feat(cert-manager): Add Cloudns issuer and DNS-01 challenge support

- Introduced a new Cloudns issuer configuration for cert-manager.
- Created separate tasks for DNS-01 and HTTP-01 challenge issuers.
- Updated cert-manager tasks to include Cloudns provider and manage secrets.
- Refactored existing LetsEncrypt issuer registration to use new task structure.
- Added necessary Kubernetes resources for Cloudns integration, including RBAC and certificates.
- Updated Terraform configurations to support new DNS records and service changes.
- Adjusted deployment strategies for CoreDNS and Open WebUI applications.

terraform/apps/dev-01/config.tf

@@ -20,6 +20,11 @@ locals {
     {
       fqdn = "${local.lab_domain}"
       records = [
+        {
+          name    = "vh-01"
+          type    = "A"
+          content = "10.19.4.109"
+        },
         {
           name    = "gpu-01"
           type    = "A"

terraform/modules/apps/coredns/main.tf

@@ -45,7 +45,7 @@ resource "kubernetes_deployment" "dns" {
     }
 
     strategy {
-      type = "RollingUpdate"
+      type = "Recreate"
     }
 
     template {

terraform/modules/apps/open-webui/config.tf

@@ -1,8 +1,5 @@
 locals {
   persistent_folder = var.persistent_folder
-  app_path          = "${local.persistent_folder}/open-webui"
-
-  app_version = var.tag
-  app_fqdn    = var.fqdn
+  openwebui_data    = "${local.persistent_folder}/open-webui"
 }
 

terraform/modules/apps/open-webui/main.tf

@@ -13,28 +13,6 @@ resource "kubernetes_service_account" "openwebui" {
 
   automount_service_account_token = false
 }
-
-resource "kubernetes_manifest" "internal_cert" {
-
-  manifest = {
-    apiVersion = "cert-manager.io/v1"
-    kind       = "Certificate"
-    metadata = {
-      name      = "internal-cert"
-      namespace = kubernetes_namespace.openwebui.metadata[0].name
-    }
-    spec = {
-      secretName = "internal-cert"
-      issuerRef = {
-        name = var.issuer
-        kind = "ClusterIssuer"
-      }
-      commonName = var.fqdn
-      dnsNames   = [var.fqdn]
-    }
-  }
-}
-
 resource "kubernetes_deployment" "openwebui" {
   metadata {
     name      = "openwebui"
@@ -70,7 +48,7 @@ resource "kubernetes_deployment" "openwebui" {
 
         container {
           name  = "openwebui-container"
-          image = "ghcr.io/open-webui/open-webui:${local.app_version}"
+          image = "ghcr.io/open-webui/open-webui:${var.tag}"
 
           security_context {
             allow_privilege_escalation = false
@@ -99,7 +77,7 @@ resource "kubernetes_deployment" "openwebui" {
         volume {
           name = "openwebui-data"
           host_path {
-            path = local.app_path
+            path = local.openwebui_data
           }
         }
       }
@@ -140,16 +118,19 @@ resource "kubernetes_ingress_v1" "openwebui" {
     namespace = kubernetes_namespace.openwebui.metadata[0].name
 
     annotations = {
+      "kubernetes.io/ingress.class"              = "public"
+      "cert-manager.io/cluster-issuer"           = "letsencrypt-prod"
+      "kubernetes.io/tls-acme"                   = "true"
       "nginx.ingress.kubernetes.io/ssl-redirect" = "true"
     }
   }
   spec {
     tls {
-      hosts       = [local.app_fqdn]
-      secret_name = "internal-cert"
+      hosts       = [var.fqdn]
+      secret_name = "openwebui-tls"
     }
     rule {
-      host = local.app_fqdn
+      host = var.fqdn
       http {
         path {
           backend {