-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathdeploy.yml
183 lines (183 loc) · 6.06 KB
/
deploy.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: secretclaims.dolansoft.org
spec:
group: dolansoft.org
versions:
- name: v1beta1
served: true
storage: true
schema:
openAPIV3Schema:
type: object
properties:
spec:
type: object
properties:
tokenFields:
type: array
description: These fields are filled with a randomly generated 128 bit token
items:
type: string
customTokenFields:
type: object
additionalProperties:
type: object
properties:
length:
type: number
description: |
Length of the token which should be generated. This is the number of bytes
for the base64, hex and raw encodings and the number of characters for the
characterset encoding. It is ignored for the uuid encoding.
encoding:
type: string
enum: [ base64, base64url, hex, upperhex, characterset, raw, uuid ]
description: |
Encoding to use
characterSet:
type: string
description: |
All characters (unicode code points) in this string can be used to
make up the token. Only used in the characterset encoding.
prefix:
type: string
description: |
Prefix to put before the generated token.
suffix:
type: string
description: |
Suffix to put after the generated token.
required: ["encoding"]
fixedFields:
type: object
description: These fields are copied as-is into the secret
additionalProperties:
type: string
x509:
type: object
description: Claim for an X.509 certificate
properties:
caSecretName:
description: |
Name of the secret storing the CA. Must be in the same namespace as this
claim. If unset and isCA is true the certificate is a root CA.
type: string
isCA:
description: Determines if the certificate is a CA. Defaults to false.
type: boolean
commonName:
description: Specifies a custom common name. Defaults to the claim name if unset.
type: string
rotateEvery:
description: |
Determines the validity period of the certificate. If unset the certificate
is eternally valid. If the certificate is nearing expiration it is reissued
automatically.
type: string
serviceNames:
description: |
List of service names to be included in the subject alternative names of the
certificate. Services need to be in the same namespace as the claim.
Specifying services here is preferred over specifying them in extraNames
as all valid forms (with/without namespace and cluster domain) are
automatically included and the claim is namespace-independant.
type: array
items:
type: string
extraNames:
type: array
description: Extra DNS names to be included in the subject alternative names.
items:
type: string
legacySEC1PrivateKey:
description: If set to true, the private key is generated in the legacy SEC1 encoding.
type: boolean
scope: Namespaced
names:
plural: secretclaims
singular: secretclaim
kind: SecretClaim
shortNames:
- secc
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: k8s-generic-secrets
namespace: kube-system
rules:
- apiGroups:
- ""
resources:
- "secrets"
verbs:
- get
- list
- watch
- create
- patch
- update
- apiGroups:
- "dolansoft.org"
resources:
- secretclaims
verbs:
- get
- list
- watch
- apiGroups:
- events.k8s.io
resources:
- events
verbs:
- create
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: k8s-generic-secrets
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: k8s-generic-secrets
namespace: kube-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: k8s-generic-secrets
subjects:
- kind: ServiceAccount
namespace: kube-system
name: k8s-generic-secrets
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: k8s-generic-secrets
namespace: kube-system
spec:
selector:
matchLabels:
app: k8s-generic-secrets
template:
metadata:
labels:
app: k8s-generic-secrets
spec:
priorityClassName: system-cluster-critical
enableServiceLinks: false
serviceAccountName: k8s-generic-secrets
containers:
- name: k8s-generic-secrets
image: docker.dolansoft.org/dolansoft/k8s-generic-secrets:58e64ff26371b7104c8d98051df70f2162febd05
resources:
requests:
memory: "64Mi"
cpu: "10m"
limits:
memory: "64Mi"
cpu: "1"