operator cert-manager (1.16.0-beta.0)

operators/cert-manager/1.16.0-beta.0/bundle.Dockerfile

@@ -0,0 +1,21 @@
+FROM scratch
+
+# Core bundle labels.
+LABEL operators.operatorframework.io.bundle.mediatype.v1=registry+v1
+LABEL operators.operatorframework.io.bundle.manifests.v1=manifests/
+LABEL operators.operatorframework.io.bundle.metadata.v1=metadata/
+LABEL operators.operatorframework.io.bundle.package.v1=cert-manager
+LABEL operators.operatorframework.io.bundle.channels.v1=candidate
+LABEL operators.operatorframework.io.bundle.channel.default.v1=candidate
+LABEL operators.operatorframework.io.metrics.builder=operator-sdk-v1.33.0
+LABEL operators.operatorframework.io.metrics.mediatype.v1=metrics+v1
+LABEL operators.operatorframework.io.metrics.project_layout=unknown
+
+# Labels for testing.
+LABEL operators.operatorframework.io.test.mediatype.v1=scorecard+v1
+LABEL operators.operatorframework.io.test.config.v1=tests/scorecard/
+
+# Copy files to locations specified by labels.
+COPY ./manifests /manifests/
+COPY ./metadata /metadata/
+COPY ./tests/scorecard /tests/scorecard/

operators/cert-manager/1.16.0-beta.0/manifests/acme.cert-manager.io_orders.yaml

@@ -0,0 +1,271 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  creationTimestamp: null
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: crds
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/version: v1.16.0-beta.0
+  name: orders.acme.cert-manager.io
+spec:
+  group: acme.cert-manager.io
+  names:
+    categories:
+    - cert-manager
+    - cert-manager-acme
+    kind: Order
+    listKind: OrderList
+    plural: orders
+    singular: order
+  scope: Namespaced
+  versions:
+  - additionalPrinterColumns:
+    - jsonPath: .status.state
+      name: State
+      type: string
+    - jsonPath: .spec.issuerRef.name
+      name: Issuer
+      priority: 1
+      type: string
+    - jsonPath: .status.reason
+      name: Reason
+      priority: 1
+      type: string
+    - description: CreationTimestamp is a timestamp representing the server time when
+        this object was created. It is not guaranteed to be set in happens-before
+        order across separate operations. Clients may not set this value. It is represented
+        in RFC3339 form and is in UTC.
+      jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
+    name: v1
+    schema:
+      openAPIV3Schema:
+        description: Order is a type to represent an Order with an ACME server
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            properties:
+              commonName:
+                description: |-
+                  CommonName is the common name as specified on the DER encoded CSR.
+                  If specified, this value must also be present in `dnsNames` or `ipAddresses`.
+                  This field must match the corresponding field on the DER encoded CSR.
+                type: string
+              dnsNames:
+                description: |-
+                  DNSNames is a list of DNS names that should be included as part of the Order
+                  validation process.
+                  This field must match the corresponding field on the DER encoded CSR.
+                items:
+                  type: string
+                type: array
+              duration:
+                description: |-
+                  Duration is the duration for the not after date for the requested certificate.
+                  this is set on order creation as pe the ACME spec.
+                type: string
+              ipAddresses:
+                description: |-
+                  IPAddresses is a list of IP addresses that should be included as part of the Order
+                  validation process.
+                  This field must match the corresponding field on the DER encoded CSR.
+                items:
+                  type: string
+                type: array
+              issuerRef:
+                description: |-
+                  IssuerRef references a properly configured ACME-type Issuer which should
+                  be used to create this Order.
+                  If the Issuer does not exist, processing will be retried.
+                  If the Issuer is not an 'ACME' Issuer, an error will be returned and the
+                  Order will be marked as failed.
+                properties:
+                  group:
+                    description: Group of the resource being referred to.
+                    type: string
+                  kind:
+                    description: Kind of the resource being referred to.
+                    type: string
+                  name:
+                    description: Name of the resource being referred to.
+                    type: string
+                required:
+                - name
+                type: object
+              request:
+                description: |-
+                  Certificate signing request bytes in DER encoding.
+                  This will be used when finalizing the order.
+                  This field must be set on the order.
+                format: byte
+                type: string
+            required:
+            - issuerRef
+            - request
+            type: object
+          status:
+            properties:
+              authorizations:
+                description: |-
+                  Authorizations contains data returned from the ACME server on what
+                  authorizations must be completed in order to validate the DNS names
+                  specified on the Order.
+                items:
+                  description: |-
+                    ACMEAuthorization contains data returned from the ACME server on an
+                    authorization that must be completed in order validate a DNS name on an ACME
+                    Order resource.
+                  properties:
+                    challenges:
+                      description: |-
+                        Challenges specifies the challenge types offered by the ACME server.
+                        One of these challenge types will be selected when validating the DNS
+                        name and an appropriate Challenge resource will be created to perform
+                        the ACME challenge process.
+                      items:
+                        description: |-
+                          Challenge specifies a challenge offered by the ACME server for an Order.
+                          An appropriate Challenge resource can be created to perform the ACME
+                          challenge process.
+                        properties:
+                          token:
+                            description: |-
+                              Token is the token that must be presented for this challenge.
+                              This is used to compute the 'key' that must also be presented.
+                            type: string
+                          type:
+                            description: |-
+                              Type is the type of challenge being offered, e.g. 'http-01', 'dns-01',
+                              'tls-sni-01', etc.
+                              This is the raw value retrieved from the ACME server.
+                              Only 'http-01' and 'dns-01' are supported by cert-manager, other values
+                              will be ignored.
+                            type: string
+                          url:
+                            description: |-
+                              URL is the URL of this challenge. It can be used to retrieve additional
+                              metadata about the Challenge from the ACME server.
+                            type: string
+                        required:
+                        - token
+                        - type
+                        - url
+                        type: object
+                      type: array
+                    identifier:
+                      description: Identifier is the DNS name to be validated as part
+                        of this authorization
+                      type: string
+                    initialState:
+                      description: |-
+                        InitialState is the initial state of the ACME authorization when first
+                        fetched from the ACME server.
+                        If an Authorization is already 'valid', the Order controller will not
+                        create a Challenge resource for the authorization. This will occur when
+                        working with an ACME server that enables 'authz reuse' (such as Let's
+                        Encrypt's production endpoint).
+                        If not set and 'identifier' is set, the state is assumed to be pending
+                        and a Challenge will be created.
+                      enum:
+                      - valid
+                      - ready
+                      - pending
+                      - processing
+                      - invalid
+                      - expired
+                      - errored
+                      type: string
+                    url:
+                      description: URL is the URL of the Authorization that must be
+                        completed
+                      type: string
+                    wildcard:
+                      description: |-
+                        Wildcard will be true if this authorization is for a wildcard DNS name.
+                        If this is true, the identifier will be the *non-wildcard* version of
+                        the DNS name.
+                        For example, if '*.example.com' is the DNS name being validated, this
+                        field will be 'true' and the 'identifier' field will be 'example.com'.
+                      type: boolean
+                  required:
+                  - url
+                  type: object
+                type: array
+              certificate:
+                description: |-
+                  Certificate is a copy of the PEM encoded certificate for this Order.
+                  This field will be populated after the order has been successfully
+                  finalized with the ACME server, and the order has transitioned to the
+                  'valid' state.
+                format: byte
+                type: string
+              failureTime:
+                description: |-
+                  FailureTime stores the time that this order failed.
+                  This is used to influence garbage collection and back-off.
+                format: date-time
+                type: string
+              finalizeURL:
+                description: |-
+                  FinalizeURL of the Order.
+                  This is used to obtain certificates for this order once it has been completed.
+                type: string
+              reason:
+                description: |-
+                  Reason optionally provides more information about a why the order is in
+                  the current state.
+                type: string
+              state:
+                description: |-
+                  State contains the current state of this Order resource.
+                  States 'success' and 'expired' are 'final'
+                enum:
+                - valid
+                - ready
+                - pending
+                - processing
+                - invalid
+                - expired
+                - errored
+                type: string
+              url:
+                description: |-
+                  URL of the Order.
+                  This will initially be empty when the resource is first created.
+                  The Order controller will populate this field when the Order is first processed.
+                  This field will be immutable after it is initially set.
+                type: string
+            type: object
+        required:
+        - metadata
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}
+status:
+  acceptedNames:
+    kind: ""
+    plural: ""
+  conditions: null
+  storedVersions: null

operators/cert-manager/1.16.0-beta.0/manifests/cert-manager-cainjector_v1_service.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Service
+metadata:
+  creationTimestamp: null
+  labels:
+    app: cainjector
+    app.kubernetes.io/component: cainjector
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cainjector
+    app.kubernetes.io/version: v1.16.0-beta.0
+  name: cert-manager-cainjector
+spec:
+  ports:
+  - name: http-metrics
+    port: 9402
+    protocol: TCP
+    targetPort: 0
+  selector:
+    app.kubernetes.io/component: cainjector
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cainjector
+  type: ClusterIP
+status:
+  loadBalancer: {}

operators/cert-manager/1.16.0-beta.0/manifests/cert-manager-cluster-view_rbac.authorization.k8s.io_v1_clusterrole.yaml

@@ -0,0 +1,21 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/version: v1.16.0-beta.0
+    rbac.authorization.k8s.io/aggregate-to-cluster-reader: "true"
+  name: cert-manager-cluster-view
+rules:
+- apiGroups:
+  - cert-manager.io
+  resources:
+  - clusterissuers
+  verbs:
+  - get
+  - list
+  - watch

operators/cert-manager/1.16.0-beta.0/manifests/cert-manager-edit_rbac.authorization.k8s.io_v1_clusterrole.yaml

@@ -0,0 +1,43 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  creationTimestamp: null
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/version: v1.16.0-beta.0
+    rbac.authorization.k8s.io/aggregate-to-admin: "true"
+    rbac.authorization.k8s.io/aggregate-to-edit: "true"
+  name: cert-manager-edit
+rules:
+- apiGroups:
+  - cert-manager.io
+  resources:
+  - certificates
+  - certificaterequests
+  - issuers
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - patch
+  - update
+- apiGroups:
+  - cert-manager.io
+  resources:
+  - certificates/status
+  verbs:
+  - update
+- apiGroups:
+  - acme.cert-manager.io
+  resources:
+  - challenges
+  - orders
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - patch
+  - update