resources

Documentation

Index

• Constants
• Variables
• func GetDeployNamespace() string
• func GetImageID(imageRegistry, imageName, defaultImageVersion, imagePostfix, envVarName string) string

Constants

const APISvcName = "v1beta1.webhook.certmanager.k8s.io"

APISvcName is the name used for cert-manager-webhooks' apiservice definition

const AcmeSolverImageEnvVar = "ICP_CERT_MANAGER_ACMESOLVER_IMAGE"

AcmeSolverImageEnvVar is the env variable name defined in operator container for acme-solver Image. Check operator.yaml

const AcmesolverImageName = "icp-cert-manager-acmesolver"

AcmesolverImageName is the image name of the cert-manager-acmesolver

const CaInjectorImageEnvVar = "ICP_CERT_MANAGER_CAINJECTOR_IMAGE"

CaInjectorImageEnvVar is the env variable name defined in operator container for cainjector Image. Check operator.yaml

const CainjectorImageName = "icp-cert-manager-cainjector"

CainjectorImageName is the image name of the cert-manager-cainjector

const CainjectorLabels = "app=ibm-cert-manager-cainjector"

CainjectorLabels is a string of the cert-manager-cainjector's labels

const CertManagerAcmeSolverName = "cert-manager-acmesolver"

CertManagerAcmeSolverName is the name of the container/pod/deployment for cert-manager-acmesolver

const CertManagerCainjectorName = "cert-manager-cainjector"

CertManagerCainjectorName is the name of the container/pod/deployment for cert-manager-cainjector

const CertManagerConfigCR = `` /* 995-byte string literal not displayed */

base on doc https://www.ibm.com/docs/en/cpfs?topic=services-configuring-foundational-by-using-custom-resource#cert_resources

const CertManagerControllerName = "cert-manager-controller"

CertManagerControllerName is the name of the container/pod/deployment for cert-manager-controller

const CertManagerWebhookName = "cert-manager-webhook"

CertManagerWebhookName is the name of the container/pod/deployment for cert-manager-webhook

const ClusterRoleName = "cert-manager"

ClusterRoleName is the default name of the clusterrole and clusterrolebinding used by the cert-manager services

const ConfigmapWatcherName = "configmap-watcher"

ConfigmapWatcherName is the name of the container/pod/deployment for the configmap-watcher

const ControllerImageEnvVar = "ICP_CERT_MANAGER_CONTROLLER_IMAGE"

ControllerImageEnvVar is the env variable name defined in operator container for Controller Image. Check operator.yaml

const ControllerImageName = "icp-cert-manager-controller"

ControllerImageName is the image name of the cert-manager-controller

const ControllerImageVersion = "0.12.0"

ControllerImageVersion is the default image version used for the cert-manager-controller

const ControllerLabels = "app=ibm-cert-manager-controller"

ControllerLabels is a string of the cert-manager-controller's labels

const DefaultImagePostfix = ""

DefaultImagePostfix is set to empty. It indicates any platform suffix that you can append to an image tag

const DefaultNamespace = "ibm-cert-manager"

DefaultNamespace is the namespace the cert-manager services will be deployed in if the operator is deployed in all namespaces or locally

const ImageRegistry = "icr.io/cpopen/cpfs"

ImageRegistry is the default image registry for the operand deployments

const SecretWatchLabel string = "operator.ibm.com/watched-by-cert-manager"

SecretWatchLabel is a string of secrets that watched by cert manager operator labels

const ServiceAccount = "cert-manager"

ServiceAccount is the name of the default service account to be used by cert-manager services

const WebhookImageEnvVar = "ICP_CERT_MANAGER_WEBHOOK_IMAGE"

WebhookImageEnvVar is the env variable name defined in operator container for Webhook Image. Check operator.yaml

const WebhookImageName = "icp-cert-manager-webhook"

WebhookImageName is the image name of the cert-manager-webhook

const WebhookImageVersion = "0.12.0"

WebhookImageVersion is the default image version used for the cert-manager-webhook

const WebhookLabels = "app=ibm-cert-manager-webhook"

WebhookLabels is a string of the cert-manager-webhook's labels

const WebhookServingSecret = "cert-manager-webhook-ca"

WebhookServingSecret is the name of tls secret used for serving the cert-manager-webhook

Variables

var APIService = &apiRegv1.APIService{
	ObjectMeta: metav1.ObjectMeta{
		Name: APISvcName,
		Labels: map[string]string{
			"app": "ibm-cert-manager-webhook",
		},
		Annotations: map[string]string{},
	},
	Spec: apiRegv1.APIServiceSpec{
		Group:                "webhook.certmanager.k8s.io",
		GroupPriorityMinimum: 1000,
		VersionPriority:      15,
		Service: &apiRegv1.ServiceReference{
			Name: CertManagerWebhookName,
		},
		Version: "v1beta1",
	},
}

APIService is the apiservice for cert-manager-webhook

var AcmeSolverArg = "--acme-http01-solver-image=" + acmesolverImage

AcmeSolverArg is the acme solver image to use for the cert-manager-controller

var CAInjectorClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-cainjector",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"certificates"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{""},
			Resources: []string{"secrets"},
		},
		{
			Verbs:     []string{"get", "create", "update", "patch"},
			APIGroups: []string{""},
			Resources: []string{"events"},
		},
		{
			Verbs:     []string{"get", "list", "watch", "update"},
			APIGroups: []string{"admissionregistration.k8s.io"},
			Resources: []string{"validatingwebhookconfigurations", "mutatingwebhookconfigurations"},
		},
		{
			Verbs:     []string{"get", "list", "watch", "update"},
			APIGroups: []string{"apiregistration.k8s.io"},
			Resources: []string{"apiservices"},
		},
		{
			Verbs:     []string{"get", "list", "watch", "update"},
			APIGroups: []string{"apiextensions.k8s.io"},
			Resources: []string{"customresourcedefinitions"},
		},
		{
			Verbs:     []string{"get", "list", "watch", "update"},
			APIGroups: []string{"auditregistration.k8s.io"},
			Resources: []string{"auditsinks"},
		},
	},
}

var CAInjectorClusterRoleBinding = &rbacv1.ClusterRoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-cainjector",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind: "ServiceAccount",
			Name: "ibm-cert-manager-cainjector",
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "ClusterRole",
		Name:     "ibm-cert-manager-cainjector",
	},
}

var CAInjectorRole = &rbacv1.Role{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-cainjector:leaderelection",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:         []string{"get", "update", "patch"},
			APIGroups:     []string{""},
			Resources:     []string{"configmaps"},
			ResourceNames: []string{"cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"},
		},
		{
			Verbs:     []string{"create"},
			APIGroups: []string{""},
			Resources: []string{"configmaps"},
		},
		{
			Verbs:         []string{"get", "update", "patch"},
			APIGroups:     []string{"coordination.k8s.io"},
			Resources:     []string{"leases"},
			ResourceNames: []string{"cert-manager-cainjector-leader-election", "cert-manager-cainjector-leader-election-core"},
		},
		{
			Verbs:     []string{"create"},
			APIGroups: []string{"coordination.k8s.io"},
			Resources: []string{"leases"},
		},
	},
}

var CAInjectorRoleBinding = &rbacv1.RoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-cainjector:leaderelection",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind:      "ServiceAccount",
			Name:      "ibm-cert-manager-cainjector",
			Namespace: DeployNamespace,
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "Role",
		Name:     "ibm-cert-manager-cainjector:leaderelection",
	},
}

var CAInjectorServiceAccount = &corev1.ServiceAccount{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-cainjector",
	},
}

var CainjectorDeployment = &appsv1.Deployment{
	ObjectMeta: metav1.ObjectMeta{
		Name: CertManagerCainjectorName,

		Labels: CainjectorLabelMap,
	},
	Spec: appsv1.DeploymentSpec{
		Replicas: &replicaCount,
		Selector: &metav1.LabelSelector{
			MatchLabels: OriginalCainjectorLabelMap,
		},
		Template: corev1.PodTemplateSpec{
			ObjectMeta: metav1.ObjectMeta{
				Labels:      CainjectorLabelMap,
				Annotations: PodAnnotations,
			},
			Spec: certManagerCainjectorPod,
		},
	},
}

CainjectorDeployment is the deployment template for deploying the cert-manager-cainjector

var CainjectorLabelMap = map[string]string{}

var ClusterRoleBindingsToCreate = &rbacv1.ClusterRoleBindingList{
	Items: []rbacv1.ClusterRoleBinding{*ControllerApproveClusterRoleBinding, *ControllerCertificateSigningRequestsClusterRoleBinding, *ControllerIssuersClusterRoleBinding, *ControllerClusterIssuersClusterRoleBinding, *ControllerCertificatesClusterRoleBinding, *ControllerOrdersClusterRoleBinding, *ControllerChallengesClusterRoleBinding, *ControllerIngressShimClusterRoleBinding, *CAInjectorClusterRoleBinding, *WebhookClusterRoleBinding},
}

var ClusterRolesToCreate = &rbacv1.ClusterRoleList{
	Items: []rbacv1.ClusterRole{*ControllerViewClusterRole, *ControllerEditClusterRole, *ControllerApproveClusterRole, *ControllerCertificateSigningRequestsClusterRole, *ControllerIssuersClusterRole, *ControllerClusterIssuersClusterRole, *ControllerCertificatesClusterRole, *ControllerOrdersClusterRole, *ControllerChallengesClusterRole, *ControllerIngressShimClusterRole, *CAInjectorClusterRole, *WebhookClusterRole},
}

var ConfigWatchServiceAccount = &corev1.ServiceAccount{
	ObjectMeta: metav1.ObjectMeta{
		Name: "cert-manager",
	},
}

var ControllerApproveClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-approve:cert-manager-io",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:         []string{"approve"},
			APIGroups:     []string{"cert-manager.io"},
			Resources:     []string{"signers"},
			ResourceNames: []string{"issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"},
		},
	},
}

var ControllerApproveClusterRoleBinding = &rbacv1.ClusterRoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-approve:cert-manager-io",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind: "ServiceAccount",
			Name: "ibm-cert-manager-controller",
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "ClusterRole",
		Name:     "ibm-cert-manager-controller-approve:cert-manager-io",
	},
}

var ControllerCertificateSigningRequestsClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-certificatesigningrequests",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:     []string{"get", "list", "watch", "update"},
			APIGroups: []string{"certificates.k8s.io"},
			Resources: []string{"certificatesigningrequests"},
		},
		{
			Verbs:     []string{"update"},
			APIGroups: []string{"certificates.k8s.io"},
			Resources: []string{"certificatesigningrequests/status"},
		},
		{
			Verbs:         []string{"sign"},
			APIGroups:     []string{"certificates.k8s.io"},
			Resources:     []string{"signers"},
			ResourceNames: []string{"issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"},
		},
		{
			Verbs:     []string{"create"},
			APIGroups: []string{"authorization.k8s.io"},
			Resources: []string{"subjectaccessreviews"},
		},
	},
}

var ControllerCertificateSigningRequestsClusterRoleBinding = &rbacv1.ClusterRoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-certificatesigningrequests",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind: "ServiceAccount",
			Name: "ibm-cert-manager-controller",
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "ClusterRole",
		Name:     "ibm-cert-manager-controller-certificatesigningrequests",
	},
}

var ControllerCertificatesClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-certificates",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:     []string{"update"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"certificates", "certificates/status", "certificaterequests", "certificaterequests/status"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"certificates", "certificaterequests", "clusterissuers", "issuers"},
		},
		{
			Verbs:     []string{"update"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"certificates/finalizers", "certificaterequests/finalizers"},
		},
		{
			Verbs:     []string{"create", "delete", "get", "list", "watch"},
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"orders"},
		},
		{
			Verbs:     []string{"get", "list", "watch", "create", "update", "delete", "patch"},
			APIGroups: []string{""},
			Resources: []string{"secrets"},
		},
		{
			Verbs:     []string{"create", "patch"},
			APIGroups: []string{""},
			Resources: []string{"events"},
		},
	},
}

var ControllerCertificatesClusterRoleBinding = &rbacv1.ClusterRoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-certificates",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind: "ServiceAccount",
			Name: "ibm-cert-manager-controller",
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "ClusterRole",
		Name:     "ibm-cert-manager-controller-certificates",
	},
}

var ControllerChallengesClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-challenges",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:     []string{"update"},
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges", "challenges/status"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"clusterissuers", "issuers"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{""},
			Resources: []string{"secrets"},
		},
		{
			Verbs:     []string{"create", "patch"},
			APIGroups: []string{""},
			Resources: []string{"events"},
		},
		{
			Verbs:     []string{"get", "list", "watch", "create", "delete"},
			APIGroups: []string{""},
			Resources: []string{"pods", "services"},
		},
		{
			Verbs:     []string{"get", "list", "watch", "create", "delete", "update"},
			APIGroups: []string{"networking.k8s.io"},
			Resources: []string{"ingresses"},
		},
		{
			Verbs:     []string{"get", "list", "watch", "create", "delete", "update"},
			APIGroups: []string{"networking.x-k8s.io"},
			Resources: []string{"httproutes"},
		},
		{
			Verbs:     []string{"create"},
			APIGroups: []string{"route.openshift.io"},
			Resources: []string{"routes/custom-host"},
		},
		{
			Verbs:     []string{"update"},
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges/finalizers"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{""},
			Resources: []string{"secrets"},
		},
	},
}

var ControllerChallengesClusterRoleBinding = &rbacv1.ClusterRoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-challenges",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind: "ServiceAccount",
			Name: "ibm-cert-manager-controller",
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "ClusterRole",
		Name:     "ibm-cert-manager-controller-challenges",
	},
}

var ControllerClusterIssuersClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-clusterissuers",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:     []string{"update"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"clusterissuers", "clusterissuers/status"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"clusterissuers"},
		},
		{
			Verbs:     []string{"get", "list", "watch", "create", "update", "delete"},
			APIGroups: []string{""},
			Resources: []string{"secrets"},
		},
		{
			Verbs:     []string{"create", "patch"},
			APIGroups: []string{""},
			Resources: []string{"events"},
		},
	},
}

var ControllerClusterIssuersClusterRoleBinding = &rbacv1.ClusterRoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-clusterissuers",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind: "ServiceAccount",
			Name: "ibm-cert-manager-controller",
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "ClusterRole",
		Name:     "ibm-cert-manager-controller-clusterissuers",
	},
}

var ControllerDeployment = &appsv1.Deployment{
	ObjectMeta: metav1.ObjectMeta{
		Name: CertManagerControllerName,

		Labels: ControllerLabelMap,
	},
	Spec: appsv1.DeploymentSpec{
		Replicas: &replicaCount,
		Selector: &metav1.LabelSelector{
			MatchLabels: OriginalControllerLabelMap,
		},
		Template: corev1.PodTemplateSpec{
			ObjectMeta: metav1.ObjectMeta{
				Labels:      ControllerLabelMap,
				Annotations: PodAnnotations,
			},
			Spec: certManagerControllerPod,
		},
	},
}

ControllerDeployment is the deployment template for deploying the cert-manager-controller

var ControllerEditClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-edit",
		Labels: map[string]string{
			"rbac.authorization.k8s.io/aggregate-to-edit":  "true",
			"rbac.authorization.k8s.io/aggregate-to-admin": "true",
		},
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:     []string{"create", "delete", "deletecollection", "patch", "update"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"certificates", "certificaterequests", "issuers"},
		},
		{
			Verbs:     []string{"create", "delete", "deletecollection", "patch", "update"},
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges", "orders"},
		},
	},
}

var ControllerIngressShimClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-ingress-shim",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:     []string{"create", "update", "delete"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"certificates", "certificaterequests"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"certificates", "certificaterequests", "issuers", "clusterissuers"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"networking.k8s.io"},
			Resources: []string{"ingresses"},
		},
		{
			Verbs:     []string{"update"},
			APIGroups: []string{"networking.k8s.io"},
			Resources: []string{"ingresses/finalizers"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"networking.x-k8s.io"},
			Resources: []string{"gateways", "httproutes"},
		},
		{
			Verbs:     []string{"update"},
			APIGroups: []string{"networking.x-k8s.io"},
			Resources: []string{"gateways/finalizers", "httproutes/finalizers"},
		},
		{
			Verbs:     []string{"create", "patch"},
			APIGroups: []string{""},
			Resources: []string{"events"},
		},
	},
}

var ControllerIngressShimClusterRoleBinding = &rbacv1.ClusterRoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-ingress-shim",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind: "ServiceAccount",
			Name: "ibm-cert-manager-controller",
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "ClusterRole",
		Name:     "ibm-cert-manager-controller-ingress-shim",
	},
}

var ControllerIssuersClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-issuers",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:     []string{"update"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"issuers", "issuers/status"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"issuers"},
		},
		{
			Verbs:     []string{"get", "list", "watch", "create", "update", "delete"},
			APIGroups: []string{""},
			Resources: []string{"secrets"},
		},
		{
			Verbs:     []string{"create", "patch"},
			APIGroups: []string{""},
			Resources: []string{"events"},
		},
	},
}

var ControllerIssuersClusterRoleBinding = &rbacv1.ClusterRoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-issuers",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind: "ServiceAccount",
			Name: "ibm-cert-manager-controller",
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "ClusterRole",
		Name:     "ibm-cert-manager-controller-issuers",
	},
}

var ControllerLabelMap = map[string]string{}

var ControllerOrdersClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-orders",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:     []string{"update"},
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"orders", "orders/status"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"orders", "challenges"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"clusterissuers", "issuers"},
		},
		{
			Verbs:     []string{"create", "delete"},
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges"},
		},
		{
			Verbs:     []string{"update"},
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"orders/finalizers"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{""},
			Resources: []string{"secrets"},
		},
		{
			Verbs:     []string{"create", "patch"},
			APIGroups: []string{""},
			Resources: []string{"events"},
		},
	},
}

var ControllerOrdersClusterRoleBinding = &rbacv1.ClusterRoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-orders",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind: "ServiceAccount",
			Name: "ibm-cert-manager-controller",
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "ClusterRole",
		Name:     "ibm-cert-manager-controller-orders",
	},
}

var ControllerRole = &rbacv1.Role{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller:leaderelection",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:         []string{"get", "update", "patch"},
			APIGroups:     []string{""},
			Resources:     []string{"configmaps"},
			ResourceNames: []string{"cert-manager-controller"},
		},
		{
			Verbs:     []string{"create"},
			APIGroups: []string{""},
			Resources: []string{"configmaps"},
		},
		{
			Verbs:         []string{"get", "update", "patch"},
			APIGroups:     []string{"coordination.k8s.io"},
			Resources:     []string{"leases"},
			ResourceNames: []string{"cert-manager-controller"},
		},
		{
			Verbs:     []string{"create"},
			APIGroups: []string{"coordination.k8s.io"},
			Resources: []string{"leases"},
		},
	},
}

var ControllerRoleBinding = &rbacv1.RoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller:leaderelection",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind: "ServiceAccount",
			Name: "ibm-cert-manager-controller",
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "Role",
		Name:     "ibm-cert-manager-controller:leaderelection",
	},
}

var ControllerServiceAccount = &corev1.ServiceAccount{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller",
	},
}

var ControllerViewClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-controller-view",
		Labels: map[string]string{
			"rbac.authorization.k8s.io/aggregate-to-view":  "true",
			"rbac.authorization.k8s.io/aggregate-to-edit":  "true",
			"rbac.authorization.k8s.io/aggregate-to-admin": "true",
		},
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"cert-manager.io"},
			Resources: []string{"certificates", "certificaterequests", "issuers"},
		},
		{
			Verbs:     []string{"get", "list", "watch"},
			APIGroups: []string{"acme.cert-manager.io"},
			Resources: []string{"challenges", "orders"},
		},
	},
}

var DefaultArgs = []string{}

DefaultArgs are the default arguments use for cert-manager-controller

var DeployNamespace = GetDeployNamespace()

DeployNamespace is the namespace the cert-manager services will be deployed in

var FalseVar = false

FalseVar the variable representing the boolean value false

var MutatingWebhook = &admRegv1.MutatingWebhookConfiguration{
	ObjectMeta: metav1.ObjectMeta{
		Name:   CertManagerWebhookName,
		Labels: WebhookLabelMap,
		Annotations: map[string]string{
			"cert-manager.io/inject-ca-from-secret": DeployNamespace + "/" + WebhookServingSecret,
		},
	},
	Webhooks: []admRegv1.MutatingWebhook{
		{
			Name: "webhook.cert-manager.io",
			ClientConfig: admRegv1.WebhookClientConfig{
				Service: &admRegv1.ServiceReference{
					Namespace: DeployNamespace,
					Name:      CertManagerWebhookName,
					Path:      &mutationPath,
				},
			},
			Rules: []admRegv1.RuleWithOperations{
				{
					Operations: []admRegv1.OperationType{
						admRegv1.Create,
						admRegv1.Update,
					},
					Rule: admRegv1.Rule{
						APIGroups: []string{
							"cert-manager.io",
							"acme.cert-manager.io",
						},
						APIVersions: []string{
							"v1",
						},
						Resources: []string{
							"*/*",
						},
					},
				},
			},
			FailurePolicy:           &failPolicy,
			SideEffects:             &sideEffect,
			AdmissionReviewVersions: []string{"v1"},
			TimeoutSeconds:          &timeoutSecondsWebhook,
		},
	},
}

MutatingWebhook is the mutating webhook definition for cert-manager-webhook

var OriginalCainjectorLabelMap = map[string]string{
	"app":                          "ibm-cert-manager-cainjector",
	"app.kubernetes.io/name":       "ibm-cert-manager-cainjector",
	"app.kubernetes.io/component":  certManagerComponentName,
	"app.kubernetes.io/managed-by": "operator",
	"app.kubernetes.io/instance":   certManagerComponentName,
	"release":                      certManagerComponentName,
}

CainjectorLabelMap is a map of all the labels used by the cert-manager-cainjector

var OriginalControllerLabelMap = map[string]string{
	"app":                          "ibm-cert-manager-controller",
	"app.kubernetes.io/name":       "ibm-cert-manager-controller",
	"app.kubernetes.io/component":  certManagerComponentName,
	"app.kubernetes.io/managed-by": "operator",
	"app.kubernetes.io/instance":   certManagerComponentName,
	"release":                      certManagerComponentName,
}

ControllerLabelMap is a map of all the labels used by cert-manager-controller

var OriginalWebhookLabelMap = map[string]string{
	"app":                          "ibm-cert-manager-webhook",
	"app.kubernetes.io/name":       "ibm-cert-manager-webhook",
	"app.kubernetes.io/component":  certManagerComponentName,
	"app.kubernetes.io/managed-by": "operator",
	"app.kubernetes.io/instance":   certManagerComponentName,
	"release":                      certManagerComponentName,
}

WebhookLabelMap is a map of all the labels used by the cert-manager-webhook

var PodAnnotations = map[string]string{"openshift.io/scc": "restricted", "productName": "IBM Cloud Platform Common Services", "productID": "068a62892a1e4db39641342e592daa25", "productMetric": "FREE"}

PodAnnotations are the annotations required for a pod

var PodNamespace = os.Getenv("POD_NAMESPACE")

PodNamespace is the namespace the the operator is getting deployed (set in an env var)

var ResourceNS = "--cluster-resource-namespace=" + DeployNamespace

ResourceNS is the resource namespace arg for cert-manager-controller

var RoleBindingsToCreate = &rbacv1.RoleBindingList{
	Items: []rbacv1.RoleBinding{*ControllerRoleBinding, *CAInjectorRoleBinding, *WebhookRoleBinding},
}

var RolesToCreate = &rbacv1.RoleList{
	Items: []rbacv1.Role{*ControllerRole, *CAInjectorRole, *WebhookRole},
}

var ServiceAccountsToCreate = &corev1.ServiceAccountList{
	Items: []corev1.ServiceAccount{*ControllerServiceAccount, *CAInjectorServiceAccount, *WebhookServiceAccount, *ConfigWatchServiceAccount},
}

var TrueVar = true

TrueVar the variable representing the boolean value true

var ValidatingWebhook = &admRegv1.ValidatingWebhookConfiguration{
	ObjectMeta: metav1.ObjectMeta{
		Name:   CertManagerWebhookName,
		Labels: WebhookLabelMap,
		Annotations: map[string]string{
			"cert-manager.io/inject-ca-from-secret": DeployNamespace + "/" + WebhookServingSecret,
		},
	},
	Webhooks: []admRegv1.ValidatingWebhook{
		{
			Name: "webhook.cert-manager.io",
			Rules: []admRegv1.RuleWithOperations{
				{
					Operations: []admRegv1.OperationType{
						admRegv1.Create,
						admRegv1.Update,
					},
					Rule: admRegv1.Rule{
						APIGroups: []string{
							"cert-manager.io",
							"acme.cert-manager.io",
						},
						APIVersions: []string{
							"v1",
						},
						Resources: []string{
							"*/*",
						},
					},
				},
			},
			AdmissionReviewVersions: []string{"v1"},
			ClientConfig: admRegv1.WebhookClientConfig{
				Service: &admRegv1.ServiceReference{
					Namespace: DeployNamespace,
					Name:      CertManagerWebhookName,
					Path:      &valPath,
				},
			},
			FailurePolicy: &failPolicy,
			SideEffects:   &sideEffect,
			NamespaceSelector: &metav1.LabelSelector{
				MatchExpressions: []metav1.LabelSelectorRequirement{
					{
						Key:      "cert-manager.io/disable-validation",
						Operator: metav1.LabelSelectorOpNotIn,
						Values:   []string{"true"},
					},
					{
						Key:      "name",
						Operator: metav1.LabelSelectorOpNotIn,
						Values:   []string{DeployNamespace},
					},
				},
			},
			TimeoutSeconds: &timeoutSecondsWebhook,
		},
	},
}

ValidatingWebhook is the validating webhook definition for cert-manager-webhook

var WebhookClusterRole = &rbacv1.ClusterRole{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-webhook:subjectaccessreviews",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:     []string{"create"},
			APIGroups: []string{"authorization.k8s.io"},
			Resources: []string{"subjectaccessreviews"},
		},
	},
}

var WebhookClusterRoleBinding = &rbacv1.ClusterRoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-webhook:subjectaccessreviews",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind: "ServiceAccount",
			Name: "ibm-cert-manager-webhook",
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "ClusterRole",
		Name:     "ibm-cert-manager-webhook:subjectaccessreviews",
	},
}

var WebhookDeployment = &appsv1.Deployment{
	ObjectMeta: metav1.ObjectMeta{
		Name: CertManagerWebhookName,

		Labels: WebhookLabelMap,
	},
	Spec: appsv1.DeploymentSpec{
		Replicas: &replicaCount,
		Selector: &metav1.LabelSelector{
			MatchLabels: map[string]string{
				"app": "ibm-cert-manager-webhook",
			},
		},
		Template: corev1.PodTemplateSpec{
			ObjectMeta: metav1.ObjectMeta{
				Labels:      WebhookLabelMap,
				Annotations: securityAnnotationWebhook,
			},
			Spec: certManagerWebhookPod,
		},
	},
}

WebhookDeployment is the deployment template for deploying the cert-manager-webhook

var WebhookLabelMap = map[string]string{}

var WebhookRole = &rbacv1.Role{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-webhook:dynamic-serving",
	},
	Rules: []rbacv1.PolicyRule{
		{
			Verbs:         []string{"get", "list", "watch", "update"},
			APIGroups:     []string{""},
			Resources:     []string{"secrets"},
			ResourceNames: []string{"cert-manager-webhook-ca"},
		},
		{
			Verbs:     []string{"create", "list"},
			APIGroups: []string{""},
			Resources: []string{"secrets"},
		},
	},
}

var WebhookRoleBinding = &rbacv1.RoleBinding{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-webhook:dynamic-serving",
	},
	Subjects: []rbacv1.Subject{
		{
			Kind:      "ServiceAccount",
			APIGroup:  "",
			Name:      "ibm-cert-manager-webhook",
			Namespace: DeployNamespace,
		},
	},
	RoleRef: rbacv1.RoleRef{
		APIGroup: "rbac.authorization.k8s.io",
		Kind:     "Role",
		Name:     "ibm-cert-manager-webhook:dynamic-serving",
	},
}

var WebhookServiceAccount = &corev1.ServiceAccount{
	ObjectMeta: metav1.ObjectMeta{
		Name: "ibm-cert-manager-webhook",
	},
}

var WebhookSvc = &corev1.Service{
	ObjectMeta: metav1.ObjectMeta{
		Name:      CertManagerWebhookName,
		Namespace: DeployNamespace,
		Labels: map[string]string{
			"app": "ibm-cert-manager-webhook",
		},
	},
	Spec: corev1.ServiceSpec{
		Ports: []corev1.ServicePort{
			{
				Name:     "https",
				Port:     443,
				Protocol: "TCP",
				TargetPort: intstr.IntOrString{
					IntVal: 10250,
				},
			},
		},
		Selector: map[string]string{
			"app": "ibm-cert-manager-webhook",
		},
		Type: corev1.ServiceTypeClusterIP,
	},
}

WebhookSvc is the service definition for cert-manager-webhook

Functions

func GetDeployNamespace

func GetDeployNamespace() string

GetDeployNamespace returns the namespace cert manager operator is deployed in

func GetImageID

func GetImageID(imageRegistry, imageName, defaultImageVersion, imagePostfix, envVarName string) string

GetImageID constructs image IDs for operands: either <IMAGE_NAME>:<IMAGE_TAG> or <IMAGE_NAME>@<IMAGE_SHA>