Skip to content

Files

Latest commit

 

History

History
79 lines (70 loc) · 1.97 KB

README.md

File metadata and controls

79 lines (70 loc) · 1.97 KB

terraform

../docs/tf.png

resource "google_project_iam_custom_role" "cert_manager" {
  project     = data.google_project.project.project_id
  role_id     = "cert_manager"
  title       = "Cert Manager"
  permissions = ["dns.resourceRecordSets.create", "dns.resourceRecordSets.list", "dns.resourceRecordSets.get", "dns.resourceRecordSets.update", "dns.resourceRecordSets.delete", "dns.changes.get", "dns.changes.create", "dns.changes.list", "dns.managedZones.list"]
}

resource "google_project_iam_member" "project" {
  project = data.google_project.project.project_id
  role    = google_project_iam_custom_role.cert_manager.name
  member  = "principal://iam.googleapis.com/projects/${data.google_project.project.number}/locations/global/workloadIdentityPools/${data.google_project.project.project_id}.svc.id.goog/subject/ns/cert-manager/sa/cert-manager"
}

cert-manager

resource "helm_release" "cert_manager" {
  depends_on       = [google_project_iam_member.cert_manager]
  name             = "cert-manager"
  namespace        = "cert-manager"
  create_namespace = true

  repository = "https://charts.jetstack.io"
  chart      = "cert-manager"

  set {
    name  = "installCRDs"
    value = "true"
  }
  set {
    name  = "global.leaderElection.namespace"
    value = "cert-manager"
  }
  set_list {
    name  = "extraArgs"
    value = ["--issuer-ambient-credentials"]
  }
}
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
  name: cloud-dns
spec:
  acme:
    email: paul.jones@jetstack.io
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: issuer-account-key
    solvers:
    - dns01:
        cloudDNS:
          project: jetstack-paul
EOF
kubectl apply -f - <<EOF
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-com
spec:
  secretName: example-com-tls
  issuerRef:
    name: cloud-dns
  dnsNames:
  - example.paul-gcp.jetstacker.net
EOF