Skip to content

Commit e768a63

Browse files
juniorjunior
committed
modularization of the cert-manager
Signed-off-by: junior <junior@users.noreply.github.com>
1 parent b4338a0 commit e768a63

File tree

12 files changed

+270
-82
lines changed

12 files changed

+270
-82
lines changed

‎module-cluster-tools.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ module "cluster-tools" {
66
source = "./modules/cluster-tools"
77

88
# Oracle Cloud Infrastructure Tenancy and Compartment OCID
9-
tenancy_ocid = var.tenancy_ocid
10-
compartment_ocid = var.compartment_ocid
11-
region = var.region
9+
tenancy_ocid = var.tenancy_ocid
10+
# compartment_ocid = var.compartment_ocid
11+
region = var.region
1212

1313
# Deployment Tags + Freeform Tags
1414
freeform_deployment_tags = local.freeform_deployment_tags

‎modules/cluster-tools/cert-manager.tf

Lines changed: 8 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -8,85 +8,14 @@ variable "cert_manager_enabled" {
88
description = "Enable x509 Certificate Management"
99
}
1010

11-
# Cert Manager Helm chart
12-
## https://github.com/jetstack/cert-manager/blob/master/README.md
13-
## https://artifacthub.io/packages/helm/cert-manager/cert-manager
14-
resource "helm_release" "cert_manager" {
15-
name = "cert-manager"
16-
repository = local.helm_repository.jetstack
17-
chart = "cert-manager"
18-
version = local.helm_repository.jetstack_version
19-
namespace = kubernetes_namespace.cluster_tools.id
20-
wait = true # wait to allow the webhook be properly configured
21-
22-
set {
23-
name = "installCRDs"
24-
value = true
25-
}
26-
27-
set {
28-
name = "webhook.timeoutSeconds"
29-
value = "30"
30-
}
31-
32-
count = var.cert_manager_enabled ? 1 : 0
33-
}
34-
35-
resource "kubernetes_manifest" "clusterissuer_letsencrypt_prod" {
36-
manifest = {
37-
"apiVersion" = "cert-manager.io/v1"
38-
"kind" = "ClusterIssuer"
39-
"metadata" = {
40-
"name" = "letsencrypt-prod"
41-
}
42-
"spec" = {
43-
"acme" = {
44-
"email" = "${var.ingress_email_issuer}"
45-
"privateKeySecretRef" = {
46-
"name" = "letsencrypt-prod"
47-
}
48-
"server" = "https://acme-v02.api.letsencrypt.org/directory"
49-
"solvers" = [
50-
{
51-
"http01" = {
52-
"ingress" = {
53-
"class" = "nginx"
54-
}
55-
}
56-
},
57-
]
58-
}
59-
}
60-
}
61-
62-
count = var.cert_manager_enabled ? 1 : 0
63-
}
64-
resource "kubernetes_manifest" "clusterissuer_letsencrypt_staging" {
65-
manifest = {
66-
"apiVersion" = "cert-manager.io/v1"
67-
"kind" = "ClusterIssuer"
68-
"metadata" = {
69-
"name" = "letsencrypt-staging"
70-
}
71-
"spec" = {
72-
"acme" = {
73-
"email" = "${var.ingress_email_issuer}"
74-
"privateKeySecretRef" = {
75-
"name" = "letsencrypt-staging"
76-
}
77-
"server" = "https://acme-staging-v02.api.letsencrypt.org/directory"
78-
"solvers" = [
79-
{
80-
"http01" = {
81-
"ingress" = {
82-
"class" = "nginx"
83-
}
84-
}
85-
},
86-
]
87-
}
88-
}
89-
}
11+
module "cert-manager" {
12+
source = "./modules/cert-manager"
13+
14+
# Helm Release variables
15+
chart_namespace = kubernetes_namespace.cluster_tools.id
16+
chart_repository = local.helm_repository.jetstack
17+
chart_version = local.helm_repository.jetstack_version
18+
ingress_email_issuer = var.ingress_email_issuer
9019

9120
count = var.cert_manager_enabled ? 1 : 0
9221
}

‎modules/cluster-tools/modules/cert-manager/issuers/.helmignore

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Patterns to ignore when building packages.
2+
# This supports shell glob matching, relative path matching, and
3+
# negation (prefixed with !). Only one pattern per line.
4+
.DS_Store
5+
# Common VCS dirs
6+
.git/
7+
.gitignore
8+
.bzr/
9+
.bzrignore
10+
.hg/
11+
.hgignore
12+
.svn/
13+
# Common backup files
14+
*.swp
15+
*.bak
16+
*.tmp
17+
*.orig
18+
*~
19+
# Various IDEs
20+
.project
21+
.idea/
22+
*.tmproj
23+
.vscode/

‎modules/cluster-tools/modules/cert-manager/issuers/Chart.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: v2
2+
name: issuers
3+
description: cert-manager ClusterIssuer and Issuer resources, simplified for use with terraform helm provider
4+
5+
type: application
6+
version: 0.1.0
7+
appVersion: "1"

‎modules/cluster-tools/modules/cert-manager/issuers/templates/NOTES.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#
2+
3+
Stuff

‎modules/cluster-tools/modules/cert-manager/issuers/templates/_helpers.tpl

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{{/*
2+
Return the name of an Issuer or ClusterIssuer
3+
*/}}

‎modules/cluster-tools/modules/cert-manager/issuers/templates/clusterissuers.yaml

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{{- if .Capabilities.APIVersions.Has "cert-manager.io/v1" -}}
2+
apiVersion: cert-manager.io/v1
3+
kind: ClusterIssuer
4+
metadata:
5+
name: letsencrypt-prod
6+
spec:
7+
acme:
8+
# The ACME production api URL
9+
server: https://acme-v02.api.letsencrypt.org/directory
10+
# Email address used for ACME registration
11+
email: {{ .Values.issuer.email }}
12+
# Name of a secret used to store the ACME account private key
13+
privateKeySecretRef:
14+
name: letsencrypt-prod
15+
solvers:
16+
- http01:
17+
ingress:
18+
class: nginx
19+
---
20+
apiVersion: cert-manager.io/v1
21+
kind: ClusterIssuer
22+
metadata:
23+
name: letsencrypt-staging
24+
spec:
25+
acme:
26+
# The ACME staging api URL
27+
server: https://acme-staging-v02.api.letsencrypt.org/directory
28+
# Email address used for ACME registration
29+
email: {{ .Values.issuer.email }}
30+
# Name of a secret used to store the ACME account private key
31+
privateKeySecretRef:
32+
name: letsencrypt-staging
33+
solvers:
34+
- http01:
35+
ingress:
36+
class: nginx
37+
---
38+
apiVersion: cert-manager.io/v1
39+
kind: ClusterIssuer
40+
metadata:
41+
name: selfsigned
42+
spec:
43+
selfSigned: {}
44+
{{ else -}}
45+
{{ fail "cert-manager.io/v1 CRD not available" -}}
46+
{{- end -}}

‎modules/cluster-tools/modules/cert-manager/issuers/values.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
issuer:
2+
3+
# Used for ACME registration (if TLS is set)
4+
email: "no-reply@ateam-oracle.com"

‎modules/cluster-tools/modules/cert-manager/main.tf

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# Copyright (c) 2022 Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
# Cert Manager Helm chart
6+
## https://github.com/jetstack/cert-manager/blob/master/README.md
7+
## https://artifacthub.io/packages/helm/cert-manager/cert-manager
8+
resource "helm_release" "cert_manager" {
9+
name = "cert-manager"
10+
repository = var.chart_repository
11+
chart = "cert-manager"
12+
version = var.chart_version
13+
namespace = var.chart_namespace
14+
wait = true # wait to allow the webhook be properly configured
15+
16+
set {
17+
name = "installCRDs"
18+
value = true
19+
}
20+
21+
set {
22+
name = "webhook.timeoutSeconds"
23+
value = "30"
24+
}
25+
26+
}
27+
28+
resource "helm_release" "cluster_issuers" {
29+
name = "cert-manager-cluster-issuers"
30+
chart = "${path.module}/issuers"
31+
namespace = var.chart_namespace
32+
33+
set {
34+
name = "issuer.email"
35+
value = var.ingress_email_issuer
36+
}
37+
38+
depends_on = [helm_release.cert_manager]
39+
}
40+
41+
# resource "kubernetes_manifest" "clusterissuer_letsencrypt_prod" {
42+
# manifest = {
43+
# "apiVersion" = "cert-manager.io/v1"
44+
# "kind" = "ClusterIssuer"
45+
# "metadata" = {
46+
# "name" = "letsencrypt-prod"
47+
# }
48+
# "spec" = {
49+
# "acme" = {
50+
# "email" = "${var.ingress_email_issuer}"
51+
# "privateKeySecretRef" = {
52+
# "name" = "letsencrypt-prod"
53+
# }
54+
# "server" = "https://acme-v02.api.letsencrypt.org/directory"
55+
# "solvers" = [
56+
# {
57+
# "http01" = {
58+
# "ingress" = {
59+
# "class" = "nginx"
60+
# }
61+
# }
62+
# },
63+
# ]
64+
# }
65+
# }
66+
# }
67+
68+
# depends_on = [helm_release.cert_manager]
69+
70+
# count = var.cert_manager_enabled ? 1 : 0
71+
# }
72+
# resource "kubernetes_manifest" "clusterissuer_letsencrypt_staging" {
73+
# manifest = {
74+
# "apiVersion" = "cert-manager.io/v1"
75+
# "kind" = "ClusterIssuer"
76+
# "metadata" = {
77+
# "name" = "letsencrypt-staging"
78+
# }
79+
# "spec" = {
80+
# "acme" = {
81+
# "email" = "${var.ingress_email_issuer}"
82+
# "privateKeySecretRef" = {
83+
# "name" = "letsencrypt-staging"
84+
# }
85+
# "server" = "https://acme-staging-v02.api.letsencrypt.org/directory"
86+
# "solvers" = [
87+
# {
88+
# "http01" = {
89+
# "ingress" = {
90+
# "class" = "nginx"
91+
# }
92+
# }
93+
# },
94+
# ]
95+
# }
96+
# }
97+
# }
98+
99+
# depends_on = [helm_release.cert_manager]
100+
101+
# count = var.cert_manager_enabled ? 1 : 0
102+
# }

‎modules/cluster-tools/modules/cert-manager/providers.tf

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
3+
#
4+
5+
terraform {
6+
required_version = ">= 1.1"
7+
required_providers {
8+
helm = {
9+
source = "hashicorp/helm"
10+
version = "~> 2"
11+
# https://registry.terraform.io/providers/hashicorp/helm/
12+
}
13+
tls = {
14+
source = "hashicorp/tls"
15+
version = "~> 4"
16+
# https://registry.terraform.io/providers/hashicorp/tls/
17+
}
18+
local = {
19+
source = "hashicorp/local"
20+
version = "~> 2"
21+
# https://registry.terraform.io/providers/hashicorp/local/
22+
}
23+
}
24+
}

0 commit comments

Comments
 (0)