deploy and configure cert-manager

cluster/cert-manager/base/cloudflare-secret-eso.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: cloudflare-api-token # This is the secret name
+  namespace: cert-manager
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  refreshInterval: "1h"
+  data:
+    - secretKey: api-token
+      remoteRef:
+        key: CLOUDFLARE_TOKEN

cluster/cert-manager/base/clusterissuers.yaml

@@ -0,0 +1,51 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    email: ryan.blundon@protonmail.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-issuer-account-key
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+    - dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token
+          email: ryan.blundon@protonmail.com
+        cnameStrategy: Follow
+      selector: 
+        dnsZones:
+          - 'mk-labs.cloud'
+          - 'monetnaildesign.com'
+
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    email: ryan.blundon@protonmail.com
+    privateKeySecretRef:
+      name: letsencrypt-staging-issuer-account-key
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    solvers:
+    - dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token
+          email: ryan.blundon@protonmail.com
+        cnameStrategy: Follow
+      selector: 
+        dnsZones:
+          - 'mk-labs.cloud'
+          - 'monetnaildesign.com'

cluster/cert-manager/base/kustomization.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+# Operator deployment
+- namespace.yaml
+- operatorgroup.yaml
+- subscription.yaml
+- monitoring.yaml
+# Deploy cluster resources
+- cloudflare-secret-eso.yaml
+- clusterissuers.yaml
+- split-horizon-patch.yaml
+#- api-ingress.yaml

cluster/cert-manager/base/monitoring.yaml

@@ -0,0 +1,52 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: prometheus-k8s
+  namespace: cert-manager
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - services
+  - endpoints
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: prometheus-k8s
+  namespace: cert-manager
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: prometheus-k8s
+subjects:
+- kind: ServiceAccount
+  name: prometheus-k8s
+  namespace: openshift-monitoring
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  labels:
+    app: cert-manager
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: cert-manager
+    app.kubernetes.io/name: cert-manager
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  endpoints:
+  - interval: 30s
+    port: tcp-prometheus-servicemonitor
+    scheme: http
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: cert-manager
+      app.kubernetes.io/name: cert-manager

cluster/cert-manager/base/namespace.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations: {}
+#    openshift.io/display-name: "cert-manager Operator for Red Hat OpenShift"
+  labels:
+    openshift.io/cluster-monitoring: 'true'
+  name: cert-manager-operator

cluster/cert-manager/base/operatorgroup.yaml

@@ -0,0 +1,9 @@
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: openshift-cert-manager-operator
+  namespace: cert-manager-operator
+spec:
+  targetNamespaces:
+    - cert-manager-operator

cluster/cert-manager/base/split-horizon-patch.yaml

@@ -0,0 +1,11 @@
+apiVersion: operator.openshift.io/v1alpha1
+kind: CertManager 
+metadata: 
+  name: cluster 
+spec: 
+  managementState: 'Managed'
+  unsupportedConfigOverrides: 
+    controller: 
+      args:
+        - "--dns01-recursive-nameservers=1.1.1.1:53" 
+        - "--dns01-recursive-nameservers-only"

cluster/cert-manager/base/subscription.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: openshift-cert-manager-operator
+  namespace: cert-manager-operator
+spec:
+  channel: stable-v1
+  installPlanApproval: Automatic
+  name: openshift-cert-manager-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace