Merge pull request #110 from vultr/fix-helm

added rbac secret-reader to helm
vultr · Jul 10, 2023 · b9a404b · b9a404b
2 parents a61133c + 5b142fe
commit b9a404b
Show file tree

Hide file tree

Showing 3 changed files with 66 additions and 0 deletions.
diff --git a/deploy/cert-manager-webhook-vultr/templates/issuers.yaml b/deploy/cert-manager-webhook-vultr/templates/issuers.yaml
@@ -0,0 +1,39 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: vultr-letsencrypt-staging
+spec:
+  acme:
+    email: {{ .Values.certManager.email }}
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: vultr-letsencrypt-staging
+    solvers:
+      - dns01:
+          webhook:
+            groupName: acme.vultr.com
+            solverName: vultr
+            config:
+              apiKeySecretRef:
+                key: apiKey
+                name: {{ .Values.secretName }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: vultr-letsencrypt-prod
+spec:
+  acme:
+    email: {{ .Values.certManager.email }}
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: vultr-letsencrypt-prod
+    solvers:
+      - dns01:
+          webhook:
+            groupName: acme.vultr.com
+            solverName: vultr
+            config:
+              apiKeySecretRef:
+                key: apiKey
+                name: {{ .Values.secretName }}
diff --git a/deploy/cert-manager-webhook-vultr/templates/rbac.yaml b/deploy/cert-manager-webhook-vultr/templates/rbac.yaml
@@ -126,3 +126,28 @@ subjects:
     kind: ServiceAccount
     name: {{ include "cert-manager-webhook-vultr.fullname" . }}
     namespace: {{ .Release.Namespace | quote }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "cert-manager-webhook-vultr.fullname" . }}:secret-reader
+  namespace: {{ .Release.Namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames: [{{ .Values.secretName }}]
+    verbs: ["get", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "cert-manager-webhook-vultr.fullname" . }}:secret-reader
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "cert-manager-webhook-vultr.fullname" . }}:secret-reader
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: {{ .Values.certManager.serviceAccountName }}
diff --git a/deploy/cert-manager-webhook-vultr/values.yaml b/deploy/cert-manager-webhook-vultr/values.yaml
@@ -7,10 +7,12 @@
 # This group name should be **unique**, hence using your own company's domain
 # here is recommended.
 groupName: acme.vultr.com
+secretName: vultr-credentials
 
 certManager:
   namespace: cert-manager
   serviceAccountName: cert-manager
+  email: [email protected]
 
 image:
   repository: vultr/cert-manager-webhook-vultr