Skip to content

Commit dc0a387

Browse files
az-adhocaz-adhoc
committed
Merge pull request #43 from adhoc-dev/t-51238
[ADD] Cloudflare support
2 parents 8b84d8d + fac5286 commit dc0a387

10 files changed

Lines changed: 372 additions & 0 deletions

File tree

‎charts/cert-cfg/v0.1.2/.helmignore‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎charts/cert-cfg/v0.1.2/Chart.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
annotations:
2+
category: DevOps
3+
apiVersion: v2
4+
name: cert-cfg
5+
description: Default configurations for cert-manager
6+
7+
type: application
8+
9+
version: 0.1.2
10+
11+
appVersion: "1.0.0"
12+
13+
home: "https://github.com/adhoc-dev/helm-charts"
14+
sources:
15+
- "https://github.com/adhoc-dev/"
16+
maintainers:
17+
- name: dbollini
18+
email: dib@adhoc.com.ar
19+
- name: jjscarafia
20+
email: jjs@adhoc.com.ar
21+
22+
icon: "https://github.com/adhoc-dev/helm-charts/raw/master/img/kube-cert-manager-nginx-kubernetes.png"

‎charts/cert-cfg/v0.1.2/README.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Platform configurations
2+
3+
## Cert Issuer configurations
4+
5+
Files:
6+
7+
* prod_issuer.yaml
8+
* staging_issuer.yaml
9+
10+
## nginx configs
11+
12+
[+info](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/)
13+
[+info](https://kubernetes.github.io/ingress-nginx/examples/customization/custom-configuration/)
14+
[+info](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/)
15+
[+info](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#x-forwarded-prefix-header)
16+
17+
Files:
18+
19+
* nginx_configMap.yaml

‎charts/cert-cfg/v0.1.2/questions.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
questions:
2+
- variable: issuerEmail
3+
label: "Email"
4+
description: "email used for let's encrypt notifications"
5+
type: "string"
6+
required: true
7+
default: "bot@adhoc.com.ar"
8+
group: "Common"
9+
10+
- variable: defaultWildcardIssuer
11+
label: "Default Wildcard Issuer"
12+
description: "Issuer to use for wildcard certificates"
13+
type: "select"
14+
required: true
15+
options:
16+
- value: "cloudDNS"
17+
label: "Google Cloud DNS"
18+
- value: "cloudflare"
19+
label: "Cloudflare"
20+
default: "cloudDNS"
21+
group: "Common"
22+
23+
# Google Cloud DNS issuer
24+
- variable: issuerCloudDNS.enabled
25+
label: "Enable Google Cloud DNS Issuer"
26+
description: "Enable the Google Cloud DNS Issuer"
27+
type: "boolean"
28+
required: true
29+
default: true
30+
group: "Common"
31+
- variable: issuerCloudDNS.hostedZoneName
32+
label: "CloudDomain"
33+
description: ""
34+
type: "string"
35+
required: true
36+
default: "dev-adhoc.com"
37+
group: "Google Cloud"
38+
show_if: "issuerCloudDNS.enabled=true"
39+
- variable: issuerCloudDNS.dnsZoneName
40+
label: "CloudDomain"
41+
description: "DNS Zone in Google Compute Engine"
42+
type: "string"
43+
required: true
44+
default: "dev-adhoc"
45+
group: "Google Cloud"
46+
show_if: "issuerCloudDNS.enabled=true"
47+
- variable: issuerCloudDNS.project
48+
label: "Project"
49+
description: "Google Compute Engine Project"
50+
type: "string"
51+
required: true
52+
default: "proyecto-laboratorios"
53+
group: "Google Cloud"
54+
show_if: "issuerCloudDNS.enabled=true"
55+
56+
# Cloudflare issuer
57+
- variable: issuerCloudflare.enabled
58+
label: "Enable Cloudflare Issuer"
59+
description: "Enable the Cloudflare Issuer"
60+
type: "boolean"
61+
required: true
62+
default: false
63+
group: "Common"
64+
- variable: issuerCloudflare.email
65+
label: "Cloudflare Email"
66+
description: "Email used for Cloudflare account"
67+
type: "string"
68+
required: true
69+
default: "user@cloudflare.com"
70+
group: "Cloudflare"
71+
show_if: "issuerCloudflare.enabled=true"
72+
- variable: issuerCloudflare.apiToken
73+
label: "Cloudflare API Token"
74+
description: "API Token used for Cloudflare account"
75+
type: "string"
76+
required: true
77+
default: ""
78+
group: "Cloudflare"
79+
show_if: "issuerCloudflare.enabled=true"
80+
- variable: issuerCloudflare.hostedZoneName
81+
label: "Cloudflare Domain"
82+
description: "Domain name in Cloudflare"
83+
type: "string"
84+
required: true
85+
default: "dev-adhoc.com"
86+
group: "Cloudflare"
87+
show_if: "issuerCloudflare.enabled=true"
88+

‎charts/cert-cfg/v0.1.2/templates/_helpers.tpl‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "cert-cfg.name" -}}
5+
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "cert-cfg.fullname" -}}
14+
{{- if .Values.fullnameOverride }}
15+
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
{{/*
27+
Create chart name and version as used by the chart label.
28+
*/}}
29+
{{- define "cert-cfg.chart" -}}
30+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
31+
{{- end }}
32+
33+
{{/*
34+
Common labels
35+
*/}}
36+
{{- define "cert-cfg.labels" -}}
37+
helm.sh/chart: {{ include "cert-cfg.chart" . }}
38+
{{ include "cert-cfg.selectorLabels" . }}
39+
{{- if .Chart.AppVersion }}
40+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
41+
{{- end }}
42+
app.kubernetes.io/managed-by: {{ .Release.Service }}
43+
{{- end }}
44+
45+
{{/*
46+
Selector labels
47+
*/}}
48+
{{- define "cert-cfg.selectorLabels" -}}
49+
app.kubernetes.io/name: {{ include "cert-cfg.name" . }}
50+
app.kubernetes.io/instance: {{ .Release.Name }}
51+
{{- end }}
52+

‎charts/cert-cfg/v0.1.2/templates/nginx_configMap.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: ingress-nginx-controller
5+
namespace: nginx-ingress
6+
data:
7+
enable-real-ip: "true"
8+
use-forwarded-headers: "true"
9+
use-proxy-protocol: "true"
10+
proxy-read-timeout: "720s"
11+
proxy-send-timeout: "720s"
12+
proxy-connect-timeout: "720s"
13+
ssl-redirect: "true"
14+
# client-max-body-size: "2m"

‎charts/cert-cfg/v0.1.2/templates/prod_issuer.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: ClusterIssuer
3+
metadata:
4+
name: adhoc-letsencrypt-prod-issuer
5+
namespace: cert-manager
6+
spec:
7+
acme:
8+
# The ACME server URL
9+
server: https://acme-v02.api.letsencrypt.org/directory
10+
# Email address used for ACME registration
11+
email: {{ .Values.issuerEmail }}
12+
# Name of a secret used to store the ACME account private key
13+
privateKeySecretRef:
14+
name: {{ include "cert-cfg.fullname" . }}-letsencrypt-prod
15+
# Enable the HTTP-01 challenge provider
16+
solvers:
17+
# Selector if not set, so the solver will be treated as the 'default' solver with the lowest priority.
18+
- selector: {}
19+
# https://cert-manager.io/docs/configuration/acme/http01/
20+
http01:
21+
ingress:
22+
class: nginx

‎charts/cert-cfg/v0.1.2/templates/staging_issuer.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: ClusterIssuer
3+
metadata:
4+
name: adhoc-letsencrypt-staging-issuer
5+
namespace: cert-manager
6+
spec:
7+
acme:
8+
# https://cert-manager.io/docs/configuration/acme/
9+
# The ACME server URL
10+
server: https://acme-staging-v02.api.letsencrypt.org/directory
11+
# Email address used for ACME registration
12+
email: {{ .Values.issuerEmail }}
13+
# Name of a secret used to store the ACME account private key
14+
privateKeySecretRef:
15+
name: {{ include "cert-cfg.fullname" . }}-letsencrypt-staging
16+
solvers:
17+
# Selector if not set, so the solver will be treated as the 'default' solver with the lowest priority.
18+
- selector: {}
19+
# https://cert-manager.io/docs/configuration/acme/http01/
20+
http01:
21+
ingress:
22+
class: nginx

‎charts/cert-cfg/v0.1.2/templates/wildcard-cert.yaml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
{{ if or .Values.issuerCloudDNS.enabled .Values.issuerCloudflare.enabled }}
2+
{{- if .Values.issuerCloudflare.enabled }}
3+
---
4+
apiVersion: v1
5+
kind: Secret
6+
metadata:
7+
name: cloudflare-api-token-secret
8+
namespace: cert-manager
9+
type: Opaque
10+
stringData:
11+
api-token: {{ .Values.issuerCloudflare.apiToken }}
12+
{{- end }}
13+
---
14+
apiVersion: cert-manager.io/v1
15+
kind: ClusterIssuer
16+
metadata:
17+
name: adhoc-wildcard
18+
namespace: cert-manager
19+
spec:
20+
acme:
21+
# The ACME server URL
22+
server: https://acme-v02.api.letsencrypt.org/directory
23+
#server: https://acme-staging-v02.api.letsencrypt.org/directory
24+
# Email address used for ACME registration
25+
email: {{ .Values.issuerEmail }}
26+
# Name of a secret used to store the ACME account private key
27+
privateKeySecretRef:
28+
name: {{ include "cert-cfg.fullname" . }}-wildcard
29+
# Enable the HTTP-01 challenge provider
30+
solvers:
31+
{{- if .Values.issuerCloudflare.enabled }}
32+
- dns01:
33+
cloudflare:
34+
email: {{ .Values.issuerCloudflare.email }}
35+
apiTokenSecretRef:
36+
name: cloudflare-api-token-secret
37+
key: api-token
38+
# Selector if not set, so the solver will be treated as the 'default' solver with the lowest priority.
39+
{{- if ne .Values.defaultWildcardIssuer "cloudflare" }}
40+
selector:
41+
dnsNames:
42+
- '{{ .Values.issuerCloudflare.hostedZoneName }}'
43+
- '*.{{ .Values.issuerCloudflare.hostedZoneName }}'
44+
{{- end }}
45+
{{- end }}
46+
{{- if .Values.issuerCloudDNS.enabled }}
47+
- dns01:
48+
cloudDNS:
49+
project: {{ .Values.issuerCloudDNS.project }}
50+
hostedZoneName: {{ .Values.issuerCloudDNS.dnsZoneName }}
51+
# This was created in cert-manager namespace by terraform, so it's a constant.
52+
serviceAccountSecretRef:
53+
# The key of the entry in the Secret resource's `data` field to be used. Some
54+
# instances of this field may be defaulted, in others it may be required.
55+
key: key.json
56+
# Name of the resource being referred to. More info:
57+
# https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
58+
name: clouddns-dns01-solver-svc-acct
59+
# Selector if not set, so the solver will be treated as the 'default' solver with the lowest priority.
60+
{{- if ne .Values.defaultWildcardIssuer "cloudDNS" }}
61+
selector:
62+
dnsNames:
63+
- '{{ .Values.issuerCloudDNS.hostedZoneName }}'
64+
- '*.{{ .Values.issuerCloudDNS.hostedZoneName }}'
65+
{{- end }}
66+
{{- end }}
67+
---
68+
apiVersion: cert-manager.io/v1
69+
kind: Certificate
70+
metadata:
71+
name: wildcard-certificate
72+
namespace: cert-manager
73+
spec:
74+
commonName: '{{ .Values.issuerCloudDNS.hostedZoneName }}'
75+
dnsNames:
76+
{{- if .Values.issuerCloudDNS.enabled }}
77+
- '{{ .Values.issuerCloudDNS.hostedZoneName }}'
78+
- '*.{{ .Values.issuerCloudDNS.hostedZoneName }}'
79+
{{- end }}
80+
{{- if .Values.issuerCloudflare.enabled }}
81+
- '{{ .Values.issuerCloudflare.hostedZoneName }}'
82+
- '*.{{ .Values.issuerCloudflare.hostedZoneName }}'
83+
{{- end }}
84+
issuerRef:
85+
kind: ClusterIssuer
86+
name: adhoc-wildcard
87+
secretName: wildcard-domain-com-tls
88+
{{ end }}

‎charts/cert-cfg/v0.1.2/values.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Default values for cert-cfg.
2+
# This is a YAML-formatted file.
3+
# Declare variables to be passed into your templates.
4+
5+
nameOverride: ""
6+
fullnameOverride: ""
7+
8+
issuerEmail: "bot@adhoc.com.ar"
9+
10+
defaultWildcardIssuer: "cloudDNS"
11+
12+
issuerCloudDNS:
13+
enabled: true
14+
hostedZoneName: "dev-adhoc.com"
15+
dnsZoneName: "dev-adhoc"
16+
project: "proyecto-laboratorios"
17+
18+
issuerCloudflare:
19+
enabled: false
20+
hostedZoneName: "ingadhoc.com"
21+
email: "devops@adhoc.com.ar"
22+
apiToken: "NEW_API_TOKEN_HERE"

0 commit comments

Comments
 (0)