Vault distributions like "Bank Vaults" automatically configure
and provision Vault and provide the CA bundle via a Kubernetes
Secret. Having to hard-code the bundle in the Issuer instead
of dynamically referencing it through the Secret requires
a manual second step when using a GitOps workflow.
Signed-off-by: Nils Mueller <nm@impactful.it>
introduced a validation whereby an issuer would be rejected if it did
not contain AccessKeyID or SecretAccessKeyID when using the route53 DNS
solver. This is incorrect, since neither should need to be defined when
using AWS ambient credentials.
Signed-off-by: joshvanl <vleeuwenjoshua@gmail.com>
This removes all .bazel and .bzl files, and a bunch of scripts relating
to bazel, now that it's been entirely replaced.
There are still a few places where traces could be removed, but this
removes the brunt of the bazel stuff that remains.
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
This is needed because go and other tools will ignore directories
starting with "_" or "." but would treat a dir called "bin" as a regular
directory.
This in turn meant that when we vendored Go in bin, these tools would by
default scan the whole stdlib included with the bundled vendored go.
See https://pkg.go.dev/cmd/go#hdr-Package_lists_and_patterns for details
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
Previously, in v1alpha1, an HTTPRoute was matched to a Gateway using
the label selectors present on the Gateways. For example, with the
following Gateway:
apiVersion: networking.x-k8s.io/v1alpha1
kind: Gateway
metadata:
name: acmesolver
spec:
listeners:
- protocol: HTTP
port: 80
routes:
kind: HTTPRoute
selector:
matchLabels:
app: foo
you would have to use the following labels on the HTTPRoute in order to
get the above Gateway to be used:
apiVersion: networking.x-k8s.io/v1alpha1
kind: HTTPRoute
metadata:
labels:
app: foo
With v1alpha2, the label selectors have been dropped. Instead, the
HTTPRoute has to give a direct reference to the Gateway:
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: HTTPRoute
spec:
parentRefs:
- kind: Gateway
name: acmesolver
namespace: traefik
This means that the "labels" field on the gatewayHTTPRoute solver is now
optional:
apiVersion: cert-manager.io/v1
kind: Issuer
spec:
acme:
solvers:
- http01:
gatewayHTTPRoute:
labels: | This field is
app: test | now optional.
parentRefs:
- kind: Gateway
name: acmesolver
Signed-off-by: Maël Valais <mael@vls.dev>
Since bazel-bin systematically exists, the Make-based CRDs were never
picked up, since the bazel-bin folder gets recreated on every invocation
of Bazel.
Signed-off-by: Maël Valais <mael@vls.dev>
These lean heavily on `go test` for everything possible.
Also adds setup for versionchecker test in make, and a script for
extracting CRDs from templated rendered YAML files
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
Falls back to looking in bin/crds if nothing has been provisioned in
bazel.
Removes "bazel.go" and consolidates in "paths.go", since the bazel name
will become obsolete and the functionality has changed
Signed-off-by: Ashley Davis <ashley.davis@jetstack.io>
