cluster

commit 58ec5e58d9d431c46a08a594d19cc1d6439ef89b
parent f021a600b031253be81b2ab58ed0d37271b74ead
Author: MTRNord <mtrnord1@gmail.com>
Date:   Fri, 17 Mar 2023 20:02:04 +0100

Add cert-manager

Diffstat:
M
README.md
 | 
2
+-
M
clusters/production/infrastructure.yaml
 | 
36
++++++++++++++++++++++++++++++++++++
A
infrastructure/configs/cluster-issuers.yaml
 | 
38
++++++++++++++++++++++++++++++++++++++
A
infrastructure/configs/kustomization.yaml
 | 
4
++++
A
infrastructure/controllers/cert-manager.yaml
 | 
33
+++++++++++++++++++++++++++++++++
M
infrastructure/controllers/kustomization.yaml
 | 
1
+

6 files changed, 113 insertions(+), 1 deletion(-)
diff --git a/README.md b/README.md
@@ -142,7 +142,7 @@ infra-controllers       main@sha1:21ebd912      False   True    Applied revision
   - [ ] Woodpecker
   - [ ] Docker repo
   - [ ] Traefik
-  - [ ] Certmanager
+  - [x] Certmanager
   - [ ] External DNS
   - [ ] Synapse
   - [ ] Mjolnir
diff --git a/clusters/production/infrastructure.yaml b/clusters/production/infrastructure.yaml
@@ -39,3 +39,39 @@ spec:
     provider: sops
     secretRef:
       name: sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: infra-configs
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: infra-controllers
+  interval: 1h
+  retryInterval: 1m
+  timeout: 5m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./infrastructure/configs
+  prune: true
+  patches:
+    - patch: |
+        - op: replace
+          path: /spec/acme/server
+          value: https://acme-v02.api.letsencrypt.org/directory
+      target:
+        kind: ClusterIssuer
+        name: letsencrypt-dns
+    - patch: |
+        - op: replace
+          path: /spec/acme/server
+          value: https://acme-v02.api.letsencrypt.org/directory
+      target:
+        kind: ClusterIssuer
+        name: letsencrypt-http
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
diff --git a/infrastructure/configs/cluster-issuers.yaml b/infrastructure/configs/cluster-issuers.yaml
@@ -0,0 +1,38 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-dns
+spec:
+  acme:
+    email: info@nordgedanken.dev
+    # The server is replaced in /clusters/production/infrastructure.yaml
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-dns-account-key
+    solvers:
+      - dns01:
+          rfc2136:
+            nameserver: "[2a01:4f9:4a:451c:2::5]:53"
+            tsigAlgorithm: HMACSHA256
+            tsigKeyName: lego_letsencrypt
+            tsigSecretSecretRef:
+              key: tsig-secret
+              name: tsig-secret
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-http
+spec:
+  acme:
+    email: info@nordgedanken.dev
+    # The server is replaced in /clusters/production/infrastructure.yaml
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-dns-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik
+            serviceType: ClusterIP
diff --git a/infrastructure/configs/kustomization.yaml b/infrastructure/configs/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - cluster-issuers.yaml
diff --git a/infrastructure/controllers/cert-manager.yaml b/infrastructure/controllers/cert-manager.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+---
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: HelmRepository
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 24h
+  url: https://charts.jetstack.io
+---
+apiVersion: helm.toolkit.fluxcd.io/v2beta1
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cert-manager
+      version: "1.x"
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager
+        namespace: cert-manager
+      interval: 12h
+  values:
+    installCRDs: true
diff --git a/infrastructure/controllers/kustomization.yaml b/infrastructure/controllers/kustomization.yaml
@@ -1,4 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - cert-manager.yaml
   - weave-gitops.yaml