security(cilium): stop committing CA + Hubble private keys (Fixes #188) #239
+185
-19
@@ -29,33 +29,199 @@ metadata:
|
||||
name: "cilium-operator"
|
||||
namespace: kube-system
|
||||
---
|
||||
# Source: cilium/templates/cilium-ca-secret.yaml
|
||||
# Source: cilium/templates/hubble/tls-cronjob/serviceaccount.yaml
|
||||
# Cilium CA + Hubble server certs are generated in-cluster by the
|
||||
# hubble-generate-certs Job below (hubble.tls.auto.method=cronJob),
|
||||
# NOT baked into this manifest. The Job creates/reuses Secret cilium-ca
|
||||
# and issues Secret hubble-server-certs at install; the CronJob renews
|
||||
# them. No private key material is committed to git. See issue #188.
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: cilium-ca
|
||||
name: "hubble-generate-certs"
|
||||
namespace: kube-system
|
||||
labels:
|
||||
cilium.io/helm-template-non-idempotent: "true"
|
||||
data:
|
||||
ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQU9DbHNSOTFSQWdPekpJbTdOc0hFcG93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTVNRFF3TXpFNApNamt6TWxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwaDcwM3UrUTNHOTNJZmdaTG9QeWY3RzdjN3NEbklYWTJWbWdLMmxpMlJsSlg2TnAKMmFXTUxzaWFHUm9iOTl5NEZGdW13dzFScFBkdkVmd0I3NUVxRXE1UlV2L0dQUUhLbHNTWGJMY0QzUW9tU2piUApaaVYrTUlXMHRrcHFyVFVvSjNaQ096M1dscmcyeFRHNEFVZFhlelhYZ1lKeVZ2U1B2ZTFEeC8ra0xpMlpCcmxoCk14QXA1MjAxbHBURVl3dThxU0xqMmlhbkhZWFBTUzV5OGhUSzBna3psTTgzblcyZThBbjd2TCt0TlQwQlVGaGMKbnozYUVidytNK2IwcG1vbFhCUTA5M29BaUdsSXR2SmJ1QkU0VXdtQnJIVDB3Zk1sL2phWEt3Z3g1SDlVeHpxYwpzcm1rZC9iSytiZ2g3S01WdWpOUU1OZlNHRldmY2JCdWR5MlJJd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRSt0T2JjUGRtVlZtaWdOazU5OEVjLysyZ0MwTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQWRUSkhkTVNsNnlmQ1dLZHpWK0xrSUxmQXFyU3FETDZUN2VDclM2U0EyWklnZjVvcU4xd1NOCmdlWlNmZjRsL2xDdDNZYUFXeXVIZEtPaWFqb29XUStyR1A3OTRWdnJHZ0ZVNDF1UTI4YWRkUDB5dkpSTklRUXgKQVNrZ2NzTVV0VlZVQTZjK1d6TDZCTGJHZ0Q0NUhHU1ZoWmI0TXY4NVdXMDE0eXc3L2NINm9ObHVLbjR2ZEFmTgpCVGZ1WUl1SURoS0NkUEVHVnFOMHgvV08wY0xRWXZXT0NLblNVejIzOEV3NVFLWVRWd04rd3diTXdZZlBrMDcrCkF3UFBXWlc3OXNBVnFPWlRjRElpcmwzTVIyR3QxaVVaSkUvY0ttVWJjS2RXMGVXWGdQQUpRQkIrdnNCd3Y4MVUKa282eFFzc1lDWGd1dWc2aW1qRFNTRVhNSWpudS93UGYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBMGg3MDN1K1EzRzkzSWZnWkxvUHlmN0c3YzdzRG5JWFkyVm1nSzJsaTJSbEpYNk5wCjJhV01Mc2lhR1JvYjk5eTRGRnVtd3cxUnBQZHZFZndCNzVFcUVxNVJVdi9HUFFIS2xzU1hiTGNEM1FvbVNqYlAKWmlWK01JVzB0a3BxclRVb0ozWkNPejNXbHJnMnhURzRBVWRYZXpYWGdZSnlWdlNQdmUxRHgvK2tMaTJaQnJsaApNeEFwNTIwMWxwVEVZd3U4cVNMajJpYW5IWVhQU1M1eThoVEswZ2t6bE04M25XMmU4QW43dkwrdE5UMEJVRmhjCm56M2FFYncrTStiMHBtb2xYQlEwOTNvQWlHbEl0dkpidUJFNFV3bUJySFQwd2ZNbC9qYVhLd2d4NUg5VXh6cWMKc3Jta2QvYksrYmdoN0tNVnVqTlFNTmZTR0ZXZmNiQnVkeTJSSXdJREFRQUJBb0lCQUdTZGVqZytreWxiSHJyZgphSCtEbzExT0tDclV4SGZ4QjlPY1BUeE1iSTcwc3RQZkZsS29HU1pWM0tSa2dqd0FMdzFnamN3YzFwbWQra3VzClZ1ajJwQ1RwMy90VWl3S3ZsdWozSG1OcWg2a1NzUjhjZTllMzRHTXZ3MGIrLzNJTllEcjFQK1hLU0xWSFpNS3MKZWlYeW1ZdGdUdCt2TFQxQ1FvcDUwTmsyS3RJSkdYajVacSt5YXY3czRTMFFDU0lKeitMREVmSHQzMThnb0lqaQpEd1Bvd0dVZzlBUW1NYUtSRnI3S1REdk0yeGg3MEZJcW1kcWJ6WFdiTzQwV1VQLzBpQzlUZHhBN1dabHBuSGJ3ClBIZkdUY2krcXNLOUJ5RmU2Vm1YeHU5Nk1GcmY5aXdKaXc1WmZOdzZYb1RIMFZKazBqRWNJbjYybGVpQWh2TjgKbUp6MjFHRUNnWUVBNnRONEdJRlphODFtOTdNeWNkazc1TVh2ekczNVl3bHhmTlA3bmRVUkt0SHZCWnpLVUg1QgpObUhvZHpxUisraTl5SlJacnJsejlmSy9scE1GcTRrL0FGdDQ0WElxZWQ2dXE1ZUZSK3NMMkZGN1ZUclFxQUpJClhyQWJmdlptTTFxOUMwYUtxenlpbkRXQ2kxZGVTdDdncDRuakZSZHhYNEE5VGVwZ3MvOHBJR3NDZ1lFQTVSRTIKOFdaSHVxWHhqYXRoZlI2K25YMjZiNGc5Z1ZFdDdGaCsyR1NYSUpCeWQ2dmYrOGxxWE1iVmFtdDkyNHRBOEx4dApoaGhpYjhSRStGcFZyVHpHVVBDblNETlhIU25YYVMvMnY3Wjd5eU9BM1ZJUzVwenVsQUdndWlPTzI2b0M0dVdwCjVkQXRiRW9wUGZYdUxReUFoMjNBMjJ1dlJlb2ZxaXNXQVRzZUlDa0NnWUJkV3JDVjNXWjFTdlV5YUJVWDJhckwKNmp6STRyZVFQY0xXUTFmMmlTd0gvK21zSzRicXRTYXJ2Z1N5MGFBVHE1VTNWbkxJMllWV002a2k3VlFGdTh4RwpFaGRlV1FxMTVHZEFaRDVpTnZsQWlEUWx6L24vc05pZ2ZCYVNSTmFnZCtSTHhVRi9qZDEvaUc1Ymd1SkRsWk51ClI0ejFaNXAwd3dDY0p4OUdyNXZqL1FLQmdRQzR1OUpZaWtqc3NPbUdmQ0ZLRzZKVU50SkZJbFdmMWMwNFh3SWwKRjdKOWs2Q00vSExOaDFrYzYwbXY0bktFdk9BcGhYeTZlUzNodnlKME83MyswUldLcnhucGMyWWM0ZUtVTlJkRQo4ekVRMlZnU3BSOFRGcHFkaUZhTDV5Tk42ZVVjQVdXc0xlQ0VCYWNQRGlmLzhxWXhFZ1ZIcjZlUnRjZkZuNnZHCllGdmlTUUtCZ1FEZVlJWjVHaCszd244V2cydVRjQ2hkS20wWFlTT282QjVRUU1yNU1QU3U5NnYvQ3pnR2tGN1AKTWhiSE5SNlF4NW5DT0thajZEaEcvM3BHQkFFb244OE42bHExdGRJaS9OaXRISWlzeUJDSXRsK0ZoODFLekNJSgpYSVZGOW1lS1N1OUN0QXBjYmU1TWJxWWFKNjMxK1pUNndTLy9qU05rbmFpUzh0T3hBN0Z1bEE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
|
||||
---
|
||||
# Source: cilium/templates/hubble/tls-helm/server-secret.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
# Source: cilium/templates/hubble/tls-cronjob/role.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: hubble-server-certs
|
||||
name: hubble-generate-certs
|
||||
namespace: kube-system
|
||||
labels:
|
||||
cilium.io/helm-template-non-idempotent: "true"
|
||||
app.kubernetes.io/part-of: cilium
|
||||
|
||||
annotations:
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQU9DbHNSOTFSQWdPekpJbTdOc0hFcG93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTVNRFF3TXpFNApNamt6TWxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwaDcwM3UrUTNHOTNJZmdaTG9QeWY3RzdjN3NEbklYWTJWbWdLMmxpMlJsSlg2TnAKMmFXTUxzaWFHUm9iOTl5NEZGdW13dzFScFBkdkVmd0I3NUVxRXE1UlV2L0dQUUhLbHNTWGJMY0QzUW9tU2piUApaaVYrTUlXMHRrcHFyVFVvSjNaQ096M1dscmcyeFRHNEFVZFhlelhYZ1lKeVZ2U1B2ZTFEeC8ra0xpMlpCcmxoCk14QXA1MjAxbHBURVl3dThxU0xqMmlhbkhZWFBTUzV5OGhUSzBna3psTTgzblcyZThBbjd2TCt0TlQwQlVGaGMKbnozYUVidytNK2IwcG1vbFhCUTA5M29BaUdsSXR2SmJ1QkU0VXdtQnJIVDB3Zk1sL2phWEt3Z3g1SDlVeHpxYwpzcm1rZC9iSytiZ2g3S01WdWpOUU1OZlNHRldmY2JCdWR5MlJJd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRSt0T2JjUGRtVlZtaWdOazU5OEVjLysyZ0MwTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQWRUSkhkTVNsNnlmQ1dLZHpWK0xrSUxmQXFyU3FETDZUN2VDclM2U0EyWklnZjVvcU4xd1NOCmdlWlNmZjRsL2xDdDNZYUFXeXVIZEtPaWFqb29XUStyR1A3OTRWdnJHZ0ZVNDF1UTI4YWRkUDB5dkpSTklRUXgKQVNrZ2NzTVV0VlZVQTZjK1d6TDZCTGJHZ0Q0NUhHU1ZoWmI0TXY4NVdXMDE0eXc3L2NINm9ObHVLbjR2ZEFmTgpCVGZ1WUl1SURoS0NkUEVHVnFOMHgvV08wY0xRWXZXT0NLblNVejIzOEV3NVFLWVRWd04rd3diTXdZZlBrMDcrCkF3UFBXWlc3OXNBVnFPWlRjRElpcmwzTVIyR3QxaVVaSkUvY0ttVWJjS2RXMGVXWGdQQUpRQkIrdnNCd3Y4MVUKa282eFFzc1lDWGd1dWc2aW1qRFNTRVhNSWpudS93UGYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQU55NzcyVXVURjJtR1h0ZUVQYVBqNDR3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTNNRFF3TkRFNApNamt6TWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUppV2M1NTU4UnRVb1BxV0lkT24KTEdMOVJudjErOHU5UHlLTm1kYkpQa2dicDEwZmdyQ3BaZktoRDJGT0luRklwdDRsR3M3Wm1NTVR2b1BOb0lkSwo2N3lmSzhzaDhaWkRTZ0xJUXNVZVV5TitKdWtiNzhxdXdXOWtwZzREczJSbmRIei9icEl4S29vVE5pZTZMNjBqCmlpRnFETERXSU1STU16dG84OWNJWndnUHJlTXhrVGdVN0hYSUw5WWU5NWNtSGhiak1UdlBBQVR2RmxRdzhsRy8KZG4xZXlwSGpEV3Bqcmw4U0pnMDd1ZW9aUUNFMjdDMkpoRFJWa0NQZXVPWXRKOC96ZFFpd1dsd3plcFFreDlLVwoxVW9wUUt6VVc4aXQwSm9pZGVVdnpCU2xNSWNSOHdLS2F4TFlUa0xRNVY2MXVyMW1SNzNWREpTNy9PUkNkQnoyCjFiRUNBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVVQ2MDV0dzkyWlZXYQpLQTJUbjN3UnovN2FBTFF3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQUNsWTIveGQxNUNZVEhoQ3VKSzdHUEttc2pYWjQKbElOV2F2eXhIakRXRmdlWDZIWGh1NS9lWEZjOS93TGpoRm9ZT3BMaEVXRmtrc2NhRjNRY0xGUHY5UXVRcW01WApYaTdCa09SVG9zZ0loL2ZidktXUXpNa29HL0xZNXgvNm5XbHVoYlE3bE5adzlseFBTUjdIVDBEb0F6UHNpZWd0CjdpLzcxaW9lMXFDUVJFMm1wL0diRk5ocDQvNExlU1YzM3VmQ2o4OVVIMlpjL1ZZMWU2WldzeTl6b05pS3JsYWsKNFJkMlFNUjRjeXRnaC9iVzNSVytaOWF3R0V3ZVVvb1M1UXA4ZzdBYVczTHlwbER1UGFOSC8zc2s2VHhPZDhWMQo4TlJBTkYrYUh1QUh5SW5wcTBTYUVqRTF5QUN3NW9oeXhMa2ViK00rWnJUblhwQndHY0NJSzdRdDRBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb1FJQkFBS0NBUUVBbUpaem5ubnhHMVNnK3BZaDA2Y3NZdjFHZS9YN3k3MC9JbzJaMXNrK1NCdW5YUitDCnNLbGw4cUVQWVU0aWNVaW0zaVVhenRtWXd4TytnODJnaDBycnZKOHJ5eUh4bGtOS0FzaEN4UjVUSTM0bTZSdnYKeXE3QmIyU21EZ096WkdkMGZQOXVrakVxaWhNMko3b3ZyU09LSVdvTXNOWWd4RXd6TzJqejF3aG5DQSt0NHpHUgpPQlRzZGNndjFoNzNseVllRnVNeE84OEFCTzhXVkREeVViOTJmVjdLa2VNTmFtT3VYeEltRFR1NTZobEFJVGJzCkxZbUVORldRSTk2NDVpMG56L04xQ0xCYVhETjZsQ1RIMHBiVlNpbEFyTlJieUszUW1pSjE1Uy9NRktVd2h4SHoKQW9wckV0aE9RdERsWHJXNnZXWkh2ZFVNbEx2ODVFSjBIUGJWc1FJREFRQUJBb0gvWXExYk5IYkVJSGJUTWxjNgpNNllodVA3MXNvb01FMFJQa0FqbVY0N3AxSnViMlVmY3l0UlFOaWFjNkJlZmc5d2l1R29xQ0g2djJpTHFvQmsrCktPcjFUN0M4YUtGU0RJVjNrRlVPWjA4MUg0WUQzTHltSFZDdGpyR0lQL215N1R1SWk0WnJ3bGdKWTNxWFVqWXkKWmY2VngzZnFFbkl1dm9xSTBCdTZCeHoyTHlMMUJOeUN3bGVlK3JCbTIwd3pNbWVhc0NIOU8wUlV2emZYK0lrbwpXQncvTGlqZmk0ejN6RmF6bFN5NE8zVk9mZHl5YmxrNkhoN1JPQlRGZklCc3lXckVpUUhXeEVVMWV4QlNOTnB0CnZ5K09SckhhQkVCUElKRE4yZk9NM1hMZWZTTGtPQmFaUlE4WGFqdVNXM0x4NERKZ0ZkdTlYV1lxMUdaZ3gzVG4KMXpISkFvR0JBTVdEMnpSY2RydDVCTUoxL1gwaGdxNVJTN3R1MjMxMllTaUdQM3hQTXQ5bUtrSFBKY0J1V3psagp5NWtGSkMrRGN6OGNuWDdMOFJMSTFBY3JSV3ZmTHppcFRuclRPTWRxWkFBR0pMckxsOGpGeGlPWnRFQWQxM0NCCjdxeHNiUVpkbzdPWEVCUGR3UVhZVmwxR25reVUyemhzdDEvWmRvcG5aZDJMUkFCeSt3OGZBb0dCQU1YRS9MZDUKWlplL3psbDE1bldTUVV1NFFObS9VMTdNYXFjOXVMeDNlNGFwcGRqd0lUQndrQnBpNWQ1YlVVdVlZb2lqekhmLwovQVhiSzB6UmhOSVVTMEJSOGc3VkZWWFNIbm1mRldlQTVFc3psMzJRWTZSY0sxdFRndzcrOHBxRHpDZFhURFJUCkJLQ2hRL0FTckVuRXB1dTNFTVA3V1dQdGszdFZlRDBWWWhFdkFvR0FHYmQ2VWczNzg1cmxNTUNXR2JYRVF4Z1kKcVRYYzVEQUdwSFVlVFB3dTNvRjUzUW13bTZhQ3dDMHJOQ2hFTnQrQm9PVUQ2Sjk3S3Z2MUIxM3Q4d2FqS2xoNAovR3NHQ0lqa3JsQWVkaWZPQW5rbHZEcm1DamNZZHZDajk5VkNPTUwyYm9xcnNEcCtTRm1MblNkMXN2anF0aVVKCmx6UkVSKzhBaDJEN29LZFg0dmNDZ1lBbUhQNXZCWEEwdkh3eDlXekNmN3Noc3BLYzVDaFcvcUlYTk9mak9rdU4KK2lmQ0ZSVHdWdUVPbEx5a0M0a3hQbDdPNG5KSE5nZ0Z3T1VwV3I5MEZRRWpsaWRHQUg2cUdXSlNJZnhvQkFqNwpEU2hHeElyUFpBdmUvOHNrR3JINllTZjQ5UFAwcVlNY3liZGtEdFV4S2pyWTltQyt4RFBIOUVNVjQ3VFdZTWFUCmRRS0JnUUNYM0FNZitOL3hzMWh1MU1hNzN5OHBtYU1HdlB0NFYxNVRVK2ZrREhDQ09kSTZMRllYcHJwVThwZkMKOHpjejdRWndrV1AvU3NWRFBxL1pPdjN4b2J2QWNLS1VZUXdJdnZQcHJHeVpvYzlyek5UQ2JLdnE1bEo2U1liYwo5NUk1cmZZcmxFTDVtY1BxZENlQ3FJajhMMkJibGhYdXdIWkdOU0ZyaEFaWFc3Ynd5dz09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
resourceNames:
|
||||
- hubble-server-certs
|
||||
- hubble-relay-client-certs
|
||||
- hubble-relay-server-certs
|
||||
- hubble-metrics-server-certs
|
||||
- hubble-ui-client-certs
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
resourceNames:
|
||||
- cilium-ca
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
---
|
||||
# Source: cilium/templates/hubble/tls-cronjob/rolebinding.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: hubble-generate-certs
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app.kubernetes.io/part-of: cilium
|
||||
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: hubble-generate-certs
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "hubble-generate-certs"
|
||||
namespace: kube-system
|
||||
---
|
||||
# Source: cilium/templates/hubble/tls-cronjob/job.yaml
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: hubble-generate-certs-a3297ae8da
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: hubble-generate-certs
|
||||
app.kubernetes.io/name: hubble-generate-certs
|
||||
app.kubernetes.io/part-of: cilium
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: hubble-generate-certs
|
||||
spec:
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: certgen
|
||||
image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
command:
|
||||
- "/usr/bin/cilium-certgen"
|
||||
# Because this is executed as a job, we pass the values as command
|
||||
# line args instead of via config map. This allows users to inspect
|
||||
# the values used in past runs by inspecting the completed pod.
|
||||
args:
|
||||
- "--ca-generate=true"
|
||||
- "--ca-reuse-secret"
|
||||
- "--ca-secret-namespace=kube-system"
|
||||
- "--ca-secret-name=cilium-ca"
|
||||
- "--ca-common-name=Cilium CA"
|
||||
env:
|
||||
- name: CILIUM_CERTGEN_CONFIG
|
||||
value: |
|
||||
certs:
|
||||
- name: hubble-server-certs
|
||||
namespace: kube-system
|
||||
commonName: "*.default.hubble-grpc.cilium.io"
|
||||
hosts:
|
||||
- "*.default.hubble-grpc.cilium.io"
|
||||
usage:
|
||||
- signing
|
||||
- key encipherment
|
||||
- server auth
|
||||
- client auth
|
||||
validity: 8760h
|
||||
|
||||
hostNetwork: false
|
||||
serviceAccountName: "hubble-generate-certs"
|
||||
automountServiceAccountToken: true
|
||||
restartPolicy: OnFailure
|
||||
---
|
||||
# Source: cilium/templates/hubble/tls-cronjob/cronjob.yaml
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: hubble-generate-certs
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: hubble-generate-certs
|
||||
app.kubernetes.io/name: hubble-generate-certs
|
||||
app.kubernetes.io/part-of: cilium
|
||||
spec:
|
||||
schedule: "0 0 1 */4 *"
|
||||
successfulJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 1
|
||||
concurrencyPolicy: Forbid
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: hubble-generate-certs
|
||||
spec:
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: certgen
|
||||
image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
command:
|
||||
- "/usr/bin/cilium-certgen"
|
||||
# Because this is executed as a job, we pass the values as command
|
||||
# line args instead of via config map. This allows users to inspect
|
||||
# the values used in past runs by inspecting the completed pod.
|
||||
args:
|
||||
- "--ca-generate=true"
|
||||
- "--ca-reuse-secret"
|
||||
- "--ca-secret-namespace=kube-system"
|
||||
- "--ca-secret-name=cilium-ca"
|
||||
- "--ca-common-name=Cilium CA"
|
||||
env:
|
||||
- name: CILIUM_CERTGEN_CONFIG
|
||||
value: |
|
||||
certs:
|
||||
- name: hubble-server-certs
|
||||
namespace: kube-system
|
||||
commonName: "*.default.hubble-grpc.cilium.io"
|
||||
hosts:
|
||||
- "*.default.hubble-grpc.cilium.io"
|
||||
usage:
|
||||
- signing
|
||||
- key encipherment
|
||||
- server auth
|
||||
- client auth
|
||||
validity: 8760h
|
||||
|
||||
hostNetwork: false
|
||||
serviceAccountName: "hubble-generate-certs"
|
||||
automountServiceAccountToken: true
|
||||
restartPolicy: OnFailure
|
||||
---
|
||||
# Source: cilium/templates/cilium-configmap.yaml
|
||||
apiVersion: v1
|
||||
|
||||
@@ -51,33 +51,195 @@ cluster:
|
||||
name: "cilium-operator"
|
||||
namespace: kube-system
|
||||
---
|
||||
# Source: cilium/templates/cilium-ca-secret.yaml
|
||||
# Source: cilium/templates/hubble/tls-cronjob/serviceaccount.yaml
|
||||
# Cilium CA + Hubble server certs are generated in-cluster by the
|
||||
# hubble-generate-certs Job below (hubble.tls.auto.method=cronJob),
|
||||
# NOT baked into this manifest. The Job creates/reuses Secret cilium-ca
|
||||
# and issues Secret hubble-server-certs at install; the CronJob renews
|
||||
# them. No private key material is committed to git. See issue #188.
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: cilium-ca
|
||||
name: "hubble-generate-certs"
|
||||
namespace: kube-system
|
||||
labels:
|
||||
cilium.io/helm-template-non-idempotent: "true"
|
||||
data:
|
||||
ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQU9DbHNSOTFSQWdPekpJbTdOc0hFcG93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTVNRFF3TXpFNApNamt6TWxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwaDcwM3UrUTNHOTNJZmdaTG9QeWY3RzdjN3NEbklYWTJWbWdLMmxpMlJsSlg2TnAKMmFXTUxzaWFHUm9iOTl5NEZGdW13dzFScFBkdkVmd0I3NUVxRXE1UlV2L0dQUUhLbHNTWGJMY0QzUW9tU2piUApaaVYrTUlXMHRrcHFyVFVvSjNaQ096M1dscmcyeFRHNEFVZFhlelhYZ1lKeVZ2U1B2ZTFEeC8ra0xpMlpCcmxoCk14QXA1MjAxbHBURVl3dThxU0xqMmlhbkhZWFBTUzV5OGhUSzBna3psTTgzblcyZThBbjd2TCt0TlQwQlVGaGMKbnozYUVidytNK2IwcG1vbFhCUTA5M29BaUdsSXR2SmJ1QkU0VXdtQnJIVDB3Zk1sL2phWEt3Z3g1SDlVeHpxYwpzcm1rZC9iSytiZ2g3S01WdWpOUU1OZlNHRldmY2JCdWR5MlJJd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRSt0T2JjUGRtVlZtaWdOazU5OEVjLysyZ0MwTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQWRUSkhkTVNsNnlmQ1dLZHpWK0xrSUxmQXFyU3FETDZUN2VDclM2U0EyWklnZjVvcU4xd1NOCmdlWlNmZjRsL2xDdDNZYUFXeXVIZEtPaWFqb29XUStyR1A3OTRWdnJHZ0ZVNDF1UTI4YWRkUDB5dkpSTklRUXgKQVNrZ2NzTVV0VlZVQTZjK1d6TDZCTGJHZ0Q0NUhHU1ZoWmI0TXY4NVdXMDE0eXc3L2NINm9ObHVLbjR2ZEFmTgpCVGZ1WUl1SURoS0NkUEVHVnFOMHgvV08wY0xRWXZXT0NLblNVejIzOEV3NVFLWVRWd04rd3diTXdZZlBrMDcrCkF3UFBXWlc3OXNBVnFPWlRjRElpcmwzTVIyR3QxaVVaSkUvY0ttVWJjS2RXMGVXWGdQQUpRQkIrdnNCd3Y4MVUKa282eFFzc1lDWGd1dWc2aW1qRFNTRVhNSWpudS93UGYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
ca.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBMGg3MDN1K1EzRzkzSWZnWkxvUHlmN0c3YzdzRG5JWFkyVm1nSzJsaTJSbEpYNk5wCjJhV01Mc2lhR1JvYjk5eTRGRnVtd3cxUnBQZHZFZndCNzVFcUVxNVJVdi9HUFFIS2xzU1hiTGNEM1FvbVNqYlAKWmlWK01JVzB0a3BxclRVb0ozWkNPejNXbHJnMnhURzRBVWRYZXpYWGdZSnlWdlNQdmUxRHgvK2tMaTJaQnJsaApNeEFwNTIwMWxwVEVZd3U4cVNMajJpYW5IWVhQU1M1eThoVEswZ2t6bE04M25XMmU4QW43dkwrdE5UMEJVRmhjCm56M2FFYncrTStiMHBtb2xYQlEwOTNvQWlHbEl0dkpidUJFNFV3bUJySFQwd2ZNbC9qYVhLd2d4NUg5VXh6cWMKc3Jta2QvYksrYmdoN0tNVnVqTlFNTmZTR0ZXZmNiQnVkeTJSSXdJREFRQUJBb0lCQUdTZGVqZytreWxiSHJyZgphSCtEbzExT0tDclV4SGZ4QjlPY1BUeE1iSTcwc3RQZkZsS29HU1pWM0tSa2dqd0FMdzFnamN3YzFwbWQra3VzClZ1ajJwQ1RwMy90VWl3S3ZsdWozSG1OcWg2a1NzUjhjZTllMzRHTXZ3MGIrLzNJTllEcjFQK1hLU0xWSFpNS3MKZWlYeW1ZdGdUdCt2TFQxQ1FvcDUwTmsyS3RJSkdYajVacSt5YXY3czRTMFFDU0lKeitMREVmSHQzMThnb0lqaQpEd1Bvd0dVZzlBUW1NYUtSRnI3S1REdk0yeGg3MEZJcW1kcWJ6WFdiTzQwV1VQLzBpQzlUZHhBN1dabHBuSGJ3ClBIZkdUY2krcXNLOUJ5RmU2Vm1YeHU5Nk1GcmY5aXdKaXc1WmZOdzZYb1RIMFZKazBqRWNJbjYybGVpQWh2TjgKbUp6MjFHRUNnWUVBNnRONEdJRlphODFtOTdNeWNkazc1TVh2ekczNVl3bHhmTlA3bmRVUkt0SHZCWnpLVUg1QgpObUhvZHpxUisraTl5SlJacnJsejlmSy9scE1GcTRrL0FGdDQ0WElxZWQ2dXE1ZUZSK3NMMkZGN1ZUclFxQUpJClhyQWJmdlptTTFxOUMwYUtxenlpbkRXQ2kxZGVTdDdncDRuakZSZHhYNEE5VGVwZ3MvOHBJR3NDZ1lFQTVSRTIKOFdaSHVxWHhqYXRoZlI2K25YMjZiNGc5Z1ZFdDdGaCsyR1NYSUpCeWQ2dmYrOGxxWE1iVmFtdDkyNHRBOEx4dApoaGhpYjhSRStGcFZyVHpHVVBDblNETlhIU25YYVMvMnY3Wjd5eU9BM1ZJUzVwenVsQUdndWlPTzI2b0M0dVdwCjVkQXRiRW9wUGZYdUxReUFoMjNBMjJ1dlJlb2ZxaXNXQVRzZUlDa0NnWUJkV3JDVjNXWjFTdlV5YUJVWDJhckwKNmp6STRyZVFQY0xXUTFmMmlTd0gvK21zSzRicXRTYXJ2Z1N5MGFBVHE1VTNWbkxJMllWV002a2k3VlFGdTh4RwpFaGRlV1FxMTVHZEFaRDVpTnZsQWlEUWx6L24vc05pZ2ZCYVNSTmFnZCtSTHhVRi9qZDEvaUc1Ymd1SkRsWk51ClI0ejFaNXAwd3dDY0p4OUdyNXZqL1FLQmdRQzR1OUpZaWtqc3NPbUdmQ0ZLRzZKVU50SkZJbFdmMWMwNFh3SWwKRjdKOWs2Q00vSExOaDFrYzYwbXY0bktFdk9BcGhYeTZlUzNodnlKME83MyswUldLcnhucGMyWWM0ZUtVTlJkRQo4ekVRMlZnU3BSOFRGcHFkaUZhTDV5Tk42ZVVjQVdXc0xlQ0VCYWNQRGlmLzhxWXhFZ1ZIcjZlUnRjZkZuNnZHCllGdmlTUUtCZ1FEZVlJWjVHaCszd244V2cydVRjQ2hkS20wWFlTT282QjVRUU1yNU1QU3U5NnYvQ3pnR2tGN1AKTWhiSE5SNlF4NW5DT0thajZEaEcvM3BHQkFFb244OE42bHExdGRJaS9OaXRISWlzeUJDSXRsK0ZoODFLekNJSgpYSVZGOW1lS1N1OUN0QXBjYmU1TWJxWWFKNjMxK1pUNndTLy9qU05rbmFpUzh0T3hBN0Z1bEE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
|
||||
---
|
||||
# Source: cilium/templates/hubble/tls-helm/server-secret.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
# Source: cilium/templates/hubble/tls-cronjob/role.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: hubble-server-certs
|
||||
name: hubble-generate-certs
|
||||
namespace: kube-system
|
||||
labels:
|
||||
cilium.io/helm-template-non-idempotent: "true"
|
||||
|
||||
annotations:
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURGRENDQWZ5Z0F3SUJBZ0lSQU9DbHNSOTFSQWdPekpJbTdOc0hFcG93RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTVNRFF3TXpFNApNamt6TWxvd0ZERVNNQkFHQTFVRUF4TUpRMmxzYVhWdElFTkJNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUEwaDcwM3UrUTNHOTNJZmdaTG9QeWY3RzdjN3NEbklYWTJWbWdLMmxpMlJsSlg2TnAKMmFXTUxzaWFHUm9iOTl5NEZGdW13dzFScFBkdkVmd0I3NUVxRXE1UlV2L0dQUUhLbHNTWGJMY0QzUW9tU2piUApaaVYrTUlXMHRrcHFyVFVvSjNaQ096M1dscmcyeFRHNEFVZFhlelhYZ1lKeVZ2U1B2ZTFEeC8ra0xpMlpCcmxoCk14QXA1MjAxbHBURVl3dThxU0xqMmlhbkhZWFBTUzV5OGhUSzBna3psTTgzblcyZThBbjd2TCt0TlQwQlVGaGMKbnozYUVidytNK2IwcG1vbFhCUTA5M29BaUdsSXR2SmJ1QkU0VXdtQnJIVDB3Zk1sL2phWEt3Z3g1SDlVeHpxYwpzcm1rZC9iSytiZ2g3S01WdWpOUU1OZlNHRldmY2JCdWR5MlJJd0lEQVFBQm8yRXdYekFPQmdOVkhROEJBZjhFCkJBTUNBcVF3SFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUYKTUFNQkFmOHdIUVlEVlIwT0JCWUVGRSt0T2JjUGRtVlZtaWdOazU5OEVjLysyZ0MwTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQWRUSkhkTVNsNnlmQ1dLZHpWK0xrSUxmQXFyU3FETDZUN2VDclM2U0EyWklnZjVvcU4xd1NOCmdlWlNmZjRsL2xDdDNZYUFXeXVIZEtPaWFqb29XUStyR1A3OTRWdnJHZ0ZVNDF1UTI4YWRkUDB5dkpSTklRUXgKQVNrZ2NzTVV0VlZVQTZjK1d6TDZCTGJHZ0Q0NUhHU1ZoWmI0TXY4NVdXMDE0eXc3L2NINm9ObHVLbjR2ZEFmTgpCVGZ1WUl1SURoS0NkUEVHVnFOMHgvV08wY0xRWXZXT0NLblNVejIzOEV3NVFLWVRWd04rd3diTXdZZlBrMDcrCkF3UFBXWlc3OXNBVnFPWlRjRElpcmwzTVIyR3QxaVVaSkUvY0ttVWJjS2RXMGVXWGdQQUpRQkIrdnNCd3Y4MVUKa282eFFzc1lDWGd1dWc2aW1qRFNTRVhNSWpudS93UGYKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWekNDQWorZ0F3SUJBZ0lSQU55NzcyVXVURjJtR1h0ZUVQYVBqNDR3RFFZSktvWklodmNOQVFFTEJRQXcKRkRFU01CQUdBMVVFQXhNSlEybHNhWFZ0SUVOQk1CNFhEVEkyTURRd05ERTRNamt6TWxvWERUSTNNRFF3TkRFNApNamt6TWxvd0tqRW9NQ1lHQTFVRUF3d2ZLaTVrWldaaGRXeDBMbWgxWW1Kc1pTMW5jbkJqTG1OcGJHbDFiUzVwCmJ6Q0NBU0l3RFFZSktvWklodmNOQVFFQkJRQURnZ0VQQURDQ0FRb0NnZ0VCQUppV2M1NTU4UnRVb1BxV0lkT24KTEdMOVJudjErOHU5UHlLTm1kYkpQa2dicDEwZmdyQ3BaZktoRDJGT0luRklwdDRsR3M3Wm1NTVR2b1BOb0lkSwo2N3lmSzhzaDhaWkRTZ0xJUXNVZVV5TitKdWtiNzhxdXdXOWtwZzREczJSbmRIei9icEl4S29vVE5pZTZMNjBqCmlpRnFETERXSU1STU16dG84OWNJWndnUHJlTXhrVGdVN0hYSUw5WWU5NWNtSGhiak1UdlBBQVR2RmxRdzhsRy8KZG4xZXlwSGpEV3Bqcmw4U0pnMDd1ZW9aUUNFMjdDMkpoRFJWa0NQZXVPWXRKOC96ZFFpd1dsd3plcFFreDlLVwoxVW9wUUt6VVc4aXQwSm9pZGVVdnpCU2xNSWNSOHdLS2F4TFlUa0xRNVY2MXVyMW1SNzNWREpTNy9PUkNkQnoyCjFiRUNBd0VBQWFPQmpUQ0JpakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdIUVlEVlIwbEJCWXdGQVlJS3dZQkJRVUgKQXdFR0NDc0dBUVVGQndNQ01Bd0dBMVVkRXdFQi93UUNNQUF3SHdZRFZSMGpCQmd3Rm9BVVQ2MDV0dzkyWlZXYQpLQTJUbjN3UnovN2FBTFF3S2dZRFZSMFJCQ013SVlJZktpNWtaV1poZFd4MExtaDFZbUpzWlMxbmNuQmpMbU5wCmJHbDFiUzVwYnpBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQUNsWTIveGQxNUNZVEhoQ3VKSzdHUEttc2pYWjQKbElOV2F2eXhIakRXRmdlWDZIWGh1NS9lWEZjOS93TGpoRm9ZT3BMaEVXRmtrc2NhRjNRY0xGUHY5UXVRcW01WApYaTdCa09SVG9zZ0loL2ZidktXUXpNa29HL0xZNXgvNm5XbHVoYlE3bE5adzlseFBTUjdIVDBEb0F6UHNpZWd0CjdpLzcxaW9lMXFDUVJFMm1wL0diRk5ocDQvNExlU1YzM3VmQ2o4OVVIMlpjL1ZZMWU2WldzeTl6b05pS3JsYWsKNFJkMlFNUjRjeXRnaC9iVzNSVytaOWF3R0V3ZVVvb1M1UXA4ZzdBYVczTHlwbER1UGFOSC8zc2s2VHhPZDhWMQo4TlJBTkYrYUh1QUh5SW5wcTBTYUVqRTF5QUN3NW9oeXhMa2ViK00rWnJUblhwQndHY0NJSzdRdDRBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
|
||||
tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb1FJQkFBS0NBUUVBbUpaem5ubnhHMVNnK3BZaDA2Y3NZdjFHZS9YN3k3MC9JbzJaMXNrK1NCdW5YUitDCnNLbGw4cUVQWVU0aWNVaW0zaVVhenRtWXd4TytnODJnaDBycnZKOHJ5eUh4bGtOS0FzaEN4UjVUSTM0bTZSdnYKeXE3QmIyU21EZ096WkdkMGZQOXVrakVxaWhNMko3b3ZyU09LSVdvTXNOWWd4RXd6TzJqejF3aG5DQSt0NHpHUgpPQlRzZGNndjFoNzNseVllRnVNeE84OEFCTzhXVkREeVViOTJmVjdLa2VNTmFtT3VYeEltRFR1NTZobEFJVGJzCkxZbUVORldRSTk2NDVpMG56L04xQ0xCYVhETjZsQ1RIMHBiVlNpbEFyTlJieUszUW1pSjE1Uy9NRktVd2h4SHoKQW9wckV0aE9RdERsWHJXNnZXWkh2ZFVNbEx2ODVFSjBIUGJWc1FJREFRQUJBb0gvWXExYk5IYkVJSGJUTWxjNgpNNllodVA3MXNvb01FMFJQa0FqbVY0N3AxSnViMlVmY3l0UlFOaWFjNkJlZmc5d2l1R29xQ0g2djJpTHFvQmsrCktPcjFUN0M4YUtGU0RJVjNrRlVPWjA4MUg0WUQzTHltSFZDdGpyR0lQL215N1R1SWk0WnJ3bGdKWTNxWFVqWXkKWmY2VngzZnFFbkl1dm9xSTBCdTZCeHoyTHlMMUJOeUN3bGVlK3JCbTIwd3pNbWVhc0NIOU8wUlV2emZYK0lrbwpXQncvTGlqZmk0ejN6RmF6bFN5NE8zVk9mZHl5YmxrNkhoN1JPQlRGZklCc3lXckVpUUhXeEVVMWV4QlNOTnB0CnZ5K09SckhhQkVCUElKRE4yZk9NM1hMZWZTTGtPQmFaUlE4WGFqdVNXM0x4NERKZ0ZkdTlYV1lxMUdaZ3gzVG4KMXpISkFvR0JBTVdEMnpSY2RydDVCTUoxL1gwaGdxNVJTN3R1MjMxMllTaUdQM3hQTXQ5bUtrSFBKY0J1V3psagp5NWtGSkMrRGN6OGNuWDdMOFJMSTFBY3JSV3ZmTHppcFRuclRPTWRxWkFBR0pMckxsOGpGeGlPWnRFQWQxM0NCCjdxeHNiUVpkbzdPWEVCUGR3UVhZVmwxR25reVUyemhzdDEvWmRvcG5aZDJMUkFCeSt3OGZBb0dCQU1YRS9MZDUKWlplL3psbDE1bldTUVV1NFFObS9VMTdNYXFjOXVMeDNlNGFwcGRqd0lUQndrQnBpNWQ1YlVVdVlZb2lqekhmLwovQVhiSzB6UmhOSVVTMEJSOGc3VkZWWFNIbm1mRldlQTVFc3psMzJRWTZSY0sxdFRndzcrOHBxRHpDZFhURFJUCkJLQ2hRL0FTckVuRXB1dTNFTVA3V1dQdGszdFZlRDBWWWhFdkFvR0FHYmQ2VWczNzg1cmxNTUNXR2JYRVF4Z1kKcVRYYzVEQUdwSFVlVFB3dTNvRjUzUW13bTZhQ3dDMHJOQ2hFTnQrQm9PVUQ2Sjk3S3Z2MUIxM3Q4d2FqS2xoNAovR3NHQ0lqa3JsQWVkaWZPQW5rbHZEcm1DamNZZHZDajk5VkNPTUwyYm9xcnNEcCtTRm1MblNkMXN2anF0aVVKCmx6UkVSKzhBaDJEN29LZFg0dmNDZ1lBbUhQNXZCWEEwdkh3eDlXekNmN3Noc3BLYzVDaFcvcUlYTk9mak9rdU4KK2lmQ0ZSVHdWdUVPbEx5a0M0a3hQbDdPNG5KSE5nZ0Z3T1VwV3I5MEZRRWpsaWRHQUg2cUdXSlNJZnhvQkFqNwpEU2hHeElyUFpBdmUvOHNrR3JINllTZjQ5UFAwcVlNY3liZGtEdFV4S2pyWTltQyt4RFBIOUVNVjQ3VFdZTWFUCmRRS0JnUUNYM0FNZitOL3hzMWh1MU1hNzN5OHBtYU1HdlB0NFYxNVRVK2ZrREhDQ09kSTZMRllYcHJwVThwZkMKOHpjejdRWndrV1AvU3NWRFBxL1pPdjN4b2J2QWNLS1VZUXdJdnZQcHJHeVpvYzlyek5UQ2JLdnE1bEo2U1liYwo5NUk1cmZZcmxFTDVtY1BxZENlQ3FJajhMMkJibGhYdXdIWkdOU0ZyaEFaWFc3Ynd5dz09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==
|
||||
app.kubernetes.io/part-of: cilium
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
resourceNames:
|
||||
- hubble-server-certs
|
||||
- hubble-relay-client-certs
|
||||
- hubble-relay-server-certs
|
||||
- hubble-metrics-server-certs
|
||||
- hubble-ui-client-certs
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
resourceNames:
|
||||
- cilium-ca
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
---
|
||||
# Source: cilium/templates/hubble/tls-cronjob/rolebinding.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: hubble-generate-certs
|
||||
namespace: kube-system
|
||||
labels:
|
||||
app.kubernetes.io/part-of: cilium
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: hubble-generate-certs
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: "hubble-generate-certs"
|
||||
namespace: kube-system
|
||||
---
|
||||
# Source: cilium/templates/hubble/tls-cronjob/job.yaml
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: hubble-generate-certs-a3297ae8da
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: hubble-generate-certs
|
||||
app.kubernetes.io/name: hubble-generate-certs
|
||||
app.kubernetes.io/part-of: cilium
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: hubble-generate-certs
|
||||
spec:
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: certgen
|
||||
image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
command:
|
||||
- "/usr/bin/cilium-certgen"
|
||||
# Because this is executed as a job, we pass the values as command
|
||||
# line args instead of via config map. This allows users to inspect
|
||||
# the values used in past runs by inspecting the completed pod.
|
||||
args:
|
||||
- "--ca-generate=true"
|
||||
- "--ca-reuse-secret"
|
||||
- "--ca-secret-namespace=kube-system"
|
||||
- "--ca-secret-name=cilium-ca"
|
||||
- "--ca-common-name=Cilium CA"
|
||||
env:
|
||||
- name: CILIUM_CERTGEN_CONFIG
|
||||
value: |
|
||||
certs:
|
||||
- name: hubble-server-certs
|
||||
namespace: kube-system
|
||||
commonName: "*.default.hubble-grpc.cilium.io"
|
||||
hosts:
|
||||
- "*.default.hubble-grpc.cilium.io"
|
||||
usage:
|
||||
- signing
|
||||
- key encipherment
|
||||
- server auth
|
||||
- client auth
|
||||
validity: 8760h
|
||||
hostNetwork: false
|
||||
serviceAccountName: "hubble-generate-certs"
|
||||
automountServiceAccountToken: true
|
||||
restartPolicy: OnFailure
|
||||
---
|
||||
# Source: cilium/templates/hubble/tls-cronjob/cronjob.yaml
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: hubble-generate-certs
|
||||
namespace: kube-system
|
||||
labels:
|
||||
k8s-app: hubble-generate-certs
|
||||
app.kubernetes.io/name: hubble-generate-certs
|
||||
app.kubernetes.io/part-of: cilium
|
||||
spec:
|
||||
schedule: "0 0 1 */4 *"
|
||||
successfulJobsHistoryLimit: 3
|
||||
failedJobsHistoryLimit: 1
|
||||
concurrencyPolicy: Forbid
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: hubble-generate-certs
|
||||
spec:
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
containers:
|
||||
- name: certgen
|
||||
image: "quay.io/cilium/certgen:v0.4.1@sha256:f0c656830e856d26b24b0e144df1f8b327d3b46748d76a630514111fc365b697"
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
allowPrivilegeEscalation: false
|
||||
command:
|
||||
- "/usr/bin/cilium-certgen"
|
||||
# Because this is executed as a job, we pass the values as command
|
||||
# line args instead of via config map. This allows users to inspect
|
||||
# the values used in past runs by inspecting the completed pod.
|
||||
args:
|
||||
- "--ca-generate=true"
|
||||
- "--ca-reuse-secret"
|
||||
- "--ca-secret-namespace=kube-system"
|
||||
- "--ca-secret-name=cilium-ca"
|
||||
- "--ca-common-name=Cilium CA"
|
||||
env:
|
||||
- name: CILIUM_CERTGEN_CONFIG
|
||||
value: |
|
||||
certs:
|
||||
- name: hubble-server-certs
|
||||
namespace: kube-system
|
||||
commonName: "*.default.hubble-grpc.cilium.io"
|
||||
hosts:
|
||||
- "*.default.hubble-grpc.cilium.io"
|
||||
usage:
|
||||
- signing
|
||||
- key encipherment
|
||||
- server auth
|
||||
- client auth
|
||||
validity: 8760h
|
||||
hostNetwork: false
|
||||
serviceAccountName: "hubble-generate-certs"
|
||||
automountServiceAccountToken: true
|
||||
restartPolicy: OnFailure
|
||||
---
|
||||
# Source: cilium/templates/cilium-configmap.yaml
|
||||
apiVersion: v1
|
||||
|
||||
Reference in New Issue
Block a user