diff --git a/appsettings.json b/appsettings.json index 132c6fb..d88f56d 100644 --- a/appsettings.json +++ b/appsettings.json @@ -1,20 +1,18 @@ { - "Logging": { - "LogLevel": { - "Default": "Information", - "Microsoft": "Warning", - "Microsoft.Hosting.Lifetime": "Information" - } + "KCert": { + "Namespace": "kcert", + "IngressName": "kcert", + "SecretName": "kcert", + "ServiceName": "kcert", + "ServicePort": 80, + "AcceptAllChallenges": false }, - "AllowedHosts": "*", - "Namespace": "kcert", - "Label": "kcert", - "SecretName": "kcert", - "ServiceName": "kcert", - "IngressName": "kcert", - "ServicePort": 80, - "AcmeWaitTimeSeconds": 10, - "AcmeNumRetries": 5, - "RenewalCheckTimeHours": 6, - "RenewalExpirationRenewalDays": 30 + "Acme": { + "DirUrl": "https://acme-staging-v02.api.letsencrypt.org/directory", + "ValidationWaitTimeSeconds": 10, + "ValidationNumRetries": 5, + "RenewalCheckTimeHours": 6, + "RenewalExpirationRenewalDays": 30, + "AutoRenewal": true + } } diff --git a/deploy.yml b/deploy.yml index e7d2099..2085c20 100644 --- a/deploy.yml +++ b/deploy.yml @@ -15,14 +15,11 @@ metadata: name: kcert rules: - apiGroups: [""] - resources: ["namespaces"] - verbs: ["get", "list"] -- apiGroups: [""] - resources: ["secrets", "services"] - verbs: ["get", "list", "create", "update", "patch", "delete"] + resources: ["secrets"] + verbs: ["get", "list", "create", "update", "patch"] - apiGroups: ["networking.k8s.io"] resources: ["ingresses"] - verbs: ["get", "create", "update", "patch", "delete"] + verbs: ["get", "list", "watch"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -37,6 +34,31 @@ roleRef: name: kcert apiGroup: rbac.authorization.k8s.io --- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: kcert + namespace: kcert +rules: +- apiGroups: ["networking.k8s.io"] + resources: ["ingresses"] + resourceNames: ["kcert"] + verbs: ["get", "create", "update", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: kcert + namespace: kcert +subjects: +- kind: ServiceAccount + name: kcert + namespace: kcert +roleRef: + kind: ClusterRole + name: kcert + apiGroup: rbac.authorization.k8s.io +--- apiVersion: apps/v1 kind: Deployment metadata: @@ -57,15 +79,39 @@ spec: serviceAccountName: kcert containers: - name: kcert - image: nabsul/kcert:v0.9.2 + image: ghcr.io/nabsul/kcert:sha-fe8d892 ports: - containerPort: 80 name: http env: - - name: ASPNETCORE_ENVIRONMENT - value: Development - - name: KCERT_NAMESPACE + - name: NAMESPACE value: kcert + - name: ENABLEAUTORENEWAL + value: "true" + - name: ACME__DIRURL + value: https://acme-v02.api.letsencrypt.org/directory + - name: ACME__TERMSACCEPTED + value: # You must set this to "true" to indicate your acceptance of Let's Encrypt's terms of service (https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf) + - name: ACME__EMAIL + value: # Your email address for Let's Encrypt and email notifications + - name: ACME__KEY + valueFrom: + secretKeyRef: + name: kcert + key: acme + - name: SMTP__EMAILFROM + value: # The address from which you will send automated emails + - name: SMTP__HOST + value: SMTP host for email notifications + - name: SMTP__PORT + value: "587" # Change this if necessary + - name: SMTP__USER + value: # SMTP user name + - name: SMTP__PASS + valueFrom: + secretKeyRef: + name: kcert + key: smtp --- apiVersion: v1 kind: Service @@ -82,3 +128,23 @@ spec: targetPort: 80 selector: app: kcert +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: kcert + namespace: kcert + annotations: + kubernetes.io/ingress.class: nginx +spec: + rules: + - host: dummy.example.test # needed because we can't have an empty ingress + http: + paths: + - path: /.well-known/acme-challenge + pathType: Prefix + backend: + service: + name: kcert + port: + number: 80 diff --git a/docker-compose.yml b/docker-compose.yml deleted file mode 100644 index db285d5..0000000 --- a/docker-compose.yml +++ /dev/null @@ -1,13 +0,0 @@ -version: "3" -services: - kcert: - build: . - ports: - - "8081:80" - environment: - - ASPNETCORE_ENVIRONMENT=development - - KCERT_CONFIG=/kubeconfig/config - - KCERT_LABEL=kcert-dev - - KCERT_NAMESPACE=kcert-dev - volumes: - - ./kubeconfig:/kubeconfig diff --git a/wwwroot/favicon.ico b/wwwroot/favicon.ico index a8387e667c6e5e0a47281f1d5ae27e33e6f75b12..1847f2a2c9676a23f60ed2112170d77df1218fba 100644 GIT binary patch literal 15406 zcmeHNYmgPi6&|Diqd)ws3sDQ75R({1W6;tnL$pX$Qh5@~BwD4VWnwh3N>M4bBx=-B zOREU5JOc8DrEowCL*9zAnsmWAClx2vXR zrl-$2U!Und-F?o{v~#p`we!!{=-#5;f1ajYr)gSCOYMEc1)A1Mb)!brzh9zlL{Y1!o3fmmdePIFsV!x?Sjww>8ni-IU*rnf^!I7QS!TxNA-eLx70f9dXI9rz z{;lxQ-}pP~a_zrk*(G-{`^Y-xR?7^EjDr#hq{X+T#Ull)#KW^sd*vO$)0Z=54U10ZWon z-10BUSMYBnzqIS^5bMf`?Zk)HoN3=<71~oIErqp@rIN4D`4QjS`1rdn%P#u`=Tlh! zgzuAlp}k7=R422KuIE?fED<;TJG-zbGK4t#@rh?Z+-T)RPBmS@@{T=F0pK2ijr@Awpj8M55?`TN#42T zzZBKJyRqPm>Rl`|eT3wlfBzoeck!Zo+IZzeJ*(u4eYN0; zd;WvJNZH_(UvanhvwY69UgB#PC0Ep|f-bxC=f3aa1>-`r zNpe@ohy5`-o)IkNUF_jGU(&Nnwk=q4%YW4`@}WoAO<%zor0p)r-=_U}u)tm=>9=ST z)qi}?ue>+Np4Ne#WcO%CXIS?_cg(%y3?@_RnY5-kC~Vaq@w|J{q>K zg^zpBU8UVqLKveeGBd9VVQ3_ukF&sBbV{daZ5>(XHH@DLRdXhYLuDJxP0zDx?y&DF ztbNpn)1ot6uuXC6%f2?oywR+<<8}H!yJ*cQ_KGI#PT?rC53M5GIod}f#=x1l<7}(X zx|*+%XM%r|XKMe@S^M`1|II+2f%rKzAD`_~dt~QqY;7>$X^C<{=#2K?~ z<5&r2+7mmNYn#1iTJhvodF&QvTXXXyYES;<>4*oa`-FIBRB^~}X)G8MqRqAchPkDl zC^GJ&@tx}_-VDEqeeivy-#U^JeSn|aSae$mgXm9M{5r(}tbKDrzCE5@sPGi z81Qexeza1`&Pvi+yy2)oqe(yN{ZBqQeWp{6k#N(JJSnl0lOWo%wE)qND$%lqG zkFhXpAH4c)^qdU;FqU8S0NH|EBz|j8E7|V4pPhWM#VwQQU)AzNR74op*=6Hoe;eV9 z`kn+o>~<|47mm#U8}e;yzL|Tm$(i%0jj! zzviz#J)$r6;Wf(Uq7v(Y7e`;88{tQ6pz`%@AvSP#nf=v=KHUQc;>5^PiYv(3=__V0 zT|9mxe%w&*P|aTY_X);3*YVhN9R8?0D=)Sr&vE#9ye<$Y@M40WUnK*3Cd5?Y3Ub&~ zv}x<&@MG=9_=qYt?B9Z)hH&V!e-LYH!LK(~qTZJ!?MEDb?B5WpiPRy-zhG;yPg53}%htZx%xl-N4pbx8J|!1_CH1km?G@6Ae|_=lD6#(Q zdla+dX}=858}@g>xs3JO$$sf+mF|(}K*y{VY4P*5iRNom!TC#`0qT9mxq;^eQ650r zQl@-weWp4mI_>!3|E+!|^u@yipv{O3z-#>iP1rKV-|0%YgkK z&J_6-<9p8)_5T^-JCOBs*1`D#a~)$dxRwtptOKd1rtI*1XzHY?lYtlmLpcUn&nFnd pcD0rZF_iNMC~0k*1 z;+8v6lAUL<>-D_9Yme4HbG*OgpYhh6(dqqR`dww5onL2U!e-TFDJ!q8QI=}d-#NYJ zz^KgVU7cxWGqTWB?aMKz(G2y#yGMJ~a3-Vo>Z`Mx!_d+nRi}4sl!LaaYDT;?s#TqG MbbU^5e+pl~57{4MX8-^I