create cluster issuers

cluster/cert-manager/templates/clusterissuers.yaml

@@ -0,0 +1,69 @@
+{{- define "le.solvers" -}}
+{{- range $solver := .Values.le.solvers -}}
+{{- if eq $solver.type "dns" -}}
+- dns01:
+    {{- toYaml $solver.dnsConfig | nindent 4 }}
+  {{- with $solver.dnsZones }}
+  selector:
+    dnsZones:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- else if eq $solver.type "http" }}
+- http01:
+    ingress:
+      ingressClassName: {{ $solver.ingressClassName }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- if .Values.ca.enabled }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: ca-issuer
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  ca:
+    secretName: cert-manager-ca
+{{- end }}
+{{- if .Values.le.prod.enabled }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    email: {{ .Values.le.email }}
+    {{- with .Values.le.preferredChain }}
+    preferredChain: {{ toYaml . }}
+    {{- end }}
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    server: {{ .Values.le.prod.server }}
+    solvers:
+    {{- include "le.solvers" . | nindent 4 }}
+{{- end }}
+{{- if .Values.le.staging.enabled }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  acme:
+    email: {{ .Values.le.email }}
+    {{- with .Values.le.preferredChain }}
+    preferredChain: {{ toYaml . }}
+    {{- end }}
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    server: {{ .Values.le.staging.server }}
+    solvers:
+    {{- include "le.solvers" . | nindent 4 }}
+{{- end }}

cluster/cert-manager/values-hub.yaml

@@ -13,4 +13,35 @@ cert-manager:
     servicemonitor:
       enabled: true
 
+le:
+  prod:
+    enabled: true
+    server: https://acme-v02.api.letsencrypt.org/directory
+  staging:
+    enabled: true
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+  apiCert:
+    enabled: false
+  routerCert:
+    enabled: false
+  preferredChain: ""
+  email: ryan.blundon@protonmail.com
+  solvers:
+  - type: dns
+    dnsConfig:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token
+          email: ryan.blundon@protonmail.com
+        cnameStrategy: Follow
+    dnsZones:
+    - mk-labs.cloud
 
+  secrets:
+  - name: le-route53-creds
+    stringData:
+      secret-access-key: <actual secret access key>
+
+cluster_name: okd
+base_domain: jharmison.com