Fix certificate generation script arguments

.github/workflows/release-docker.yaml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - devel
 
 jobs:
   release:

helm/imagepullsecret-injector/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.0.15
+version: 0.0.10
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

helm/imagepullsecret-injector/scripts/create-signed-cert.sh

@@ -89,7 +89,6 @@ apiVersion: certificates.k8s.io/v1
 kind: CertificateSigningRequest
 metadata:
   name: ${csrName}
-  namespace: ${namespace}
 spec:
   signerName: kubernetes.io/kubelet-serving
   groups:

helm/imagepullsecret-injector/templates/certificate-gen/cronjob-certificate-gen.yaml

@@ -5,7 +5,7 @@ metadata:
   labels:
     {{- include "imagepullsecret-injector.labels" . | nindent 4 }}
 spec:
-  schedule: '* * * * 0'
+  schedule: '* * * * *'
   jobTemplate:
     metadata:
       name: "{{ .Release.Name }}"
@@ -21,12 +21,9 @@ spec:
               image: "{{ .Values.certificateGeneratorImage.registry }}/{{ .Values.certificateGeneratorImage.repository }}:{{ .Values.certificateGeneratorImage.tag | default .Chart.AppVersion }}"
               command: ["/entrypoint/entrypoint.sh"]
               args:
-                - --service
+                - --service "{{ include "imagepullsecret-injector.serviceName" . }}"
-                - "{{ include "imagepullsecret-injector.serviceName" . }}"
+                - --namespace "{{ .Release.Namespace }}"
-                - --namespace
+                - --secret "{{ include "imagepullsecret-injector.certificateSecretName" . }}"
-                - "{{ .Release.Namespace }}"
-                - --secret
-                - "{{ include "imagepullsecret-injector.certificateSecretName" . }}"
               volumeMounts:
                 - mountPath: "/entrypoint"
                   name: entrypoint

helm/imagepullsecret-injector/templates/certificate-gen/job-certificate-gen.yaml

@@ -14,12 +14,9 @@ spec:
           image: "{{ .Values.certificateGeneratorImage.registry }}/{{ .Values.certificateGeneratorImage.repository }}:{{ .Values.certificateGeneratorImage.tag | default .Chart.AppVersion }}"
           command: ["/entrypoint/entrypoint.sh"]
           args:
-            - --service
+            - --service "{{ include "imagepullsecret-injector.serviceName" . }}"
-            - "{{ include "imagepullsecret-injector.serviceName" . }}"
+            - --namespace "{{ .Release.Namespace }}"
-            - --namespace
+            - --secret "{{ include "imagepullsecret-injector.certificateSecretName" . }}"
-            - "{{ .Release.Namespace }}"
-            - --secret
-            - "{{ include "imagepullsecret-injector.certificateSecretName" . }}"
           volumeMounts:
             - mountPath: "/entrypoint"
               name: entrypoint

helm/imagepullsecret-injector/templates/certificate-gen/rbac-certificate-gen.yaml

@@ -30,16 +30,15 @@ rules:
       - list
       - get
   - apiGroups:
-      - certificates.k8s.io
+      - "certificates.k8s.io/v1"
     resources:
       - certificatesigningrequests
     verbs:
       - create
       - list
       - get
-      - delete
   - apiGroups:
-      - certificates.k8s.io
+      - "certificates.k8s.io/v1"
     resources:
       - certificatesigningrequests/approval
     verbs:

helm/imagepullsecret-injector/templates/mutatingwebhook.yaml

@@ -21,5 +21,3 @@ webhooks:
     resources: ["serviceaccounts"]
   admissionReviewVersions: ["v1", "v1beta1"]
   sideEffects: None
-  # The default "Fail" option prevents Gardener cluster to be hibernated
-  failurePolicy: Ignore