re-add helm chart and automated chart release

.github/workflows/helm-release.yaml

@@ -0,0 +1,30 @@
+# This workflow publishes a new chart release to github pages
+# The content of the branch gh-pages is then published to https://puzzle.github.io/cert-manager-webhook-dnsimple/
+name: Release a new chart version
+
+on:
+  workflow_dispatch:
+
+jobs:
+  release:
+    permissions:
+      contents: write
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "[email protected]"
+
+      - name: Run chart-releaser
+        uses: helm/[email protected]
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+        with:
+          charts_dir: ./charts

.gitignore

@@ -11,8 +11,5 @@
 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
 
-# Ignore the built binary
-cert-manager-webhook-dnsimple
-
 # Ignore kubebuilder test binaries
 _test/

charts/cert-manager-webhook-dnsimple/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/cert-manager-webhook-dnsimple/Chart.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+appVersion: "0.1.2"
+description: cert-manager webhook solver for ACME DNS01 challenge via DNSimple
+name: cert-manager-webhook-dnsimple
+version: 0.1.2
+home: https://github.com/puzzle/cert-manager-webhook-dnsimple
+sources:
+  - https://github.com/puzzle/cert-manager-webhook-dnsimple
+maintainers:
+  - name: Puzzle ITC
+    email: [email protected]
+    url: https://www.puzzle.ch

charts/cert-manager-webhook-dnsimple/templates/_helpers.tpl

@@ -0,0 +1,52 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "dnsimple-webhook.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "dnsimple-webhook.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "dnsimple-webhook.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "dnsimple-webhook.selfSignedIssuer" -}}
+{{ printf "%s-selfsign" (include "dnsimple-webhook.fullname" .) }}
+{{- end -}}
+
+{{- define "dnsimple-webhook.rootCAIssuer" -}}
+{{ printf "%s-ca" (include "dnsimple-webhook.fullname" .) }}
+{{- end -}}
+
+{{- define "dnsimple-webhook.rootCACertificate" -}}
+{{ printf "%s-ca" (include "dnsimple-webhook.fullname" .) }}
+{{- end -}}
+
+{{- define "dnsimple-webhook.servingCertificate" -}}
+{{ printf "%s-webhook-tls" (include "dnsimple-webhook.fullname" .) }}
+{{- end -}}
+
+{{- define "dnsimple-webhook.tokenSecretName" -}}
+{{- default (include "dnsimple-webhook.fullname" .) (.Values.dnsimple.tokenSecretName) -}}
+{{- end -}}

charts/cert-manager-webhook-dnsimple/templates/apiservice.yaml

@@ -0,0 +1,20 @@
+{{- $APIRegistrationAPIVersion := ternary "apiregistration.k8s.io/v1" "apiregistration.k8s.io/v1beta1" (.Capabilities.APIVersions.Has "apiregistration.k8s.io/v1") -}}
+apiVersion: {{ $APIRegistrationAPIVersion }}
+kind: APIService
+metadata:
+  name: v1alpha1.{{ .Values.groupName }}
+  labels:
+    app: {{ include "dnsimple-webhook.name" . }}
+    chart: {{ include "dnsimple-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "dnsimple-webhook.servingCertificate" . }}"
+spec:
+  group: {{ .Values.groupName }}
+  groupPriorityMinimum: 1000
+  versionPriority: 15
+  service:
+    name: {{ include "dnsimple-webhook.fullname" . }}
+    namespace: {{ .Release.Namespace }}
+  version: v1alpha1

charts/cert-manager-webhook-dnsimple/templates/deployment.yaml

@@ -0,0 +1,79 @@
+{{- if semverCompare ">=1.16-0" .Capabilities.KubeVersion.GitVersion -}}
+apiVersion: apps/v1
+{{- else -}}
+apiVersion: extensions/v1beta1
+{{- end }}
+kind: Deployment
+metadata:
+  name: {{ include "dnsimple-webhook.fullname" . }}
+  labels:
+    app: {{ include "dnsimple-webhook.name" . }}
+    chart: {{ include "dnsimple-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ include "dnsimple-webhook.name" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ include "dnsimple-webhook.name" . }}
+        release: {{ .Release.Name }}
+    spec:
+      serviceAccountName: {{ include "dnsimple-webhook.fullname" . }}
+      {{- if .Values.image.pullSecret }}
+      imagePullSecrets:
+        - name: {{ .Values.image.pullSecret }}
+      {{- end }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+            - --tls-cert-file=/tls/tls.crt
+            - --tls-private-key-file=/tls/tls.key
+{{- if .Values.logLevel }}
+            - --v={{ .Values.logLevel }}
+{{- end }}
+          env:
+            - name: GROUP_NAME
+              value: {{ .Values.groupName | quote }}
+          ports:
+            - name: https
+              containerPort: 443
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /healthz
+              port: https
+          readinessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /healthz
+              port: https
+          volumeMounts:
+            - name: certs
+              mountPath: /tls
+              readOnly: true
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+      volumes:
+        - name: certs
+          secret:
+            secretName: {{ include "dnsimple-webhook.servingCertificate" . }}
+    {{- with .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}

charts/cert-manager-webhook-dnsimple/templates/pki.yaml

@@ -0,0 +1,77 @@
+{{- $CertManagerAPIVersion := ternary "cert-manager.io/v1" "cert-manager.io/v1alpha2" (.Capabilities.APIVersions.Has "cert-manager.io/v1") -}}
+---
+# Create a selfsigned Issuer, in order to create a root CA certificate for
+# signing webhook serving certificates
+apiVersion: {{ $CertManagerAPIVersion }}
+kind: Issuer
+metadata:
+  name: {{ include "dnsimple-webhook.selfSignedIssuer" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "dnsimple-webhook.name" . }}
+    chart: {{ include "dnsimple-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  selfSigned: {}
+
+---
+
+# Generate a CA Certificate used to sign certificates for the webhook
+apiVersion: {{ $CertManagerAPIVersion }}
+kind: Certificate
+metadata:
+  name: {{ include "dnsimple-webhook.rootCACertificate" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "dnsimple-webhook.name" . }}
+    chart: {{ include "dnsimple-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  secretName: {{ include "dnsimple-webhook.rootCACertificate" . }}
+  duration: 43800h0m0s # 5y
+  issuerRef:
+    name: {{ include "dnsimple-webhook.selfSignedIssuer" . }}
+  commonName: "ca.dnsimple-webhook.cert-manager"
+  isCA: true
+
+---
+
+# Create an Issuer that uses the above generated CA certificate to issue certs
+apiVersion: {{ $CertManagerAPIVersion }}
+kind: Issuer
+metadata:
+  name: {{ include "dnsimple-webhook.rootCAIssuer" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "dnsimple-webhook.name" . }}
+    chart: {{ include "dnsimple-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  ca:
+    secretName: {{ include "dnsimple-webhook.rootCACertificate" . }}
+
+---
+
+# Finally, generate a serving certificate for the webhook to use
+apiVersion: {{ $CertManagerAPIVersion }}
+kind: Certificate
+metadata:
+  name: {{ include "dnsimple-webhook.servingCertificate" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "dnsimple-webhook.name" . }}
+    chart: {{ include "dnsimple-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  secretName: {{ include "dnsimple-webhook.servingCertificate" . }}
+  duration: 8760h0m0s # 1y
+  issuerRef:
+    name: {{ include "dnsimple-webhook.rootCAIssuer" . }}
+  dnsNames:
+  - {{ include "dnsimple-webhook.fullname" . }}
+  - {{ include "dnsimple-webhook.fullname" . }}.{{ .Release.Namespace }}
+  - {{ include "dnsimple-webhook.fullname" . }}.{{ .Release.Namespace }}.svc

charts/cert-manager-webhook-dnsimple/templates/production.cluster-issuer.yaml

@@ -0,0 +1,27 @@
+{{- if .Values.clusterIssuer.production.enabled -}}
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ include "dnsimple-webhook.fullname" . }}-production
+  labels:
+    app: {{ include "dnsimple-webhook.name" . }}
+    chart: {{ include "dnsimple-webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  acme:
+    email: {{ .Values.clusterIssuer.email }}
+    privateKeySecretRef:
+      name: {{ include "dnsimple-webhook.fullname" . }}-production
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+    - dns01:
+        webhook:
+          config:
+            tokenSecretRef:
+              key: token
+              name: {{ include "dnsimple-webhook.tokenSecretName" . }}
+            accountID: {{ .Values.dnsimple.accountID | quote }}
+          groupName: {{ .Values.groupName }}
+          solverName: dnsimple
+{{- end -}}