chore(cert-manager): validate names that are also used for k8s objects (#7789)

charts/enterprise/cert-manager/Chart.yaml

@@ -21,7 +21,7 @@ sources:
   - https://github.com/truecharts/charts/tree/master/charts/enterprise/cert-manager
   - https://cert-manager.io/
 type: application
-version: 1.0.9
+version: 1.0.10
 annotations:
   truecharts.org/catagories: |
     - core

charts/enterprise/cert-manager/docs/validation.md

@@ -0,0 +1,14 @@
+# Input Validation
+
+**`Self Signed Issuer Name`, `ACME Issuer Entry` and `CA Issuer Name`**
+Accepted formats are:
+
+- Lowercase letters and single hyphens between letters
+- No hyphens at the beginning or end of the name
+
+Regex used to match those: `^[a-z]+(-?[a-z]){0,63}-?[a-z]+$`
+You can try live [here](https://regex101.com/r/wKN01j/1)
+
+---
+
+_If you find a field that you think it needs validation, please open an issue on github_

charts/enterprise/cert-manager/questions.yaml

@@ -26,6 +26,7 @@ questions:
                       schema:
                         type: string
                         required: true
+                        valid_chars: '^[a-z]+(-?[a-z]){0,63}-?[a-z]+$'
                         default: ""
                     - variable: type
                       label: Type or DNS-Provider
@@ -198,7 +199,7 @@ questions:
                         default: ""
 
         - variable: CA
-          label: Certiticate Authority Issuer
+          label: Certificate Authority Issuer
           schema:
             type: list
             default: []
@@ -215,6 +216,7 @@ questions:
                       schema:
                         type: string
                         required: true
+                        valid_chars: '^[a-z]+(-?[a-z]){0,63}-?[a-z]+$'
                         default: ""
                     - variable: selfSigned
                       label: selfSigned
@@ -265,7 +267,8 @@ questions:
                 schema:
                   type: string
                   required: true
-                  default: "selfSigned"
+                  valid_chars: '^[a-z]+(-?[a-z]){0,63}-?[a-z]+$'
+                  default: "selfsigned"
 
   - variable: customMetrics
     group: Metrics

charts/enterprise/cert-manager/templates/clusterissuer/_ACME.tpl

@@ -1,6 +1,8 @@
 {{- define "certmanager.clusterissuer.acme" -}}
 {{- range .Values.clusterIssuer.ACME }}
-
+  {{- if not (mustRegexMatch "^[a-z]+(-?[a-z]){0,63}-?[a-z]+$" .name) -}}
+    {{- fail "ACME - Expected name to be all lowercase with hyphens, but not start or end with a hyphen" -}}
+  {{- end -}}
   {{- $validTypes := list "HTTP01" "cloudflare" "route53" -}}
   {{- if not (mustHas .type $validTypes) -}}
     {{- fail (printf "Expected ACME type to be one of [%s], but got [%s]" (join ", " $validTypes) .type) -}}

charts/enterprise/cert-manager/templates/clusterissuer/_CA.tpl

@@ -1,5 +1,8 @@
 {{- define "certmanager.clusterissuer.ca" -}}
 {{- range .Values.clusterIssuer.CA }}
+  {{- if not (mustRegexMatch "^[a-z]+(-?[a-z]){0,63}-?[a-z]+$" .name) -}}
+    {{- fail "CA - Expected name to be all lowercase with hyphens, but not start or end with a hyphen" -}}
+  {{- end -}}
 {{- if .selfSigned }}
 ---
 apiVersion: cert-manager.io/v1

charts/enterprise/cert-manager/templates/clusterissuer/_selfSigned.tpl

@@ -1,5 +1,8 @@
 {{- define "certmanager.clusterissuer.selfsigned" -}}
-{{- if .Values.clusterIssuer.selfSigned.enabled }}
+{{- if .Values.clusterIssuer.selfSigned.enabled -}}
+  {{- if not (mustRegexMatch "^[a-z]+(-?[a-z]){0,63}-?[a-z]+$" .Values.clusterIssuer.selfSigned.name) -}}
+    {{- fail "Self Singed Issuer - Expected name to be all lowercase with hyphens, but not start or end with a hyphen" -}}
+  {{- end }}
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer