add helm charts
This commit is contained in:
Ybehrooz
@@ -0,0 +1,248 @@
|
||||
{{ $tls := fromYaml ( include "aws-load-balancer-controller.webhookCerts" . ) }}
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: MutatingWebhookConfiguration
|
||||
metadata:
|
||||
{{- if $.Values.enableCertManager }}
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert
|
||||
{{- end }}
|
||||
name: {{ include "aws-load-balancer-controller.namePrefix" . }}-webhook
|
||||
labels:
|
||||
{{- include "aws-load-balancer-controller.labels" . | nindent 4 }}
|
||||
webhooks:
|
||||
- clientConfig:
|
||||
{{ if not $.Values.enableCertManager -}}
|
||||
caBundle: {{ $tls.caCert }}
|
||||
{{ end }}
|
||||
service:
|
||||
name: {{ template "aws-load-balancer-controller.webhookService" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
path: /mutate-v1-pod
|
||||
failurePolicy: Fail
|
||||
name: mpod.elbv2.k8s.aws
|
||||
admissionReviewVersions:
|
||||
- v1beta1
|
||||
namespaceSelector:
|
||||
matchExpressions:
|
||||
{{ if .Values.webhookNamespaceSelectors }}
|
||||
{{ toYaml .Values.webhookNamespaceSelectors | nindent 4 }}
|
||||
{{ else }}
|
||||
- key: elbv2.k8s.aws/pod-readiness-gate-inject
|
||||
operator: In
|
||||
values:
|
||||
- enabled
|
||||
{{ end }}
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/name
|
||||
operator: NotIn
|
||||
values:
|
||||
- {{ include "aws-load-balancer-controller.name" . }}
|
||||
{{- if .Values.objectSelector.matchExpressions }}
|
||||
{{- toYaml .Values.objectSelector.matchExpressions | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.objectSelector.matchLabels }}
|
||||
matchLabels:
|
||||
{{- toYaml .Values.objectSelector.matchLabels | nindent 6 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
resources:
|
||||
- pods
|
||||
sideEffects: None
|
||||
{{- if .Values.enableServiceMutatorWebhook }}
|
||||
- clientConfig:
|
||||
{{ if not $.Values.enableCertManager -}}
|
||||
caBundle: {{ $tls.caCert }}
|
||||
{{ end }}
|
||||
service:
|
||||
name: {{ template "aws-load-balancer-controller.webhookService" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
path: /mutate-v1-service
|
||||
failurePolicy: {{ .Values.serviceMutatorWebhookConfig.failurePolicy }}
|
||||
name: mservice.elbv2.k8s.aws
|
||||
admissionReviewVersions:
|
||||
- v1beta1
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/name
|
||||
operator: NotIn
|
||||
values:
|
||||
- {{ include "aws-load-balancer-controller.name" . }}
|
||||
{{- if .Values.serviceMutatorWebhookConfig.objectSelector.matchExpressions }}
|
||||
{{- toYaml .Values.serviceMutatorWebhookConfig.objectSelector.matchExpressions | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.serviceMutatorWebhookConfig.objectSelector.matchLabels }}
|
||||
matchLabels:
|
||||
{{- toYaml .Values.serviceMutatorWebhookConfig.objectSelector.matchLabels | nindent 6 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
{{- toYaml .Values.serviceMutatorWebhookConfig.operations | nindent 4 }}
|
||||
resources:
|
||||
- services
|
||||
sideEffects: None
|
||||
{{- end }}
|
||||
- clientConfig:
|
||||
{{ if not $.Values.enableCertManager -}}
|
||||
caBundle: {{ $tls.caCert }}
|
||||
{{ end }}
|
||||
service:
|
||||
name: {{ template "aws-load-balancer-controller.webhookService" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
path: /mutate-elbv2-k8s-aws-v1beta1-targetgroupbinding
|
||||
failurePolicy: Fail
|
||||
name: mtargetgroupbinding.elbv2.k8s.aws
|
||||
admissionReviewVersions:
|
||||
- v1beta1
|
||||
rules:
|
||||
- apiGroups:
|
||||
- elbv2.k8s.aws
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- targetgroupbindings
|
||||
sideEffects: None
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
{{- if $.Values.enableCertManager }}
|
||||
annotations:
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert
|
||||
{{- end }}
|
||||
name: {{ include "aws-load-balancer-controller.namePrefix" . }}-webhook
|
||||
labels:
|
||||
{{- include "aws-load-balancer-controller.labels" . | nindent 4 }}
|
||||
webhooks:
|
||||
- clientConfig:
|
||||
{{ if not $.Values.enableCertManager -}}
|
||||
caBundle: {{ $tls.caCert }}
|
||||
{{ end }}
|
||||
service:
|
||||
name: {{ template "aws-load-balancer-controller.webhookService" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
path: /validate-elbv2-k8s-aws-v1beta1-ingressclassparams
|
||||
failurePolicy: Fail
|
||||
name: vingressclassparams.elbv2.k8s.aws
|
||||
admissionReviewVersions:
|
||||
- v1beta1
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/name
|
||||
operator: NotIn
|
||||
values:
|
||||
- {{ include "aws-load-balancer-controller.name" . }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- elbv2.k8s.aws
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingressclassparams
|
||||
sideEffects: None
|
||||
- clientConfig:
|
||||
{{ if not $.Values.enableCertManager -}}
|
||||
caBundle: {{ $tls.caCert }}
|
||||
{{ end }}
|
||||
service:
|
||||
name: {{ template "aws-load-balancer-controller.webhookService" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
path: /validate-elbv2-k8s-aws-v1beta1-targetgroupbinding
|
||||
failurePolicy: Fail
|
||||
name: vtargetgroupbinding.elbv2.k8s.aws
|
||||
admissionReviewVersions:
|
||||
- v1beta1
|
||||
rules:
|
||||
- apiGroups:
|
||||
- elbv2.k8s.aws
|
||||
apiVersions:
|
||||
- v1beta1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- targetgroupbindings
|
||||
sideEffects: None
|
||||
- clientConfig:
|
||||
{{ if not $.Values.enableCertManager -}}
|
||||
caBundle: {{ $tls.caCert }}
|
||||
{{ end }}
|
||||
service:
|
||||
name: {{ template "aws-load-balancer-controller.webhookService" . }}
|
||||
namespace: {{ $.Release.Namespace }}
|
||||
path: /validate-networking-v1-ingress
|
||||
failurePolicy: Fail
|
||||
matchPolicy: Equivalent
|
||||
name: vingress.elbv2.k8s.aws
|
||||
admissionReviewVersions:
|
||||
- v1beta1
|
||||
rules:
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingresses
|
||||
sideEffects: None
|
||||
---
|
||||
{{- if not $.Values.enableCertManager }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "aws-load-balancer-controller.webhookCertSecret" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{ include "aws-load-balancer-controller.labels" . | indent 4 }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: {{ $tls.caCert }}
|
||||
tls.crt: {{ $tls.clientCert }}
|
||||
tls.key: {{ $tls.clientKey }}
|
||||
{{- else }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ template "aws-load-balancer-controller.namePrefix" . }}-serving-cert
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{ include "aws-load-balancer-controller.labels" . | indent 4 }}
|
||||
spec:
|
||||
dnsNames:
|
||||
- {{ template "aws-load-balancer-controller.webhookService" . }}.{{ .Release.Namespace }}.svc
|
||||
- {{ template "aws-load-balancer-controller.webhookService" . }}.{{ .Release.Namespace }}.svc.{{ .Values.cluster.dnsDomain }}
|
||||
issuerRef:
|
||||
kind: Issuer
|
||||
name: {{ template "aws-load-balancer-controller.namePrefix" . }}-selfsigned-issuer
|
||||
secretName: {{ template "aws-load-balancer-controller.webhookCertSecret" . }}
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ template "aws-load-balancer-controller.namePrefix" . }}-selfsigned-issuer
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{ include "aws-load-balancer-controller.labels" . | indent 4 }}
|
||||
spec:
|
||||
selfSigned: {}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user