updates configs

.ko.yaml

@@ -0,0 +1 @@
+defaultBaseImage: gcr.io/distroless/static:nonroot

README.md

@@ -40,6 +40,8 @@ webhook:
 
 Secret to store webhook API key:
 
+**Note:** the `api-key` secret must be created in the same namespace as the `Certificate`.
+
 ```
 apiVersion: v1
 kind: Secret

config/200-psp.yaml

@@ -0,0 +1,36 @@
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: template-solver
+  annotations:
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+    apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default'
+spec:
+  privileged: false
+  allowPrivilegeEscalation: false
+  requiredDropCapabilities: ["ALL"]
+  readOnlyRootFilesystem: true
+  volumes: ["secret"]
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'MustRunAsNonRoot'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+    - min: 1
+      max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+    - min: 1
+      max: 65535
+  hostPorts:
+    - min: 1
+      max: 65535

config/300-podsecuritypolicy.yaml

@@ -1,28 +0,0 @@
----
-apiVersion: policy/v1beta1
-kind: PodSecurityPolicy
-metadata:
-  name: pvc-reaper
-spec:
-  privileged: false
-  allowPrivilegeEscalation: false
-  requiredDropCapabilities:
-  - ALL
-  readOnlyRootFilesystem: true
-  hostNetwork: false
-  hostIPC: false
-  hostPID: false
-  runAsUser:
-    rule: 'RunAsAny'
-  seLinux:
-    rule: 'RunAsAny'
-  supplementalGroups:
-    rule: 'MustRunAs'
-    ranges:
-    - min: 1
-      max: 65535
-  fsGroup:
-    rule: 'MustRunAs'
-    ranges:
-    - min: 1
-      max: 65535

config/300-rbac.yaml

@@ -51,12 +51,9 @@ kind: ClusterRole
 metadata:
   name: template-solver:domain-solver
 rules:
-- apiGroups:
+- apiGroups: ["template-solver"]
-  - template-solver
+  resources: ["*"]
-  resources:
+  verbs: ["create"]
-  - '*'
-  verbs:
-  - 'create'
 ---
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRoleBinding

config/400-apiservice.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: apiregistration.k8s.io/v1beta1
 kind: APIService
 metadata:

config/service.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: v1
 kind: Service
 metadata: