feat(certs): Configuring certs through Cloudlfare using Cert Manager with Traefik

Basically following an example in the [Traefik Helm Chart documentation](https://github.com/traefik/traefik-helm-chart/blob/master/EXAMPLES.md#provide-default-certificate-with-cert-manager-and-cloudflare-dns)

apps/home-assistant/ingress.yaml

@@ -10,7 +10,4 @@ spec:
       kind: Rule
       services:
         - name: home-assistant
-          port: 8123
-  tls:
-    store:
-      name: cloudflare-tls
+          port: 8123

apps/plex/ingress.yaml

@@ -10,6 +10,4 @@ spec:
       kind: Rule
       services:
         - name: plex
-          port: 32400
-  tls:
-    certResolver: letsencrypt
+          port: 32400

apps/stonegarden/ingress.yaml

@@ -10,7 +10,4 @@ spec:
       kind: Rule
       services:
         - name: stonegarden
-          port: web
-  tls:
-    store:
-      name: cloudflare-tls
+          port: web

apps/whoami/ingress-route.yaml

@@ -26,8 +26,4 @@ spec:
       kind: Rule
       services:
         - name: whoami
-          port: 80
-  tls:
-    store:
-      name: cloudflare-tls
-    certResolver: letsencrypt
+          port: 80

charts/application/templates/ingress-route.yaml

@@ -9,9 +9,6 @@ metadata:
 spec:
   entryPoints:
     - websecure
-  tls:
-    store:
-      name: cloudflare-tls
   routes:
     {{- if include "service.create" . }}
     - match: Host(`{{ .Values.name }}.stonegarden.dev`)

infra/argocd/ingress.yaml

@@ -19,6 +19,4 @@ spec:
       services:
         - name: argocd-server
           port: 80
-          scheme: h2c
-  tls:
-    certResolver: letsencrypt
+          scheme: h2c

infra/cilium/ingress-route.yaml

@@ -20,6 +20,4 @@ spec:
         - name: hubble-ui
           port: 80
       middlewares:
-        - name: traefik-forward-auth
-  tls:
-    certResolver: letsencrypt
+        - name: traefik-forward-auth

infra/dashboard/ingress.yaml

@@ -24,6 +24,4 @@ spec:
         - name: kubernetes-dashboard
           port: 80
       middlewares:
-        - name: traefik-forward-auth
-  tls:
-    certResolver: letsencrypt
+        - name: traefik-forward-auth

infra/monitoring/ingress-route.yaml

@@ -32,6 +32,4 @@ spec:
           port: http-web # 9093
       middlewares:
         - name: traefik-forward-auth
-          namespace: kube-system
-  tls:
-    certResolver: letsencrypt
+          namespace: kube-system

infra/net-aux/ingress-route.yaml

@@ -12,7 +12,4 @@ spec:
         - name: pi-hole-web
           port: http
       middlewares:
-        - name: traefik-forward-auth
-  tls:
-    store:
-      name: cloudflare-tls
+        - name: traefik-forward-auth

infra/pi-hole/ingress-route.yaml

@@ -12,7 +12,4 @@ spec:
         - name: pi-hole-web
           port: http
       middlewares:
-        - name: traefik-forward-auth
-  tls:
-    store:
-      name: cloudflare-tls
+        - name: traefik-forward-auth

infra/traefik/cloudflare-cert.yaml

@@ -0,0 +1,13 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-stonegarden-dev
+  namespace: traefik-system
+spec:
+  secretName: wildcard-stonegarden-dev-tls
+  dnsNames:
+    - "stonegarden.dev"
+    - "*.stonegarden.dev"
+  issuerRef:
+    name: cloudflare-issuer
+    kind: Issuer

infra/traefik/cloudflare-issuer.yaml

@@ -0,0 +1,17 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: cloudflare-issuer
+  namespace: traefik-system
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: cloudflare-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare
+              key: api-token

infra/traefik/cloudflare-token-cert-manager.yaml

@@ -0,0 +1,14 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: cloudflare-token-cert-manager
+  namespace: traefik-system
+spec:
+  encryptedData:
+    api-token: AgAJwhExpbTIdzVFXRdBw4tuKHtVMsUuee8Gewjr4Kft+O/RWJ3Gfe9VHmpHNsBFM0oOsCZ5d69JTVfNrLQ531ig+Ed3KcAaxVfUx/ksvLwNnzKEaKWSLmOLDQdqs9yLPJ01K/rhCGDkO7nciXgo+KOJLWUbOwlS/p0E+IMYuS1lFxURb/mARwBvYUvvLlRRmCy9l56LrqEBCpcoC+8Gh+1rrwh/ccrxDYi6cpTmGcPhSJrfHQiQFcjEIPVcwsane3LBwnytJhFCOf25KIp3GGHsikkSpyOugXxqwl37d1nSRDUA8wVas1oTdqts+ipdWkDxAvkCSRW/VdufnipJSmXNgO5CYqQ+PBW1WBtYoXjGaWCt1g+5o5SHdmogu4zr//UQUZ/by03LDitfNNkONWQ4CnrBDxHb8sS8PZI3yMIEfayAhFeGbmka9w0PcwojlWXDwqK3KdfN+heIDT5xh40uNmE/vPmHs1eAxSxrtbfVpag51gZ32cnJKSizEy8HyV6m8D7SLRCJrM2hcOooQG/74ZukB/BflTyASfcTJZ1bJ4DL8Sv5bMYWQHtrTVvQhtfO7UKcOrc6L3Tp082npngyNRDPBMhDxFdfzxa3VXICxfwBp/CL7XMMNuFlFkhbx7xCrx9SiuUyfemOSLeVlKf+zVZ+ASD6A+TUNVHa6YaTj05WDmkrSArrfvmZQ2l3rd4EZ4uaN44g9zrxW/67ThtlhS4A0HH9cK28vMxaFouBzXz6K2y3dTb2
+  template:
+    metadata:
+      name: cloudflare-token-cert-manager
+      namespace: traefik-system
+    type: Opaque
+

infra/traefik/tlsStore.yaml

@@ -1,8 +1,8 @@
-apiVersion: traefik.containo.us/v1alpha1
+apiVersion: traefik.io/v1alpha1
 kind: TLSStore
 metadata:
-  name: cloudflare-tls
-  namespace: kube-system
+  name: cloudflare
+  namespace: traefik-system
 spec:
   defaultCertificate:
     secretName: cloudflare-tls

infra/traefik/values.yaml

@@ -34,10 +34,7 @@ persistence:
   storageClass: cert-storage
   path: /data
 
-certResolvers:
-  letsencrypt:
-    email: [email protected]
-    tlsChallenge: true
-    storage: /data/acme.json
-    # Remove staging server when it's working
-    #caServer: https://acme-staging-v02.api.letsencrypt.org/directory
+tlsStore:
+  default:
+    defaultCertificate:
+      secretName: wildcard-stonegarden-dev-tls