do-k8s-cert-manager.tf

locals {
  do-cert-manager = {
    email = "andy@onthewings.net"
    ingress_annotations = {
      "cert-manager.io/cluster-issuer" = "letsencrypt-production"
    }
  }
}

# https://cert-manager.io/docs/installation/helm/
resource "helm_release" "do-cert-manager" {
  provider = helm.do

  name       = "cert-manager"
  repository = "https://charts.jetstack.io"
  chart      = "cert-manager"
  version    = "1.6.1"

  values = [yamlencode({
    installCRDs = false # CRDs are installed by module.do-cert-manager-crds
  })]

  depends_on = [
    module.do-cert-manager-crds
  ]
}

# ./cert-manager.crds was generated by
# earthly +cert-manager.crds
module "do-cert-manager-crds" {
  source = "./cert-manager.crds"
  providers = {
    kubernetes = kubernetes.do
  }
}

resource "kubernetes_manifest" "do-letsencrypt-issuer-staging" {
  provider = kubernetes.do

  manifest = {
    "apiVersion" = "cert-manager.io/v1"
    "kind"       = "ClusterIssuer"
    "metadata" = {
      "name" = "letsencrypt-staging"
    }
    "spec" = {
      "acme" = {
        "email" = local.do-cert-manager.email
        "privateKeySecretRef" = {
          "name" = "letsencrypt-staging"
        }
        "server" = "https://acme-staging-v02.api.letsencrypt.org/directory"
        "solvers" = [
          {
            "http01" = {
              "ingress" = {
                "class" = "nginx"
              }
            }
          },
        ]
      }
    }
  }

  depends_on = [
    helm_release.do-cert-manager
  ]
}

resource "kubernetes_manifest" "do-letsencrypt-issuer-production" {
  provider = kubernetes.do

  manifest = {
    "apiVersion" = "cert-manager.io/v1"
    "kind"       = "ClusterIssuer"
    "metadata" = {
      "name" = "letsencrypt-production"
    }
    "spec" = {
      "acme" = {
        "email" = local.do-cert-manager.email
        "privateKeySecretRef" = {
          "name" = "letsencrypt-production"
        }
        "server" = "https://acme-v02.api.letsencrypt.org/directory"
        "solvers" = [
          {
            "http01" = {
              "ingress" = {
                "class" = "nginx"
              }
            }
          },
        ]
      }
    }
  }

  depends_on = [
    helm_release.do-cert-manager
  ]
}