feat(cert-manager): Add Cloudns issuer and DNS-01 challenge support

- Introduced a new Cloudns issuer configuration for cert-manager. - Created separate tasks for DNS-01 and HTTP-01 challenge issuers. - Updated cert-manager tasks to include Cloudns provider and manage secrets. - Refactored existing LetsEncrypt issuer registration to use new task structure. - Added necessary Kubernetes resources for Cloudns integration, including RBAC and certificates. - Updated Terraform configurations to support new DNS records and service changes. - Adjusted deployment strategies for CoreDNS and Open WebUI applications.
2025-06-07 20:39:38 +02:00
parent 3cda0b5624
commit 01bf71f8d2
25 changed files with 590 additions and 17396 deletions
@@ -0,0 +1,322 @@
+---
+# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cert-manager-webhook-cloudns
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager-webhook-cloudns
+---
+# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
+# Grant cert-manager permission to validate using our apiserver
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cert-manager-webhook-cloudns:domain-solver
+  labels:
+    app: cert-manager-webhook-cloudns
+rules:
+  - apiGroups:
+      - acme.ixon.cloud
+    resources:
+      - "*"
+    verbs:
+      - "create"
+---
+# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cert-manager-webhook-cloudns:flowcontrol-solver
+  labels:
+    app: cert-manager-webhook-cloudns
+    chart: cert-manager-webhook-cloudns-1.1.1
+    release: cert-manager-webhook-cloudns
+    heritage: Helm
+rules:
+  - apiGroups:
+      - "flowcontrol.apiserver.k8s.io"
+    resources:
+      - "prioritylevelconfigurations"
+      - "flowschemas"
+    verbs:
+      - "list"
+      - "watch"
+---
+# Source: cert-manager-webhook-cloudns/templates/secret-rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cert-manager-webhook-cloudns:cloudns-api-secret-access
+  labels:
+    app: cert-manager-webhook-cloudns
+rules:
+  - apiGroups: [""]
+    resources:
+      - secrets
+    resourceNames:
+      - cert-manager-webhook-cloudns-api-secret
+    verbs:
+      - "get"
+---
+# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
+# apiserver gets the auth-delegator role to delegate auth decisions to
+# the core apiserver
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cert-manager-webhook-cloudns:auth-delegator
+  labels:
+    app: cert-manager-webhook-cloudns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: cert-manager-webhook-cloudns
+    namespace: cert-manager
+---
+# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cert-manager-webhook-cloudns:domain-solver
+  labels:
+    app: cert-manager-webhook-cloudns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cert-manager-webhook-cloudns:domain-solver
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: cert-manager
+    namespace: cert-manager
+---
+# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cert-manager-webhook-cloudns:flowcontrol-solver
+  labels:
+    app: cert-manager-webhook-cloudns
+    chart: cert-manager-webhook-cloudns-1.1.1
+    release: cert-manager-webhook-cloudns
+    heritage: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cert-manager-webhook-cloudns:flowcontrol-solver
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: cert-manager-webhook-cloudns
+    namespace: "cert-manager"
+---
+# Source: cert-manager-webhook-cloudns/templates/secret-rbac.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cert-manager-webhook-cloudns:api-secret-access
+  labels:
+    app: cert-manager-webhook-cloudns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cert-manager-webhook-cloudns:api-secret-access
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    namespace: default
+    name: cert-manager-webhook-cloudns
+---
+# Source: cert-manager-webhook-cloudns/templates/rbac.yaml
+# Grant the webhook permission to read the ConfigMap containing the Kubernetes
+# apiserver's requestheader-ca-certificate.
+# This ConfigMap is automatically created by the Kubernetes apiserver.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: cert-manager-webhook-cloudns:webhook-authentication-reader
+  namespace: kube-system
+  labels:
+    app: cert-manager-webhook-cloudns
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: extension-apiserver-authentication-reader
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: cert-manager-webhook-cloudns
+    namespace: cert-manager
+---
+# Source: cert-manager-webhook-cloudns/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: cert-manager-webhook-cloudns
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager-webhook-cloudns
+spec:
+  type: ClusterIP
+  ports:
+    - port: 443
+      targetPort: https
+      protocol: TCP
+      name: https
+  selector:
+    app: cert-manager-webhook-cloudns
+---
+# Source: cert-manager-webhook-cloudns/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cert-manager-webhook-cloudns
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager-webhook-cloudns
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: cert-manager-webhook-cloudns
+  template:
+    metadata:
+      labels:
+        app: cert-manager-webhook-cloudns
+    spec:
+      serviceAccountName: cert-manager-webhook-cloudns
+      containers:
+        - name: cert-manager-webhook-cloudns
+          image: "mschirrmeister/cert-manager-webhook-cloudns:latest-alpine"
+          imagePullPolicy: IfNotPresent
+          args:
+            - --tls-cert-file=/certs/tls.crt
+            - --tls-private-key-file=/certs/tls.key
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: GROUP_NAME
+              value: "acme.ixon.cloud"
+            - name: CLOUDNS_AUTH_ID_FILE
+              value: "/creds/auth_id"
+            - name: CLOUDNS_AUTH_PASSWORD_FILE
+              value: "/creds/auth_password"
+            - name: CLOUDNS_AUTH_ID_TYPE
+              value: auth-id
+          ports:
+            - name: https
+              containerPort: 443
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /healthz
+              port: https
+          readinessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /healthz
+              port: https
+          volumeMounts:
+            - name: certs
+              mountPath: /certs
+              readOnly: true
+            - name: creds
+              mountPath: /creds
+              readOnly: true
+          resources: {}
+      volumes:
+        - name: certs
+          secret:
+            secretName: cert-manager-webhook-cloudns-webhook-tls
+        - name: creds
+          secret:
+            secretName: cert-manager-webhook-cloudns-api-secret
+---
+# Source: cert-manager-webhook-cloudns/templates/apiservice.yaml
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  name: v1alpha1.acme.ixon.cloud
+  labels:
+    app: cert-manager-webhook-cloudns
+  annotations:
+    cert-manager.io/inject-ca-from: "cert-manager/cert-manager-webhook-cloudns-webhook-tls"
+spec:
+  group: acme.ixon.cloud
+  groupPriorityMinimum: 1000
+  versionPriority: 15
+  service:
+    name: cert-manager-webhook-cloudns
+    namespace: cert-manager
+  version: v1alpha1
+---
+# Source: cert-manager-webhook-cloudns/templates/pki.yaml
+# Generate a CA Certificate used to sign certificates for the webhook
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: cert-manager-webhook-cloudns-ca
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager-webhook-cloudns
+spec:
+  secretName: cert-manager-webhook-cloudns-ca
+  duration: 43800h # 5y
+  issuerRef:
+    name: cert-manager-webhook-cloudns-selfsign
+  commonName: "ca.cert-manager-webhook-cloudns.cert-manager"
+  isCA: true
+---
+# Source: cert-manager-webhook-cloudns/templates/pki.yaml
+# Finally, generate a serving certificate for the webhook to use
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: cert-manager-webhook-cloudns-webhook-tls
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager-webhook-cloudns
+spec:
+  secretName: cert-manager-webhook-cloudns-webhook-tls
+  duration: 8760h # 1y
+  issuerRef:
+    name: cert-manager-webhook-cloudns-ca
+  dnsNames:
+    - cert-manager-webhook-cloudns
+    - cert-manager-webhook-cloudns.cert-manager
+    - cert-manager-webhook-cloudns.cert-manager.svc
+---
+# Source: cert-manager-webhook-cloudns/templates/pki.yaml
+# Create a selfsigned Issuer, in order to create a root CA certificate for
+# signing webhook serving certificates
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: cert-manager-webhook-cloudns-selfsign
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager-webhook-cloudns
+spec:
+  selfSigned: {}
+---
+# Source: cert-manager-webhook-cloudns/templates/pki.yaml
+# Create an Issuer that uses the above generated CA certificate to issue certs
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: cert-manager-webhook-cloudns-ca
+  namespace: "cert-manager"
+  labels:
+    app: cert-manager-webhook-cloudns
+spec:
+  ca:
+    secretName: cert-manager-webhook-cloudns-ca