pomerium Changeset - 723ad82340d1

Changeset - 723ad82340d1

Parent rev.

Child rev.

[Not reviewed]

default

1 2 1

drewp@bigasterisk.com - 22 months ago 2022-12-13 07:19:28
drewp@bigasterisk.com

code versions

3 files changed with 7 insertions and 9 deletions:

00-defs/49-cert-manager-crd.yaml

04-gen-secrets-job.yaml

20-kube/20-pom-deploy.yaml

0 comments (0 inline, 0 general)

00-defs/49-cert-manager-crd.yaml

➞

Show inline comments

 # Source: cert-manager/templates/crd-templates.yaml
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: certificaterequests.cert-manager.io
   labels:
     app: 'cert-manager'
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
     # Generated labels
     app.kubernetes.io/version: "v1.9.1"
 spec:
   group: cert-manager.io
   names:
     kind: CertificateRequest
     listKind: CertificateRequestList
     plural: certificaterequests
     shortNames:
       - cr
       - crs
     singular: certificaterequest
     categories:
       - cert-manager
   scope: Namespaced
   versions:
     - name: v1
       subresources:
         status: {}
       additionalPrinterColumns:
         - jsonPath: .status.conditions[?(@.type=="Approved")].status
           name: Approved
           type: string
         - jsonPath: .status.conditions[?(@.type=="Denied")].status
           name: Denied
           type: string
         - jsonPath: .status.conditions[?(@.type=="Ready")].status
           name: Ready
           type: string
         - jsonPath: .spec.issuerRef.name
           name: Issuer
           type: string
         - jsonPath: .spec.username
           name: Requestor
           type: string
         - jsonPath: .status.conditions[?(@.type=="Ready")].message
           name: Status
           priority: 1
           type: string
         - jsonPath: .metadata.creationTimestamp
           description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
           name: Age
           type: date
       schema:
         openAPIV3Schema:
           description: "A CertificateRequest is used to request a signed certificate from one of the configured issuers. \n All fields within the CertificateRequest's `spec` are immutable after creation. A CertificateRequest will either succeed or fail, as denoted by its `status.state` field. \n A CertificateRequest is a one-shot resource, meaning it represents a single point in time request for a certificate and cannot be re-used."
           type: object
           required:
             - spec
           properties:
@@ @@ -163,97 +161,97 @@ spec: @@
                   type: array
                   items:
                     description: CertificateRequestCondition contains condition information for a CertificateRequest.
                     type: object
                     required:
                       - status
                       - type
                     properties:
                       lastTransitionTime:
                         description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
                         type: string
                         format: date-time
                       message:
                         description: Message is a human readable description of the details of the last transition, complementing reason.
                         type: string
                       reason:
                         description: Reason is a brief machine readable explanation for the condition's last transition.
                         type: string
                       status:
                         description: Status of the condition, one of (`True`, `False`, `Unknown`).
                         type: string
                         enum:
                           - "True"
                           - "False"
                           - Unknown
                       type:
                         description: Type of the condition, known values are (`Ready`, `InvalidRequest`, `Approved`, `Denied`).
                         type: string
                   x-kubernetes-list-map-keys:
                     - type
                   x-kubernetes-list-type: map
                 failureTime:
                   description: FailureTime stores the time that this CertificateRequest failed. This is used to influence garbage collection and back-off.
                   type: string
                   format: date-time
       served: true
       storage: true
 ---
 # Source: cert-manager/templates/crd-templates.yaml
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: certificates.cert-manager.io
   labels:
     app: 'cert-manager'
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
     # Generated labels
-    app.kubernetes.io/version: "v1.9.1"
+    app.kubernetes.io/version: "v1.10.1"
 spec:
   group: cert-manager.io
   names:
     kind: Certificate
     listKind: CertificateList
     plural: certificates
     shortNames:
       - cert
       - certs
     singular: certificate
     categories:
       - cert-manager
   scope: Namespaced
   versions:
     - name: v1
       subresources:
         status: {}
       additionalPrinterColumns:
         - jsonPath: .status.conditions[?(@.type=="Ready")].status
           name: Ready
           type: string
         - jsonPath: .spec.secretName
           name: Secret
           type: string
         - jsonPath: .spec.issuerRef.name
           name: Issuer
           priority: 1
           type: string
         - jsonPath: .status.conditions[?(@.type=="Ready")].message
           name: Status
           priority: 1
           type: string
         - jsonPath: .metadata.creationTimestamp
           description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
           name: Age
           type: date
       schema:
         openAPIV3Schema:
           description: "A Certificate resource should be created to ensure an up to date and signed x509 certificate is stored in the Kubernetes Secret resource named in `spec.secretName`. \n The stored certificate will be renewed before it expires (as configured by `spec.renewBefore`)."
           type: object
           required:
             - spec
           properties:
             apiVersion:
               description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
               type: string
             kind:
               description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
@@ @@ -536,97 +534,97 @@ spec: @@
                         enum:
                           - "True"
                           - "False"
                           - Unknown
                       type:
                         description: Type of the condition, known values are (`Ready`, `Issuing`).
                         type: string
                   x-kubernetes-list-map-keys:
                     - type
                   x-kubernetes-list-type: map
                 failedIssuanceAttempts:
                   description: The number of continuous failed issuance attempts up till now. This field gets removed (if set) on a successful issuance and gets set to 1 if unset and an issuance has failed. If an issuance has failed, the delay till the next issuance will be calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts - 1).
                   type: integer
                 lastFailureTime:
                   description: LastFailureTime is the time as recorded by the Certificate controller of the most recent failure to complete a CertificateRequest for this Certificate resource. If set, cert-manager will not re-request another Certificate until 1 hour has elapsed from this time.
                   type: string
                   format: date-time
                 nextPrivateKeySecretName:
                   description: The name of the Secret resource containing the private key to be used for the next certificate iteration. The keymanager controller will automatically set this field if the `Issuing` condition is set to `True`. It will automatically unset this field when the Issuing condition is not set or False.
                   type: string
                 notAfter:
                   description: The expiration time of the certificate stored in the secret named by this resource in `spec.secretName`.
                   type: string
                   format: date-time
                 notBefore:
                   description: The time after which the certificate stored in the secret named by this resource in spec.secretName is valid.
                   type: string
                   format: date-time
                 renewalTime:
                   description: RenewalTime is the time at which the certificate will be next renewed. If not set, no upcoming renewal is scheduled.
                   type: string
                   format: date-time
                 revision:
                   description: "The current 'revision' of the certificate as issued. \n When a CertificateRequest resource is created, it will have the `cert-manager.io/certificate-revision` set to one greater than the current value of this field. \n Upon issuance, this field will be set to the value of the annotation on the CertificateRequest resource used to issue the certificate. \n Persisting the value on the CertificateRequest resource allows the certificates controller to know whether a request is part of an old issuance or if it is part of the ongoing revision's issuance by checking if the revision value in the annotation is greater than this field."
                   type: integer
       served: true
       storage: true
 ---
 # Source: cert-manager/templates/crd-templates.yaml
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: challenges.acme.cert-manager.io
   labels:
     app: 'cert-manager'
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
     # Generated labels
-    app.kubernetes.io/version: "v1.9.1"
+    app.kubernetes.io/version: "v1.10.1"
 spec:
   group: acme.cert-manager.io
   names:
     kind: Challenge
     listKind: ChallengeList
     plural: challenges
     singular: challenge
     categories:
       - cert-manager
       - cert-manager-acme
   scope: Namespaced
   versions:
     - additionalPrinterColumns:
         - jsonPath: .status.state
           name: State
           type: string
         - jsonPath: .spec.dnsName
           name: Domain
           type: string
         - jsonPath: .status.reason
           name: Reason
           priority: 1
           type: string
         - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
           jsonPath: .metadata.creationTimestamp
           name: Age
           type: date
       name: v1
       schema:
         openAPIV3Schema:
           description: Challenge is a type to represent a Challenge request with an ACME server
           type: object
           required:
             - metadata
             - spec
           properties:
             apiVersion:
               description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
               type: string
             kind:
               description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
               type: string
             metadata:
               type: object
             spec:
               type: object
               required:
                 - authorizationURL
@@ @@ -1583,97 +1581,97 @@ spec: @@
                   type: string
                   enum:
                     - HTTP-01
                     - DNS-01
                 url:
                   description: The URL of the ACME Challenge resource for this challenge. This can be used to lookup details about the status of this challenge.
                   type: string
                 wildcard:
                   description: wildcard will be true if this challenge is for a wildcard identifier, for example '*.example.com'.
                   type: boolean
             status:
               type: object
               properties:
                 presented:
                   description: presented will be set to true if the challenge values for this challenge are currently 'presented'. This *does not* imply the self check is passing. Only that the values have been 'submitted' for the appropriate challenge mechanism (i.e. the DNS01 TXT record has been presented, or the HTTP01 configuration has been configured).
                   type: boolean
                 processing:
                   description: Used to denote whether this challenge should be processed or not. This field will only be set to true by the 'scheduling' component. It will only be set to false by the 'challenges' controller, after the challenge has reached a final state or timed out. If this field is set to false, the challenge controller will not take any more action.
                   type: boolean
                 reason:
                   description: Contains human readable information on why the Challenge is in the current state.
                   type: string
                 state:
                   description: Contains the current 'state' of the challenge. If not set, the state of the challenge is unknown.
                   type: string
                   enum:
                     - valid
                     - ready
                     - pending
                     - processing
                     - invalid
                     - expired
                     - errored
       served: true
       storage: true
       subresources:
         status: {}
 ---
 # Source: cert-manager/templates/crd-templates.yaml
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: clusterissuers.cert-manager.io
   labels:
     app: 'cert-manager'
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
     # Generated labels
-    app.kubernetes.io/version: "v1.9.1"
+    app.kubernetes.io/version: "v1.10.1"
 spec:
   group: cert-manager.io
   names:
     kind: ClusterIssuer
     listKind: ClusterIssuerList
     plural: clusterissuers
     singular: clusterissuer
     categories:
       - cert-manager
   scope: Cluster
   versions:
     - name: v1
       subresources:
         status: {}
       additionalPrinterColumns:
         - jsonPath: .status.conditions[?(@.type=="Ready")].status
           name: Ready
           type: string
         - jsonPath: .status.conditions[?(@.type=="Ready")].message
           name: Status
           priority: 1
           type: string
         - jsonPath: .metadata.creationTimestamp
           description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
           name: Age
           type: date
       schema:
         openAPIV3Schema:
           description: A ClusterIssuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is similar to an Issuer, however it is cluster-scoped and therefore can be referenced by resources that exist in *any* namespace, not just the same namespace as the referent.
           type: object
           required:
             - spec
           properties:
             apiVersion:
               description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
               type: string
             kind:
               description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
               type: string
             metadata:
               type: object
             spec:
               description: Desired state of the ClusterIssuer resource.
               type: object
               properties:
                 acme:
                   description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates.
                   type: object
@@ @@ -2845,97 +2843,97 @@ spec: @@
                   type: array
                   items:
                     description: IssuerCondition contains condition information for an Issuer.
                     type: object
                     required:
                       - status
                       - type
                     properties:
                       lastTransitionTime:
                         description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
                         type: string
                         format: date-time
                       message:
                         description: Message is a human readable description of the details of the last transition, complementing reason.
                         type: string
                       observedGeneration:
                         description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer.
                         type: integer
                         format: int64
                       reason:
                         description: Reason is a brief machine readable explanation for the condition's last transition.
                         type: string
                       status:
                         description: Status of the condition, one of (`True`, `False`, `Unknown`).
                         type: string
                         enum:
                           - "True"
                           - "False"
                           - Unknown
                       type:
                         description: Type of the condition, known values are (`Ready`).
                         type: string
                   x-kubernetes-list-map-keys:
                     - type
                   x-kubernetes-list-type: map
       served: true
       storage: true
 ---
 # Source: cert-manager/templates/crd-templates.yaml
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: issuers.cert-manager.io
   labels:
     app: 'cert-manager'
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
     # Generated labels
-    app.kubernetes.io/version: "v1.9.1"
+    app.kubernetes.io/version: "v1.10.1"
 spec:
   group: cert-manager.io
   names:
     kind: Issuer
     listKind: IssuerList
     plural: issuers
     singular: issuer
     categories:
       - cert-manager
   scope: Namespaced
   versions:
     - name: v1
       subresources:
         status: {}
       additionalPrinterColumns:
         - jsonPath: .status.conditions[?(@.type=="Ready")].status
           name: Ready
           type: string
         - jsonPath: .status.conditions[?(@.type=="Ready")].message
           name: Status
           priority: 1
           type: string
         - jsonPath: .metadata.creationTimestamp
           description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
           name: Age
           type: date
       schema:
         openAPIV3Schema:
           description: An Issuer represents a certificate issuing authority which can be referenced as part of `issuerRef` fields. It is scoped to a single namespace and can therefore only be referenced by resources within the same namespace.
           type: object
           required:
             - spec
           properties:
             apiVersion:
               description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
               type: string
             kind:
               description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
               type: string
             metadata:
               type: object
             spec:
               description: Desired state of the Issuer resource.
               type: object
               properties:
                 acme:
                   description: ACME configures this issuer to communicate with a RFC8555 (ACME) server to obtain signed x509 certificates.
                   type: object
@@ @@ -4107,97 +4105,97 @@ spec: @@
                   type: array
                   items:
                     description: IssuerCondition contains condition information for an Issuer.
                     type: object
                     required:
                       - status
                       - type
                     properties:
                       lastTransitionTime:
                         description: LastTransitionTime is the timestamp corresponding to the last status change of this condition.
                         type: string
                         format: date-time
                       message:
                         description: Message is a human readable description of the details of the last transition, complementing reason.
                         type: string
                       observedGeneration:
                         description: If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer.
                         type: integer
                         format: int64
                       reason:
                         description: Reason is a brief machine readable explanation for the condition's last transition.
                         type: string
                       status:
                         description: Status of the condition, one of (`True`, `False`, `Unknown`).
                         type: string
                         enum:
                           - "True"
                           - "False"
                           - Unknown
                       type:
                         description: Type of the condition, known values are (`Ready`).
                         type: string
                   x-kubernetes-list-map-keys:
                     - type
                   x-kubernetes-list-type: map
       served: true
       storage: true
 ---
 # Source: cert-manager/templates/crd-templates.yaml
 apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   name: orders.acme.cert-manager.io
   labels:
     app: 'cert-manager'
     app.kubernetes.io/name: 'cert-manager'
     app.kubernetes.io/instance: 'cert-manager'
     # Generated labels
-    app.kubernetes.io/version: "v1.9.1"
+    app.kubernetes.io/version: "v1.10.1"
 spec:
   group: acme.cert-manager.io
   names:
     kind: Order
     listKind: OrderList
     plural: orders
     singular: order
     categories:
       - cert-manager
       - cert-manager-acme
   scope: Namespaced
   versions:
     - name: v1
       subresources:
         status: {}
       additionalPrinterColumns:
         - jsonPath: .status.state
           name: State
           type: string
         - jsonPath: .spec.issuerRef.name
           name: Issuer
           priority: 1
           type: string
         - jsonPath: .status.reason
           name: Reason
           priority: 1
           type: string
         - jsonPath: .metadata.creationTimestamp
           description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.
           name: Age
           type: date
       schema:
         openAPIV3Schema:
           description: Order is a type to represent an Order with an ACME server
           type: object
           required:
             - metadata
             - spec
           properties:
             apiVersion:
               description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
               type: string
             kind:
               description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
               type: string
             metadata:
               type: object
             spec:

04-gen-secrets-job.yaml

➞

Show inline comments

@@ file renamed from kube/04-gen-secrets-job.yaml to 04-gen-secrets-job.yaml @@
 apiVersion: batch/v1
 kind: Job
 metadata:
   labels:
     app.kubernetes.io/name: pomerium
   name: pomerium-gen-secrets
   namespace: pomerium
 spec:
   template:
     metadata:
       labels:
         app.kubernetes.io/name: pomerium
       name: pomerium-gen-secrets
     spec:
       containers:
       - args:
         - gen-secrets
         - --secrets=$(POD_NAMESPACE)/bootstrap
         env:
         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
-        image: pomerium/ingress-controller:main
+        image: pomerium/ingress-controller:sha-efe2d11
         imagePullPolicy: IfNotPresent
         name: gen-secrets
         securityContext:
           allowPrivilegeEscalation: false
       nodeSelector:
         kubernetes.io/os: linux
       restartPolicy: OnFailure
       securityContext:
         fsGroup: 1000
         runAsNonRoot: true
         runAsUser: 1000
       serviceAccountName: pomerium-gen-secrets

20-kube/20-pom-deploy.yaml

➞

Show inline comments

 apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels: { app.kubernetes.io/name: pomerium }
   name: pomerium
   namespace: pomerium
 spec:
   replicas: 1
   selector:
     matchLabels: { app.kubernetes.io/name: pomerium }
   template:
     metadata:
       labels: { app.kubernetes.io/name: pomerium }
     spec:
       containers:
         - args:
             - all-in-one
             - --pomerium-config=global
             - --update-status-from-service=$(POMERIUM_NAMESPACE)/pomerium-proxy
             - --metrics-bind-address=$(POD_IP):9090
           env:
             - { name: TMPDIR, value: /tmp }
             - { name: XDG_CACHE_HOME, value: /tmp }
             - name: POMERIUM_NAMESPACE
               valueFrom:
                 fieldRef:
                   apiVersion: v1
                   fieldPath: metadata.namespace
             - name: POD_IP
               valueFrom:
                 fieldRef:
                   fieldPath: status.podIP
-          image: pomerium/ingress-controller:sha-5294279
+          image: pomerium/ingress-controller:sha-efe2d11
           imagePullPolicy: IfNotPresent
           name: pomerium
           ports:
             - { containerPort: 8443, name: https, protocol: TCP }
             - { containerPort: 8080, name: http, protocol: TCP }
             - { containerPort: 9090, name: metrics, protocol: TCP }
           resources:
             limits: { cpu: 5000m, memory: 1Gi }
             requests: { cpu: 300m, memory: 200Mi }
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true
             runAsGroup: 1000
             runAsNonRoot: true
             runAsUser: 1000
           volumeMounts:
             - { mountPath: /tmp, name: tmp }
             - { mountPath: /data/autocert, name: autocert }
       nodeSelector:
         kubernetes.io/os: linux
       securityContext:
         runAsNonRoot: true
       serviceAccountName: pomerium-controller
       terminationGracePeriodSeconds: 10
       volumes:
         - { name: tmp, emptyDir: {} }
         - { name: autocert, persistentVolumeClaim: { claimName: autocert-data } }
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
               - matchExpressions:
                   - key: "kubernetes.io/hostname"
                     operator: In
                     values: ["bang"]
 ---
 apiVersion: networking.k8s.io/v1
 kind: IngressClass
 metadata:
   labels:
     app.kubernetes.io/name: pomerium
   name: pomerium
 spec:
   controller: pomerium.io/ingress-controller

0 comments (0 inline, 0 general)