From 362b8160c86e741db7db50bd9c570d2f03504b63 Mon Sep 17 00:00:00 2001
From: rblundon <ryan.blundon@protonmail.com>
Date: Tue, 13 May 2025 13:19:01 -0500
Subject: [PATCH] deploy and configure cert-manager

---
 cluster/cert-manager.yaml                     | 33 ++++++++++++
 .../base/cloudflare-secret-eso.yaml           | 15 ++++++
 cluster/cert-manager/base/clusterissuers.yaml | 51 ++++++++++++++++++
 cluster/cert-manager/base/kustomization.yaml  | 18 +++++++
 cluster/cert-manager/base/monitoring.yaml     | 52 +++++++++++++++++++
 cluster/cert-manager/base/namespace.yaml      |  9 ++++
 cluster/cert-manager/base/operatorgroup.yaml  |  9 ++++
 .../base/split-horizon-patch.yaml             | 11 ++++
 cluster/cert-manager/base/subscription.yaml   | 12 +++++
 cluster/cert-manager/cert-patches.yaml        |  1 +
 .../overlays/hub/api-ingress.yaml             | 41 +++++++++++++++
 .../overlays/hub/apiserver-cert-config.yaml   | 11 ++++
 .../hub/ingress-controller-cert-config.yaml   |  8 +++
 .../overlays/hub/kustomization.yaml           | 11 ++++
 14 files changed, 282 insertions(+)
 create mode 100644 cluster/cert-manager.yaml
 create mode 100644 cluster/cert-manager/base/cloudflare-secret-eso.yaml
 create mode 100644 cluster/cert-manager/base/clusterissuers.yaml
 create mode 100644 cluster/cert-manager/base/kustomization.yaml
 create mode 100644 cluster/cert-manager/base/monitoring.yaml
 create mode 100644 cluster/cert-manager/base/namespace.yaml
 create mode 100644 cluster/cert-manager/base/operatorgroup.yaml
 create mode 100644 cluster/cert-manager/base/split-horizon-patch.yaml
 create mode 100644 cluster/cert-manager/base/subscription.yaml
 create mode 100644 cluster/cert-manager/cert-patches.yaml
 create mode 100644 cluster/cert-manager/overlays/hub/api-ingress.yaml
 create mode 100644 cluster/cert-manager/overlays/hub/apiserver-cert-config.yaml
 create mode 100644 cluster/cert-manager/overlays/hub/ingress-controller-cert-config.yaml
 create mode 100644 cluster/cert-manager/overlays/hub/kustomization.yaml

diff --git a/cluster/cert-manager.yaml b/cluster/cert-manager.yaml
new file mode 100644
index 0000000..2031dd8
--- /dev/null
+++ b/cluster/cert-manager.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  destination:
+    name: in-cluster
+    namespace: cert-manager
+  project: default
+  source:
+    path: cluster/cert-manager/overlays/hub
+    repoURL: https://github.com/rblundon/homelab.git
+    targetRevision: HEAD
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - RespectIgnoreDifferences=true
+    - CreateNamespace=true
+    managedNamespaceMetadata:
+      labels:
+        argocd.argoproj.io/managed-by: openshift-gitops
+  ignoreDifferences:
+  - group: apps
+    kind: Deployment
+    jsonPointers:
+    - /spec/replicas
\ No newline at end of file
diff --git a/cluster/cert-manager/base/cloudflare-secret-eso.yaml b/cluster/cert-manager/base/cloudflare-secret-eso.yaml
new file mode 100644
index 0000000..53e2fd0
--- /dev/null
+++ b/cluster/cert-manager/base/cloudflare-secret-eso.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: cloudflare-api-token # This is the secret name
+  namespace: cert-manager
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  refreshInterval: "1h"
+  data:
+    - secretKey: api-token
+      remoteRef:
+        key: CLOUDFLARE_TOKEN
diff --git a/cluster/cert-manager/base/clusterissuers.yaml b/cluster/cert-manager/base/clusterissuers.yaml
new file mode 100644
index 0000000..00c3473
--- /dev/null
+++ b/cluster/cert-manager/base/clusterissuers.yaml
@@ -0,0 +1,51 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    email: ryan.blundon@protonmail.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-issuer-account-key
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+    - dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token
+          email: ryan.blundon@protonmail.com
+        cnameStrategy: Follow
+      selector: 
+        dnsZones:
+          - 'mk-labs.cloud'
+          - 'monetnaildesign.com'
+
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    email: ryan.blundon@protonmail.com
+    privateKeySecretRef:
+      name: letsencrypt-staging-issuer-account-key
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    solvers:
+    - dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token
+          email: ryan.blundon@protonmail.com
+        cnameStrategy: Follow
+      selector: 
+        dnsZones:
+          - 'mk-labs.cloud'
+          - 'monetnaildesign.com'
diff --git a/cluster/cert-manager/base/kustomization.yaml b/cluster/cert-manager/base/kustomization.yaml
new file mode 100644
index 0000000..cffc385
--- /dev/null
+++ b/cluster/cert-manager/base/kustomization.yaml
@@ -0,0 +1,18 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+# Operator deployment
+- namespace.yaml
+- operatorgroup.yaml
+- subscription.yaml
+- monitoring.yaml
+# Deploy cluster resources
+- cloudflare-secret-eso.yaml
+- clusterissuers.yaml
+- split-horizon-patch.yaml
+#- api-ingress.yaml
diff --git a/cluster/cert-manager/base/monitoring.yaml b/cluster/cert-manager/base/monitoring.yaml
new file mode 100644
index 0000000..c868148
--- /dev/null
+++ b/cluster/cert-manager/base/monitoring.yaml
@@ -0,0 +1,52 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: prometheus-k8s
+  namespace: cert-manager
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  - endpoints
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: prometheus-k8s
+  namespace: cert-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: prometheus-k8s
+subjects:
+- kind: ServiceAccount
+  name: prometheus-k8s
+  namespace: openshift-monitoring
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  endpoints:
+  - interval: 30s
+    port: tcp-prometheus-servicemonitor
+    scheme: http
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: cert-manager
+      app.kubernetes.io/name: cert-manager
\ No newline at end of file
diff --git a/cluster/cert-manager/base/namespace.yaml b/cluster/cert-manager/base/namespace.yaml
new file mode 100644
index 0000000..79127f3
--- /dev/null
+++ b/cluster/cert-manager/base/namespace.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations: {}
+#    openshift.io/display-name: "cert-manager Operator for Red Hat OpenShift"
+  labels:
+    openshift.io/cluster-monitoring: 'true'
+  name: cert-manager-operator
diff --git a/cluster/cert-manager/base/operatorgroup.yaml b/cluster/cert-manager/base/operatorgroup.yaml
new file mode 100644
index 0000000..ecc0627
--- /dev/null
+++ b/cluster/cert-manager/base/operatorgroup.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: openshift-cert-manager-operator
+  namespace: cert-manager-operator
+spec:
+  targetNamespaces:
+    - cert-manager-operator
\ No newline at end of file
diff --git a/cluster/cert-manager/base/split-horizon-patch.yaml b/cluster/cert-manager/base/split-horizon-patch.yaml
new file mode 100644
index 0000000..9cff70c
--- /dev/null
+++ b/cluster/cert-manager/base/split-horizon-patch.yaml
@@ -0,0 +1,11 @@
+apiVersion: operator.openshift.io/v1alpha1
+kind: CertManager 
+metadata: 
+  name: cluster 
+spec: 
+  managementState: 'Managed'
+  unsupportedConfigOverrides: 
+    controller: 
+      args:
+        - "--dns01-recursive-nameservers=1.1.1.1:53" 
+        - "--dns01-recursive-nameservers-only"
\ No newline at end of file
diff --git a/cluster/cert-manager/base/subscription.yaml b/cluster/cert-manager/base/subscription.yaml
new file mode 100644
index 0000000..26bc55a
--- /dev/null
+++ b/cluster/cert-manager/base/subscription.yaml
@@ -0,0 +1,12 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: openshift-cert-manager-operator
+  namespace: cert-manager-operator
+spec:
+  channel: stable-v1
+  installPlanApproval: Automatic
+  name: openshift-cert-manager-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace
\ No newline at end of file
diff --git a/cluster/cert-manager/cert-patches.yaml b/cluster/cert-manager/cert-patches.yaml
new file mode 100644
index 0000000..0519ecb
--- /dev/null
+++ b/cluster/cert-manager/cert-patches.yaml
@@ -0,0 +1 @@
+ 
\ No newline at end of file
diff --git a/cluster/cert-manager/overlays/hub/api-ingress.yaml b/cluster/cert-manager/overlays/hub/api-ingress.yaml
new file mode 100644
index 0000000..c359585
--- /dev/null
+++ b/cluster/cert-manager/overlays/hub/api-ingress.yaml
@@ -0,0 +1,41 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  annotations:
+  generation: 1
+  name: letsencrypt
+  namespace: openshift-ingress
+spec:
+  commonName: '*.apps.hub.int.mk-labs.cloud'
+  dnsNames:
+  - '*.apps.hub.int.mk-labs.cloud'
+  duration: 2160h0m0s
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  renewBefore: 360h0m0s
+  secretName: letsencrypt
+  usages:
+  - server auth
+  - client auth
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  annotations:
+  name: letsencrypt
+  namespace: openshift-config
+spec:
+  commonName: 'api.hub.int.mk-labs.cloud'
+  dnsNames:
+  - api.hub.int.mk-labs.cloud
+  duration: 2160h0m0s
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt-prod
+  renewBefore: 360h0m0s
+  secretName: letsencrypt
+  usages:
+  - server auth
+  - client auth
\ No newline at end of file
diff --git a/cluster/cert-manager/overlays/hub/apiserver-cert-config.yaml b/cluster/cert-manager/overlays/hub/apiserver-cert-config.yaml
new file mode 100644
index 0000000..c1725b9
--- /dev/null
+++ b/cluster/cert-manager/overlays/hub/apiserver-cert-config.yaml
@@ -0,0 +1,11 @@
+apiVersion: config.openshift.io/v1
+kind: APIServer
+metadata:
+  name: cluster
+spec:
+  servingCerts:
+    namedCertificates:
+    - names:
+      - api.hub.int.mk-labs.cloud
+      servingCertificate:
+        name: letsencrypt
diff --git a/cluster/cert-manager/overlays/hub/ingress-controller-cert-config.yaml b/cluster/cert-manager/overlays/hub/ingress-controller-cert-config.yaml
new file mode 100644
index 0000000..e4b2aeb
--- /dev/null
+++ b/cluster/cert-manager/overlays/hub/ingress-controller-cert-config.yaml
@@ -0,0 +1,8 @@
+apiVersion: operator.openshift.io/v1
+kind: IngressController
+metadata:
+  name: default
+  namespace: openshift-ingress-operator
+spec:
+  defaultCertificate:
+    name: letsencrypt
diff --git a/cluster/cert-manager/overlays/hub/kustomization.yaml b/cluster/cert-manager/overlays/hub/kustomization.yaml
new file mode 100644
index 0000000..6185406
--- /dev/null
+++ b/cluster/cert-manager/overlays/hub/kustomization.yaml
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+- ../../base
+- api-ingress.yaml
+- apiserver-cert-config.yaml
+- ingress-controller-cert-config.yaml