first commit

config/100-namespace.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: template-solver

config/200-rbac.yaml

@@ -0,0 +1,99 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: template-solver
+  namespace: template-solver
+---
+# can be removed in k8s v1.17.0
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: extension-apiserver-authentication-reader-custom
+  namespace: kube-system
+rules:
+- apiGroups: [""]
+  resourceNames: ["extension-apiserver-authentication"]
+  resources: ["configmaps"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: template-solver:webhook-authentication-reader
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader-custom
+subjects:
+- apiGroup: ""
+  kind: ServiceAccount
+  name: template-solver
+  namespace: template-solver
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: template-solver:auth-delegator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- apiGroup: ""
+  kind: ServiceAccount
+  name: template-solver
+  namespace: template-solver
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: template-solver:domain-solver
+rules:
+- apiGroups:
+  - template-solver
+  resources:
+  - '*'
+  verbs:
+  - 'create'
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: template-solver:domain-solver
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: template-solver:domain-solver
+subjects:
+- apiGroup: ""
+  kind: ServiceAccount
+  name: cert-manager
+  namespace: cert-manager
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: template-solver
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+- apiGroups: ["policy"]
+  resources: ["podsecuritypolicies"]
+  resourceNames: ["template-solver"]
+  verbs: ["use"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: template-solver
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: template-solver
+subjects:
+- kind: ServiceAccount
+  name: template-solver
+  namespace: template-solver

config/300-podsecuritypolicy.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: pvc-reaper
+spec:
+  privileged: false
+  allowPrivilegeEscalation: false
+  requiredDropCapabilities:
+  - ALL
+  readOnlyRootFilesystem: true
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+    - min: 1
+      max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+    - min: 1
+      max: 65535

config/400-apiservice.yaml

@@ -0,0 +1,14 @@
+apiVersion: apiregistration.k8s.io/v1beta1
+kind: APIService
+metadata:
+  name: v1alpha1.template-solver
+  annotations:
+    cert-manager.io/inject-ca-from: "template-solver/template-solver-ca"
+spec:
+  group: template-solver
+  groupPriorityMinimum: 1000
+  versionPriority: 15
+  service:
+    name: template-solver
+    namespace: template-solver
+  version: v1alpha1

config/400-pki.yaml

@@ -0,0 +1,45 @@
+---
+apiVersion: cert-manager.io/v1alpha2
+kind: Issuer
+metadata:
+  name: template-solver-ca
+  namespace: template-solver
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1alpha2
+kind: Certificate
+metadata:
+  name: template-solver-ca
+  namespace: template-solver
+spec:
+  secretName: template-solver-ca
+  duration: 43800h # 5y
+  issuerRef:
+    name: template-solver-ca
+  commonName: "ca.template-solver.cert-manager"
+  isCA: true
+---
+apiVersion: cert-manager.io/v1alpha2
+kind: Issuer
+metadata:
+  name: template-solver-cert
+  namespace: template-solver
+spec:
+  ca:
+    secretName: template-solver-ca
+---
+apiVersion: cert-manager.io/v1alpha2
+kind: Certificate
+metadata:
+  name: template-solver-cert
+  namespace: template-solver
+spec:
+  secretName: template-solver-cert
+  duration: 8760h
+  issuerRef:
+    name: template-solver-cert
+  dnsNames:
+  - template-solver
+  - template-solver.template-solver
+  - template-solver.template-solver.svc

config/deployment.yaml

@@ -0,0 +1,55 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: template-solver
+  namespace: template-solver
+  labels:
+    app: template-solver
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: template-solver
+  template:
+    metadata:
+      labels:
+        app: template-solver
+    spec:
+      serviceAccountName: template-solver
+      containers:
+      - name: template-solver
+        image: git.giftfish.de/ston1th/template-solver
+        imagePullPolicy: Always
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+        args:
+        - --tls-cert-file=/tls/tls.crt
+        - --tls-private-key-file=/tls/tls.key
+        env:
+        - name: GROUP_NAME
+          value: template-solver
+        ports:
+        - name: https
+          containerPort: 443
+          protocol: TCP
+        livenessProbe:
+          httpGet:
+            scheme: HTTPS
+            path: /healthz
+            port: https
+        readinessProbe:
+          httpGet:
+            scheme: HTTPS
+            path: /healthz
+            port: https
+        volumeMounts:
+          - name: certs
+            mountPath: /tls
+            readOnly: true
+      volumes:
+      - name: certs
+        secret:
+          secretName: template-solver-cert

config/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: template-solver
+  namespace: template-solver
+spec:
+  type: ClusterIP
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: https
+  selector:
+    app: template-solver