diff --git a/Makefile b/Makefile index 92e5afeb5..ea933f5ea 100644 --- a/Makefile +++ b/Makefile @@ -60,6 +60,7 @@ endif CERT_MANAGER_VERSION ?= v1.20.2 ISTIO_CSR_VERSION ?= v0.16.0 TRUST_MANAGER_VERSION ?= v0.20.3 +APPROVER_POLICY_VERSION ?= v0.27.0 # --- Test Versions --- @@ -488,6 +489,7 @@ update-manifests: $(HELM) $(JSONNET) $(YQ) ## Update cert-manager and istio-csr hack/update-cert-manager-manifests.sh $(CERT_MANAGER_VERSION) hack/update-istio-csr-manifests.sh $(ISTIO_CSR_VERSION) hack/update-trust-manager-manifests.sh $(TRUST_MANAGER_VERSION) + hack/update-approver-policy-manifests.sh $(APPROVER_POLICY_VERSION) .PHONY: update-vendor update-vendor: ## Update vendor directory for all modules in the workspace. diff --git a/bindata/approver-policy/resources/clusterrole_cert-manager-approver-policy.yml b/bindata/approver-policy/resources/clusterrole_cert-manager-approver-policy.yml new file mode 100644 index 000000000..4bb95fbca --- /dev/null +++ b/bindata/approver-policy/resources/clusterrole_cert-manager-approver-policy.yml @@ -0,0 +1,39 @@ +--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator + name: cert-manager-approver-policy +rules: + - apiGroups: ["policy.cert-manager.io"] + resources: ["certificaterequestpolicies"] + verbs: ["list", "watch"] + - apiGroups: ["policy.cert-manager.io"] + resources: ["certificaterequestpolicies/status"] + verbs: ["patch"] + - apiGroups: ["cert-manager.io"] + resources: ["certificaterequests"] + verbs: ["list", "watch"] + - apiGroups: ["cert-manager.io"] + resources: ["certificaterequests/status"] + verbs: ["patch"] + - apiGroups: ["cert-manager.io"] + resources: ["signers"] + verbs: ["approve"] + - apiGroups: ["rbac.authorization.k8s.io"] + resources: ["roles", "clusterroles", "rolebindings", "clusterrolebindings"] + verbs: ["list", "watch"] + - apiGroups: ["", "events.k8s.io"] + resources: ["events"] + verbs: ["create", "patch"] + - apiGroups: ["authorization.k8s.io"] + resources: ["subjectaccessreviews"] + verbs: ["create"] + - apiGroups: [""] + resources: ["namespaces"] + verbs: ["list", "watch"] diff --git a/bindata/approver-policy/resources/clusterrolebinding_cert-manager-approver-policy.yml b/bindata/approver-policy/resources/clusterrolebinding_cert-manager-approver-policy.yml new file mode 100644 index 000000000..57781c7d6 --- /dev/null +++ b/bindata/approver-policy/resources/clusterrolebinding_cert-manager-approver-policy.yml @@ -0,0 +1,19 @@ +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator + name: cert-manager-approver-policy +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-approver-policy +subjects: + - kind: ServiceAccount + name: cert-manager-approver-policy + namespace: cert-manager diff --git a/bindata/approver-policy/resources/deployment_cert-manager-approver-policy.yml b/bindata/approver-policy/resources/deployment_cert-manager-approver-policy.yml new file mode 100644 index 000000000..e6bb321ca --- /dev/null +++ b/bindata/approver-policy/resources/deployment_cert-manager-approver-policy.yml @@ -0,0 +1,70 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +spec: + replicas: 1 + selector: + matchLabels: + app: cert-manager-approver-policy + template: + metadata: + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator + spec: + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: cert-manager-approver-policy + containers: + - name: cert-manager-approver-policy + image: "quay.io/jetstack/cert-manager-approver-policy:v0.27.0" + imagePullPolicy: IfNotPresent + ports: + - name: webhook + containerPort: 10250 + - name: metrics + containerPort: 9402 + - name: healthcheck + containerPort: 6060 + readinessProbe: + httpGet: + port: 6060 + path: "/readyz" + initialDelaySeconds: 3 + periodSeconds: 7 + args: + - --log-format=text + - --log-level=1 + - --metrics-bind-address=:9402 + - --readiness-probe-bind-address=:6060 + - --webhook-host=0.0.0.0 + - --webhook-port=10250 + - --webhook-service-name=cert-manager-approver-policy + - --webhook-ca-secret-namespace=cert-manager + - --webhook-ca-secret-name=cert-manager-approver-policy-tls + resources: {} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + hostNetwork: false + dnsPolicy: ClusterFirst + nodeSelector: + kubernetes.io/os: linux diff --git a/bindata/approver-policy/resources/role_cert-manager-approver-policy.yml b/bindata/approver-policy/resources/role_cert-manager-approver-policy.yml new file mode 100644 index 000000000..afd1aaeec --- /dev/null +++ b/bindata/approver-policy/resources/role_cert-manager-approver-policy.yml @@ -0,0 +1,24 @@ +--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +rules: + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["create"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "update"] + resourceNames: ["policy.cert-manager.io"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch", "create", "update"] + resourceNames: ['cert-manager-approver-policy-tls'] diff --git a/bindata/approver-policy/resources/rolebinding_cert-manager-approver-policy.yml b/bindata/approver-policy/resources/rolebinding_cert-manager-approver-policy.yml new file mode 100644 index 000000000..fd3433f9d --- /dev/null +++ b/bindata/approver-policy/resources/rolebinding_cert-manager-approver-policy.yml @@ -0,0 +1,20 @@ +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager-approver-policy +subjects: + - kind: ServiceAccount + name: cert-manager-approver-policy + namespace: cert-manager diff --git a/bindata/approver-policy/resources/secret_cert-manager-approver-policy-tls.yml b/bindata/approver-policy/resources/secret_cert-manager-approver-policy-tls.yml new file mode 100644 index 000000000..61041631f --- /dev/null +++ b/bindata/approver-policy/resources/secret_cert-manager-approver-policy-tls.yml @@ -0,0 +1,15 @@ +--- +apiVersion: v1 +kind: Secret +metadata: + name: cert-manager-approver-policy-tls + namespace: "cert-manager" + annotations: + cert-manager.io/allow-direct-injection: "true" + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator diff --git a/bindata/approver-policy/resources/service_cert-manager-approver-policy-metrics.yml b/bindata/approver-policy/resources/service_cert-manager-approver-policy-metrics.yml new file mode 100644 index 000000000..d4c346106 --- /dev/null +++ b/bindata/approver-policy/resources/service_cert-manager-approver-policy-metrics.yml @@ -0,0 +1,22 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: cert-manager-approver-policy-metrics + namespace: "cert-manager" + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +spec: + type: ClusterIP + ports: + - port: 9402 + targetPort: 9402 + protocol: TCP + name: metrics + selector: + app: cert-manager-approver-policy diff --git a/bindata/approver-policy/resources/service_cert-manager-approver-policy.yml b/bindata/approver-policy/resources/service_cert-manager-approver-policy.yml new file mode 100644 index 000000000..9c63b0587 --- /dev/null +++ b/bindata/approver-policy/resources/service_cert-manager-approver-policy.yml @@ -0,0 +1,22 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +spec: + type: ClusterIP + ports: + - port: 443 + targetPort: 10250 + protocol: TCP + name: webhook + selector: + app: cert-manager-approver-policy diff --git a/bindata/approver-policy/resources/serviceaccount_cert-manager-approver-policy.yml b/bindata/approver-policy/resources/serviceaccount_cert-manager-approver-policy.yml new file mode 100644 index 000000000..38cab4467 --- /dev/null +++ b/bindata/approver-policy/resources/serviceaccount_cert-manager-approver-policy.yml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator diff --git a/bindata/approver-policy/resources/servicemonitor_cert-manager-approver-policy.yml b/bindata/approver-policy/resources/servicemonitor_cert-manager-approver-policy.yml new file mode 100644 index 000000000..3665cad47 --- /dev/null +++ b/bindata/approver-policy/resources/servicemonitor_cert-manager-approver-policy.yml @@ -0,0 +1,27 @@ +--- +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + prometheus: default + app.kubernetes.io/part-of: cert-manager-operator +spec: + jobLabel: cert-manager-approver-policy + selector: + matchLabels: + app: cert-manager-approver-policy + namespaceSelector: + matchNames: + - cert-manager + endpoints: + - port: metrics + path: "/metrics" + interval: 10s + scrapeTimeout: 5s diff --git a/bindata/approver-policy/resources/validatingwebhookconfiguration_cert-manager-approver-policy.yml b/bindata/approver-policy/resources/validatingwebhookconfiguration_cert-manager-approver-policy.yml new file mode 100644 index 000000000..d63adcc09 --- /dev/null +++ b/bindata/approver-policy/resources/validatingwebhookconfiguration_cert-manager-approver-policy.yml @@ -0,0 +1,35 @@ +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: cert-manager-approver-policy + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator + annotations: + cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-approver-policy-tls" +webhooks: + - name: policy.cert-manager.io + rules: + - apiGroups: + - "policy.cert-manager.io" + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + resources: + - certificaterequestpolicies + admissionReviewVersions: ["v1", "v1beta1"] + timeoutSeconds: 5 + failurePolicy: Fail + sideEffects: None + clientConfig: + service: + name: cert-manager-approver-policy + namespace: "cert-manager" + path: /validate-policy-cert-manager-io-v1alpha1-certificaterequestpolicy diff --git a/config/crd/bases/customresourcedefinition_certificaterequestpolicies.policy.cert-manager.io.yml b/config/crd/bases/customresourcedefinition_certificaterequestpolicies.policy.cert-manager.io.yml new file mode 100644 index 000000000..655e36fad --- /dev/null +++ b/config/crd/bases/customresourcedefinition_certificaterequestpolicies.policy.cert-manager.io.yml @@ -0,0 +1,1333 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: "certificaterequestpolicies.policy.cert-manager.io" + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +spec: + group: policy.cert-manager.io + names: + categories: + - cert-manager + kind: CertificateRequestPolicy + listKind: CertificateRequestPolicyList + plural: certificaterequestpolicies + shortNames: + - crp + singular: certificaterequestpolicy + scope: Cluster + versions: + - additionalPrinterColumns: + - description: CertificateRequestPolicy is ready for evaluation + jsonPath: .status.conditions[?(@.type == "Ready")].status + name: Ready + type: string + - description: Timestamp CertificateRequestPolicy was created + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + CertificateRequestPolicy is an object for describing a "policy profile" that + makes decisions on whether applicable CertificateRequests should be approved + or denied. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + CertificateRequestPolicySpec defines the desired state of + CertificateRequestPolicy. + properties: + allowed: + description: |- + Allowed defines the allowed attributes for a CertificateRequest. + A CertificateRequest can request _less_ than what is allowed, + but _not more_, i.e. a CertificateRequest can request a subset of what + is declared as allowed by the policy. + Omitted fields declare that the equivalent CertificateRequest + field _must_ be omitted or have an empty value for the request to be + permitted. + properties: + commonName: + description: CommonName defines the X.509 Common Name that may be requested. + properties: + required: + description: |- + Required marks that the related field must be provided and not be an + empty string. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute value present on request beyond what is possible + to express using value/required. + An attribute value on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + value: + description: |- + Value defines the allowed attribute value on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field must match the specified pattern. + + NOTE:`value: ""` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + type: string + type: object + dnsNames: + description: DNSNames defines the X.509 DNS SANs that may be requested. + properties: + required: + description: |- + Required controls whether the related field must have at least one value. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute values present on request beyond what is possible + to express using values/required. + ALL attribute values on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines allowed attribute values on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field can only include items contained in the allowed values. + + NOTE:`values: []` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + items: + type: string + type: array + type: object + emailAddresses: + description: EmailAddresses defines the X.509 Email SANs that may be requested. + properties: + required: + description: |- + Required controls whether the related field must have at least one value. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute values present on request beyond what is possible + to express using values/required. + ALL attribute values on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines allowed attribute values on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field can only include items contained in the allowed values. + + NOTE:`values: []` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + items: + type: string + type: array + type: object + ipAddresses: + description: IPAddresses defines the X.509 IP SANs that may be requested. + properties: + required: + description: |- + Required controls whether the related field must have at least one value. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute values present on request beyond what is possible + to express using values/required. + ALL attribute values on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines allowed attribute values on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field can only include items contained in the allowed values. + + NOTE:`values: []` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + items: + type: string + type: array + type: object + isCA: + description: |- + IsCA defines if a CertificateRequest is allowed to set the `spec.isCA` + field set to `true`. + If `true`, the `spec.isCA` field can be `true` or `false`. + If `false` or unset, the `spec.isCA` field must be `false`. + type: boolean + otherNames: + description: |- + OtherNames defines the additional SAN GeneralName otherName entries + (context tag 0) that may be present in a CertificateRequest. Each + entry pins a dotted ASN.1 OID (e.g. "1.3.6.1.4.1.311.20.2.3" for the + Microsoft User Principal Name) and constrains the allowed values for + that OID. + Any otherName entry whose OID is not listed here is denied. SAN + GeneralName types other than rfc822Name/dNSName/uniformResourceIdentifier/ + iPAddress/otherName (i.e. x400Address, directoryName, ediPartyName, + registeredID) are always denied. + An omitted or empty field denies any otherName SAN entry. + items: + description: |- + CertificateRequestPolicyAllowedOtherName declares the allowed values for a + single SAN otherName GeneralName OID. + If neither Values nor Validations are specified, the related otherName + entry must be absent from the request. + properties: + oid: + description: |- + OID is the dotted ASN.1 object identifier that the otherName entry + must carry, e.g. "1.3.6.1.4.1.311.20.2.3" for the Microsoft User + Principal Name. + type: string + required: + description: |- + Required marks that at least one otherName entry with this OID must + be present on the request. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate every otherName value with the matching OID present on the + request beyond what is possible to express using values/required. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines the allowed values for otherName entries with this + OID. Accepts wildcards "*". + If set, every otherName entry with the matching OID present in the + request must be a member of this list. + items: + type: string + type: array + required: + - oid + type: object + type: array + x-kubernetes-list-map-keys: + - oid + x-kubernetes-list-type: map + subject: + description: |- + Subject declares the X.509 Subject attributes allowed in a + CertificateRequest. An omitted field forbids any Subject attributes + from being requested. + A CertificateRequest can request a subset of the allowed X.509 Subject + attributes. + properties: + countries: + description: Countries define the X.509 Subject Countries that may be requested. + properties: + required: + description: |- + Required controls whether the related field must have at least one value. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute values present on request beyond what is possible + to express using values/required. + ALL attribute values on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines allowed attribute values on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field can only include items contained in the allowed values. + + NOTE:`values: []` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + items: + type: string + type: array + type: object + localities: + description: Localities defines the X.509 Subject Localities that may be requested. + properties: + required: + description: |- + Required controls whether the related field must have at least one value. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute values present on request beyond what is possible + to express using values/required. + ALL attribute values on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines allowed attribute values on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field can only include items contained in the allowed values. + + NOTE:`values: []` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + items: + type: string + type: array + type: object + organizationalUnits: + description: |- + OrganizationalUnits defines the X.509 Subject Organizational Units that + may be requested. + properties: + required: + description: |- + Required controls whether the related field must have at least one value. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute values present on request beyond what is possible + to express using values/required. + ALL attribute values on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines allowed attribute values on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field can only include items contained in the allowed values. + + NOTE:`values: []` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + items: + type: string + type: array + type: object + organizations: + description: |- + Organizations define the X.509 Subject Organizations that may be + requested. + properties: + required: + description: |- + Required controls whether the related field must have at least one value. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute values present on request beyond what is possible + to express using values/required. + ALL attribute values on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines allowed attribute values on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field can only include items contained in the allowed values. + + NOTE:`values: []` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + items: + type: string + type: array + type: object + otherAttributes: + description: |- + OtherAttributes defines additional Subject RDN attribute OIDs that + may be present in a CertificateRequest beyond the named fields above. + Each entry pins a dotted ASN.1 OID (e.g. "1.2.840.113549.1.9.1" for + emailAddress, "0.9.2342.19200300.100.1.25" for domainComponent) and + constrains the allowed values for that OID. + Subject RDN attributes whose OID is neither covered by one of the + named fields above nor listed here are denied. + An omitted or empty field denies any unrecognised Subject RDN + attribute. + items: + description: |- + CertificateRequestPolicyAllowedSubjectOtherAttribute declares the allowed + values for a single Subject RDN attribute OID not covered by the named + fields of CertificateRequestPolicyAllowedX509Subject. + If neither Values nor Validations are specified, the related Subject RDN + attribute must be absent from the request. + properties: + oid: + description: |- + OID is the dotted ASN.1 object identifier of the Subject RDN + attribute, e.g. "1.2.840.113549.1.9.1" for emailAddress. + type: string + required: + description: |- + Required marks that at least one Subject RDN attribute with this OID + must be present on the request. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate every Subject RDN attribute value with the matching OID + present on the request beyond what is possible to express using + values/required. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines the allowed values for Subject RDN attributes with + this OID. Accepts wildcards "*". + If set, every Subject RDN attribute with the matching OID present in + the request must be a member of this list. + items: + type: string + type: array + required: + - oid + type: object + type: array + x-kubernetes-list-map-keys: + - oid + x-kubernetes-list-type: map + postalCodes: + description: PostalCodes defines the X.509 Subject Postal Codes that may be requested. + properties: + required: + description: |- + Required controls whether the related field must have at least one value. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute values present on request beyond what is possible + to express using values/required. + ALL attribute values on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines allowed attribute values on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field can only include items contained in the allowed values. + + NOTE:`values: []` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + items: + type: string + type: array + type: object + provinces: + description: Provinces defines the X.509 Subject Provinces that may be requested. + properties: + required: + description: |- + Required controls whether the related field must have at least one value. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute values present on request beyond what is possible + to express using values/required. + ALL attribute values on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines allowed attribute values on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field can only include items contained in the allowed values. + + NOTE:`values: []` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + items: + type: string + type: array + type: object + serialNumber: + description: |- + SerialNumber defines the X.509 Subject Serial Number that may be + requested. + properties: + required: + description: |- + Required marks that the related field must be provided and not be an + empty string. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute value present on request beyond what is possible + to express using value/required. + An attribute value on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + value: + description: |- + Value defines the allowed attribute value on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field must match the specified pattern. + + NOTE:`value: ""` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + type: string + type: object + streetAddresses: + description: |- + StreetAddresses defines the X.509 Subject Street Addresses that may be + requested. + properties: + required: + description: |- + Required controls whether the related field must have at least one value. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute values present on request beyond what is possible + to express using values/required. + ALL attribute values on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines allowed attribute values on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field can only include items contained in the allowed values. + + NOTE:`values: []` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + items: + type: string + type: array + type: object + type: object + uris: + description: URIs defines the X.509 URI SANs that may be requested. + properties: + required: + description: |- + Required controls whether the related field must have at least one value. + Defaults to `false`. + type: boolean + validations: + description: |- + Validations applies rules using Common Expression Language (CEL) to + validate attribute values present on request beyond what is possible + to express using values/required. + ALL attribute values on the related CertificateRequest field must pass + ALL validations for the request to be granted by this policy. + items: + description: ValidationRule describes a validation rule expressed in CEL. + properties: + message: + description: |- + Message is the message to display when validation fails. + Message is required if the Rule contains line breaks. Note that Message + must not contain line breaks. + If unset, a fallback message is used: "failed rule: ``". + e.g. "must be a URL with the host matching spec.host" + type: string + rule: + description: |- + Rule represents the expression which will be evaluated by CEL. + ref: https://github.com/google/cel-spec + The Rule is scoped to the location of the validations in the schema. + The `self` variable in the CEL expression is bound to the scoped value. + To enable more advanced validation rules, approver-policy provides the + `cr` (map) variable to the CEL expression containing `namespace` and + `name` of the `CertificateRequest` resource. + + Example (rule for namespaced DNSNames): + ``` + rule: self.endsWith(cr.namespace + '.svc.cluster.local') + ``` + type: string + required: + - rule + type: object + type: array + x-kubernetes-list-map-keys: + - rule + x-kubernetes-list-type: map + values: + description: |- + Values defines allowed attribute values on the related CertificateRequest field. + Accepts wildcards "*". + If set, the related field can only include items contained in the allowed values. + + NOTE:`values: []` paired with `required: true` establishes a policy that + will never grant a `CertificateRequest`, but other policies may. + items: + type: string + type: array + type: object + usages: + description: |- + Usages defines the key usages that may be included in a + CertificateRequest `spec.keyUsages` field. + If set, `spec.keyUsages` in a CertificateRequest must be a subset of the + specified values. + If `[]` or unset, no `spec.keyUsages` are allowed. + items: + description: |- + KeyUsage specifies valid usage contexts for keys. + See: + https://tools.ietf.org/html/rfc5280#section-4.2.1.3 + https://tools.ietf.org/html/rfc5280#section-4.2.1.12 + + Valid KeyUsage values are as follows: + "signing", + "digital signature", + "content commitment", + "key encipherment", + "key agreement", + "data encipherment", + "cert sign", + "crl sign", + "encipher only", + "decipher only", + "any", + "server auth", + "client auth", + "code signing", + "email protection", + "s/mime", + "ipsec end system", + "ipsec tunnel", + "ipsec user", + "timestamping", + "ocsp signing", + "microsoft sgc", + "netscape sgc" + enum: + - signing + - digital signature + - content commitment + - key encipherment + - key agreement + - data encipherment + - cert sign + - crl sign + - encipher only + - decipher only + - any + - server auth + - client auth + - code signing + - email protection + - s/mime + - ipsec end system + - ipsec tunnel + - ipsec user + - timestamping + - ocsp signing + - microsoft sgc + - netscape sgc + type: string + type: array + type: object + constraints: + description: |- + Constraints define fields that _must_ be satisfied by a + CertificateRequest for the request to be allowed by this policy. + Omitted fields place no restrictions on the corresponding + attribute in a request. + properties: + maxDuration: + description: |- + MaxDuration defines the maximum duration for a certificate request. + Values are inclusive (i.e. a value of `1h` will accept a duration of + `1h`). MinDuration and MaxDuration may be the same value. + If set, a duration _must_ be requested in the CertificateRequest. + An omitted field applies no maximum constraint for duration. + type: string + minDuration: + description: |- + MinDuration defines the minimum duration for a certificate request. + Values are inclusive (i.e. a value of `1h` will accept a duration of + `1h`). MinDuration and MaxDuration may be the same value. + If set, a duration _must_ be requested in the CertificateRequest. + An omitted field applies no minimum constraint for duration. + type: string + privateKey: + description: |- + PrivateKey defines constraints on the shape of private key + allowed for a CertificateRequest. + An omitted field applies no private key shape constraints. + properties: + algorithm: + description: |- + Algorithm defines the allowed crypto algorithm for the private key + in a request. + An omitted field permits any algorithm. + enum: + - RSA + - ECDSA + - Ed25519 + type: string + maxSize: + description: |- + MaxSize defines the maximum key size for a private key. + Values are inclusive (i.e. a min value of `2048` will accept a size + of `2048`). MaxSize and MinSize may be the same value. + An omitted field applies no maximum constraint on size. + type: integer + minSize: + description: |- + MinSize defines the minimum key size for a private key. + Values are inclusive (i.e. a min value of `2048` will accept a size + of `2048`). MinSize and MaxSize may be the same value. + An omitted field applies no minimum constraint on size. + type: integer + type: object + type: object + plugins: + additionalProperties: + description: |- + CertificateRequestPolicyPluginData is configuration needed by the plugin + approver to evaluate a CertificateRequest on this policy. + properties: + values: + additionalProperties: + type: string + description: |- + Values define a set of well-known, to the plugin, key value pairs that + are required for the plugin to successfully evaluate a request based on + this policy. + type: object + type: object + description: |- + Plugins are approvers that are built into approver-policy at + compile-time. This is an advanced feature typically used to extend + approver-policy core features. This field define plugins and their + configuration that should be executed when this policy is evaluated + against a CertificateRequest. + type: object + selector: + description: |- + Selector is used for selecting over which CertificateRequests this + CertificateRequestPolicy is appropriate for and so will be used for its + approval evaluation. + properties: + issuerRef: + description: |- + IssuerRef is used to match by issuer, meaning the + CertificateRequestPolicy will only evaluate CertificateRequests + referring to matching issuers. + CertificateRequests will not be processed if the issuer does not match, + regardless of whether the requestor is bound by RBAC. + + The following value will match _all_ issuers: + ``` + issuerRef: {} + ``` + properties: + group: + description: |- + Group is the wildcard selector to match the `spec.issuerRef.group` field + on requests. + Accepts wildcards "*". + An omitted field matches all groups. + type: string + kind: + description: |- + Kind is the wildcard selector to match the `spec.issuerRef.kind` field + on requests. + Accepts wildcards "*". + An omitted field matches all kinds. + type: string + name: + description: |- + Name is a wildcard enabled selector that matches the + `spec.issuerRef.name` field of requests. + Accepts wildcards "*". + An omitted field matches all names. + type: string + type: object + namespace: + description: |- + Namespace is used to match by namespace, meaning the + CertificateRequestPolicy will only match CertificateRequests + created in matching namespaces. + If this field is omitted, resources in all namespaces are checked. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is the set of Namespace labels that select on + CertificateRequests which have been created in a namespace matching the + selector. + type: object + matchNames: + description: |- + MatchNames is the set of namespace names that select on + CertificateRequests that have been created in a matching namespace. + Accepts wildcards "*". + items: + type: string + type: array + type: object + type: object + required: + - selector + type: object + status: + description: |- + CertificateRequestPolicyStatus defines the observed state of the + CertificateRequestPolicy. + properties: + conditions: + description: |- + List of status conditions to indicate the status of the + CertificateRequestPolicy. + Known condition types are `Ready`. + items: + description: Condition contains details for one aspect of the current state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/hack/update-approver-policy-manifests.sh b/hack/update-approver-policy-manifests.sh new file mode 100755 index 000000000..daf9b746f --- /dev/null +++ b/hack/update-approver-policy-manifests.sh @@ -0,0 +1,61 @@ +#!/bin/bash + +set -e + +# cleanup handled by trap +cleanup() { + # cleanup created temp files + rm -rf _output/manifests +} +trap cleanup EXIT + +source "$(dirname "${BASH_SOURCE[0]}")/lib/init.sh" + +APPROVER_POLICY_VERSION=${1:?"missing approver-policy version. Please specify a version from https://github.com/cert-manager/approver-policy/releases"} +MANIFESTS_PATH=./_output/manifests + +mkdir -p ${MANIFESTS_PATH} + +echo "---- Downloading approver-policy manifests ${APPROVER_POLICY_VERSION} ----" + +# The approver-policy chart is published to charts.jetstack.io as cert-manager-approver-policy. +# Ref: https://cert-manager.io/docs/policy/approval/approver-policy/installation/ +./bin/helm repo add cert-manager https://charts.jetstack.io --force-update +./bin/helm template cert-manager-approver-policy cert-manager/cert-manager-approver-policy \ + -n cert-manager \ + --version "${APPROVER_POLICY_VERSION}" \ + --set app.metrics.service.servicemonitor.enabled=true \ + > ${MANIFESTS_PATH}/manifests.yaml + +echo "---- Patching manifest ----" + +# remove non-essential helm-specific labels from resource metadata and pod templates +./bin/yq e 'del(.metadata.labels."helm.sh/chart")' -i ${MANIFESTS_PATH}/manifests.yaml +./bin/yq e 'del(.spec.template.metadata.labels."helm.sh/chart")' -i ${MANIFESTS_PATH}/manifests.yaml + +# update all occurrences of standard labels using recursive descent +# this finds and updates labels wherever they appear (metadata.labels, spec.template.metadata.labels, +# spec.selector.matchLabels, etc.) +./bin/yq e '(.. | select(has("app.kubernetes.io/managed-by"))."app.kubernetes.io/managed-by") = "cert-manager-operator"' -i ${MANIFESTS_PATH}/manifests.yaml +./bin/yq e '(.. | select(has("app.kubernetes.io/name"))."app.kubernetes.io/name") = "cert-manager-approver-policy"' -i ${MANIFESTS_PATH}/manifests.yaml +./bin/yq e '(.. | select(has("app.kubernetes.io/instance"))."app.kubernetes.io/instance") = "cert-manager-approver-policy"' -i ${MANIFESTS_PATH}/manifests.yaml +./bin/yq e '(.. | select(has("app"))."app") = "cert-manager-approver-policy"' -i ${MANIFESTS_PATH}/manifests.yaml + +# add app.kubernetes.io/part-of to all labels objects (wherever app.kubernetes.io/name exists) +./bin/yq e '(.. | select(has("app.kubernetes.io/name"))."app.kubernetes.io/part-of") = "cert-manager-operator"' -i ${MANIFESTS_PATH}/manifests.yaml + +# regenerate all bindata +rm -rf bindata/approver-policy/resources +rm -f config/crd/bases/customresourcedefinition_certificaterequestpolicies.policy.cert-manager.io.yml + +# split into individual manifest files +./bin/yq e '... comments=""' -s '"_output/manifests/" + .kind + "_" + .metadata.name + ".yml" | downcase' ${MANIFESTS_PATH}/manifests.yaml + +# The CertificateRequestPolicy CRD is included in the operator OLM bundle and installed by OLM at +# operator installation time. +mv ${MANIFESTS_PATH}/customresourcedefinition_* config/crd/bases/ + +# Move remaining operand manifests to bindata — these are applied by the approver-policy-controller +# when the ApproverPolicy CR is created. +mkdir -p bindata/approver-policy/resources +mv ${MANIFESTS_PATH}/*.yml bindata/approver-policy/resources diff --git a/pkg/operator/assets/bindata.go b/pkg/operator/assets/bindata.go index 2b36f5be4..6bd9aea7d 100644 --- a/pkg/operator/assets/bindata.go +++ b/pkg/operator/assets/bindata.go @@ -1,5 +1,16 @@ // Code generated for package assets by go-bindata DO NOT EDIT. (@generated) // sources: +// bindata/approver-policy/resources/clusterrole_cert-manager-approver-policy.yml +// bindata/approver-policy/resources/clusterrolebinding_cert-manager-approver-policy.yml +// bindata/approver-policy/resources/deployment_cert-manager-approver-policy.yml +// bindata/approver-policy/resources/role_cert-manager-approver-policy.yml +// bindata/approver-policy/resources/rolebinding_cert-manager-approver-policy.yml +// bindata/approver-policy/resources/secret_cert-manager-approver-policy-tls.yml +// bindata/approver-policy/resources/service_cert-manager-approver-policy-metrics.yml +// bindata/approver-policy/resources/service_cert-manager-approver-policy.yml +// bindata/approver-policy/resources/serviceaccount_cert-manager-approver-policy.yml +// bindata/approver-policy/resources/servicemonitor_cert-manager-approver-policy.yml +// bindata/approver-policy/resources/validatingwebhookconfiguration_cert-manager-approver-policy.yml // bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yaml // bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-crb.yaml // bindata/cert-manager-deployment/cainjector/cert-manager-cainjector-deployment.yaml @@ -129,6 +140,497 @@ func (fi bindataFileInfo) Sys() interface{} { return nil } +var _approverPolicyResourcesClusterrole_certManagerApproverPolicyYml = []byte(`--- +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator + name: cert-manager-approver-policy +rules: + - apiGroups: ["policy.cert-manager.io"] + resources: ["certificaterequestpolicies"] + verbs: ["list", "watch"] + - apiGroups: ["policy.cert-manager.io"] + resources: ["certificaterequestpolicies/status"] + verbs: ["patch"] + - apiGroups: ["cert-manager.io"] + resources: ["certificaterequests"] + verbs: ["list", "watch"] + - apiGroups: ["cert-manager.io"] + resources: ["certificaterequests/status"] + verbs: ["patch"] + - apiGroups: ["cert-manager.io"] + resources: ["signers"] + verbs: ["approve"] + - apiGroups: ["rbac.authorization.k8s.io"] + resources: ["roles", "clusterroles", "rolebindings", "clusterrolebindings"] + verbs: ["list", "watch"] + - apiGroups: ["", "events.k8s.io"] + resources: ["events"] + verbs: ["create", "patch"] + - apiGroups: ["authorization.k8s.io"] + resources: ["subjectaccessreviews"] + verbs: ["create"] + - apiGroups: [""] + resources: ["namespaces"] + verbs: ["list", "watch"] +`) + +func approverPolicyResourcesClusterrole_certManagerApproverPolicyYmlBytes() ([]byte, error) { + return _approverPolicyResourcesClusterrole_certManagerApproverPolicyYml, nil +} + +func approverPolicyResourcesClusterrole_certManagerApproverPolicyYml() (*asset, error) { + bytes, err := approverPolicyResourcesClusterrole_certManagerApproverPolicyYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "approver-policy/resources/clusterrole_cert-manager-approver-policy.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _approverPolicyResourcesClusterrolebinding_certManagerApproverPolicyYml = []byte(`--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator + name: cert-manager-approver-policy +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cert-manager-approver-policy +subjects: + - kind: ServiceAccount + name: cert-manager-approver-policy + namespace: cert-manager +`) + +func approverPolicyResourcesClusterrolebinding_certManagerApproverPolicyYmlBytes() ([]byte, error) { + return _approverPolicyResourcesClusterrolebinding_certManagerApproverPolicyYml, nil +} + +func approverPolicyResourcesClusterrolebinding_certManagerApproverPolicyYml() (*asset, error) { + bytes, err := approverPolicyResourcesClusterrolebinding_certManagerApproverPolicyYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "approver-policy/resources/clusterrolebinding_cert-manager-approver-policy.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _approverPolicyResourcesDeployment_certManagerApproverPolicyYml = []byte(`--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +spec: + replicas: 1 + selector: + matchLabels: + app: cert-manager-approver-policy + template: + metadata: + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator + spec: + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: cert-manager-approver-policy + containers: + - name: cert-manager-approver-policy + image: "quay.io/jetstack/cert-manager-approver-policy:v0.27.0" + imagePullPolicy: IfNotPresent + ports: + - name: webhook + containerPort: 10250 + - name: metrics + containerPort: 9402 + - name: healthcheck + containerPort: 6060 + readinessProbe: + httpGet: + port: 6060 + path: "/readyz" + initialDelaySeconds: 3 + periodSeconds: 7 + args: + - --log-format=text + - --log-level=1 + - --metrics-bind-address=:9402 + - --readiness-probe-bind-address=:6060 + - --webhook-host=0.0.0.0 + - --webhook-port=10250 + - --webhook-service-name=cert-manager-approver-policy + - --webhook-ca-secret-namespace=cert-manager + - --webhook-ca-secret-name=cert-manager-approver-policy-tls + resources: {} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + hostNetwork: false + dnsPolicy: ClusterFirst + nodeSelector: + kubernetes.io/os: linux +`) + +func approverPolicyResourcesDeployment_certManagerApproverPolicyYmlBytes() ([]byte, error) { + return _approverPolicyResourcesDeployment_certManagerApproverPolicyYml, nil +} + +func approverPolicyResourcesDeployment_certManagerApproverPolicyYml() (*asset, error) { + bytes, err := approverPolicyResourcesDeployment_certManagerApproverPolicyYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "approver-policy/resources/deployment_cert-manager-approver-policy.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _approverPolicyResourcesRole_certManagerApproverPolicyYml = []byte(`--- +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +rules: + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["create"] + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "update"] + resourceNames: ["policy.cert-manager.io"] + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "list", "watch", "create", "update"] + resourceNames: ['cert-manager-approver-policy-tls'] +`) + +func approverPolicyResourcesRole_certManagerApproverPolicyYmlBytes() ([]byte, error) { + return _approverPolicyResourcesRole_certManagerApproverPolicyYml, nil +} + +func approverPolicyResourcesRole_certManagerApproverPolicyYml() (*asset, error) { + bytes, err := approverPolicyResourcesRole_certManagerApproverPolicyYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "approver-policy/resources/role_cert-manager-approver-policy.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _approverPolicyResourcesRolebinding_certManagerApproverPolicyYml = []byte(`--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cert-manager-approver-policy +subjects: + - kind: ServiceAccount + name: cert-manager-approver-policy + namespace: cert-manager +`) + +func approverPolicyResourcesRolebinding_certManagerApproverPolicyYmlBytes() ([]byte, error) { + return _approverPolicyResourcesRolebinding_certManagerApproverPolicyYml, nil +} + +func approverPolicyResourcesRolebinding_certManagerApproverPolicyYml() (*asset, error) { + bytes, err := approverPolicyResourcesRolebinding_certManagerApproverPolicyYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "approver-policy/resources/rolebinding_cert-manager-approver-policy.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _approverPolicyResourcesSecret_certManagerApproverPolicyTlsYml = []byte(`--- +apiVersion: v1 +kind: Secret +metadata: + name: cert-manager-approver-policy-tls + namespace: "cert-manager" + annotations: + cert-manager.io/allow-direct-injection: "true" + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +`) + +func approverPolicyResourcesSecret_certManagerApproverPolicyTlsYmlBytes() ([]byte, error) { + return _approverPolicyResourcesSecret_certManagerApproverPolicyTlsYml, nil +} + +func approverPolicyResourcesSecret_certManagerApproverPolicyTlsYml() (*asset, error) { + bytes, err := approverPolicyResourcesSecret_certManagerApproverPolicyTlsYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "approver-policy/resources/secret_cert-manager-approver-policy-tls.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _approverPolicyResourcesService_certManagerApproverPolicyMetricsYml = []byte(`--- +apiVersion: v1 +kind: Service +metadata: + name: cert-manager-approver-policy-metrics + namespace: "cert-manager" + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +spec: + type: ClusterIP + ports: + - port: 9402 + targetPort: 9402 + protocol: TCP + name: metrics + selector: + app: cert-manager-approver-policy +`) + +func approverPolicyResourcesService_certManagerApproverPolicyMetricsYmlBytes() ([]byte, error) { + return _approverPolicyResourcesService_certManagerApproverPolicyMetricsYml, nil +} + +func approverPolicyResourcesService_certManagerApproverPolicyMetricsYml() (*asset, error) { + bytes, err := approverPolicyResourcesService_certManagerApproverPolicyMetricsYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "approver-policy/resources/service_cert-manager-approver-policy-metrics.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _approverPolicyResourcesService_certManagerApproverPolicyYml = []byte(`--- +apiVersion: v1 +kind: Service +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +spec: + type: ClusterIP + ports: + - port: 443 + targetPort: 10250 + protocol: TCP + name: webhook + selector: + app: cert-manager-approver-policy +`) + +func approverPolicyResourcesService_certManagerApproverPolicyYmlBytes() ([]byte, error) { + return _approverPolicyResourcesService_certManagerApproverPolicyYml, nil +} + +func approverPolicyResourcesService_certManagerApproverPolicyYml() (*asset, error) { + bytes, err := approverPolicyResourcesService_certManagerApproverPolicyYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "approver-policy/resources/service_cert-manager-approver-policy.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _approverPolicyResourcesServiceaccount_certManagerApproverPolicyYml = []byte(`apiVersion: v1 +kind: ServiceAccount +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator +`) + +func approverPolicyResourcesServiceaccount_certManagerApproverPolicyYmlBytes() ([]byte, error) { + return _approverPolicyResourcesServiceaccount_certManagerApproverPolicyYml, nil +} + +func approverPolicyResourcesServiceaccount_certManagerApproverPolicyYml() (*asset, error) { + bytes, err := approverPolicyResourcesServiceaccount_certManagerApproverPolicyYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "approver-policy/resources/serviceaccount_cert-manager-approver-policy.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _approverPolicyResourcesServicemonitor_certManagerApproverPolicyYml = []byte(`--- +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: cert-manager-approver-policy + namespace: "cert-manager" + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + prometheus: default + app.kubernetes.io/part-of: cert-manager-operator +spec: + jobLabel: cert-manager-approver-policy + selector: + matchLabels: + app: cert-manager-approver-policy + namespaceSelector: + matchNames: + - cert-manager + endpoints: + - port: metrics + path: "/metrics" + interval: 10s + scrapeTimeout: 5s +`) + +func approverPolicyResourcesServicemonitor_certManagerApproverPolicyYmlBytes() ([]byte, error) { + return _approverPolicyResourcesServicemonitor_certManagerApproverPolicyYml, nil +} + +func approverPolicyResourcesServicemonitor_certManagerApproverPolicyYml() (*asset, error) { + bytes, err := approverPolicyResourcesServicemonitor_certManagerApproverPolicyYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "approver-policy/resources/servicemonitor_cert-manager-approver-policy.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + +var _approverPolicyResourcesValidatingwebhookconfiguration_certManagerApproverPolicyYml = []byte(`--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: cert-manager-approver-policy + labels: + app: cert-manager-approver-policy + app.kubernetes.io/name: cert-manager-approver-policy + app.kubernetes.io/instance: cert-manager-approver-policy + app.kubernetes.io/version: "v0.27.0" + app.kubernetes.io/managed-by: cert-manager-operator + app.kubernetes.io/part-of: cert-manager-operator + annotations: + cert-manager.io/inject-ca-from-secret: "cert-manager/cert-manager-approver-policy-tls" +webhooks: + - name: policy.cert-manager.io + rules: + - apiGroups: + - "policy.cert-manager.io" + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + resources: + - certificaterequestpolicies + admissionReviewVersions: ["v1", "v1beta1"] + timeoutSeconds: 5 + failurePolicy: Fail + sideEffects: None + clientConfig: + service: + name: cert-manager-approver-policy + namespace: "cert-manager" + path: /validate-policy-cert-manager-io-v1alpha1-certificaterequestpolicy +`) + +func approverPolicyResourcesValidatingwebhookconfiguration_certManagerApproverPolicyYmlBytes() ([]byte, error) { + return _approverPolicyResourcesValidatingwebhookconfiguration_certManagerApproverPolicyYml, nil +} + +func approverPolicyResourcesValidatingwebhookconfiguration_certManagerApproverPolicyYml() (*asset, error) { + bytes, err := approverPolicyResourcesValidatingwebhookconfiguration_certManagerApproverPolicyYmlBytes() + if err != nil { + return nil, err + } + + info := bindataFileInfo{name: "approver-policy/resources/validatingwebhookconfiguration_cert-manager-approver-policy.yml", size: 0, mode: os.FileMode(0), modTime: time.Unix(0, 0)} + a := &asset{bytes: bytes, info: info} + return a, nil +} + var _certManagerDeploymentCainjectorCertManagerCainjectorCrYaml = []byte(`apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: @@ -3724,6 +4226,17 @@ func AssetNames() []string { // _bindata is a table, holding each asset generator, mapped to its name. var _bindata = map[string]func() (*asset, error){ + "approver-policy/resources/clusterrole_cert-manager-approver-policy.yml": approverPolicyResourcesClusterrole_certManagerApproverPolicyYml, + "approver-policy/resources/clusterrolebinding_cert-manager-approver-policy.yml": approverPolicyResourcesClusterrolebinding_certManagerApproverPolicyYml, + "approver-policy/resources/deployment_cert-manager-approver-policy.yml": approverPolicyResourcesDeployment_certManagerApproverPolicyYml, + "approver-policy/resources/role_cert-manager-approver-policy.yml": approverPolicyResourcesRole_certManagerApproverPolicyYml, + "approver-policy/resources/rolebinding_cert-manager-approver-policy.yml": approverPolicyResourcesRolebinding_certManagerApproverPolicyYml, + "approver-policy/resources/secret_cert-manager-approver-policy-tls.yml": approverPolicyResourcesSecret_certManagerApproverPolicyTlsYml, + "approver-policy/resources/service_cert-manager-approver-policy-metrics.yml": approverPolicyResourcesService_certManagerApproverPolicyMetricsYml, + "approver-policy/resources/service_cert-manager-approver-policy.yml": approverPolicyResourcesService_certManagerApproverPolicyYml, + "approver-policy/resources/serviceaccount_cert-manager-approver-policy.yml": approverPolicyResourcesServiceaccount_certManagerApproverPolicyYml, + "approver-policy/resources/servicemonitor_cert-manager-approver-policy.yml": approverPolicyResourcesServicemonitor_certManagerApproverPolicyYml, + "approver-policy/resources/validatingwebhookconfiguration_cert-manager-approver-policy.yml": approverPolicyResourcesValidatingwebhookconfiguration_certManagerApproverPolicyYml, "cert-manager-deployment/cainjector/cert-manager-cainjector-cr.yaml": certManagerDeploymentCainjectorCertManagerCainjectorCrYaml, "cert-manager-deployment/cainjector/cert-manager-cainjector-crb.yaml": certManagerDeploymentCainjectorCertManagerCainjectorCrbYaml, "cert-manager-deployment/cainjector/cert-manager-cainjector-deployment.yaml": certManagerDeploymentCainjectorCertManagerCainjectorDeploymentYaml, @@ -3845,6 +4358,21 @@ type bintree struct { } var _bintree = &bintree{nil, map[string]*bintree{ + "approver-policy": {nil, map[string]*bintree{ + "resources": {nil, map[string]*bintree{ + "clusterrole_cert-manager-approver-policy.yml": {approverPolicyResourcesClusterrole_certManagerApproverPolicyYml, map[string]*bintree{}}, + "clusterrolebinding_cert-manager-approver-policy.yml": {approverPolicyResourcesClusterrolebinding_certManagerApproverPolicyYml, map[string]*bintree{}}, + "deployment_cert-manager-approver-policy.yml": {approverPolicyResourcesDeployment_certManagerApproverPolicyYml, map[string]*bintree{}}, + "role_cert-manager-approver-policy.yml": {approverPolicyResourcesRole_certManagerApproverPolicyYml, map[string]*bintree{}}, + "rolebinding_cert-manager-approver-policy.yml": {approverPolicyResourcesRolebinding_certManagerApproverPolicyYml, map[string]*bintree{}}, + "secret_cert-manager-approver-policy-tls.yml": {approverPolicyResourcesSecret_certManagerApproverPolicyTlsYml, map[string]*bintree{}}, + "service_cert-manager-approver-policy-metrics.yml": {approverPolicyResourcesService_certManagerApproverPolicyMetricsYml, map[string]*bintree{}}, + "service_cert-manager-approver-policy.yml": {approverPolicyResourcesService_certManagerApproverPolicyYml, map[string]*bintree{}}, + "serviceaccount_cert-manager-approver-policy.yml": {approverPolicyResourcesServiceaccount_certManagerApproverPolicyYml, map[string]*bintree{}}, + "servicemonitor_cert-manager-approver-policy.yml": {approverPolicyResourcesServicemonitor_certManagerApproverPolicyYml, map[string]*bintree{}}, + "validatingwebhookconfiguration_cert-manager-approver-policy.yml": {approverPolicyResourcesValidatingwebhookconfiguration_certManagerApproverPolicyYml, map[string]*bintree{}}, + }}, + }}, "cert-manager-deployment": {nil, map[string]*bintree{ "cainjector": {nil, map[string]*bintree{ "cert-manager-cainjector-cr.yaml": {certManagerDeploymentCainjectorCertManagerCainjectorCrYaml, map[string]*bintree{}},