- name
properties:
group:
description: Group of the resource being referred to.
type: string
kind:
description: Kind of the resource being referred to.
type: string
name:
description: Name of the resource being referred to.
type: string
request:
description: Certificate signing request bytes in DER encoding. This will be used when finalizing the order. This field must be set on the order.
type: string
format: byte
status:
type: object
properties:
authorizations:
description: Authorizations contains data returned from the ACME server on what authorizations must be completed in order to validate the DNS names specified on the Order.
type: array
items:
description: ACMEAuthorization contains data returned from the ACME server on an authorization that must be completed in order validate a DNS name on an ACME Order resource.
type: object
required:
- url
properties:
challenges:
description: Challenges specifies the challenge types offered by the ACME server. One of these challenge types will be selected when validating the DNS name and an appropriate Challenge resource will be created to perform the ACME challenge process.
type: array
items:
description: Challenge specifies a challenge offered by the ACME server for an Order. An appropriate Challenge resource can be created to perform the ACME challenge process.
type: object
required:
- token
- type
- url
properties:
token:
description: Token is the token that must be presented for this challenge. This is used to compute the 'key' that must also be presented.
type: string
type:
description: Type is the type of challenge being offered, e.g. 'http-01', 'dns-01', 'tls-sni-01', etc. This is the raw value retrieved from the ACME server. Only 'http-01' and 'dns-01' are supported by cert-manager, other values will be ignored.
type: string
url:
description: URL is the URL of this challenge. It can be used to retrieve additional metadata about the Challenge from the ACME server.
type: string
identifier:
description: Identifier is the DNS name to be validated as part of this authorization
type: string
initialState:
description: InitialState is the initial state of the ACME authorization when first fetched from the ACME server. If an Authorization is already 'valid', the Order controller will not create a Challenge resource for the authorization. This will occur when working with an ACME server that enables 'authz reuse' (such as Let's Encrypt's production endpoint). If not set and 'identifier' is set, the state is assumed to be pending and a Challenge will be created.
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL is the URL of the Authorization that must be completed
type: string
wildcard:
description: Wildcard will be true if this authorization is for a wildcard DNS name. If this is true, the identifier will be the *non-wildcard* version of the DNS name. For example, if '*.example.com' is the DNS name being validated, this field will be 'true' and the 'identifier' field will be 'example.com'.
type: boolean
certificate:
description: Certificate is a copy of the PEM encoded certificate for this Order. This field will be populated after the order has been successfully finalized with the ACME server, and the order has transitioned to the 'valid' state.
type: string
format: byte
failureTime:
description: FailureTime stores the time that this order failed. This is used to influence garbage collection and back-off.
type: string
format: date-time
finalizeURL:
description: FinalizeURL of the Order. This is used to obtain certificates for this order once it has been completed.
type: string
reason:
description: Reason optionally provides more information about a why the order is in the current state.
type: string
state:
description: State contains the current state of this Order resource. States 'success' and 'expired' are 'final'
type: string
enum:
- valid
- ready
- pending
- processing
- invalid
- expired
- errored
url:
description: URL of the Order. This will initially be empty when the resource is first created. The Order controller will populate this field when the Order is first processed. This field will be immutable after it is initially set.
type: string
served: true
storage: true
status:
acceptedNames:
kind: ""
plural: ""
conditions: []
storedVersions: []
deploy/manifests/BUILD.bazel
+35 -57
View File
@@ -10,104 +10,82 @@ RELEASE_NAME = "cert-manager"
RELEASE_NAMESPACE = "cert-manager"
VARIANTS = {
"cert-manager": {
"crd_variant": "regular",
"additional_api_versions": "",
"values": {
"installCRDs": "false",
},
},
"cert-manager-legacy": {
"crd_variant": "legacy",
# This following line tells Helm that we need to use v1beta1 webhooks
# When using helm template the API versions are determined for the version
# helm was compiled with, there is no way to remove any from this list
# the following hack adds an API version which we then can use to force
# the template engine to use v1beta1 webhooks.
"additional_api_versions": "hacking-helm.i-wish-this-wasnt-required.cert-manager.io/force-v1beta1-webhooks",
"values": {
"installCRDs": "false",
},
},
}
[genrule(
name = "%s.nohelm.crds.yaml" % name,
genrule(
name = "crds.nohelm.yaml",
srcs = [
"//deploy/crds:crds.%s" % meta["crd_variant"],
"//deploy/crds",
],
outs = ["%s.crds.nohelm.out" % name],
outs = ["crds.nohelm.out"],
cmd = " ".join([
"$(location //hack/filter-crd)",
"-variant=no-helm",
"$(location //deploy/crds:crds.%s)" % meta["crd_variant"],
"$(location //deploy/crds:crds)",
"> $@",
]),
tools = [
"//hack/filter-crd",
],
visibility = ["//visibility:public"],
) for (name, meta) in VARIANTS.items()]
)
[helm_tmpl(
name = "%s.manifests" % name,
additional_api_versions = meta["additional_api_versions"],
helm_tmpl(
name = "manifests.helm",
helm_pkg = "//deploy/charts/cert-manager",
release_name = RELEASE_NAME,
release_namespace = RELEASE_NAMESPACE,
values = meta["values"],
) for (name, meta) in VARIANTS.items()]
)
[licensed_file(
name = "%s.crds.yaml" % name,
src = ":%s.nohelm.crds.yaml" % name,
) for (name, meta) in VARIANTS.items()]
licensed_file(
name = "crds.yaml",
src = ":crds.nohelm.yaml",
)
[genrule(
name = "%s.unlicensed" % name,
genrule(
name = "unlicensed",
srcs = [
"//deploy/crds:crds.%s" % meta["crd_variant"],
"//deploy/crds",
"01-namespace.yaml",
"%s.manifests" % name,
"manifests.helm",
],
outs = ["%s.unlicensed.yaml" % name],
outs = ["unlicensed.yaml"],
cmd = " ".join([
"cat",
"$(location //deploy/crds:crds.%s)" % meta["crd_variant"],
"$(location //deploy/crds:crds)",
"$(location 01-namespace.yaml)",
"$(location %s.manifests)" % name,
"$(location manifests.helm)",
"> $@",
]),
) for (name, meta) in VARIANTS.items()]
)
[genrule(
name = "%s.unlicensed.nohelm" % name,
genrule(
name = "unlicensed.nohelm",
srcs = [
":%s.unlicensed" % name,
":unlicensed",
],
outs = ["%s.unlicensed.nohelm.yaml" % name],
outs = ["unlicensed.nohelm.yaml"],
cmd = " ".join([
"$(location //hack/filter-crd)",
"-variant=no-helm",
"$(location :%s.unlicensed)" % name,
"$(location :unlicensed)",
"> $@",
]),
tools = [
"//hack/filter-crd",
],
visibility = ["//visibility:public"],
) for (name, meta) in VARIANTS.items()]
)
[licensed_file(
name = "%s.yaml" % name,
src = "%s.unlicensed.nohelm" % name,
) for (name, meta) in VARIANTS.items()]
licensed_file(
name = "manifests.yaml",
src = "unlicensed.nohelm",
)
pkg_tar(
name = "manifests",
srcs = [":%s.yaml" % name for name in VARIANTS.keys()] +
[":%s.crds.yaml" % name for name in VARIANTS.keys()],
srcs = [
":crds.yaml",
":manifests.helm",
],
extension = "tar.gz",
mode = "0644",
package_dir = "manifests",
deploy/manifests/README.md
-2
View File
@@ -21,8 +21,6 @@ To build the manifests, run:
```bash
$ bazel build //deploy/manifests:cert-manager.yaml
# Alternatively, build the legacy variant with:
$ bazel build //deploy/manifests:cert-manager-legacy.yaml
```
This will generate the static deployment manifests at
hack/filter-crd/main.go
+5 -70
View File
@@ -21,15 +21,12 @@ import (
"fmt"
"log"
"os"
"reflect"
"strings"
"gopkg.in/yaml.v2"
)
var removeKeys = []string{}
var retainElementForValue = map[string]string{}
var singleCRDVersion = false
func main() {
loadVariant()
@@ -55,34 +52,6 @@ func main() {
checkChain(d, []string{})
if singleCRDVersion {
spec, ok := d["spec"].(map[interface{}]interface{})
if !ok {
log.Fatal("Cannot read spec of CRD")
}
versions, ok := spec["versions"].([]interface{})
if !ok {
log.Fatal("Cannot read versions of CRD")
}
if len(versions) == 0 {
log.Fatal("CRD versions length is 0")
}
if len(versions) > 1 {
log.Fatal("Multiple CRD versions found while 1 is expected")
}
versionInfo, ok := versions[0].(map[interface{}]interface{})
if !ok {
log.Fatal("Cannot read version of CRD")
}
// move the schema to the root of the CRD as we only have 1 version specified
if validations, exists := versionInfo["schema"]; exists {
spec["validation"] = validations
delete(versionInfo, "schema")
}
}
fileOut, err := yaml.Marshal(d)
if err != nil {
log.Fatal("Error marshaling output: ", err)
@@ -132,10 +101,6 @@ func checkSliceChain(s []interface{}, chain []string) []interface{} {
}
}
if value, ok := retainElementForValue[strings.Join(chain, "/")]; ok && value != v.(string) {
s = removeFromSlice(s, d)
}
if value, ok := v.(map[interface{}]interface{}); ok {
checkChain(value, chain)
}
@@ -152,46 +117,16 @@ func checkSliceChain(s []interface{}, chain []string) []interface{} {
return s
}
func removeFromSlice(s []interface{}, d map[interface{}]interface{}) []interface{} {
newSlice := []interface{}{}
for _, sliceVal := range s {
if !reflect.DeepEqual(sliceVal, d) {
newSlice = append(newSlice, sliceVal)
}
}
s = newSlice
return s
}
func loadVariant() {
variant := ""
flag.StringVar(&variant, "variant", "", "variant of remove rules")
flag.Parse()
if variant == "cert-manager-legacy" {
// These are the keys that the script will remove for OpenShift 3 and older Kubernetes compatibility
removeKeys = []string{
"spec/preserveUnknownFields",
"spec/validation/openAPIV3Schema/type",
"spec/versions/[]/schema/openAPIV3Schema/type",
"spec/conversion",
// This field exists on the Issuer and ClusterIssuer CRD
"spec/validation/openAPIV3Schema/properties/spec/properties/acme/properties/solvers/items/properties/dns01/properties/webhook/properties/config/x-kubernetes-preserve-unknown-fields",
"spec/versions/[]/schema/openAPIV3Schema/properties/spec/properties/acme/properties/solvers/items/properties/dns01/properties/webhook/properties/config/x-kubernetes-preserve-unknown-fields",
// This field exists on the Challenge CRD
"spec/validation/openAPIV3Schema/properties/spec/properties/solver/properties/dns01/properties/webhook/properties/config/x-kubernetes-preserve-unknown-fields",
"spec/versions/[]/schema/openAPIV3Schema/properties/spec/properties/solver/properties/dns01/properties/webhook/properties/config/x-kubernetes-preserve-unknown-fields",
}
// only retain the `v1` version in the CRD
retainElementForValue = map[string]string{
"spec/versions/[]/name": "v1",
}
singleCRDVersion = true
} else if variant == "no-helm" {
// filter-crd is also able to be used without variant which should produce the same output again
// this section used to have multiple variants for legacy releases, this has been removed now
// TODO: ultimately we should find a we should find a way to remove the Helm specific labels
// without using this hack
if variant == "no-helm" {
removeKeys = []string{
"metadata/labels/app.kubernetes.io/managed-by",
"metadata/labels/helm.sh/chart",
test/integration/framework/BUILD.bazel
+1 -1
View File
@@ -8,7 +8,7 @@ go_library(
"paths.go",
],
data = [
"//deploy/crds:crds.regular.yaml",
"//deploy/crds:crds.yaml",
"//hack/bin:com_coreos_etcd",
"//hack/bin:io_kubernetes_kube-apiserver",
"//hack/bin:kubectl",
tools/setup-integration-test-dependencies.sh
+1 -1
View File
@@ -20,7 +20,7 @@ set -o pipefail
SCRIPT_ROOT=$(realpath $(dirname "${BASH_SOURCE}"))
REPO_ROOT=$(dirname "${SCRIPT_ROOT}}")
bazel build //deploy/crds:crds.regular.yaml
bazel build //deploy/crds:crds.yaml
bazel build //hack/bin:com_coreos_etcd
bazel build //hack/bin:io_kubernetes_kube-apiserver
bazel build //hack/bin:kubectl