feat(cert-manager): Installing and configuring cert-manager

apps/whoami/ingress-route.yaml

@@ -0,0 +1,34 @@
+#
+# Auth Ingress
+#
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: whoami
+  labels:
+    app: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`auth-whoami.stonegarden.dev`)
+      kind: Rule
+      services:
+        - name: traefik-forward-auth
+          port: 4181
+      middlewares:
+        - name: traefik-forward-auth
+    - match: Host(`whoami.stonegarden.dev`)
+      kind: Rule
+      services:
+        - name: whoami
+          port: 80
+      middlewares:
+        - name: traefik-forward-auth
+    - match: Host(`test.stonegarden.dev`)
+      kind: Rule
+      services:
+        - name: whoami
+          port: 80
+  tls:
+    certResolver: letsencrypt

apps/whoami/ingress.yaml

@@ -1,34 +1,23 @@
-#
-# Auth Ingress
-#
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
+apiVersion: networking.k8s.io/v1
+kind: Ingress
 metadata:
-  name: traefik-forward-auth
-  labels:
-    app: traefik
+  name: whoami
+  namespace: whoami
+  annotations:
+    cert-manager.io/issuer: "le-example-http"
 spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`auth-whoami.stonegarden.dev`)
-      kind: Rule
-      services:
-        - name: traefik-forward-auth
-          port: 4181
-      middlewares:
-        - name: traefik-forward-auth
-    - match: Host(`whoami.stonegarden.dev`)
-      kind: Rule
-      services:
-        - name: whoami
-          port: 80
-      middlewares:
-        - name: traefik-forward-auth
-    - match: Host(`test.stonegarden.dev`)
-      kind: Rule
-      services:
-        - name: whoami
-          port: 80
   tls:
-    certResolver: letsencrypt
+    - hosts:
+        - whoami.ratatoskr.myddns.rocks
+      secretName: tls-whoami-ingress-http
+  rules:
+    - host: whoami.ratatoskr.myddns.rocks
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: whoami
+                port:
+                  name: web

apps/whoami/kustomization.yaml

@@ -4,5 +4,6 @@ namespace: whoami
 
 resources:
   - ingress.yaml
+  - ingress-route.yaml
   - traefik-forward-auth
   - whoami

infra/argocd/infrastructure.yaml

@@ -11,6 +11,8 @@ spec:
   destinations:
     - namespace: 'argocd'
       server: '*'
+    - namespace: 'cert-manager'
+      server: '*'
     - namespace: 'kubernetes-dashboard'
       server: '*'
     - namespace: 'metallb-system'

infra/cert-manager.yaml

@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: infrastructure
+  source:
+    path: infra/cert-manager
+    repoURL: https://github.com/vehagn/homelab
+    targetRevision: HEAD
+  destination:
+    namespace: cert-manager
+    name: in-cluster
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true

infra/cert-manager/issuer.yaml

@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: le-example-http
+  namespace: whoami
+spec:
+  acme:
+    email: [email protected]
+    # We use the staging server here for testing to avoid hitting
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      # if not existing, it will register a new account and stores it
+      name: example-issuer-account-key
+    solvers:
+      - http01:
+          # The ingressClass used to create the necessary ingress routes
+          ingress:
+            class: traefik

infra/cert-manager/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+
+resources:
+  - https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
+  - issuer.yaml