a13labs.infra/ansible/roles/microk8s/tasks/certmanager.yml

- name: CertManager | Copy latest manifest
  ansible.builtin.get_url:
    url: "https://github.com/cert-manager/cert-manager/releases/download/v{{ microk8s_certmgr_version }}/cert-manager.yaml"
    dest: "{{ k8s_etc }}/k8s-certmanager.yaml"
    mode: "0600"

- name: CertManager | Apply manifest
  environment:
    PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
  vars:
    ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
  kubernetes.core.k8s:
    state: present
    kubeconfig: "{{ k8s_kubeconfig }}"
    src: "{{ k8s_etc }}/k8s-certmanager.yaml"
    wait: true

- name: CertManager | Register LetsEncrypt (prod)
  when: microk8s_lets_encrypt_issuer is true
  environment:
    PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
  vars:
    ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
  kubernetes.core.k8s:
    state: present
    kubeconfig: "{{ k8s_kubeconfig }}"
    wait: true
    definition:
      apiVersion: cert-manager.io/v1
      kind: ClusterIssuer
      metadata:
        name: letsencrypt-prod
        namespace: cert-manager
      spec:
        acme:
          # The ACME server URL
          server: https://acme-v02.api.letsencrypt.org/directory
          # Email address used for ACME registration
          email: "{{ microk8s_issuer_email }}"
          # Name of a secret used to store the ACME account private key
          privateKeySecretRef:
            name: letsencrypt-prod
          # Enable the HTTP-01 challenge provider
          solvers:
            - http01:
                ingress:
                  class: public

- name: CertManager | Register LetsEncrypt (staging)
  when: microk8s_lets_encrypt_issuer is true
  environment:
    PATH: "{{ k8s_venv }}/bin:{{ ansible_env.PATH }}"
  vars:
    ansible_python_interpreter: "{{ k8s_venv }}/bin/python"
  kubernetes.core.k8s:
    state: present
    kubeconfig: "{{ k8s_kubeconfig }}"
    wait: true
    definition:
      apiVersion: cert-manager.io/v1
      kind: ClusterIssuer
      metadata:
        name: letsencrypt-staging
        namespace: cert-manager
      spec:
        acme:
          # The ACME server URL
          server: https://acme-staging-v02.api.letsencrypt.org/directory
          # Email address used for ACME registration
          email: "{{ microk8s_issuer_email }}"
          # Name of a secret used to store the ACME account private key
          privateKeySecretRef:
            name: letsencrypt-staging
          # Enable the HTTP-01 challenge provider
          solvers:
            - http01:
                ingress:
                  class: public