cluster/kube/lib/cert-manager.libsonnet

# Deploy a per-cluster cert-manager

local kube = import "../../../kube/kube.libsonnet";

{
    local cm = self,
    Environment: {
        local env = self,
        local cfg = env.cfg,

        cfg:: {
            namespace: "cert-manager",
            leaderElectionNamespace: "kube-system",
            enableWebhook: false,
            version: "v1.5.0",
        },

        metadata:: {
            namespace: cfg.namespace,
        },

        namespace: kube.Namespace(cfg.namespace) {
            metadata+: {
                labels: { "certmanager.k8s.io/disable-validation": "true" },
            },
        },
        sas: {
            cainjector: kube.ServiceAccount("cert-manager-cainjector") {
                metadata+: env.metadata,
            },
            webhook: kube.ServiceAccount("cert-manager-webhook") {
                metadata+: env.metadata,
            },
            certManager: kube.ServiceAccount("cert-manager") {
                metadata+: env.metadata,
            },
        },

        crds: (std.native("parseYaml"))(importstr "./cert-manager.crds.yaml"),

        rbac: (import "./cert-manager-rbac.libsonnet") {
            env:: env,
            sas:: env.sas,
        },

        deployments: {
            cainjector: kube.Deployment("cert-manager-cainjector") {
                metadata+: env.metadata,
                spec+: {
                    replicas: 1,
                    template+: {
                        spec+: {
                            serviceAccountName: env.sas.cainjector.metadata.name,
                            containers_: {
                                cainjector: kube.Container("cainjector") {
                                    image: "quay.io/jetstack/cert-manager-cainjector:" + cfg.version,
                                    args: [
                                        "--v=2",
                                        "--leader-election-namespace=%s" % [cfg.leaderElectionNamespace],
                                    ],
                                    env_: {
                                        POD_NAMESPACE: kube.FieldRef("metadata.namespace"),
                                    },
                                },
                            },
                        },
                    },
                },
            },
            webhook: kube.Deployment("cert-manager-webhook") {
                metadata+: env.metadata {
                    labels: {
                        app: "webhook",
                    },
                },
                spec+: {
                    replicas: if cfg.enableWebhook then 1 else 0,
                    template+: {
                        spec+: {
                            serviceAccountName: env.sas.webhook.metadata.name,
                            containers_: {
                                webhook: kube.Container("webhook") {
                                    image: "quay.io/jetstack/cert-manager-webhook:" + cfg.version,
                                    args: [
                                        "--v=2",
                                        "--secure-port=10250",
                                        "--dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)",
                                        "--dynamic-serving-ca-secret-name=cert-manager-webhook-ca",
                                        "--dynamic-serving-dns-names=cert-manager-webhook,cert-manager-webhook.cert-manager,cert-manager-webhook.cert-manager.svc",
                                    ],
                                    env_: {
                                        POD_NAMESPACE: kube.FieldRef("metadata.namespace"),
                                    },
                                    ports_: {
                                        https: { containerPort: 10250 },
                                    },
                                },
                            },
                        },
                    },
                },
            },
            certmanager: kube.Deployment("cert-manager") {
                metadata+: env.metadata,
                spec+: {
                    replicas: 1,
                    template+: {
                        spec+: {
                            serviceAccountName: env.sas.certManager.metadata.name,
                            dnsPolicy: "None",
                            dnsConfig: {
                               nameservers: ["8.8.8.8"],
                            },
                            # TODO: liveness probe, readiness probe
                            containers_: {
                                webhook: kube.Container("cert-manager") {
                                    image: "quay.io/jetstack/cert-manager-controller:" + cfg.version,
                                    args: [
                                        "--v=2",
                                        "--cluster-resource-namespace=%s" % [cfg.namespace],
                                        "--leader-election-namespace=%s" % [cfg.leaderElectionNamespace],
                                    ],
                                    env_: {
                                        POD_NAMESPACE: kube.FieldRef("metadata.namespace"),
                                    },
                                    ports_: {
                                        metrics: { containerPort: 9402 },
                                    },
                                    resources: {
                                        requests: {
                                            cpu: "10m",
                                            memory: "32Mi",
                                        },
                                    },
                                },
                            },
                        },
                    },
                },
            },
        },
        services: {
            certmanager: kube.Service("cert-manager") {
                metadata+: env.metadata,
                target:: env.deployments.certmanager,
                spec+: {
                    type: "ClusterIP",
                    ports: [
                        { name: "tcp-prometheus-servicemonitor", port: 9402, targetPort: 9402, protocol: "TCP"},
                    ],
                },
            },
            webhook: kube.Service("cert-manager-webhook") {
                metadata+: env.metadata,
                target:: env.deployments.webhook,
                spec+: {
                    type: "ClusterIP",
                    ports: [
                        { name: "https", port: 443, targetPort: 10250, protocol: "TCP" },
                    ],
                },
            },
        },
        apiservice:  if cfg.enableWebhook then kube._Object("apiregistration.k8s.io/v1beta1", "APIService", "v1beta1.admission.certmanager.k8s.io") {
            spec+: {
                version: "v1beta1",
                group: "admission.certmanager.k8s.io",
                groupPriorityMinimum: 1000,
                versionPriority: 15,
                service: {
                    name: env.service.metadata.name,
                    namespace: cfg.namespace,
                },
            },
        },

        webhooks: if cfg.enableWebhook then {
            mutating: kube._Object("admissionregistration.k8s.io/v1", "MutatingWebhookConfiguration", "cert-manager-webhook") {
                metadata+: {
                    annotations: {
                        "cert-manager.io/inject-ca-from-secret": "%s/cert-manager-webhook-ca" % [cfg.namespace],
                    },
                },
                webhooks: [
                    {
                        name: "webhook.cert-manager.io",
                        rules: [
                            {
                                apiGRoups: ["cert-manager.io", "acme.cert-manager.io"],
                                apiVersions: ["v1"],
                                operations: ["CREATE", "UPDATE"],
                                resources: ["*/*"],
                            }
                        ],
                        admissionReviewVersions: ["v1", "v1beta1"],
                        matchPolicy: "Equivalent",
                        timeoutSeconds: 10,
                        failurePolicy: "Fail",
                        sideEffects: "None",
                        clientConfig: {
                            service: {
                                name: "cert-manager-webhook",
                                namespace: cfg.namespace,
                                path: "/mutate",
                            },
                        },
                    }
                ],
            },
            validating: kube._Object("admissionregistration.k8s.io/v1", "ValidatingWebhookConfiguration", "cert-manager-webhook") {
                metadata+: {
                    annotations: {
                        "cert-manager.io/inject-ca-from-secret": "%s/cert-manager-webhook-ca" % [cfg.namespace],
                    },
                },
                // Copied from official yaml
                webhooks: [
                    {
                        name: "webhook.cert-manager.io",
                        namespaceSelector: {
                            matchExpressions: [
                                {
                                    key: "cert-manager.io/disable-validation",
                                    operator: "NotIn",
                                    values: ["true"],
                                },
                                {
                                    key: "name",
                                    operator: "NotIn",
                                    values: ["cert-manager"],
                                },
                            ],
                        },
                        rules: [
                            {
                                apiGroups: ["cert-manager.io", "acme.cert-manager.io"],
                                apiVersions: ["v1"],
                                operations: ["CREATE", "UPDATE"],
                                resources: ["*/*"],
                            }
                        ],
                        admissionReviewVersions: ["v1", "v1beta1"],
                        matchPolicy: "Equivalent",
                        timeoutSeconds: 10,
                        failurePolicy: "Fail",
                        sideEffects: "None",
                        clientConfig: {
                            service: {
                                name: "cert-manager-webhook",
                                namespace: cfg.namespace,
                                path: "/validate",
                            },
                        },
                    },
                ],
            },
        },
    },
}