From ca44a520c8a253fd8553bd89e1da2e0b287362f7 Mon Sep 17 00:00:00 2001
From: Vegard Hagen <vegard@edgeworks.no>
Date: Tue, 24 Jan 2023 20:28:49 +0100
Subject: [PATCH] feat(cert-manager): Installing and configuring cert-manager

---
 apps/whoami/ingress-route.yaml        | 34 ++++++++++++++++++
 apps/whoami/ingress.yaml              | 51 +++++++++++----------------
 apps/whoami/kustomization.yaml        |  1 +
 infra/argocd/infrastructure.yaml      |  2 ++
 infra/cert-manager.yaml               | 22 ++++++++++++
 infra/cert-manager/issuer.yaml        | 18 ++++++++++
 infra/cert-manager/kustomization.yaml |  7 ++++
 7 files changed, 104 insertions(+), 31 deletions(-)
 create mode 100644 apps/whoami/ingress-route.yaml
 create mode 100644 infra/cert-manager.yaml
 create mode 100644 infra/cert-manager/issuer.yaml
 create mode 100644 infra/cert-manager/kustomization.yaml

diff --git a/apps/whoami/ingress-route.yaml b/apps/whoami/ingress-route.yaml
new file mode 100644
index 0000000..65710f4
--- /dev/null
+++ b/apps/whoami/ingress-route.yaml
@@ -0,0 +1,34 @@
+#
+# Auth Ingress
+#
+apiVersion: traefik.containo.us/v1alpha1
+kind: IngressRoute
+metadata:
+  name: whoami
+  labels:
+    app: traefik
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`auth-whoami.stonegarden.dev`)
+      kind: Rule
+      services:
+        - name: traefik-forward-auth
+          port: 4181
+      middlewares:
+        - name: traefik-forward-auth
+    - match: Host(`whoami.stonegarden.dev`)
+      kind: Rule
+      services:
+        - name: whoami
+          port: 80
+      middlewares:
+        - name: traefik-forward-auth
+    - match: Host(`test.stonegarden.dev`)
+      kind: Rule
+      services:
+        - name: whoami
+          port: 80
+  tls:
+    certResolver: letsencrypt
diff --git a/apps/whoami/ingress.yaml b/apps/whoami/ingress.yaml
index db0cfbc..182f79f 100644
--- a/apps/whoami/ingress.yaml
+++ b/apps/whoami/ingress.yaml
@@ -1,34 +1,23 @@
-#
-# Auth Ingress
-#
-apiVersion: traefik.containo.us/v1alpha1
-kind: IngressRoute
+apiVersion: networking.k8s.io/v1
+kind: Ingress
 metadata:
-  name: traefik-forward-auth
-  labels:
-    app: traefik
+  name: whoami
+  namespace: whoami
+  annotations:
+    cert-manager.io/issuer: "le-example-http"
 spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`auth-whoami.stonegarden.dev`)
-      kind: Rule
-      services:
-        - name: traefik-forward-auth
-          port: 4181
-      middlewares:
-        - name: traefik-forward-auth
-    - match: Host(`whoami.stonegarden.dev`)
-      kind: Rule
-      services:
-        - name: whoami
-          port: 80
-      middlewares:
-        - name: traefik-forward-auth
-    - match: Host(`test.stonegarden.dev`)
-      kind: Rule
-      services:
-        - name: whoami
-          port: 80
   tls:
-    certResolver: letsencrypt
+    - hosts:
+        - whoami.ratatoskr.myddns.rocks
+      secretName: tls-whoami-ingress-http
+  rules:
+    - host: whoami.ratatoskr.myddns.rocks
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: whoami
+                port:
+                  name: web
\ No newline at end of file
diff --git a/apps/whoami/kustomization.yaml b/apps/whoami/kustomization.yaml
index c8c55de..99956ab 100644
--- a/apps/whoami/kustomization.yaml
+++ b/apps/whoami/kustomization.yaml
@@ -4,5 +4,6 @@ namespace: whoami
 
 resources:
   - ingress.yaml
+  - ingress-route.yaml
   - traefik-forward-auth
   - whoami
\ No newline at end of file
diff --git a/infra/argocd/infrastructure.yaml b/infra/argocd/infrastructure.yaml
index 8cb527a..32b26f0 100644
--- a/infra/argocd/infrastructure.yaml
+++ b/infra/argocd/infrastructure.yaml
@@ -11,6 +11,8 @@ spec:
   destinations:
     - namespace: 'argocd'
       server: '*'
+    - namespace: 'cert-manager'
+      server: '*'
     - namespace: 'kubernetes-dashboard'
       server: '*'
     - namespace: 'metallb-system'
diff --git a/infra/cert-manager.yaml b/infra/cert-manager.yaml
new file mode 100644
index 0000000..cd10286
--- /dev/null
+++ b/infra/cert-manager.yaml
@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cert-manager
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: infrastructure
+  source:
+    path: infra/cert-manager
+    repoURL: https://github.com/vehagn/homelab
+    targetRevision: HEAD
+  destination:
+    namespace: cert-manager
+    name: in-cluster
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/infra/cert-manager/issuer.yaml b/infra/cert-manager/issuer.yaml
new file mode 100644
index 0000000..957eb14
--- /dev/null
+++ b/infra/cert-manager/issuer.yaml
@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: le-example-http
+  namespace: whoami
+spec:
+  acme:
+    email: veghag@gmail.com
+    # We use the staging server here for testing to avoid hitting
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      # if not existing, it will register a new account and stores it
+      name: example-issuer-account-key
+    solvers:
+      - http01:
+          # The ingressClass used to create the necessary ingress routes
+          ingress:
+            class: traefik
\ No newline at end of file
diff --git a/infra/cert-manager/kustomization.yaml b/infra/cert-manager/kustomization.yaml
new file mode 100644
index 0000000..91c94b6
--- /dev/null
+++ b/infra/cert-manager/kustomization.yaml
@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+
+resources:
+  - https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
+  - issuer.yaml
\ No newline at end of file