Skip to content

Commit e2df6fc

Browse files
james-callahanjames-callahan
committed
Kustomize deprecated vars, use replacements 
1 parent defc745 commit e2df6fc

File tree

8 files changed

+83
-50
lines changed

8 files changed

+83
-50
lines changed

‎config/certmanager/cainjection_in_ingressclassparams_patch.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,6 @@ apiVersion: apiextensions.k8s.io/v1
44
kind: CustomResourceDefinition
55
metadata:
66
annotations:
7-
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
7+
# `default` and `serving-cert` may be substituted by kustomize
8+
cert-manager.io/inject-ca-from: default/serving-cert
89
name: ingressclassparams.elbv2.k8s.aws

‎config/certmanager/cainjection_in_targetgroupbindings_patch.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,5 +4,6 @@ apiVersion: apiextensions.k8s.io/v1
44
kind: CustomResourceDefinition
55
metadata:
66
annotations:
7-
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
7+
# `default` and `serving-cert` may be substituted by kustomize
8+
cert-manager.io/inject-ca-from: default/serving-cert
89
name: targetgroupbindings.elbv2.k8s.aws

‎config/certmanager/certificate.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,10 @@ kind: Certificate
1414
metadata:
1515
name: serving-cert # this name should match the one appeared in kustomizeconfig.yaml
1616
spec:
17-
# $(SERVICE_NAME) and $(SERVICE_NAMESPACE) will be substituted by kustomize
17+
# `webhook-service` and `default` may be substituted by kustomize
1818
dnsNames:
19-
- $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc
20-
- $(SERVICE_NAME).$(SERVICE_NAMESPACE).svc.cluster.local
19+
- webhook-service.default.svc
20+
- webhook-service.default.svc.cluster.local
2121
issuerRef:
2222
kind: Issuer
2323
name: selfsigned-issuer

‎config/certmanager/kustomization.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ patches:
88
# patches here are for enabling the CA injection for each CRD
99
- path: cainjection_in_targetgroupbindings_patch.yaml
1010
- path: cainjection_in_ingressclassparams_patch.yaml
11-
# This patch add annotation to admission webhook config and
12-
# the variables $(CERTIFICATE_NAMESPACE) and $(CERTIFICATE_NAME) will be substituted by kustomize.
11+
# This patch add annotation to admission webhook config, `default` and
12+
# `serving-cert` may be substituted by kustomize
1313
- target:
1414
kind: (MutatingWebhookConfiguration|ValidatingWebhookConfiguration)
1515
patch: |-
@@ -18,4 +18,4 @@ patches:
1818
metadata:
1919
name: webhook
2020
annotations:
21-
cert-manager.io/inject-ca-from: $(CERTIFICATE_NAMESPACE)/$(CERTIFICATE_NAME)
21+
cert-manager.io/inject-ca-from: default/serving-cert

‎config/certmanager/kustomizeconfig.yaml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,8 @@
1-
# This configuration is for teaching kustomize how to update name ref and var substitution
1+
# This configuration is for teaching kustomize how to update name ref
22
nameReference:
33
- kind: Issuer
44
group: cert-manager.io
55
fieldSpecs:
66
- kind: Certificate
77
group: cert-manager.io
88
path: spec/issuerRef/name
9-
10-
varReference:
11-
- kind: Certificate
12-
group: cert-manager.io
13-
path: spec/commonName
14-
- kind: Certificate
15-
group: cert-manager.io
16-
path: spec/dnsNames

‎config/crd/kustomizeconfig.yaml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# This file is for teaching kustomize how to substitute name and namespace reference in CRD
1+
# This file is for teaching kustomize how to modify name and namespace references in CRD
22
nameReference:
33
- kind: Service
44
version: v1
@@ -12,6 +12,3 @@ namespace:
1212
group: apiextensions.k8s.io
1313
path: spec/conversion/webhookClientConfig/service/namespace
1414
create: false
15-
16-
varReference:
17-
- path: metadata/annotations

‎config/default/kustomization.yaml‎

Lines changed: 70 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -28,32 +28,77 @@ components:
2828
# To disable cert-manager comment out the following line, the 'webhook' component is required
2929
- ../certmanager
3030

31-
# the following config is for teaching kustomize how to do var substitution
32-
vars:
33-
# [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER' prefix.
34-
- name: CERTIFICATE_NAMESPACE # namespace of the certificate CR
35-
objref:
31+
replacements:
32+
# The following patches adds a directive for certmanager to inject CA into the CRD
33+
# CRD conversion requires k8s 1.13 or later.
34+
- source:
3635
kind: Certificate
37-
group: cert-manager.io
38-
version: v1
39-
name: serving-cert # this name should match the one in certificate.yaml
40-
fieldref:
41-
fieldpath: metadata.namespace
42-
- name: CERTIFICATE_NAME
43-
objref:
36+
fieldPath: metadata.namespace
37+
targets:
38+
- select:
39+
kind: CustomResourceDefinition
40+
fieldPaths:
41+
- metadata.annotations.[cert-manager.io/inject-ca-from]
42+
options:
43+
delimiter: /
44+
- select:
45+
kind: MutatingWebhookConfiguration
46+
fieldPaths:
47+
- metadata.annotations.[cert-manager.io/inject-ca-from]
48+
options:
49+
delimiter: /
50+
- select:
51+
kind: ValidatingWebhookConfiguration
52+
fieldPaths:
53+
- metadata.annotations.[cert-manager.io/inject-ca-from]
54+
options:
55+
delimiter: /
56+
- source:
4457
kind: Certificate
45-
group: cert-manager.io
46-
version: v1
47-
name: serving-cert # this name should match the one in certificate.yaml
48-
- name: SERVICE_NAMESPACE # namespace of the service
49-
objref:
58+
fieldPath: metadata.name
59+
targets:
60+
- select:
61+
kind: CustomResourceDefinition
62+
fieldPaths:
63+
- metadata.annotations.[cert-manager.io/inject-ca-from]
64+
options:
65+
delimiter: /
66+
index: 1
67+
- select:
68+
kind: MutatingWebhookConfiguration
69+
fieldPaths:
70+
- metadata.annotations.[cert-manager.io/inject-ca-from]
71+
options:
72+
delimiter: /
73+
index: 1
74+
- select:
75+
kind: ValidatingWebhookConfiguration
76+
fieldPaths:
77+
- metadata.annotations.[cert-manager.io/inject-ca-from]
78+
options:
79+
delimiter: /
80+
index: 1
81+
# Patch dnsNames in webhook Service
82+
- source:
5083
kind: Service
51-
version: v1
52-
name: webhook-service
53-
fieldref:
54-
fieldpath: metadata.namespace
55-
- name: SERVICE_NAME
56-
objref:
84+
fieldPath: metadata.name
85+
targets:
86+
- select:
87+
kind: Certificate
88+
name: serving-cert
89+
fieldPaths:
90+
- spec.dnsNames.*
91+
options:
92+
delimiter: .
93+
- source:
5794
kind: Service
58-
version: v1
59-
name: webhook-service
95+
fieldPath: metadata.namespace
96+
targets:
97+
- select:
98+
kind: Certificate
99+
name: serving-cert
100+
fieldPaths:
101+
- spec.dnsNames.*
102+
options:
103+
delimiter: .
104+
index: 1

‎config/webhook/kustomizeconfig.yaml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# the following config is for teaching kustomize where to look at when substituting vars.
1+
# the following config is for teaching kustomize where to look at when modifing fields.
22
# It requires kustomize v2.1.0 or newer to work properly.
33
nameReference:
44
- kind: Service
@@ -20,6 +20,3 @@ namespace:
2020
group: admissionregistration.k8s.io
2121
path: webhooks/clientConfig/service/namespace
2222
create: true
23-
24-
varReference:
25-
- path: metadata/annotations

0 commit comments

Comments
 (0)