update
diff --git a/charts/cert-manager/templates/webhook-deployment.yaml b/charts/cert-manager/templates/webhook-deployment.yaml
index 043c4b1..cb2425c 100644
--- a/charts/cert-manager/templates/webhook-deployment.yaml
+++ b/charts/cert-manager/templates/webhook-deployment.yaml
@@ -15,6 +15,10 @@
{{- end }}
spec:
replicas: {{ .Values.webhook.replicaCount }}
+ {{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
+ {{- if not (has (quote .Values.global.revisionHistoryLimit) (list "" (quote ""))) }}
+ revisionHistoryLimit: {{ .Values.global.revisionHistoryLimit }}
+ {{- end }}
selector:
matchLabels:
app.kubernetes.io/name: {{ include "webhook.name" . }}
@@ -39,14 +43,32 @@
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if and .Values.prometheus.enabled (not (or .Values.prometheus.servicemonitor.enabled .Values.prometheus.podmonitor.enabled)) }}
+ {{- if not .Values.webhook.podAnnotations }}
+ annotations:
+ {{- end }}
+ prometheus.io/path: "/metrics"
+ prometheus.io/scrape: 'true'
+ prometheus.io/port: '9402'
+ {{- end }}
spec:
+ {{- if not .Values.webhook.serviceAccount.create }}
+ {{- with .Values.global.imagePullSecrets }}
+ imagePullSecrets:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- end }}
serviceAccountName: {{ template "webhook.serviceAccountName" . }}
{{- if hasKey .Values.webhook "automountServiceAccountToken" }}
automountServiceAccountToken: {{ .Values.webhook.automountServiceAccountToken }}
{{- end }}
+ enableServiceLinks: {{ .Values.webhook.enableServiceLinks }}
{{- with .Values.global.priorityClassName }}
priorityClassName: {{ . | quote }}
{{- end }}
+ {{- if (hasKey .Values.global "hostUsers") }}
+ hostUsers: {{ .Values.global.hostUsers }}
+ {{- end }}
{{- with .Values.webhook.securityContext }}
securityContext:
{{- toYaml . | nindent 8 }}
@@ -54,14 +76,16 @@
{{- if .Values.webhook.hostNetwork }}
hostNetwork: true
{{- end }}
+ {{- if .Values.webhook.hostNetwork }}
+ dnsPolicy: ClusterFirstWithHostNet
+ {{- end }}
containers:
- name: {{ .Chart.Name }}-webhook
- {{- with .Values.webhook.image }}
- image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}"
- {{- end }}
+ image: "{{ template "cert-manager.image" (tuple .Values.webhook.image .Values.imageRegistry .Values.imageNamespace (printf ":%s" .Chart.AppVersion)) }}"
imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
args:
- {{- if .Values.global.logLevel }}
+ {{- /* The if statement below is equivalent to {{- if $value }} but will also return true for 0. */ -}}
+ {{- if not (has (quote .Values.global.logLevel) (list "" (quote ""))) }}
- --v={{ .Values.global.logLevel }}
{{- end }}
{{- if .Values.webhook.config }}
@@ -71,8 +95,17 @@
{{ if not $config.securePort -}}
- --secure-port={{ .Values.webhook.securePort }}
{{- end }}
- {{- if .Values.featureGates }}
- - --feature-gates={{ .Values.featureGates }}
+ {{- if .Values.webhook.featureGates }}
+ - --feature-gates={{ .Values.webhook.featureGates }}
+ {{- end }}
+ {{- if .Values.webhook.enableClientVerification }}
+ - --enable-client-verification={{ .Values.webhook.enableClientVerification }}
+ {{- end }}
+ {{- if .Values.webhook.clientCAFile }}
+ - --client-ca-path={{ .Values.webhook.clientCAFile }}
+ {{- end }}
+ {{- if .Values.webhook.apiserverClientCertSubjects }}
+ - --client-subject-names={{ .Values.webhook.apiserverClientCertSubjects }}
{{- end }}
{{- $tlsConfig := default $config.tlsConfig "" }}
{{ if or (not $config.tlsConfig) (and (not $tlsConfig.dynamic) (not $tlsConfig.filesystem) ) -}}
@@ -81,13 +114,16 @@
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}.$(POD_NAMESPACE)
- --dynamic-serving-dns-names={{ template "webhook.fullname" . }}.$(POD_NAMESPACE).svc
- {{ if .Values.webhook.url.host }}
+ {{- if .Values.webhook.url.host }}
- --dynamic-serving-dns-names={{ .Values.webhook.url.host }}
{{- end }}
{{- end }}
{{- with .Values.webhook.extraArgs }}
{{- toYaml . | nindent 10 }}
{{- end }}
+ {{- if not .Values.prometheus.enabled }}
+ - --metrics-listen-address=0
+ {{- end }}
ports:
- name: https
protocol: TCP
@@ -105,14 +141,15 @@
{{- else }}
containerPort: 6080
{{- end }}
+ {{- if .Values.prometheus.enabled }}
+ - containerPort: 9402
+ name: http-metrics
+ protocol: TCP
+ {{- end }}
livenessProbe:
httpGet:
path: /livez
- {{- if $config.healthzPort }}
- port: {{ $config.healthzPort }}
- {{- else }}
- port: 6080
- {{- end }}
+ port: healthcheck
scheme: HTTP
initialDelaySeconds: {{ .Values.webhook.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.webhook.livenessProbe.periodSeconds }}
@@ -122,11 +159,7 @@
readinessProbe:
httpGet:
path: /healthz
- {{- if $config.healthzPort }}
- port: {{ $config.healthzPort }}
- {{- else }}
- port: 6080
- {{- end }}
+ port: healthcheck
scheme: HTTP
initialDelaySeconds: {{ .Values.webhook.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.webhook.readinessProbe.periodSeconds }}
@@ -142,6 +175,9 @@
valueFrom:
fieldRef:
fieldPath: metadata.namespace
+ {{- with .Values.webhook.extraEnv }}
+ {{- toYaml . | nindent 10 }}
+ {{- end }}
{{- with .Values.webhook.resources }}
resources:
{{- toYaml . | nindent 12 }}
@@ -152,18 +188,27 @@
- name: config
mountPath: /var/cert-manager/config
{{- end }}
- {{- if .Values.webhook.volumeMounts }}
- {{- toYaml .Values.webhook.volumeMounts | nindent 12 }}
+ {{- with .Values.webhook.volumeMounts }}
+ {{- toYaml . | nindent 12 }}
{{- end }}
{{- end }}
- {{- with .Values.webhook.nodeSelector }}
+ {{- $nodeSelector := .Values.global.nodeSelector | default dict }}
+ {{- $nodeSelector = merge $nodeSelector (.Values.webhook.nodeSelector | default dict) }}
+ {{- with $nodeSelector }}
nodeSelector:
- {{- toYaml . | nindent 8 }}
+ {{- range $key, $value := . }}
+ {{ $key }}: {{ $value | quote }}
+ {{- end }}
{{- end }}
{{- with .Values.webhook.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
+ {{- if .Values.webhook.runtimeClassName }}
+ runtimeClassName: {{ .Values.webhook.runtimeClassName | quote }}
+ {{- else if .Values.global.runtimeClassName }}
+ runtimeClassName: {{ .Values.global.runtimeClassName | quote }}
+ {{- end }}
{{- with .Values.webhook.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
@@ -179,7 +224,7 @@
configMap:
name: {{ include "webhook.fullname" . }}
{{- end }}
- {{- if .Values.webhook.volumes }}
- {{- toYaml .Values.webhook.volumes | nindent 8 }}
+ {{- with .Values.webhook.volumes }}
+ {{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}