Merge pull request #79 from guangbochen/master

charts/cert-manager/latest/Chart.yaml

 name: cert-manager
-version: v0.4.1
-appVersion: v0.4.1
+version: v0.5.2
+appVersion: v0.5.2
 description: A Helm chart for cert-manager
 home: https://github.com/jetstack/cert-manager
 keywords:
@@ -10,7 +10,7 @@ keywords:
   - tls
 sources:
   - https://github.com/jetstack/cert-manager
-icon: https://letsencrypt.org/images/letsencrypt-logo-horizontal.svg
+icon: file://../letsencrypt-logo-horizontal.svg
 maintainers:
   - name: munnerz
     email: james@jetstack.io

charts/cert-manager/latest/README.md

@@ -42,7 +42,7 @@ The following table lists the configurable parameters of the cert-manager chart
 | Parameter | Description | Default |
 | --------- | ----------- | ------- |
 | `image.repository` | Image repository | `quay.io/jetstack/cert-manager-controller` |
-| `image.tag` | Image tag | `v0.4.1` |
+| `image.tag` | Image tag | `v0.5.2` |
 | `image.pullPolicy` | Image pull policy | `IfNotPresent` |
 | `replicaCount`  | Number of cert-manager replicas  | `1` |
 | `createCustomResource` | Create CRD/TPR with this release | `true` |
@@ -54,7 +54,7 @@ The following table lists the configurable parameters of the cert-manager chart
 | `rbac.create` | If `true`, create and use RBAC resources | `true` |
 | `serviceAccount.create` | If `true`, create a new service account | `true` |
 | `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template |  |
-| `resources` | CPU/memory resource requests/limits | `requests: {cpu: 10m, memory: 32Mi}` |
+| `resources` | CPU/memory resource requests/limits | |
 | `nodeSelector` | Node labels for pod assignment | `{}` |
 | `affinity` | Node affinity for pod assignment | `{}` |
 | `tolerations` | Node tolerations for pod assignment | `[]` |
@@ -69,6 +69,14 @@ The following table lists the configurable parameters of the cert-manager chart
 | `http_proxy` | Value of the `HTTP_PROXY` environment variable in the cert-manager pod | |
 | `https_proxy` | Value of the `HTTPS_PROXY` environment variable in the cert-manager pod | |
 | `no_proxy` | Value of the `NO_PROXY` environment variable in the cert-manager pod | |
+| `webhook.enabled` | Toggles whether the validating webhook component should be installed | `false` |
+| `webhook.replicaCount` | Number of cert-manager webhook replicas | `1` |
+| `webhook.podAnnotations` | Annotations to add to the webhook pods | `{}` |
+| `webhook.extraArgs` | Optional flags for cert-manager webhook component | `[]` |
+| `webhook.resources` | CPU/memory resource requests/limits for the webhook pods | |
+| `webhook.image.repository` | Webhook image repository | `quay.io/jetstack/cert-manager-webhook` |
+| `webhook.image.tag` | Webhook image tag | `v0.5.2` |
+| `webhook.image.pullPolicy` | Webhook image pull policy | `IfNotPresent` |
 
 Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
 

charts/cert-manager/latest/questions.yml

@@ -14,17 +14,39 @@ questions:
     type: string
     label: Cert-Manager Docker Image Name
   - variable: image.tag
-    default: "v0.4.1"
+    default: "v0.5.2"
     description: "Cert-Manager Docker image tag"
     type: string
     label: Cert-Manager Image Tag
-- variable: createCustomResource
+  - variable: webhook.image.repository
+    default: "quay.io/jetstack/cert-manager-webhook"
+    description: "cert-manager webhook image name"
+    type: string
+    label: Cert-Manager Webhook Image Name
+    show_if: webhook.enabled=true&&defaultImage=false
+  - variable: webhook.image.tag
+    default: "v0.5.2"
+    description: "cert-manager webhook image tag"
+    type: string
+    label: Cert-Manager Webhook Image Tag
+    show_if: webhook.enabled=true&&defaultImage=false
+- variable: replicaCount
+  default: 1
+  description: "Replica count of cert-manager"
+  min: 1
+  max: 5
+  label: Replica count of cert-manager
+  type: int
+  group: "Settings"
+- variable: clusterissuerEnabled
   default: true
-  description: "Create Custom Resource Definition(CRD) of certmanager"
-  label: Create Custom Resource Definition(CRD)
+  description: "Create Default Cluster Issuer"
+  label: Create Default Cluster Issuer
   type: boolean
   group: "Settings"
-- variable: ingressShim.defaultIssuerName
+  show_subquestion_if: true
+  subquestions:
+  - variable: ingressShim.defaultIssuerName
     default: "letsencrypt-staging"
     required: true
     type: enum
@@ -34,10 +56,36 @@ questions:
     options:
     - "letsencrypt-staging"
     - "letsencrypt-prod"
-- variable: letsencrypt.email
+  - variable: letsencrypt.email
     default: ""
     required: true
     type: string
     description: "Let's Encrypt register email, for https://letsencrypt.org/docs/staging-environment"
     label: Let's Encrypt Client Register Email
     group: "Settings"
+- variable: createCustomResource
+  default: true
+  description: "Create Custom Resource Definition(CRD) of certmanager"
+  label: Create Custom Resource Definition(CRD)
+  type: boolean
+  group: "CRD Settings"
+- variable: webhook.enabled
+  default: false
+  description: "Enabled Webhook"
+  label: Enabled Webhook
+  type: boolean
+  show_subquestion_if: true
+  group: "Webhook Settings"
+  subquestions:
+  - variable: webhook.replicaCount
+    default: 1
+    description: "Replica count of webhook pod"
+    min: 1
+    max: 5
+    label: Webhook Replica count
+    type: int
+  - variable: webhook.extraArgs
+    default: "[]"
+    description: "Optional additional arguments for webhook"
+    label: Optional Additional Arguments for Webhook
+    type: string

charts/cert-manager/latest/requirements.lock

+dependencies:
+- name: webhook
+  repository: file://./webhook
+  version: v0.5.2
+digest: sha256:efe1f1adfd027b361934a3d745760b10d947a050048e5046b257e79cd5c40ea2
+generated: 2018-11-23T14:56:41.555379+08:00

charts/cert-manager/latest/requirements.yaml

+# requirements.yaml
+dependencies:
+- name: webhook
+  version: "v0.5.2"
+  repository: "file://./webhook"
+  condition: webhook.enabled

charts/cert-manager/latest/templates/00-namespace.yaml

@@ -3,4 +3,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: {{ .Release.Namespace | quote }}
+  labels:
+    name: {{ .Release.Namespace | quote }}
+    certmanager.k8s.io/disable-validation: "true"
 {{- end }}

charts/cert-manager/latest/templates/certificate-crd.yaml

@@ -3,14 +3,14 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: certificates.certmanager.k8s.io
+  annotations:
+    "helm.sh/hook": "crd-install"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
   labels:
     app: {{ template "cert-manager.name" . }}
     chart: {{ template "cert-manager.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
-  annotations:
-    "helm.sh/hook": "crd-install"
-    "helm.sh/hook-delete-policy": "before-hook-creation"
 spec:
   group: certmanager.k8s.io
   version: v1alpha1

charts/cert-manager/latest/templates/clusterissuer-crd.yaml

@@ -3,14 +3,14 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: clusterissuers.certmanager.k8s.io
+  annotations:
+    "helm.sh/hook": "crd-install"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
   labels:
     app: {{ template "cert-manager.name" . }}
     chart: {{ template "cert-manager.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
-  annotations:
-    "helm.sh/hook": "crd-install"
-    "helm.sh/hook-delete-policy": "before-hook-creation"
 spec:
   group: certmanager.k8s.io
   version: v1alpha1

charts/cert-manager/latest/templates/deployment.yaml

@@ -60,6 +60,14 @@ spec:
           - --default-acme-issuer-dns01-provider-name={{ .defaultACMEDNS01ChallengeProvider }}
           {{- end }}
           {{- end }}
+          {{- if .Values.affinity }}
+          affinity:
+{{ toYaml .Values.affinity | indent 10 }}
+          {{- end }}
+          {{- if .Values.tolerations }}
+          tolerations:
+{{ toYaml .Values.tolerations | indent 10 }}
+          {{- end }}
           env:
           - name: POD_NAMESPACE
             valueFrom:

charts/cert-manager/latest/templates/issuer-crd.yaml

@@ -3,13 +3,14 @@ apiVersion: apiextensions.k8s.io/v1beta1
 kind: CustomResourceDefinition
 metadata:
   name: issuers.certmanager.k8s.io
+  annotations:
+    "helm.sh/hook": "crd-install"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
   labels:
     app: {{ template "cert-manager.name" . }}
     chart: {{ template "cert-manager.chart" . }}
     release: {{ .Release.Name }}
     heritage: {{ .Release.Service }}
-  annotations:
-    "helm.sh/hook": crd-install
 spec:
   group: certmanager.k8s.io
   version: v1alpha1

charts/cert-manager/latest/templates/rbac.yaml

@@ -13,12 +13,7 @@ rules:
     resources: ["certificates", "issuers", "clusterissuers"]
     verbs: ["*"]
   - apiGroups: [""]
-    # TODO: remove endpoints once 0.4 is released. We include it here in case
-    # users use the 'master' version of the Helm chart with a 0.2.x release of
-    # cert-manager that still performs leader election with Endpoint resources.
-    # We advise users don't do this, but some will anyway and this will reduce
-    # friction.
-    resources: ["endpoints", "configmaps", "secrets", "events", "services", "pods"]
+    resources: ["configmaps", "secrets", "events", "services", "pods"]
     verbs: ["*"]
   - apiGroups: ["extensions"]
     resources: ["ingresses"]

charts/cert-manager/latest/values.yaml

@@ -5,7 +5,7 @@ replicaCount: 1
 
 image:
   repository: quay.io/jetstack/cert-manager-controller
-  tag: v0.4.1
+  tag: v0.5.2
   pullPolicy: IfNotPresent
 
 createCustomResource: true
@@ -69,11 +69,32 @@ ingressShim:
   defaultACMEChallengeType: "http01"
   # defaultACMEDNS01ChallengeProvider: ""
 
+webhook:
+  enabled: false
+  replicaCount: 1
+  podAnnotations: {}
+
+  # Optional additional arguments for webhook
+  extraArgs: []
+
+  resources: {}
+    # requests:
+    #   cpu: 10m
+  #   memory: 32Mi
+
+  image:
+    repository: quay.io/jetstack/cert-manager-webhook
+    tag: v0.5.2
+    pullPolicy: IfNotPresent
+
 letsencrypt:
+  enabled: true
   email: user@example.com
   # specifies custom letsencrypt server, both staing and prod letsencrypt has default value in clusterissuer.yaml
   server: "https://https://acme-staging-v02.api.letsencrypt.org/directory"
 
+clusterissuerEnabled: true
+
 # This is used by the static manifest generator in order to create a static
 # namespace manifest for the namespace that cert-manager is being installed
 # within. It should **not** be used if you are using Helm for deployment.
@@ -84,4 +105,24 @@ createNamespaceResource: false
 # http_proxy: "http://proxy:8080"
 # no_proxy: 127.0.0.1,localhost
 
-clusterissuerEnabled: true
+# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#affinity-v1-core
+# for example:
+#   affinity:
+#     nodeAffinity:
+#      requiredDuringSchedulingIgnoredDuringExecution:
+#        nodeSelectorTerms:
+#        - matchExpressions:
+#          - key: foo.bar.com/role
+#            operator: In
+#            values:
+#            - master
+affinity: {}
+
+# expects input structure as per specification https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#toleration-v1-core
+# for example:
+#   tolerations:
+#   - key: foo.bar.com/role
+#     operator: Equal
+#     value: master
+#     effect: NoSchedule
+tolerations: []

charts/cert-manager/latest/webhook/.helmignore

+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/cert-manager/latest/webhook/Chart.yaml

+apiVersion: v1
+appVersion: "v0.5.2"
+description: A Helm chart for deploying the cert-manager webhook component
+name: webhook
+version: "v0.5.2"

charts/cert-manager/latest/webhook/templates/_helpers.tpl

+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "webhook.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "webhook.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "webhook.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "webhook.selfSignedIssuer" -}}
+{{ printf "%s-selfsign" (include "webhook.fullname" .) }}
+{{- end -}}
+
+{{- define "webhook.rootCAIssuer" -}}
+{{ printf "%s-ca" (include "webhook.fullname" .) }}
+{{- end -}}
+
+{{- define "webhook.rootCACertificate" -}}
+{{ printf "%s-ca" (include "webhook.fullname" .) }}
+{{- end -}}
+
+{{- define "webhook.servingCertificate" -}}
+{{ printf "%s-webhook-tls" (include "webhook.fullname" .) }}
+{{- end -}}

charts/cert-manager/latest/webhook/templates/apiservice.yaml

+apiVersion: apiregistration.k8s.io/v1beta1
+kind: APIService
+metadata:
+  name: v1beta1.admission.certmanager.k8s.io
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  group: admission.certmanager.k8s.io
+  groupPriorityMinimum: 1000
+  versionPriority: 15
+  service:
+    name: {{ include "webhook.fullname" . }}
+    namespace: "{{ .Release.Namespace }}"
+  version: v1beta1

charts/cert-manager/latest/webhook/templates/ca-sync.yaml

+## This file contains a CronJob that runs every 24h to automatically update the
+## caBundle set on the APIService and ValidatingWebhookConfiguration resource.
+## This allows us to store the CA bundle in a Secret resource which is
+## generated by cert-manager's 'selfsigned' Issuer.
+apiVersion: batch/v1beta1
+kind: CronJob
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  schedule: "* * */24 * *"
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: ca-helper
+        spec:
+          serviceAccountName: {{ include "webhook.fullname" . }}-ca-sync
+          restartPolicy: OnFailure
+          containers:
+          - name: ca-helper
+            image: quay.io/munnerz/apiextensions-ca-helper:v0.1.0
+            imagePullPolicy: IfNotPresent
+            args:
+            - -config=/config/config
+            volumeMounts:
+            - name: config
+              mountPath: /config
+            resources:
+              requests:
+                cpu: 10m
+                memory: 32Mi
+              limits:
+                cpu: 100m
+                memory: 128Mi
+          volumes:
+          - name: config
+            configMap:
+              name: {{ include "webhook.fullname" . }}-ca-sync
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  template:
+    metadata:
+      labels:
+        app: ca-helper
+    spec:
+      serviceAccountName: {{ include "webhook.fullname" . }}-ca-sync
+      restartPolicy: OnFailure
+      containers:
+      - name: ca-helper
+        image: quay.io/munnerz/apiextensions-ca-helper:canary
+        imagePullPolicy: IfNotPresent
+        args:
+        - -config=/config/config
+        volumeMounts:
+        - name: config
+          mountPath: /config
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+          limits:
+            cpu: 100m
+            memory: 128Mi
+      volumes:
+      - name: config
+        configMap:
+          name: {{ include "webhook.fullname" . }}-ca-sync
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+  config: |-
+    {
+        "apiServices": [
+            {
+                "name": "v1beta1.admission.certmanager.k8s.io",
+                "secret": {
+                    "name": "{{ include "webhook.rootCACertificate" . }}",
+                    "namespace": "{{ .Release.Namespace }}",
+                    "key": "tls.crt"
+                }
+            }
+        ],
+        "validatingWebhookConfigurations": [
+            {
+                "name": "{{ include "webhook.fullname" . }}",
+                "file": {
+                    "path": "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+                }
+            }
+        ]
+    }
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get"]
+    resourceNames:
+    - {{ include "webhook.rootCACertificate" . }}
+  - apiGroups: ["admissionregistration.k8s.io"]
+    resources: ["validatingwebhookconfigurations", "mutatingwebhookconfigurations"]
+    verbs: ["get", "update"]
+    resourceNames:
+    - {{ include "webhook.fullname" . }}
+  - apiGroups: ["apiregistration.k8s.io"]
+    resources: ["apiservices"]
+    verbs: ["get", "update"]
+    resourceNames:
+    - v1beta1.admission.certmanager.k8s.io
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "webhook.fullname" . }}-ca-sync
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "webhook.fullname" . }}-ca-sync
+subjects:
+  - name: {{ include "webhook.fullname" . }}-ca-sync
+    namespace: {{ .Release.Namespace }}
+    kind: ServiceAccount

charts/cert-manager/latest/webhook/templates/deployment.yaml

+apiVersion: apps/v1beta1
+kind: Deployment
+metadata:
+  name: {{ include "webhook.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ include "webhook.name" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ include "webhook.name" . }}
+        release: {{ .Release.Name }}
+      annotations:
+      {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+      {{- end }}
+    spec:
+      serviceAccountName: {{ include "webhook.fullname" . }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+          - --v=12
+          - --tls-cert-file=/certs/tls.crt
+          - --tls-private-key-file=/certs/tls.key
+          - --disable-admission-plugins=NamespaceLifecycle,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,Initializers
+        {{- if .Values.extraArgs }}
+{{ toYaml .Values.extraArgs | indent 10 }}
+        {{- end }}
+          env:
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+          volumeMounts:
+          - name: certs
+            mountPath: /certs
+      volumes:
+      - name: certs
+        secret:
+          secretName: {{ include "webhook.servingCertificate" . }}
+    {{- with .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}

charts/cert-manager/latest/webhook/templates/pki.yaml

+---
+# Create a selfsigned Issuer, in order to create a root CA certificate for
+# signing webhook serving certificates
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: Issuer
+metadata:
+  name: {{ include "webhook.selfSignedIssuer" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  selfsigned: {}
+
+---
+
+# Generate a CA Certificate used to sign certificates for the webhook
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: Certificate
+metadata:
+  name: {{ include "webhook.rootCACertificate" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  secretName: {{ include "webhook.rootCACertificate" . }}
+  issuerRef:
+    name: {{ include "webhook.selfSignedIssuer" . }}
+  commonName: "ca.webhook.cert-manager"
+  isCA: true
+
+---
+
+# Create an Issuer that uses the above generated CA certificate to issue certs
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: Issuer
+metadata:
+  name: {{ include "webhook.rootCAIssuer" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  ca:
+    secretName: {{ include "webhook.rootCACertificate" . }}
+
+---
+
+# Finally, generate a serving certificate for the webhook to use
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: Certificate
+metadata:
+  name: {{ include "webhook.servingCertificate" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  secretName: {{ include "webhook.servingCertificate" . }}
+  issuerRef:
+    name: {{ include "webhook.rootCAIssuer" . }}
+  dnsNames:
+  - {{ include "webhook.fullname" . }}
+  - {{ include "webhook.fullname" . }}.{{ .Release.Namespace }}
+  - {{ include "webhook.fullname" . }}.{{ .Release.Namespace }}.svc

charts/cert-manager/latest/webhook/templates/rbac.yaml

+### Webhook ###
+---
+# apiserver gets the auth-delegator role to delegate auth decisions to
+# the core apiserver
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "webhook.fullname" . }}:auth-delegator
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+- apiGroup: ""
+  kind: ServiceAccount
+  name: {{ include "webhook.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+
+---
+
+# apiserver gets the ability to read authentication. This allows it to
+# read the specific configmap that has the requestheader-* entries to
+# api agg
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  name: {{ include "webhook.fullname" . }}:webhook-authentication-reader
+  namespace: kube-system
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+- apiGroup: ""
+  kind: ServiceAccount
+  name: {{ include "webhook.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "webhook.fullname" . }}:webhook-requester
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+- apiGroups:
+  - admission.certmanager.k8s.io
+  resources:
+  - certificates
+  - issuers
+  - clusterissuers
+  verbs:
+  - create

charts/cert-manager/latest/webhook/templates/service.yaml

+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "webhook.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  type: ClusterIP
+  ports:
+  - name: https
+    port: 443
+    targetPort: 443
+  selector:
+    app: {{ include "webhook.name" . }}
+    release: {{ .Release.Name }}

charts/cert-manager/latest/webhook/templates/serviceaccount.yaml

+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "webhook.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}

charts/cert-manager/latest/webhook/templates/validating-webhook.yaml

+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: ValidatingWebhookConfiguration
+metadata:
+  name: {{ include "webhook.fullname" . }}
+  labels:
+    app: {{ include "webhook.name" . }}
+    chart: {{ include "webhook.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+webhooks:
+  - name: certificates.admission.certmanager.k8s.io
+    namespaceSelector:
+      matchExpressions:
+      - key: "certmanager.k8s.io/disable-validation"
+        operator: "NotIn"
+        values:
+        - "true"
+      - key: "name"
+        operator: "NotIn"
+        values:
+        - {{ .Release.Namespace }}
+    rules:
+      - apiGroups:
+          - "certmanager.k8s.io"
+        apiVersions:
+          - v1alpha1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - certificates
+    failurePolicy: Fail
+    clientConfig:
+      service:
+        name: kubernetes
+        namespace: default
+        path: /apis/admission.certmanager.k8s.io/v1beta1/certificates
+  - name: issuers.admission.certmanager.k8s.io
+    namespaceSelector:
+      matchExpressions:
+      - key: "certmanager.k8s.io/disable-validation"
+        operator: "NotIn"
+        values:
+        - "true"
+      - key: "name"
+        operator: "NotIn"
+        values:
+        - {{ .Release.Namespace }}
+    rules:
+      - apiGroups:
+          - "certmanager.k8s.io"
+        apiVersions:
+          - v1alpha1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - issuers
+    failurePolicy: Fail
+    clientConfig:
+      service:
+        name: kubernetes
+        namespace: default
+        path: /apis/admission.certmanager.k8s.io/v1beta1/issuers
+  - name: clusterissuers.admission.certmanager.k8s.io
+    namespaceSelector:
+      matchExpressions:
+      - key: "certmanager.k8s.io/disable-validation"
+        operator: "NotIn"
+        values:
+        - "true"
+      - key: "name"
+        operator: "NotIn"
+        values:
+        - {{ .Release.Namespace }}
+    rules:
+      - apiGroups:
+          - "certmanager.k8s.io"
+        apiVersions:
+          - v1alpha1
+        operations:
+          - CREATE
+          - UPDATE
+        resources:
+          - clusterissuers
+    failurePolicy: Fail
+    clientConfig:
+      service:
+        name: kubernetes
+        namespace: default
+        path: /apis/admission.certmanager.k8s.io/v1beta1/clusterissuers

charts/cert-manager/latest/webhook/values.yaml

+replicaCount: 1
+
+podAnnotations: {}
+
+# Optional additional arguments for webhook
+extraArgs: []
+
+resources: {}
+  # requests:
+  #   cpu: 10m
+  #   memory: 32Mi
+
+image:
+  repository: quay.io/jetstack/cert-manager-webhook
+  tag: v0.5.2
+  pullPolicy: IfNotPresent

charts/cert-manager/v0.4.1/.helmignore

+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/cert-manager/v0.4.1/Chart.yaml

+name: cert-manager
+version: v0.4.1
+appVersion: v0.4.1
+description: A Helm chart for cert-manager
+home: https://github.com/jetstack/cert-manager
+keywords:
+  - cert-manager
+  - kube-lego
+  - letsencrypt
+  - tls
+sources:
+  - https://github.com/jetstack/cert-manager
+icon: https://letsencrypt.org/images/letsencrypt-logo-horizontal.svg
+maintainers:
+  - name: munnerz
+    email: james@jetstack.io

charts/cert-manager/v0.4.1/OWNERS

+approvers:
+- munnerz
+- simonswine
+- kragniz
+reviewers:
+- munnerz
+- unguiculus
+- simonswine
+- kragniz

charts/cert-manager/v0.4.1/README.md

+## Installing the Chart
+
+Full installation instructions, including details on how to configure extra
+functionality in cert-manager can be found in the [getting started docs](https://cert-manager.readthedocs.io/en/latest/getting-started/).
+
+To install the chart with the release name `my-release`:
+
+```console
+$ helm install --name my-release stable/cert-manager
+```
+
+In order to begin issuing certificates, you will need to set up a ClusterIssuer
+or Issuer resource (for example, by creating a 'letsencrypt-staging' issuer).
+
+More information on the different types of issuers and how to configure them
+can be found in our documentation:
+
+https://cert-manager.readthedocs.io/en/latest/reference/issuers.html
+
+For information on how to configure cert-manager to automatically provision
+Certificates for Ingress resources, take a look at the `ingress-shim`
+documentation:
+
+https://cert-manager.readthedocs.io/en/latest/reference/ingress-shim.html
+
+> **Tip**: List all releases using `helm list`
+
+## Uninstalling the Chart
+
+To uninstall/delete the `my-release` deployment:
+
+```console
+$ helm delete my-release
+```
+
+The command removes all the Kubernetes components associated with the chart and deletes the release.
+
+## Configuration
+
+The following table lists the configurable parameters of the cert-manager chart and their default values.
+
+| Parameter | Description | Default |
+| --------- | ----------- | ------- |
+| `image.repository` | Image repository | `quay.io/jetstack/cert-manager-controller` |
+| `image.tag` | Image tag | `v0.4.1` |
+| `image.pullPolicy` | Image pull policy | `IfNotPresent` |
+| `replicaCount`  | Number of cert-manager replicas  | `1` |
+| `createCustomResource` | Create CRD/TPR with this release | `true` |
+| `clusterResourceNamespace` | Override the namespace used to store DNS provider credentials etc. for ClusterIssuer resources | Same namespace as cert-manager pod
+| `leaderElection.Namespace` | Override the namespace used to store the ConfigMap for leader election | Same namespace as cert-manager pod
+| `certificateResourceShortNames` | Custom aliases for Certificate CRD | `["cert", "certs"]` |
+| `extraArgs` | Optional flags for cert-manager | `[]` |
+| `extraEnv` | Optional environment variables for cert-manager | `[]` |
+| `rbac.create` | If `true`, create and use RBAC resources | `true` |
+| `serviceAccount.create` | If `true`, create a new service account | `true` |
+| `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template |  |
+| `resources` | CPU/memory resource requests/limits | `requests: {cpu: 10m, memory: 32Mi}` |
+| `nodeSelector` | Node labels for pod assignment | `{}` |
+| `affinity` | Node affinity for pod assignment | `{}` |
+| `tolerations` | Node tolerations for pod assignment | `[]` |
+| `ingressShim.defaultIssuerName` | Optional default issuer to use for ingress resources |  |
+| `ingressShim.defaultIssuerKind` | Optional default issuer kind to use for ingress resources |  |
+| `ingressShim.defaultACMEChallengeType` | Optional default challenge type to use for ingresses using ACME issuers |  |
+| `ingressShim.defaultACMEDNS01ChallengeProvider` | Optional default DNS01 challenge provider to use for ingresses using ACME issuers with DNS01 |  |
+| `podAnnotations` | Annotations to add to the cert-manager pod | `{}` |
+| `podDnsPolicy` | Optional cert-manager pod [DNS policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods-dns-policy) |  |
+| `podDnsConfig` | Optional cert-manager pod [DNS configurations](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods-dns-config) |  |
+| `podLabels` | Labels to add to the cert-manager pod | `{}` |
+| `http_proxy` | Value of the `HTTP_PROXY` environment variable in the cert-manager pod | |
+| `https_proxy` | Value of the `HTTPS_PROXY` environment variable in the cert-manager pod | |
+| `no_proxy` | Value of the `NO_PROXY` environment variable in the cert-manager pod | |
+
+Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
+
+Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
+
+```console
+$ helm install --name my-release -f values.yaml .
+```
+> **Tip**: You can use the default [values.yaml](values.yaml)
+
+## Contributing
+
+This chart is maintained at [github.com/jetstack/cert-manager](https://github.com/jetstack/cert-manager/tree/master/contrib/charts/cert-manager).

charts/cert-manager/v0.4.1/app-readme.md

+# cert-manager
+
+cert-manager is a Kubernetes addon to automate the management and issuance of
+TLS certificates from various issuing sources.  
+It will ensure certificates are valid and up to date periodically, and attempt
+to renew certificates at an appropriate time before expiry.
+
+## How to Use It
+### [Ingress-shim](https://cert-manager.readthedocs.io/en/latest/reference/ingress-shim.html#ingress-shim)
+Cert-manager will create Certificate resources that reference the `ClusterIssuer` for all Ingresses that have following annotations.
+```
+kubernetes.io/tls-acme: "true"
+certmanager.k8s.io/cluster-issuer: letsencrypt-staging # your cluerissuer name
+nginx.ingress.kubernetes.io/secure-backends: "true" # optional
+```
+
+For cert-manager to work properly, the following information has to be added on your ingress definition.
+```
+spec:
+  tls:
+  - hosts:
+    - host.example.com
+    secretName: host-example-crt
+```

charts/cert-manager/v0.4.1/questions.yml

+minimum_rancher_version: v2.1.0
+questions:
+- variable: defaultImage
+  default: true
+  description: "Use default Docker image"
+  label: Use Default Image
+  type: boolean
+  show_subquestion_if: false
+  group: "Container Images"
+  subquestions:
+  - variable: image.repository
+    default: "quay.io/jetstack/cert-manager-controller"
+    description: "Cert-Manager Docker image name"
+    type: string
+    label: Cert-Manager Docker Image Name
+  - variable: image.tag
+    default: "v0.4.1"
+    description: "Cert-Manager Docker image tag"
+    type: string
+    label: Cert-Manager Image Tag
+- variable: createCustomResource
+  default: true
+  description: "Create Custom Resource Definition(CRD) of certmanager"
+  label: Create Custom Resource Definition(CRD)
+  type: boolean
+  group: "Settings"
+- variable: ingressShim.defaultIssuerName
+  default: "letsencrypt-staging"
+  required: true
+  type: enum
+  description: "Let's Encrypt ACME clients, use staging environment to avoid hitting rate limits"
+  label: Let's Encrypt Cluster Issuer clients
+  group: "Settings"
+  options:
+  - "letsencrypt-staging"
+  - "letsencrypt-prod"
+- variable: letsencrypt.email
+  default: ""
+  required: true
+  type: string
+  description: "Let's Encrypt register email, for https://letsencrypt.org/docs/staging-environment"
+  label: Let's Encrypt Client Register Email
+  group: "Settings"

charts/cert-manager/v0.4.1/templates/00-namespace.yaml

+{{ if .Values.createNamespaceResource }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ .Release.Namespace | quote }}
+{{- end }}

charts/cert-manager/v0.4.1/templates/NOTES.txt

+cert-manager has been deployed successfully!
+
+1. In order to begin issuing certificates, you will need to set up a ClusterIssuer
+or Issuer resource, and we have set a default ClusterIssuer called `{{ .Values.letsencrypt.name }}` with your register email <{{ .Values.letsencrypt.email }}>.
+
+More information on the different types of issuers and how to configure them
+can be found in our documentation:
+
+https://cert-manager.readthedocs.io/en/latest/reference/issuers.html
+
+2. Cert-manager will create Certificate resources that reference the ClusterIssuer `{{ .Values.letsencrypt.name }}` for all Ingresses that have a `kubernetes.io/tls-acme: "true"` annotation.
+
+For information on how to configure cert-manager to automatically provision
+Certificates for Ingress resources, take a look at the `ingress-shim`
+documentation:
+
+https://cert-manager.readthedocs.io/en/latest/reference/ingress-shim.html

charts/cert-manager/v0.4.1/templates/_helpers.tpl

+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "cert-manager.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "cert-manager.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "cert-manager.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "cert-manager.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "cert-manager.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

charts/cert-manager/v0.4.1/templates/certificate-crd.yaml

+{{- if .Values.createCustomResource -}}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: certificates.certmanager.k8s.io
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": "crd-install"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
+spec:
+  group: certmanager.k8s.io
+  version: v1alpha1
+  scope: Namespaced
+  names:
+    kind: Certificate
+    plural: certificates
+    {{- if .Values.certificateResourceShortNames }}
+    shortNames:
+{{ toYaml .Values.certificateResourceShortNames | indent 6 }}
+    {{- end -}}
+{{- end -}}

charts/cert-manager/v0.4.1/templates/clusterissuer-crd.yaml

+{{- if .Values.createCustomResource -}}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: clusterissuers.certmanager.k8s.io
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": "crd-install"
+    "helm.sh/hook-delete-policy": "before-hook-creation"
+spec:
+  group: certmanager.k8s.io
+  version: v1alpha1
+  names:
+    kind: ClusterIssuer
+    plural: clusterissuers
+  scope: Cluster
+{{- end -}}

charts/cert-manager/v0.4.1/templates/clusterissuer.yaml

+{{- if .Values.clusterissuerEnabled -}}
+apiVersion: certmanager.k8s.io/v1alpha1
+kind: ClusterIssuer
+metadata:
+  name: {{ .Values.ingressShim.defaultIssuerName }}
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  acme:
+    {{- if eq .Values.ingressShim.defaultIssuerName "letsencrypt-prod" }}
+    server: "https://acme-v02.api.letsencrypt.org/directory"
+    {{- else if eq .Values.ingressShim.defaultIssuerName "letsencrypt-staging" }}
+    server: "https://acme-staging-v02.api.letsencrypt.org/directory"
+    {{- else }}
+    server: {{ .Values.letsencrypt.server }}
+    {{- end }}
+    email: {{ .Values.letsencrypt.email }}
+    privateKeySecretRef:
+      name: {{ .Values.ingressShim.defaultIssuerName }}-account-key
+    http01: {}
+{{- end -}}

charts/cert-manager/v0.4.1/templates/deployment.yaml

+apiVersion: apps/v1beta1
+kind: Deployment
+metadata:
+  name: {{ template "cert-manager.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  selector:
+    matchLabels:
+      app: {{ template "cert-manager.name" . }}
+      release: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app: {{ template "cert-manager.name" . }}
+        release: {{ .Release.Name }}
+{{- if .Values.podLabels }}
+{{ toYaml .Values.podLabels | indent 8 }}
+{{- end }}
+      annotations:
+      {{- if .Values.podAnnotations }}
+{{ toYaml .Values.podAnnotations | indent 8 }}
+      {{- end }}
+    spec:
+      serviceAccountName: {{ template "cert-manager.serviceAccountName" . }}
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          args:
+        {{- if .Values.clusterResourceNamespace }}
+          - --cluster-resource-namespace={{ .Values.clusterResourceNamespace }}
+        {{- else }}
+          - --cluster-resource-namespace=$(POD_NAMESPACE)
+        {{- end }}
+        {{- if .Values.leaderElection.namespace }}
+          - --leader-election-namespace={{ .Values.leaderElection.namespace }}
+        {{- else }}
+          - --leader-election-namespace=$(POD_NAMESPACE)
+        {{- end }}
+        {{- if .Values.extraArgs }}
+{{ toYaml .Values.extraArgs | indent 10 }}
+        {{- end }}
+          {{- with .Values.ingressShim }}
+          {{- if .defaultIssuerName }}
+          - --default-issuer-name={{ .defaultIssuerName }}
+          {{- end }}
+          {{- if .defaultIssuerKind }}
+          - --default-issuer-kind={{ .defaultIssuerKind }}
+          {{- end }}
+          {{- if .defaultACMEChallengeType }}
+          - --default-acme-issuer-challenge-type={{ .defaultACMEChallengeType }}
+          {{- end }}
+          {{- if .defaultACMEDNS01ChallengeProvider }}
+          - --default-acme-issuer-dns01-provider-name={{ .defaultACMEDNS01ChallengeProvider }}
+          {{- end }}
+          {{- end }}
+          env:
+          - name: POD_NAMESPACE
+            valueFrom:
+              fieldRef:
+                fieldPath: metadata.namespace
+        {{- if .Values.extraEnv }}
+{{ toYaml .Values.extraEnv | indent 10 }}
+        {{- end }}
+          {{- if .Values.http_proxy }}
+          - name: HTTP_PROXY
+            value: {{ .Values.http_proxy }}
+          {{- end }}
+          {{- if .Values.https_proxy }}
+          - name: HTTPS_PROXY
+            value: {{ .Values.https_proxy }}
+          {{- end }}
+          {{- if .Values.no_proxy }}
+          - name: NO_PROXY
+            value: {{ .Values.no_proxy }}
+          {{- end }}
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+    {{- with .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+{{- if .Values.podDnsPolicy }}
+      dnsPolicy: {{ .Values.podDnsPolicy }}
+{{- end }}
+{{- if .Values.podDnsConfig }}
+      dnsConfig:
+{{ toYaml .Values.podDnsConfig | indent 8 }}
+{{- end }}

charts/cert-manager/v0.4.1/templates/issuer-crd.yaml

+{{- if .Values.createCustomResource -}}
+apiVersion: apiextensions.k8s.io/v1beta1
+kind: CustomResourceDefinition
+metadata:
+  name: issuers.certmanager.k8s.io
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    "helm.sh/hook": crd-install
+spec:
+  group: certmanager.k8s.io
+  version: v1alpha1
+  names:
+    kind: Issuer
+    plural: issuers
+  scope: Namespaced
+{{- end -}}

charts/cert-manager/v0.4.1/templates/rbac.yaml

+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRole
+metadata:
+  name: {{ template "cert-manager.fullname" . }}
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+rules:
+  - apiGroups: ["certmanager.k8s.io"]
+    resources: ["certificates", "issuers", "clusterissuers"]
+    verbs: ["*"]
+  - apiGroups: [""]
+    # TODO: remove endpoints once 0.4 is released. We include it here in case
+    # users use the 'master' version of the Helm chart with a 0.2.x release of
+    # cert-manager that still performs leader election with Endpoint resources.
+    # We advise users don't do this, but some will anyway and this will reduce
+    # friction.
+    resources: ["endpoints", "configmaps", "secrets", "events", "services", "pods"]
+    verbs: ["*"]
+  - apiGroups: ["extensions"]
+    resources: ["ingresses"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "cert-manager.fullname" . }}
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "cert-manager.fullname" . }}
+subjects:
+  - name: {{ template "cert-manager.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace | quote }}
+    kind: ServiceAccount
+{{- end -}}

charts/cert-manager/v0.4.1/templates/serviceaccount.yaml

+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "cert-manager.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    app: {{ template "cert-manager.name" . }}
+    chart: {{ template "cert-manager.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+{{- end -}}

charts/cert-manager/v0.4.1/values.yaml

+# Default values for cert-manager.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+replicaCount: 1
+
+image:
+  repository: quay.io/jetstack/cert-manager-controller
+  tag: v0.4.1
+  pullPolicy: IfNotPresent
+
+createCustomResource: true
+
+# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer
+# resources. By default, the same namespace as cert-manager is deployed within is
+# used. This namespace will not be automatically created by the Helm chart.
+clusterResourceNamespace: ""
+
+leaderElection:
+  # Override the namespace used to store the ConfigMap for leader election
+  namespace: ""
+
+certificateResourceShortNames: ["cert", "certs"]
+
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: true
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name:
+
+# Optional additional arguments
+extraArgs: []
+  # Use this flag to set a namespace that cert-manager will use to store
+  # supporting resources required for each ClusterIssuer (default is kube-system)
+  # - --cluster-resource-namespace=kube-system
+
+extraEnv: []
+# - name: SOME_VAR
+#   value: 'some value'
+
+resources: {}
+  # requests:
+  #   cpu: 10m
+  #   memory: 32Mi
+
+podAnnotations: {}
+
+podLabels: {}
+# Optional DNS settings, useful if you have a public and private DNS zone for
+# the same domain on Route 53. What follows is an example of ensuring
+# cert-manager can access an ingress or DNS TXT records at all times.
+# NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for
+# the cluster to work.
+# podDnsPolicy: "None"
+# podDnsConfig:
+#   nameservers:
+#     - "1.1.1.1"
+#     - "8.8.8.8"
+
+nodeSelector: {}
+
+ingressShim:
+  defaultIssuerName: "letsencrypt-staging"
+  defaultIssuerKind: "ClusterIssuer"
+  defaultACMEChallengeType: "http01"
+  # defaultACMEDNS01ChallengeProvider: ""
+
+letsencrypt:
+  email: user@example.com
+  # specifies custom letsencrypt server, both staing and prod letsencrypt has default value in clusterissuer.yaml
+  server: "https://https://acme-staging-v02.api.letsencrypt.org/directory"
+
+# This is used by the static manifest generator in order to create a static
+# namespace manifest for the namespace that cert-manager is being installed
+# within. It should **not** be used if you are using Helm for deployment.
+createNamespaceResource: false
+
+# Use these variables to configure the HTTP_PROXY environment variables
+# http_proxy: "http://proxy:8080"
+# http_proxy: "http://proxy:8080"
+# no_proxy: 127.0.0.1,localhost
+
+clusterissuerEnabled: true

charts/chartmuseum/latest/Chart.yaml

 apiVersion: v1
 description: Helm Chart Repository with support for Amazon S3 and Google Cloud Storage
 name: chartmuseum
-version: 1.6.0
+version: 1.6.2
 appVersion: 0.7.1
 home: https://github.com/chartmuseum/chartmuseum
-icon: https://raw.githubusercontent.com/chartmuseum/chartmuseum/master/logo.png
+icon: file://../logo.png
 keywords:
 - chartmuseum
 - helm

charts/chartmuseum/latest/README.md

@@ -108,6 +108,8 @@ their default values. See values.yaml for all available options.
 | `gcp.secret.enabled`                   | Flag for the GCP service account            | `false`                                             |
 | `gcp.secret.name`                      | Secret name for the GCP json file           | ``                                                  |
 | `gcp.secret.key`                       | Secret key for te GCP json file             | `credentials.json`                                  |
+| `service.type`                         | Kubernetes Service type                     | `ClusterIP`                                          |
+| `service.clusterIP`                    | Static clusterIP or None for headless services| `nil`                                              |
 
 Specify each parameter using the `--set key=value[,key=value]` argument to
 `helm install`.

charts/chartmuseum/latest/questions.yml

@@ -245,6 +245,11 @@ questions:
     group: "Storage Options"
     label: Default StorageClass for Local Storage
     show_if: "env.open.STORAGE=local&&persistence.enabled=true"
+  - variable: persistence.existingClaim
+    default: ""
+    description: "If not empty, uses the specified existing PVC instead of creating new one"
+    type: pvc
+    label: Uses Existing Persistent Volume Cliam for LocalStorage
 # Service and L7 LoadBalancer
 - variable: ingress.enabled
   default: true

charts/chartmuseum/latest/templates/NOTES.txt

@@ -25,6 +25,6 @@ OR
 
   export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "chartmuseum.name" . }}" -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
   echo http://127.0.0.1:8080{{ .Values.env.open.CONTEXT_PATH }}/
-  kubectl port-forward $POD_NAME 8080:8080
+  kubectl port-forward $POD_NAME 8080:8080 --namespace {{ .Release.Namespace }}
 
 {{- end }}

charts/chartmuseum/latest/templates/deployment.yaml

@@ -100,7 +100,7 @@ spec:
     {{- end }}
       volumes:
       - name: storage-volume
-      {{- if and .Values.persistence.enabled (eq .Values.env.open.STORAGE "local") }}
+      {{- if .Values.persistence.enabled }}
         persistentVolumeClaim:
           claimName: {{ .Values.persistence.existingClaim | default (include "chartmuseum.fullname" .) }}
       {{- else }}

charts/chartmuseum/latest/templates/ingress.yaml

-{{- if .Values.ingress.enabled -}}
 {{- $servicePort := .Values.service.externalPort -}}
 {{- $serviceName := include "chartmuseum.fullname" . -}}
+{{- if .Values.ingress.enabled }}
+---
 apiVersion: extensions/v1beta1
 kind: Ingress
 metadata:
-  name: {{ template "chartmuseum.fullname" . }}
-  labels:
-    app: {{ template "chartmuseum.name" . }}
-    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
+  name: {{ include "chartmuseum.fullname" . }}
   annotations:
 {{ toYaml .Values.ingress.annotations | indent 4 }}
   labels:

charts/chartmuseum/latest/templates/pvc.yaml

 {{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) -}}
-{{- if eq .Values.env.open.STORAGE "local" }}
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
@@ -21,4 +20,3 @@ spec:
 {{- end }}
 {{- end }}
 {{- end }}
-{{- end }}

charts/chartmuseum/latest/templates/service.yaml

@@ -12,6 +12,11 @@ metadata:
 {{- end }}
 spec:
   type: {{ .Values.service.type }}
+  {{- if eq .Values.service.type "ClusterIP" }}
+  {{- if .Values.service.clusterIP }}
+  clusterIP: {{ .Values.service.clusterIP }}
+  {{- end }}
+  {{- end }}
   ports:
   - port: {{ .Values.service.externalPort }}
 {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort))) }}

charts/chartmuseum/latest/values.yaml

@@ -98,18 +98,18 @@ replica:
   #   iam.amazonaws.com/role: role-arn
 service:
   type: ClusterIP
+  # clusterIP: None
   externalPort: 8080
   nodePort:
   annotations: {}
 
-# resources: {}
-resources:
-  limits:
-    cpu: 100m
-    memory: 128Mi
-  requests:
-    cpu: 80m
-    memory: 64Mi
+resources: {}
+#  limits:
+#    cpu: 100m
+#    memory: 128Mi
+#  requests:
+#    cpu: 80m
+#    memory: 64Mi
 
 probes:
   liveness:

charts/chartmuseum/v1.6.0/.helmignore

+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+# OWNERS file for Kubernetes
+OWNERS

charts/chartmuseum/v1.6.0/Chart.yaml

+apiVersion: v1
+description: Helm Chart Repository with support for Amazon S3 and Google Cloud Storage
+name: chartmuseum
+version: 1.6.0
+appVersion: 0.7.1
+home: https://github.com/chartmuseum/chartmuseum
+icon: https://raw.githubusercontent.com/chartmuseum/chartmuseum/master/logo.png
+keywords:
+- chartmuseum
+- helm
+- charts repo
+maintainers:
+- name: codefresh-io
+  email: opensource@codefresh.io
+- name: cloudposse
+  email: hello@cloudposse.com
+- name: chartmuseum
+  email: chartmuseum@gmail.com

charts/chartmuseum/v1.6.0/OWNERS

+approvers:
+- jdolitsky
+- goruha
+reviewers:
+- jdolitsky
+- goruha

charts/chartmuseum/v1.6.0/templates/NOTES.txt

+** Please be patient while the chart is being deployed **
+
+Get the ChartMuseum URL by running:
+
+{{- if contains "NodePort" .Values.service.type }}
+
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "chartmuseum.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT{{ .Values.env.open.CONTEXT_PATH }}/
+
+{{- else if contains "LoadBalancer" .Values.service.type }}
+
+** Please ensure an external IP is associated to the {{ template "chartmuseum.fullname" . }} service before proceeding **
+** Watch the status using: kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "chartmuseum.fullname" . }} **
+
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "chartmuseum.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
+  echo http://$SERVICE_IP:{{ .Values.service.externalPort }}{{ .Values.env.open.CONTEXT_PATH }}/
+
+OR
+
+  export SERVICE_HOST=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "chartmuseum.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
+  echo http://$SERVICE_HOST:{{ .Values.service.externalPort }}{{ .Values.env.open.CONTEXT_PATH }}/
+
+{{- else if contains "ClusterIP"  .Values.service.type }}
+
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app={{ template "chartmuseum.name" . }}" -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  echo http://127.0.0.1:8080{{ .Values.env.open.CONTEXT_PATH }}/
+  kubectl port-forward $POD_NAME 8080:8080
+
+{{- end }}

charts/chartmuseum/v1.6.0/templates/_helpers.tpl

+{{- /*
+name defines a template for the name of the chartmuseum chart.
+
+The prevailing wisdom is that names should only contain a-z, 0-9 plus dot (.) and dash (-), and should
+not exceed 63 characters.
+
+Parameters:
+
+- .Values.nameOverride: Replaces the computed name with this given name
+- .Values.namePrefix: Prefix
+- .Values.global.namePrefix: Global prefix
+- .Values.nameSuffix: Suffix
+- .Values.global.nameSuffix: Global suffix
+
+The applied order is: "global prefix + prefix + name + suffix + global suffix"
+
+Usage: 'name: "{{- template "chartmuseum.name" . -}}"'
+*/ -}}
+{{- define "chartmuseum.name"}}
+{{- $global := default (dict) .Values.global -}}
+{{- $base := default .Chart.Name .Values.nameOverride -}}
+{{- $gpre := default "" $global.namePrefix -}}
+{{- $pre := default "" .Values.namePrefix -}}
+{{- $suf := default "" .Values.nameSuffix -}}
+{{- $gsuf := default "" $global.nameSuffix -}}
+{{- $name := print $gpre $pre $base $suf $gsuf -}}
+{{- $name | lower | trunc 54 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- /*
+fullname defines a suitably unique name for a resource by combining
+the release name and the chartmuseum chart name.
+
+The prevailing wisdom is that names should only contain a-z, 0-9 plus dot (.) and dash (-), and should
+not exceed 63 characters.
+
+Parameters:
+
+- .Values.fullnameOverride: Replaces the computed name with this given name
+- .Values.fullnamePrefix: Prefix
+- .Values.global.fullnamePrefix: Global prefix
+- .Values.fullnameSuffix: Suffix
+- .Values.global.fullnameSuffix: Global suffix
+
+The applied order is: "global prefix + prefix + name + suffix + global suffix"
+
+Usage: 'name: "{{- template "chartmuseum.fullname" . -}}"'
+*/ -}}
+{{- define "chartmuseum.fullname"}}
+{{- $global := default (dict) .Values.global -}}
+{{- $base := default (printf "%s-%s" .Release.Name .Chart.Name) .Values.fullnameOverride -}}
+{{- $gpre := default "" $global.fullnamePrefix -}}
+{{- $pre := default "" .Values.fullnamePrefix -}}
+{{- $suf := default "" .Values.fullnameSuffix -}}
+{{- $gsuf := default "" $global.fullnameSuffix -}}
+{{- $name := print $gpre $pre $base $suf $gsuf -}}
+{{- $name | lower | trunc 54 | trimSuffix "-" -}}
+{{- end -}}
+
+
+{{- /*
+chartmuseum.labels.standard prints the standard chartmuseum Helm labels.
+
+The standard labels are frequently used in metadata.
+*/ -}}
+{{- define "chartmuseum.labels.standard" -}}
+app: {{ template "chartmuseum.name" . }}
+chart: {{ template "chartmuseum.chartref" . }}
+heritage: {{ .Release.Service | quote }}
+release: {{ .Release.Name | quote }}
+{{- end -}}
+
+{{- /*
+chartmuseum.chartref prints a chart name and version.
+
+It does minimal escaping for use in Kubernetes labels.
+
+Example output:
+
+chartmuseum-0.4.5
+*/ -}}
+{{- define "chartmuseum.chartref" -}}
+{{- replace "+" "_" .Chart.Version | printf "%s-%s" .Chart.Name -}}
+{{- end -}}

charts/chartmuseum/v1.6.0/templates/deployment.yaml

+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: {{ include "chartmuseum.fullname" . }}
+  annotations:
+{{ toYaml .Values.deployment.annotations | indent 4 }}
+  labels:
+{{ include "chartmuseum.labels.standard" . | indent 4 }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  strategy:
+{{ toYaml .Values.strategy | indent 4 }}
+  revisionHistoryLimit: 10
+  template:
+    metadata:
+      name: {{ include "chartmuseum.fullname" . }}
+      annotations:
+{{ toYaml .Values.replica.annotations | indent 8 }}
+      labels:
+        app: {{ template "chartmuseum.name" . }}
+        release: {{ .Release.Name | quote }}
+    spec:
+      containers:
+      - name: {{ .Chart.Name }}
+        image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        env:
+{{- range $name, $value := .Values.env.open }}
+{{- if not (empty $value) }}
+        - name: {{ $name | quote }}
+          value: {{ $value | quote }}
+{{- end }}
+{{- end }}
+{{- if .Values.gcp.secret.enabled }}
+        - name: GOOGLE_APPLICATION_CREDENTIALS
+          value: "/etc/secrets/google/credentials.json"
+{{- end }}
+{{- $secret_name := include "chartmuseum.fullname" . }}
+{{- range $name, $value := .Values.env.secret }}
+{{- if not ( empty $value) }}
+        - name: {{ $name | quote }}
+          valueFrom:
+            secretKeyRef:
+              name: {{ $secret_name }}
+              key: {{ $name | quote }}
+{{- end }}
+{{- end }}
+        args:
+        - --port=8080
+{{- if eq .Values.env.open.STORAGE "local" }}
+        - --storage-local-rootdir=/storage
+{{- end }}
+        ports:
+        - name: http
+          containerPort: 8080
+        livenessProbe:
+          httpGet:
+            path: {{ .Values.env.open.CONTEXT_PATH }}/health
+            port: http
+{{ toYaml .Values.probes.liveness | indent 10 }}
+        readinessProbe:
+          httpGet:
+            path: {{ .Values.env.open.CONTEXT_PATH }}/health
+            port: http
+{{ toYaml .Values.probes.readiness | indent 10 }}
+{{- if eq .Values.env.open.STORAGE "local" }}
+        volumeMounts:
+        - mountPath: /storage
+          name: storage-volume
+{{- end }}
+{{- if  .Values.gcp.secret.enabled }}
+        volumeMounts:
+        - mountPath: /etc/secrets/google
+          name: {{ include "chartmuseum.fullname" . }}-gcp
+{{- end }}
+      {{- with .Values.resources }}
+        resources:
+{{ toYaml . | indent 10 }}
+      {{- end }}
+    {{- with .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.affinity }}
+      affinity:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- with .Values.tolerations }}
+      tolerations:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+    {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ include "chartmuseum.fullname" . }}
+    {{- else if .Values.serviceAccount.name }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
+    {{- end }}
+    {{- with .Values.securityContext }}
+      securityContext:
+{{ toYaml . | indent 8 }}
+    {{- end }}
+      volumes:
+      - name: storage-volume
+      {{- if and .Values.persistence.enabled (eq .Values.env.open.STORAGE "local") }}
+        persistentVolumeClaim:
+          claimName: {{ .Values.persistence.existingClaim | default (include "chartmuseum.fullname" .) }}
+      {{- else }}
+        emptyDir: {}
+      {{- end -}}
+      {{ if .Values.gcp.secret.enabled }}
+      - name: {{ include "chartmuseum.fullname" . }}-gcp
+        secret:
+      {{ if .Values.env.secret.GOOGLE_CREDENTIALS_JSON }}
+          secretName: {{ include "chartmuseum.fullname" . }}
+          items:
+          - key: GOOGLE_CREDENTIALS_JSON
+            path: credentials.json
+      {{ else }}
+          secretName: {{ .Values.gcp.secret.name }}
+          items:
+          - key: {{ .Values.gcp.secret.key }}
+            path: credentials.json
+      {{ end }}
+      {{ end }}

charts/chartmuseum/v1.6.0/templates/ingress.yaml

+{{- if .Values.ingress.enabled -}}
+{{- $servicePort := .Values.service.externalPort -}}
+{{- $serviceName := include "chartmuseum.fullname" . -}}
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: {{ template "chartmuseum.fullname" . }}
+  labels:
+    app: {{ template "chartmuseum.name" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  annotations:
+{{ toYaml .Values.ingress.annotations | indent 4 }}
+  labels:
+{{- if .Values.ingress.labels }}
+{{ toYaml .Values.ingress.labels | indent 4 }}
+{{- end }}
+{{ include "chartmuseum.labels.standard" . | indent 4 }}
+spec:
+  rules:
+    {{- range $host := .Values.ingress.hosts }}
+    - host: {{ $host }}
+      http:
+        paths:
+        - path:
+          backend:
+            serviceName: {{ $serviceName }}
+            servicePort: {{ $servicePort }}
+    {{- end -}}
+  {{- if .Values.ingress.tls }}
+  tls:
+{{ toYaml .Values.ingress.tls | indent 4 }}
+  {{- end -}}
+{{- end -}}

charts/chartmuseum/v1.6.0/templates/pvc.yaml

+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) -}}
+{{- if eq .Values.env.open.STORAGE "local" }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ include "chartmuseum.fullname" . }}
+  labels:
+    app: {{ include "chartmuseum.fullname" . }}
+    release: {{ .Release.Name | quote }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- if .Values.persistence.storageClass }}
+{{- if (eq "-" .Values.persistence.storageClass) }}
+  storageClassName: ""
+{{- else }}
+  storageClassName: "{{ .Values.persistence.storageClass }}"
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/chartmuseum/v1.6.0/templates/secret.yaml

+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "chartmuseum.fullname" . }}
+  labels:
+{{ include "chartmuseum.labels.standard" . | indent 4 }}
+type: Opaque
+data:
+{{- range $name, $value := .Values.env.secret }}
+{{- if not (empty $value) }}
+{{- if eq $name "GOOGLE_CREDENTIALS_JSON" }}
+  {{ $name }}: {{ $value }}
+  {{- else }}
+  {{ $name }}: {{ $value | b64enc }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/chartmuseum/v1.6.0/templates/service.yaml

+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "chartmuseum.fullname" . }}
+  annotations:
+{{ toYaml .Values.service.annotations | indent 4 }}
+  labels:
+{{ include "chartmuseum.labels.standard" . | indent 4 }}
+{{- if .Values.service.annotations }}
+  annotations:
+{{ toYaml .Values.service.annotations | indent 4 }}
+{{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+  - port: {{ .Values.service.externalPort }}
+{{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePort))) }}
+    nodePort: {{.Values.service.nodePort}}
+{{- else }}
+    targetPort: http
+{{- end }}
+    protocol: TCP
+    name: http
+  selector:
+    app: {{ template "chartmuseum.name" . }}
+    release: {{ .Release.Name | quote }}

charts/chartmuseum/v1.6.0/templates/serviceaccount.yaml

+{{- if .Values.serviceAccount.create -}}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "chartmuseum.fullname" . }}
+  labels:
+{{ include "chartmuseum.labels.standard" . | indent 4 }}
+{{- end -}}

charts/chartmuseum/v1.6.0/values.yaml

+replicaCount: 1
+strategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxUnavailable: 0
+image:
+  repository: chartmuseum/chartmuseum
+  tag: v0.7.1
+  pullPolicy: IfNotPresent
+env:
+  open:
+    # storage backend, can be one of: local, alibaba, amazon, google, microsoft
+    STORAGE: local
+    # oss bucket to store charts for alibaba storage backend
+    STORAGE_ALIBABA_BUCKET:
+    # prefix to store charts for alibaba storage backend
+    STORAGE_ALIBABA_PREFIX:
+    # oss endpoint to store charts for alibaba storage backend
+    STORAGE_ALIBABA_ENDPOINT:
+    # server side encryption algorithm for alibaba storage backend, can be one
+    # of: AES256 or KMS
+    STORAGE_ALIBABA_SSE:
+    # s3 bucket to store charts for amazon storage backend
+    STORAGE_AMAZON_BUCKET:
+    # prefix to store charts for amazon storage backend
+    STORAGE_AMAZON_PREFIX:
+    # region of s3 bucket to store charts
+    STORAGE_AMAZON_REGION:
+    # alternative s3 endpoint
+    STORAGE_AMAZON_ENDPOINT:
+    # server side encryption algorithm
+    STORAGE_AMAZON_SSE:
+    # gcs bucket to store charts for google storage backend
+    STORAGE_GOOGLE_BUCKET:
+    # prefix to store charts for google storage backend
+    STORAGE_GOOGLE_PREFIX:
+    # container to store charts for microsoft storage backend
+    STORAGE_MICROSOFT_CONTAINER:
+    # prefix to store charts for microsoft storage backend
+    STORAGE_MICROSOFT_PREFIX:
+    # container to store charts for openstack storage backend
+    STORAGE_OPENSTACK_CONTAINER:
+    # prefix to store charts for openstack storage backend
+    STORAGE_OPENSTACK_PREFIX:
+    # region of openstack container
+    STORAGE_OPENSTACK_REGION:
+    # path to a CA cert bundle for your openstack endpoint
+    STORAGE_OPENSTACK_CACERT:
+    # form field which will be queried for the chart file content
+    CHART_POST_FORM_FIELD_NAME: chart
+    # form field which will be queried for the provenance file content
+    PROV_POST_FORM_FIELD_NAME: prov
+    # levels of nested repos for multitenancy. The default depth is 0 (singletenant server)
+    DEPTH: 0
+    # show debug messages
+    DEBUG: false
+    # output structured logs as json
+    LOG_JSON: true
+    # disable use of index-cache.yaml
+    DISABLE_STATEFILES: false
+    # disable Prometheus metrics
+    DISABLE_METRICS: true
+    # disable all routes prefixed with /api
+    DISABLE_API: false
+    # allow chart versions to be re-uploaded
+    ALLOW_OVERWRITE: false
+    # absolute url for .tgzs in index.yaml
+    CHART_URL:
+    # allow anonymous GET operations when auth is used
+    AUTH_ANONYMOUS_GET: false
+    # sets the base context path
+    CONTEXT_PATH:
+    # parallel scan limit for the repo indexer
+    INDEX_LIMIT: 0
+    # cache store, can be one of: redis (leave blank for inmemory cache)
+    CACHE:
+    # address of Redis service (host:port)
+    CACHE_REDIS_ADDR:
+    # Redis database to be selected after connect
+    CACHE_REDIS_DB: 0
+  secret:
+    # username for basic http authentication
+    BASIC_AUTH_USER:
+    # password for basic http authentication
+    BASIC_AUTH_PASS:
+    # GCP service account json file
+    GOOGLE_CREDENTIALS_JSON:
+    # Redis requirepass server configuration
+    CACHE_REDIS_PASSWORD:
+deployment:
+  ## Chartmuseum Deployment annotations
+  annotations: {}
+  #   name: value
+replica:
+  ## Chartmuseum Replicas annotations
+  annotations: {}
+  ## Read more about kube2iam to provide access to s3 https://github.com/jtblin/kube2iam
+  #   iam.amazonaws.com/role: role-arn
+service:
+  type: ClusterIP
+  externalPort: 8080
+  nodePort:
+  annotations: {}
+
+# resources: {}
+resources:
+  limits:
+    cpu: 100m
+    memory: 128Mi
+  requests:
+    cpu: 80m
+    memory: 64Mi
+
+probes:
+  liveness:
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 1
+    successThreshold: 1
+    failureThreshold: 3
+  readiness:
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 1
+    successThreshold: 1
+    failureThreshold: 3
+
+serviceAccount:
+  create: false
+  # name:
+
+securityContext: {}
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+persistence:
+  enabled: false
+  accessMode: ReadWriteOnce
+  size: 8Gi
+  ## A manually managed Persistent Volume and Claim
+  ## Requires persistence.enabled: true
+  ## If defined, PVC must be created manually before volume will be bound
+  # existingClaim:
+
+  ## Chartmuseum data Persistent Volume Storage Class
+  ## If defined, storageClassName: <storageClass>
+  ## If set to "-", storageClassName: "", which disables dynamic provisioning
+  ## If undefined (the default) or set to null, no storageClassName spec is
+  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
+  ##   GKE, AWS & OpenStack)
+  ##
+  # storageClass: "-"
+
+## Ingress for load balancer
+ingress:
+  enabled: false
+## Chartmuseum Ingress labels
+##
+#   labels:
+#     dns: "route53"
+
+## Chartmuseum Ingress annotations
+##
+#   annotations:
+#     kubernetes.io/ingress.class: nginx
+#     kubernetes.io/tls-acme: "true"
+
+## Chartmuseum Ingress hostnames
+## Must be provided if Ingress is enabled
+##
+#   hosts:
+#     chartmuseum.domain.com:
+#         - /charts
+#         - /index.yaml
+
+## Chartmuseum Ingress TLS configuration
+## Secrets must be manually created in the namespace
+##
+#   tls:
+#   - secretName: chartmuseum-server-tls
+#     hosts:
+#     - chartmuseum.domain.com
+
+# Adding secrets to tiller is not a great option, so If you want to use an existing
+# secret that contains the json file, you can use the following entries
+gcp:
+  secret:
+    enabled: false
+    # Name of the secret that contains the encoded json
+    name:
+    # Secret key that holds the json value.
+    key: credentials.json

charts/kubernetes-dashboard/latest/Chart.yaml

 name: kubernetes-dashboard
-version: 0.6.8
-appVersion: 1.8.3
+version: 0.8.0
+appVersion: 1.10.0
 description: General-purpose web UI for Kubernetes clusters
 keywords:
 - kubernetes

charts/kubernetes-dashboard/latest/README.md

+# kubernetes-dashboard
+
+[Kubernetes Dashboard](https://github.com/kubernetes/dashboard) is a general purpose, web-based UI for Kubernetes clusters. It allows users to manage applications running in the cluster and troubleshoot them, as well as manage the cluster itself.
+
+## Access control
+It is critical for the Kubernetes cluster to correctly setup access control of Kubernetes Dashboard. See this [guide](https://github.com/kubernetes/dashboard/wiki/Access-control) for best practises.
+
+It is highly recommended to use RBAC with minimal privileges needed for Dashboard to run.
+
 ## Configuration
 
 The following table lists the configurable parameters of the kubernetes-dashboard chart and their default values.
 
 | Parameter                           | Description                                                                                                                 | Default                                                                    |
-|---------------------------|-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------|
+|-------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------|
 | `image.repository`                  | Repository for container image                                                                                              | `k8s.gcr.io/kubernetes-dashboard-amd64`                                    |
-| `image.tag`               | Image tag                                                                                                                   | `v1.8.3`                                                                 |
+| `image.tag`                         | Image tag                                                                                                                   | `v1.10.0`                                                                  |
 | `image.pullPolicy`                  | Image pull policy                                                                                                           | `IfNotPresent`                                                             |
+| `replicaCount`                      | Number of replicas                                                                                                          | `1`                                                                        |
 | `extraArgs`                         | Additional container arguments                                                                                              | `[]`                                                                       |
 | `nodeSelector`                      | node labels for pod assignment                                                                                              | `{}`                                                                       |
 | `tolerations`                       | List of node taints to tolerate (requires Kubernetes >= 1.6)                                                                | `[]`                                                                       |
+| `affinity`                         | Affinity for pod assignment                                                                                                  | `[]`                                                                       |
 | `service.externalPort`              | Dashboard external port                                                                                                     | 443                                                                        |
 | `service.internalPort`              | Dashboard internal port                                                                                                     | 443                                                                        |
 | `ingress.annotations`               | Specify ingress class                                                                                                       | `kubernetes.io/ingress.class: nginx`                                       |
@@ -17,8 +28,32 @@ The following table lists the configurable parameters of the kubernetes-dashboar
 | `ingress.path`                      | Path to match against incoming requests. Must begin with a '/'                                                              | `/`                                                                        |
 | `ingress.hosts`                     | Dashboard Hostnames                                                                                                         | `nil`                                                                      |
 | `ingress.tls`                       | Ingress TLS configuration                                                                                                   | `[]`                                                                       |
-| `resources`               | Pod resource requests & limits                                                                                              | `limits: {cpu: 100m, memory: 50Mi}, requests: {cpu: 100m, memory: 50Mi}` |
+| `resources`                         | Pod resource requests & limits                                                                                              | `limits: {cpu: 100m, memory: 100Mi}, requests: {cpu: 100m, memory: 100Mi}` |
 | `rbac.create`                       | Create & use RBAC resources                                                                                                 | `true`                                                                     |
 | `rbac.clusterAdminRole`             | "cluster-admin" ClusterRole will be used for dashboard ServiceAccount ([NOT RECOMMENDED](#access-control))                  | `false`                                                                    |
 | `serviceAccount.create`             | Whether a new service account name that the agent will use should be created.                                               | `true`                                                                     |
 | `serviceAccount.name`               | Service account to be used. If not set and serviceAccount.create is `true` a name is generated using the fullname template. |                                                                            |
+| `livenessProbe.initialDelaySeconds` | Number of seconds to wait before sending first probe                                                                        | 30                                                                         |
+| `livenessProbe.timeoutSeconds`      | Number of seconds to wait for probe response                                                                                | 30                                                                         |
+
+Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
+
+```console
+$ helm install stable/kubernetes-dashboard --name my-release \
+  --set=service.externalPort=8080,resources.limits.cpu=200m
+```
+
+Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example,
+
+```console
+$ helm install stable/kubernetes-dashboard --name my-release -f values.yaml
+```
+
+> **Tip**: You can use the default [values.yaml](values.yaml)
+
+## Using the dashboard with 'kubectl proxy'
+
+When running 'kubectl proxy', the address `localhost:8001/ui` automatically expands to `http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/`. For this to reach the dashboard, the name of the service must be 'kubernetes-dashboard', not any other value as set by Helm. You can manually specify this using the value 'fullnameOverride':
+```
+fullnameOverride: 'kubernetes-dashboard'
+```

charts/kubernetes-dashboard/latest/questions.yml

-namespace: kube-system
 rancher_version: v2.0.7
 categories:
 - dashboard
@@ -17,7 +16,7 @@ questions:
     type: string
     label: Image Repository
   - variable: image.tag
-    default: "v1.8.3"
+    default: "v1.10.0"
     description: "Docker image tag"
     type: string
     label: Image Tag

charts/kubernetes-dashboard/latest/templates/NOTES.txt

@@ -26,5 +26,7 @@ Get the Kubernetes Dashboard URL by running:
 {{- else if contains "ClusterIP"  .Values.service.type }}
 
 Get the Kubernetes Dashboard URL by running:
-  kubectl cluster-info | grep dashboard
+  export POD_NAME=$(kubectl get pods -n {{ .Release.Namespace }} -l "app={{ template "kubernetes-dashboard.name" . }},release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  echo https://127.0.0.1:8443/
+  kubectl -n {{ .Release.Namespace }} port-forward $POD_NAME 8443:8443
 {{- end }}

charts/kubernetes-dashboard/latest/templates/deployment.yaml

@@ -12,7 +12,7 @@ metadata:
 {{ toYaml .Values.labels | indent 4 }}
 {{- end }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.replicaCount }}
   strategy:
     rollingUpdate:
       maxSurge: 0
@@ -50,8 +50,8 @@ spec:
             scheme: HTTPS
             path: /
             port: 8443
-          initialDelaySeconds: 30
-          timeoutSeconds: 30
+          initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds }}
+          timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
     {{- if .Values.nodeSelector }}
@@ -68,3 +68,7 @@ spec:
       tolerations:
 {{ toYaml .Values.tolerations | indent 8 }}
     {{- end }}
+    {{- if .Values.affinity }}
+        affinity:
+{{ toYaml .Values.affinity | indent 8 }}
+    {{- end }}

charts/kubernetes-dashboard/latest/templates/ingress.yaml

@@ -13,7 +13,6 @@ metadata:
     heritage: {{ .Release.Service }}
 {{- if .Values.ingress.annotations }}
   annotations:
-    nginx.org/redirect-to-https: true
 {{ toYaml .Values.ingress.annotations | indent 4 }}
 {{- end }}
 spec:

charts/kubernetes-dashboard/latest/templates/role.yaml

@@ -8,7 +8,7 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
   name: {{ template "kubernetes-dashboard.fullname" . }}
-  namespace: kube-system
+  namespace: {{ .Release.Namespace }}
 rules:
   # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
 - apiGroups:

charts/kubernetes-dashboard/latest/templates/rolebinding.yaml

 {{- if .Values.rbac.create }}
+
 {{- if .Values.rbac.clusterAdminRole }}
 # Cluster role binding for clusterAdminRole == true
 apiVersion: rbac.authorization.k8s.io/v1beta1
@@ -17,7 +18,7 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: {{ template "kubernetes-dashboard.serviceAccountName" . }}
-    namespace: kube-system
+    namespace: {{ .Release.Namespace }}
 {{- else -}}
 # Role binding for clusterAdminRole == false
 apiVersion: rbac.authorization.k8s.io/v1beta1
@@ -29,7 +30,7 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
   name: {{ template "kubernetes-dashboard.fullname" . }}
-  namespace: kube-system
+  namespace: {{ .Release.Namespace }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
@@ -37,6 +38,6 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: {{ template "kubernetes-dashboard.serviceAccountName" . }}
-    namespace: kube-system
+    namespace: {{ .Release.Namespace }}
 {{- end -}}
 {{- end -}}

charts/kubernetes-dashboard/latest/templates/secret.yaml

@@ -7,5 +7,5 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
   name: {{ template "kubernetes-dashboard.fullname" . }}
-  namespace: kube-system
+  namespace: {{ .Release.Namespace }}
 type: Opaque

charts/kubernetes-dashboard/latest/templates/serviceaccount.yaml

@@ -8,5 +8,5 @@ metadata:
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
   name: {{ template "kubernetes-dashboard.serviceAccountName" . }}
-  namespace: kube-system
+  namespace: {{ .Release.Namespace }}
 {{- end -}}

charts/kubernetes-dashboard/latest/templates/svc.yaml

@@ -18,8 +18,7 @@ metadata:
 spec:
   type: {{ .Values.service.type }}
   ports:
-  - name: https
-    port: {{ .Values.service.externalPort }}
+  - port: {{ .Values.service.externalPort }}
     targetPort: https
 {{- if .Values.service.nodePort }}
     nodePort: {{ .Values.service.nodePort }}

charts/kubernetes-dashboard/latest/values.yaml

@@ -5,10 +5,12 @@
 
 image:
   repository: k8s.gcr.io/kubernetes-dashboard-amd64
-  tag: v1.8.3
+  tag: v1.10.0
   pullPolicy: IfNotPresent
 
-## Here labels can be added to the kubernets dashboard deployment
+replicaCount: 1
+
+## Here labels can be added to the kubernetes dashboard deployment
 ##
 labels: {}
 # kubernetes.io/cluster-service: "true"
@@ -32,6 +34,11 @@ tolerations: []
 #    value: "value"
 #    effect: "NoSchedule|PreferNoSchedule|NoExecute"
 
+## Affinity
+## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+affinity: {}
+
+
 service:
   type: ClusterIP
   externalPort: 443
@@ -54,10 +61,10 @@ service:
 resources:
   limits:
     cpu: 100m
-    memory: 50Mi
+    memory: 100Mi
   requests:
     cpu: 100m
-    memory: 50Mi
+    memory: 100Mi
 
 ingress:
   ## If true, Kubernetes Dashboard Ingress will be created.
@@ -73,7 +80,7 @@ ingress:
 
   ## Kubernetes Dashboard Ingress path
   ##
-  path: ""
+  path: /
 
   ## Kubernetes Dashboard Ingress hostnames
   ## Must be provided if Ingress is enabled
@@ -103,3 +110,9 @@ serviceAccount:
   # The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template
   name:
+
+livenessProbe:
+  # Number of seconds to wait before sending first probe
+  initialDelaySeconds: 30
+  # Number of seconds to wait for probe response
+  timeoutSeconds: 30

charts/kubernetes-dashboard/v0.6.8/.helmignore

+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

charts/kubernetes-dashboard/v0.6.8/Chart.yaml

+name: kubernetes-dashboard
+version: 0.6.8
+appVersion: 1.8.3
+description: General-purpose web UI for Kubernetes clusters
+keywords:
+- kubernetes
+- dashboard
+home: https://github.com/kubernetes/dashboard
+sources:
+- https://github.com/kubernetes/dashboard
+maintainers:
+- name: kfox1111
+  email: Kevin.Fox@pnnl.gov
+icon: https://raw.githubusercontent.com/kubernetes/kubernetes/master/logo/logo.svg

charts/kubernetes-dashboard/v0.6.8/README.md

+## Configuration
+
+The following table lists the configurable parameters of the kubernetes-dashboard chart and their default values.
+
+| Parameter                 | Description                                                                                                                 | Default                                                                  |
+|---------------------------|-----------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------|
+| `image.repository`        | Repository for container image                                                                                              | `k8s.gcr.io/kubernetes-dashboard-amd64`                                  |
+| `image.tag`               | Image tag                                                                                                                   | `v1.8.3`                                                                 |
+| `image.pullPolicy`        | Image pull policy                                                                                                           | `IfNotPresent`                                                           |
+| `extraArgs`               | Additional container arguments                                                                                              | `[]`                                                                     |
+| `nodeSelector`            | node labels for pod assignment                                                                                              | `{}`                                                                     |
+| `tolerations`             | List of node taints to tolerate (requires Kubernetes >= 1.6)                                                                | `[]`                                                                     |
+| `service.externalPort`    | Dashboard external port                                                                                                     | 443                                                                      |
+| `service.internalPort`    | Dashboard internal port                                                                                                     | 443                                                                      |
+| `ingress.annotations`     | Specify ingress class                                                                                                       | `kubernetes.io/ingress.class: nginx` |
+| `ingress.enabled`         | Enable ingress controller resource                                                                                          | `false`                                                                  |
+| `ingress.path`            | Path to match against incoming requests. Must begin with a '/'                                                              | `/`                                                                  |
+| `ingress.hosts`           | Dashboard Hostnames                                                                                                         | `nil`                                                                    |
+| `ingress.tls`             | Ingress TLS configuration                                                                                                   | `[]`                                                                     |
+| `resources`               | Pod resource requests & limits                                                                                              | `limits: {cpu: 100m, memory: 50Mi}, requests: {cpu: 100m, memory: 50Mi}` |
+| `rbac.create`             | Create & use RBAC resources                                                                                                 | `true`                                                                   |
+| `rbac.clusterAdminRole`   | "cluster-admin" ClusterRole will be used for dashboard ServiceAccount ([NOT RECOMMENDED](#access-control))                  | `false`                                                                  |
+| `serviceAccount.create`   | Whether a new service account name that the agent will use should be created.                                               | `true`                                                                   |
+| `serviceAccount.name`     | Service account to be used. If not set and serviceAccount.create is `true` a name is generated using the fullname template. |                                                                          |

charts/kubernetes-dashboard/v0.6.8/app-readme.md

+# kubernetes-dashboard
+
+[Kubernetes Dashboard](https://github.com/kubernetes/dashboard) is a general purpose, web-based UI for Kubernetes clusters. It allows users to manage applications running in the cluster and troubleshoot them, as well as manage the cluster itself.
+
+## Access control
+
+IMPORTANT: 
+
+You must be a cluster admin to be able to deploy Kubernetes Dashboard. 
+
+WARNING: 
+
+Once the Dashboard is deployed with cluster admin role, anyone with access to this project can access the Dashboard and therefore gain access to the entire Kubernetes cluster!!!
+
+It is critical for the Kubernetes cluster to correctly setup access control of Kubernetes Dashboard. See this [guide](https://github.com/kubernetes/dashboard/wiki/Access-control) for best practises.
+
+It is highly recommended to use RBAC with minimal privileges needed for Dashboard to run.
+
+`Notes: Dashboard is required to be installed in the System Project`

charts/kubernetes-dashboard/v0.6.8/questions.yml

+namespace: kube-system
+rancher_version: v2.0.7
+categories:
+- dashboard
+questions:
+- variable: defaultImage
+  default: true
+  description: "Use default Docker image"
+  label: Use Default Image
+  type: boolean
+  show_subquestion_if: false
+  group: "Container Images"
+  subquestions:
+  - variable: image.repository
+    default: "k8s.gcr.io/kubernetes-dashboard-amd64"
+    description: "Docker image repository"
+    type: string
+    label: Image Repository
+  - variable: image.tag
+    default: "v1.8.3"
+    description: "Docker image tag"
+    type: string
+    label: Image Tag
+- variable: rbac.clusterAdminRole
+  required: true
+  default: false
+  description: "IMPORTANT: Granting admin privileges to Dashboard's Service Account might be a security risk, makeing sure that you know what you are doing before proceeding."
+  type: boolean
+  label: "IMPORTANT: Enable Dashboard Cluster Admin Role"

charts/kubernetes-dashboard/v0.6.8/templates/NOTES.txt

+*********************************************************************************
+*** PLEASE BE PATIENT: kubernetes-dashboard may take a few minutes to install ***
+*********************************************************************************
+
+{{- if .Values.ingress.enabled }}
+From outside the cluster, the server URL(s) are:
+{{- range .Values.ingress.hosts }}
+     https://{{ . }}
+{{- end }}
+
+{{- else if contains "NodePort" .Values.service.type }}
+
+Get the Kubernetes Dashboard URL by running:
+  export NODE_PORT=$(kubectl get -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "kubernetes-dashboard.fullname" . }})
+  export NODE_IP=$(kubectl get nodes -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo https://$NODE_IP:$NODE_PORT/
+
+{{- else if contains "LoadBalancer" .Values.service.type }}
+
+  NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+        Watch the status with: 'kubectl get svc -w {{ template "kubernetes-dashboard.fullname" . }}'
+
+Get the Kubernetes Dashboard URL by running:
+  export SERVICE_IP=$(kubectl get svc {{ template "kubernetes-dashboard.fullname" . }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
+  echo https://$SERVICE_IP/
+{{- else if contains "ClusterIP"  .Values.service.type }}
+
+Get the Kubernetes Dashboard URL by running:
+  kubectl cluster-info | grep dashboard
+{{- end }}

charts/kubernetes-dashboard/v0.6.8/templates/_helpers.tpl

+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "kubernetes-dashboard.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "kubernetes-dashboard.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "kubernetes-dashboard.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "kubernetes-dashboard.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "kubernetes-dashboard.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

charts/kubernetes-dashboard/v0.6.8/templates/deployment.yaml

+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: {{ template "kubernetes-dashboard.fullname" . }}
+  labels:
+    app: {{ template "kubernetes-dashboard.name" . }}
+    chart: {{ template "kubernetes-dashboard.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    kubernetes.io/cluster-service: "true"
+{{- if .Values.labels }}
+{{ toYaml .Values.labels | indent 4 }}
+{{- end }}
+spec:
+  replicas: 1
+  strategy:
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: {{ template "kubernetes-dashboard.name" . }}
+        release: {{ .Release.Name }}
+        kubernetes.io/cluster-service: "true"
+    spec:
+      serviceAccountName: {{ template "kubernetes-dashboard.serviceAccountName" . }}
+      containers:
+      - name: {{ .Chart.Name }}
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        args:
+          - --auto-generate-certificates
+{{- if .Values.extraArgs }}
+{{ toYaml .Values.extraArgs | indent 10 }}
+{{- end }}
+        ports:
+        - name: https
+          containerPort: 8443
+          protocol: TCP
+        volumeMounts:
+        - name: kubernetes-dashboard-certs
+          mountPath: /certs
+          # Create on-disk volume to store exec logs
+        - mountPath: /tmp
+          name: tmp-volume
+        livenessProbe:
+          httpGet:
+            scheme: HTTPS
+            path: /
+            port: 8443
+          initialDelaySeconds: 30
+          timeoutSeconds: 30
+        resources:
+{{ toYaml .Values.resources | indent 10 }}
+    {{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+    {{- end }}
+      volumes:
+      - name: kubernetes-dashboard-certs
+        secret:
+          secretName: {{ template "kubernetes-dashboard.fullname" . }}
+      - name: tmp-volume
+        emptyDir: {}
+    {{- if .Values.tolerations }}
+      tolerations:
+{{ toYaml .Values.tolerations | indent 8 }}
+    {{- end }}

charts/kubernetes-dashboard/v0.6.8/templates/ingress.yaml

+{{- if .Values.ingress.enabled -}}
+{{- $serviceName := include "kubernetes-dashboard.fullname" . -}}
+{{- $servicePort := .Values.service.externalPort -}}
+{{- $path := .Values.ingress.path -}}
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: {{ template "kubernetes-dashboard.fullname" . }}
+  labels:
+    app: {{ template "kubernetes-dashboard.name" . }}
+    chart: {{ template "kubernetes-dashboard.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+{{- if .Values.ingress.annotations }}
+  annotations:
+    nginx.org/redirect-to-https: true
+{{ toYaml .Values.ingress.annotations | indent 4 }}
+{{- end }}
+spec:
+  rules:
+  {{- if .Values.ingress.hosts }}
+  {{- range $host := .Values.ingress.hosts }}
+    - host: {{ $host }}
+      http:
+        paths:
+          - path: {{ $path }}
+            backend:
+              serviceName: {{ $serviceName }}
+              servicePort: {{ $servicePort }}
+  {{- end -}}
+  {{- else }}
+    - http:
+        paths:
+          - path: {{ $path }}
+            backend:
+              serviceName: {{ $serviceName }}
+              servicePort: {{ $servicePort }}
+  {{- end -}}
+  {{- if .Values.ingress.tls }}
+  tls:
+{{ toYaml .Values.ingress.tls | indent 4 }}
+  {{- end -}}
+{{- end -}}

charts/kubernetes-dashboard/v0.6.8/templates/role.yaml

+{{- if and .Values.rbac.create (not .Values.rbac.clusterAdminRole) }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: Role
+metadata:
+  labels:
+    app: {{ template "kubernetes-dashboard.name" . }}
+    chart: {{ template "kubernetes-dashboard.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "kubernetes-dashboard.fullname" . }}
+  namespace: kube-system
+rules:
+  # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
+- apiGroups:
+    - ""
+  resources:
+    - secrets
+  verbs:
+    - create
+
+  # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
+- apiGroups:
+    - ""
+  resources:
+    - configmaps
+  verbs:
+    - create
+
+  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
+- apiGroups:
+    - ""
+  resources:
+    - secrets
+  resourceNames:
+    - kubernetes-dashboard-key-holder
+    - {{ template "kubernetes-dashboard.fullname" . }}
+  verbs:
+    - get
+    - update
+    - delete
+
+  # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
+- apiGroups:
+    - ""
+  resources:
+    - configmaps
+  resourceNames:
+    - kubernetes-dashboard-settings
+  verbs:
+    - get
+    - update
+
+  # Allow Dashboard to get metrics from heapster.
+- apiGroups:
+    - ""
+  resources:
+    - services
+  resourceNames:
+    - heapster
+  verbs:
+    - proxy
+- apiGroups:
+    - ""
+  resources:
+    - services/proxy
+  resourceNames:
+    - heapster
+    - "http:heapster:"
+    - "https:heapster:"
+  verbs:
+    - get
+{{- end -}}

charts/kubernetes-dashboard/v0.6.8/templates/rolebinding.yaml

+{{- if .Values.rbac.create }}
+{{- if .Values.rbac.clusterAdminRole }}
+# Cluster role binding for clusterAdminRole == true
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app: {{ template "kubernetes-dashboard.name" . }}
+    chart: {{ template "kubernetes-dashboard.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "kubernetes-dashboard.fullname" . }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "kubernetes-dashboard.serviceAccountName" . }}
+    namespace: kube-system
+{{- else -}}
+# Role binding for clusterAdminRole == false
+apiVersion: rbac.authorization.k8s.io/v1beta1
+kind: RoleBinding
+metadata:
+  labels:
+    app: {{ template "kubernetes-dashboard.name" . }}
+    chart: {{ template "kubernetes-dashboard.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "kubernetes-dashboard.fullname" . }}
+  namespace: kube-system
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "kubernetes-dashboard.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "kubernetes-dashboard.serviceAccountName" . }}
+    namespace: kube-system
+{{- end -}}
+{{- end -}}

charts/kubernetes-dashboard/v0.6.8/templates/secret.yaml

+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    app: {{ template "kubernetes-dashboard.name" . }}
+    chart: {{ template "kubernetes-dashboard.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "kubernetes-dashboard.fullname" . }}
+  namespace: kube-system
+type: Opaque

charts/kubernetes-dashboard/v0.6.8/templates/serviceaccount.yaml

+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: {{ template "kubernetes-dashboard.name" . }}
+    chart: {{ template "kubernetes-dashboard.chart" . }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "kubernetes-dashboard.serviceAccountName" . }}
+  namespace: kube-system
+{{- end -}}

charts/kubernetes-dashboard/v0.6.8/templates/svc.yaml

+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "kubernetes-dashboard.fullname" . }}
+  labels:
+    app: {{ template "kubernetes-dashboard.name" . }}
+    chart: {{ template "kubernetes-dashboard.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+    kubernetes.io/cluster-service: "true"
+{{- if .Values.service.labels }}
+{{ toYaml .Values.service.labels | indent 4 }}
+{{- end }}
+{{- if .Values.service.annotations }}
+  annotations:
+{{ toYaml .Values.service.annotations | indent 4 }}
+{{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+  - name: https
+    port: {{ .Values.service.externalPort }}
+    targetPort: https
+{{- if .Values.service.nodePort }}
+    nodePort: {{ .Values.service.nodePort }}
+{{- end }}
+  selector:
+    app: {{ template "kubernetes-dashboard.name" . }}
+    release: {{ .Release.Name }}

charts/kubernetes-dashboard/v0.6.8/values.yaml

+# Default values for kubernetes-dashboard
+# This is a YAML-formatted file.
+# Declare name/value pairs to be passed into your templates.
+# name: value
+
+image:
+  repository: k8s.gcr.io/kubernetes-dashboard-amd64
+  tag: v1.8.3
+  pullPolicy: IfNotPresent
+
+## Here labels can be added to the kubernets dashboard deployment
+##
+labels: {}
+# kubernetes.io/cluster-service: "true"
+# kubernetes.io/name: "Kubernetes Dashboard"
+
+## Additional container arguments
+##
+# extraArgs:
+#   - --enable-insecure-login
+#   - --system-banner="Welcome to Kubernetes"
+
+## Node labels for pod assignment
+## Ref: https://kubernetes.io/docs/user-guide/node-selection/
+##
+nodeSelector: {}
+
+## List of node taints to tolerate (requires Kubernetes >= 1.6)
+tolerations: []
+#  - key: "key"
+#    operator: "Equal|Exists"
+#    value: "value"
+#    effect: "NoSchedule|PreferNoSchedule|NoExecute"
+
+service:
+  type: ClusterIP
+  externalPort: 443
+
+  ## This allows an override of the heapster service name
+  ## Default: {{ .Chart.Name }}
+  ##
+  # nameOverride:
+
+  ## Kubernetes Dashboard Service annotations
+  ##
+  annotations: {}
+  # foo.io/bar: "true"
+
+  ## Here labels can be added to the Kubernetes Dashboard service
+  ##
+  labels: {}
+  # kubernetes.io/name: "Kubernetes Dashboard"
+
+resources:
+  limits:
+    cpu: 100m
+    memory: 50Mi
+  requests:
+    cpu: 100m
+    memory: 50Mi
+
+ingress:
+  ## If true, Kubernetes Dashboard Ingress will be created.
+  ##
+  enabled: false
+
+  ## Kubernetes Dashboard Ingress annotations
+  ##
+  # annotations:
+  #   kubernetes.io/ingress.class: nginx
+  #   nginx.ingress.kubernetes.io/secure-backends: "true"
+  #   kubernetes.io/tls-acme: 'true'
+
+  ## Kubernetes Dashboard Ingress path
+  ##
+  path: ""
+
+  ## Kubernetes Dashboard Ingress hostnames
+  ## Must be provided if Ingress is enabled
+  ##
+  # hosts:
+  #   - kubernetes-dashboard.domain.com
+
+  ## Kubernetes Dashboard Ingress TLS configuration
+  ## Secrets must be manually created in the namespace
+  ##
+  # tls:
+  #   - secretName: kubernetes-dashboard-tls
+  #     hosts:
+  #       - kubernetes-dashboard.domain.com
+
+rbac:
+  # Specifies whether RBAC resources should be created
+  create: true
+
+  # Specifies whether cluster-admin ClusterRole will be used for dashboard
+  # ServiceAccount (NOT RECOMMENDED).
+  clusterAdminRole: false
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name:

proposed/kubeflow/latest/.helmignore

+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

proposed/kubeflow/latest/Chart.yaml

+apiVersion: v1
+appVersion: "1.0"
+description: Machine Learning Toolkit for Kubernetes
+name: kubeflow
+version: 0.1.0
+icon: file://../icon.jpg
+maintainers:
+- name: guangbochen
+  email: support@rancher.com
+home: https://www.kubeflow.org/docs/about/kubeflow/

proposed/kubeflow/latest/README.md

+# Kubeflow
+
+The Kubeflow project is dedicated to making deployments of machine learning (ML) workflows on Kubernetes simple, portable and scalable. Our goal is not to recreate other services, but to provide a straightforward way to deploy best-of-breed open-source systems for ML to diverse infrastructures. Anywhere you are running Kubernetes, you should be able to run Kubeflow
+
+## Who should consider using Kubeflow?
+
+Based on the current functionality you should consider using Kubeflow if:
+
+- You want to train/serve TensorFlow models in different environments (e.g. local, on prem, and cloud)
+- You want to use Jupyter notebooks to manage TensorFlow training jobs
+- You want to launch training jobs that use resources – such as additional CPUs or GPUs – that aren’t available on your personal computer
+- You want to combine TensorFlow with other processes
+  > For example, you may want to use [tensorflow/agents](https://github.com/google-research/batch-ppo) to run simulations to generate data for training reinforcement learning models.
+
+This list is based ONLY on current capabilities. We are investing significant resources to expand the functionality and actively soliciting help from companies and individuals interested in contributing (see [Contributing](https://www.kubeflow.org/docs/about/contributing/)).
+
+## How it works?
+
+For more details of how Kubeflow works please reference the [Kubeflow Doc](https://www.kubeflow.org/docs/about/kubeflow/).

proposed/kubeflow/latest/app-readme.md

+# Kubeflow
+
+The Kubeflow project is dedicated to making deployments of machine learning (ML) workflows on Kubernetes simple, portable and scalable. Our goal is not to recreate other services, but to provide a straightforward way to deploy best-of-breed open-source systems for ML to diverse infrastructures. Anywhere you are running Kubernetes, you should be able to run Kubeflow
+
+## Who should consider using Kubeflow?
+
+Based on the current functionality you should consider using Kubeflow if:
+
+- You want to train/serve TensorFlow models in different environments (e.g. local, on prem, and cloud)
+- You want to use Jupyter notebooks to manage TensorFlow training jobs
+- You want to launch training jobs that use resources – such as additional CPUs or GPUs – that aren’t available on your personal computer
+- You want to combine TensorFlow with other processes
+  > For example, you may want to use [tensorflow/agents](https://github.com/google-research/batch-ppo) to run simulations to generate data for training reinforcement learning models.