Skip to content

Commit 203613f

Browse files
az-adhocaz-adhoc
authored
Merge pull request #43 from adhoc-dev/t-51238
[ADD] Cloudflare support
2 parents 8b84d8d + fac5286 commit 203613f

10 files changed

Lines changed: 393 additions & 0 deletions

File tree

‎charts/cert-cfg/v0.1.2/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/cert-cfg/v0.1.2/Chart.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
annotations:
2+
category: DevOps
3+
apiVersion: v2
4+
name: cert-cfg
5+
description: Default configurations for cert-manager
6+
7+
type: application
8+
9+
version: 0.1.2
10+
11+
appVersion: "1.0.0"
12+
13+
home: "https://github.com/adhoc-dev/helm-charts"
14+
sources:
15+
- "https://github.com/adhoc-dev/"
16+
maintainers:
17+
- name: dbollini
18+
email: dib@adhoc.com.ar
19+
- name: jjscarafia
20+
email: jjs@adhoc.com.ar
21+
22+
icon: "https://github.com/adhoc-dev/helm-charts/raw/master/img/kube-cert-manager-nginx-kubernetes.png"

‎charts/cert-cfg/v0.1.2/README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Platform configurations
2+
3+
## Cert Issuer configurations
4+
5+
Files:
6+
7+
* prod_issuer.yaml
8+
* staging_issuer.yaml
9+
10+
## nginx configs
11+
12+
[+info](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/)
13+
[+info](https://kubernetes.github.io/ingress-nginx/examples/customization/custom-configuration/)
14+
[+info](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/)
15+
[+info](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#x-forwarded-prefix-header)
16+
17+
Files:
18+
19+
* nginx_configMap.yaml

‎charts/cert-cfg/v0.1.2/questions.yml‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
questions:
2+
- variable: issuerEmail
3+
label: "Email"
4+
description: "email used for let's encrypt notifications"
5+
type: "string"
6+
required: true
7+
default: "bot@adhoc.com.ar"
8+
group: "Common"
9+
10+
- variable: defaultWildcardIssuer
11+
label: "Default Wildcard Issuer"
12+
description: "Issuer to use for wildcard certificates"
13+
type: "select"
14+
required: true
15+
options:
16+
- value: "cloudDNS"
17+
label: "Google Cloud DNS"
18+
- value: "cloudflare"
19+
label: "Cloudflare"
20+
default: "cloudDNS"
21+
group: "Common"
22+
23+
# Google Cloud DNS issuer
24+
- variable: issuerCloudDNS.enabled
25+
label: "Enable Google Cloud DNS Issuer"
26+
description: "Enable the Google Cloud DNS Issuer"
27+
type: "boolean"
28+
required: true
29+
default: true
30+
group: "Common"
31+
- variable: issuerCloudDNS.hostedZoneName
32+
label: "CloudDomain"
33+
description: ""
34+
type: "string"
35+
required: true
36+
default: "dev-adhoc.com"
37+
group: "Google Cloud"
38+
show_if:
39+
- variable: issuerCloudDNS.enabled
40+
value: true
41+
- variable: issuerCloudDNS.dnsZoneName
42+
label: "CloudDomain"
43+
description: "DNS Zone in Google Compute Engine"
44+
type: "string"
45+
required: true
46+
default: "dev-adhoc"
47+
group: "Google Cloud"
48+
show_if:
49+
- variable: issuerCloudDNS.enabled
50+
value: true
51+
- variable: issuerCloudDNS.project
52+
label: "Project"
53+
description: "Google Compute Engine Project"
54+
type: "string"
55+
required: true
56+
default: "proyecto-laboratorios"
57+
group: "Google Cloud"
58+
show_if:
59+
- variable: issuerCloudDNS.enabled
60+
value: true
61+
62+
# Cloudflare issuer
63+
- variable: issuerCloudflare.enabled
64+
label: "Enable Cloudflare Issuer"
65+
description: "Enable the Cloudflare Issuer"
66+
type: "boolean"
67+
required: true
68+
default: false
69+
group: "Common"
70+
- variable: issuerCloudflare.email
71+
label: "Cloudflare Email"
72+
description: "Email used for Cloudflare account"
73+
type: "string"
74+
required: true
75+
default: "user@cloudflare.com"
76+
group: "Cloudflare"
77+
show_if:
78+
- variable: issuerCloudflare.enabled
79+
value: true
80+
- variable: issuerCloudflare.apiToken
81+
label: "Cloudflare API Token"
82+
description: "API Token used for Cloudflare account"
83+
type: "string"
84+
required: true
85+
default: ""
86+
group: "Cloudflare"
87+
show_if:
88+
- variable: issuerCloudflare.enabled
89+
value: true
90+
- variable: issuerCloudflare.hostedZoneName
91+
label: "Cloudflare Domain"
92+
description: "Domain name in Cloudflare"
93+
type: "string"
94+
required: true
95+
default: "dev-adhoc.com"
96+
group: "Cloudflare"
97+
show_if:
98+
- variable: issuerCloudflare.enabled
99+
value: true
100+
- variable: issuerCloudflare.hostedZoneName
101+
label: "Cloudflare Domain"
102+
description: "Domain name in Cloudflare"
103+
type: "string"
104+
required: true
105+
default: "dev-adhoc.com"
106+
group: "Cloudflare"
107+
show_if:
108+
- variable: issuerCloudflare.enabled
109+
value: true

‎charts/cert-cfg/v0.1.2/templates/_helpers.tpl‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "cert-cfg.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "cert-cfg.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "cert-cfg.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "cert-cfg.labels" -}}
37+
helm.sh/chart: {{ include "cert-cfg.chart" . }}
38+
{{ include "cert-cfg.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "cert-cfg.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "cert-cfg.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+

‎charts/cert-cfg/v0.1.2/templates/nginx_configMap.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: ingress-nginx-controller
5+
namespace: nginx-ingress
6+
data:
7+
enable-real-ip: "true"
8+
use-forwarded-headers: "true"
9+
use-proxy-protocol: "true"
10+
proxy-read-timeout: "720s"
11+
proxy-send-timeout: "720s"
12+
proxy-connect-timeout: "720s"
13+
ssl-redirect: "true"
14+
# client-max-body-size: "2m"

‎charts/cert-cfg/v0.1.2/templates/prod_issuer.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: ClusterIssuer
3+
metadata:
4+
name: adhoc-letsencrypt-prod-issuer
5+
namespace: cert-manager
6+
spec:
7+
acme:
8+
# The ACME server URL
9+
server: https://acme-v02.api.letsencrypt.org/directory
10+
# Email address used for ACME registration
11+
email: {{ .Values.issuerEmail }}
12+
# Name of a secret used to store the ACME account private key
13+
privateKeySecretRef:
14+
name: {{ include "cert-cfg.fullname" . }}-letsencrypt-prod
15+
# Enable the HTTP-01 challenge provider
16+
solvers:
17+
# Selector if not set, so the solver will be treated as the 'default' solver with the lowest priority.
18+
- selector: {}
19+
# https://cert-manager.io/docs/configuration/acme/http01/
20+
http01:
21+
ingress:
22+
class: nginx

‎charts/cert-cfg/v0.1.2/templates/staging_issuer.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: ClusterIssuer
3+
metadata:
4+
name: adhoc-letsencrypt-staging-issuer
5+
namespace: cert-manager
6+
spec:
7+
acme:
8+
# https://cert-manager.io/docs/configuration/acme/
9+
# The ACME server URL
10+
server: https://acme-staging-v02.api.letsencrypt.org/directory
11+
# Email address used for ACME registration
12+
email: {{ .Values.issuerEmail }}
13+
# Name of a secret used to store the ACME account private key
14+
privateKeySecretRef:
15+
name: {{ include "cert-cfg.fullname" . }}-letsencrypt-staging
16+
solvers:
17+
# Selector if not set, so the solver will be treated as the 'default' solver with the lowest priority.
18+
- selector: {}
19+
# https://cert-manager.io/docs/configuration/acme/http01/
20+
http01:
21+
ingress:
22+
class: nginx

‎charts/cert-cfg/v0.1.2/templates/wildcard-cert.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{{ if or .Values.issuerCloudDNS.enabled .Values.issuerCloudflare.enabled }}
2+
{{- if .Values.issuerCloudflare.enabled }}
3+
---
4+
apiVersion: v1
5+
kind: Secret
6+
metadata:
7+
name: cloudflare-api-token-secret
8+
namespace: cert-manager
9+
type: Opaque
10+
stringData:
11+
api-token: {{ .Values.issuerCloudflare.apiToken }}
12+
{{- end }}
13+
---
14+
apiVersion: cert-manager.io/v1
15+
kind: ClusterIssuer
16+
metadata:
17+
name: adhoc-wildcard
18+
namespace: cert-manager
19+
spec:
20+
acme:
21+
# The ACME server URL
22+
server: https://acme-v02.api.letsencrypt.org/directory
23+
#server: https://acme-staging-v02.api.letsencrypt.org/directory
24+
# Email address used for ACME registration
25+
email: {{ .Values.issuerEmail }}
26+
# Name of a secret used to store the ACME account private key
27+
privateKeySecretRef:
28+
name: {{ include "cert-cfg.fullname" . }}-wildcard
29+
# Enable the HTTP-01 challenge provider
30+
solvers:
31+
{{- if .Values.issuerCloudflare.enabled }}
32+
- dns01:
33+
cloudflare:
34+
email: {{ .Values.issuerCloudflare.email }}
35+
apiTokenSecretRef:
36+
name: cloudflare-api-token-secret
37+
key: api-token
38+
# Selector if not set, so the solver will be treated as the 'default' solver with the lowest priority.
39+
{{- if ne .Values.defaultWildcardIssuer "cloudflare" }}
40+
selector:
41+
dnsNames:
42+
- '{{ .Values.issuerCloudflare.hostedZoneName }}'
43+
- '*.{{ .Values.issuerCloudflare.hostedZoneName }}'
44+
{{- end }}
45+
{{- end }}
46+
{{- if .Values.issuerCloudDNS.enabled }}
47+
- dns01:
48+
cloudDNS:
49+
project: {{ .Values.issuerCloudDNS.project }}
50+
hostedZoneName: {{ .Values.issuerCloudDNS.dnsZoneName }}
51+
# This was created in cert-manager namespace by terraform, so it's a constant.
52+
serviceAccountSecretRef:
53+
# The key of the entry in the Secret resource's `data` field to be used. Some
54+
# instances of this field may be defaulted, in others it may be required.
55+
key: key.json
56+
# Name of the resource being referred to. More info:
57+
# https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
58+
name: clouddns-dns01-solver-svc-acct
59+
# Selector if not set, so the solver will be treated as the 'default' solver with the lowest priority.
60+
{{- if ne .Values.defaultWildcardIssuer "cloudDNS" }}
61+
selector:
62+
dnsNames:
63+
- '{{ .Values.issuerCloudDNS.hostedZoneName }}'
64+
- '*.{{ .Values.issuerCloudDNS.hostedZoneName }}'
65+
{{- end }}
66+
{{- end }}
67+
---
68+
apiVersion: cert-manager.io/v1
69+
kind: Certificate
70+
metadata:
71+
name: wildcard-certificate
72+
namespace: cert-manager
73+
spec:
74+
commonName: '{{ .Values.issuerCloudDNS.hostedZoneName }}'
75+
dnsNames:
76+
{{- if .Values.issuerCloudDNS.enabled }}
77+
- '{{ .Values.issuerCloudDNS.hostedZoneName }}'
78+
- '*.{{ .Values.issuerCloudDNS.hostedZoneName }}'
79+
{{- end }}
80+
{{- if .Values.issuerCloudflare.enabled }}
81+
- '{{ .Values.issuerCloudflare.hostedZoneName }}'
82+
- '*.{{ .Values.issuerCloudflare.hostedZoneName }}'
83+
{{- end }}
84+
issuerRef:
85+
kind: ClusterIssuer
86+
name: adhoc-wildcard
87+
secretName: wildcard-domain-com-tls
88+
{{ end }}

0 commit comments

Comments
 (0)