feat(certs): add ks to import certs from 1password (#7282)

onedr0p · Apr 2, 2024 · fe8d23b · fe8d23b
1 parent c8e6c89
commit fe8d23b
Show file tree

Hide file tree

Showing 18 changed files with 198 additions and 57 deletions.
diff --git a/kubernetes/main/apps/cert-manager/cert-manager/issuers/issuers.yaml b/kubernetes/main/apps/cert-manager/cert-manager/issuers/issuers.yaml
@@ -18,8 +18,7 @@ spec:
               name: cloudflare-secret
               key: CLOUDFLARE_API_KEY
         selector:
-          dnsZones:
-            - devbu.io
+          dnsZones: ["devbu.io"]
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/clusterissuer_v1.json
 apiVersion: cert-manager.io/v1
@@ -40,5 +39,4 @@ spec:
               name: cloudflare-secret
               key: CLOUDFLARE_API_KEY
         selector:
-          dnsZones:
-            - devbu.io
+          dnsZones: ["devbu.io"]
diff --git a/...work/nginx/certificates/certificates.yaml → ...anager/certificates/app/certificates.yaml b/...work/nginx/certificates/certificates.yaml → ...anager/certificates/app/certificates.yaml
diff --git a/...ork/nginx/certificates/kustomization.yaml → ...nager/certificates/app/kustomization.yaml b/...ork/nginx/certificates/kustomization.yaml → ...nager/certificates/app/kustomization.yaml
diff --git a/...etwork/nginx/certificates/pushsecret.yaml → ...-manager/certificates/app/pushsecret.yaml b/...etwork/nginx/certificates/pushsecret.yaml → ...-manager/certificates/app/pushsecret.yaml
diff --git a/kubernetes/main/apps/cert-manager/certificates/import/clusterexternalsecret.yaml b/kubernetes/main/apps/cert-manager/certificates/import/clusterexternalsecret.yaml
@@ -0,0 +1,40 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/clusterexternalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterExternalSecret
+metadata:
+  name: devbu-io-tls
+spec:
+  externalSecretName: devbu-io-tls
+  namespaceSelector:
+    matchExpressions:
+      - key: kubernetes.io/metadata.name
+        operator: In
+        values: ["cert-manager", "network"]
+  refreshTime: 1m
+  externalSecretSpec:
+    secretStoreRef:
+      kind: ClusterSecretStore
+      name: onepassword-connect
+    target:
+      name: devbu-io-tls
+      creationPolicy: Orphan
+      template:
+        engineVersion: v2
+        type: kubernetes.io/tls
+        metadata:
+          annotations:
+            cert-manager.io/alt-names: '*.devbu.io,devbu.io'
+            cert-manager.io/certificate-name: devbu-io
+            cert-manager.io/common-name: devbu.io
+            cert-manager.io/ip-sans: ""
+            cert-manager.io/issuer-group: ""
+            cert-manager.io/issuer-kind: ClusterIssuer
+            cert-manager.io/issuer-name: letsencrypt-production
+            cert-manager.io/uri-sans: ""
+          labels:
+            controller.cert-manager.io/fao: "true"
+    dataFrom:
+      - extract:
+          key: devbu-io-tls
+          decodingStrategy: Auto
diff --git a/kubernetes/main/apps/cert-manager/certificates/import/kustomization.yaml b/kubernetes/main/apps/cert-manager/certificates/import/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./clusterexternalsecret.yaml
diff --git a/kubernetes/main/apps/cert-manager/certificates/ks.yaml b/kubernetes/main/apps/cert-manager/certificates/ks.yaml
@@ -0,0 +1,48 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app certificates-import
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets-stores
+  path: ./kubernetes/main/apps/cert-manager/certificates/import
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app certificates
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: certificates-import
+    - name: cert-manager-issuers
+    - name: external-secrets-stores
+  path: ./kubernetes/main/apps/cert-manager/certificates/app
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
diff --git a/kubernetes/main/apps/cert-manager/kustomization.yaml b/kubernetes/main/apps/cert-manager/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
   - ./namespace.yaml
   # Flux-Kustomizations
   - ./cert-manager/ks.yaml
+  - ./certificates/ks.yaml
diff --git a/kubernetes/main/apps/network/nginx/ks.yaml b/kubernetes/main/apps/network/nginx/ks.yaml
@@ -2,29 +2,6 @@
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
-metadata:
-  name: &app nginx-certificates
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager-issuers
-  path: ./kubernetes/main/apps/network/nginx/certificates
-  prune: false
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
 metadata:
   name: &app nginx-external
   namespace: flux-system
@@ -34,8 +11,8 @@ spec:
     labels:
       app.kubernetes.io/name: *app
   dependsOn:
+    - name: certificates
     - name: external-secrets-stores
-    - name: nginx-certificates
   path: ./kubernetes/main/apps/network/nginx/external
   prune: false
   sourceRef:
@@ -58,7 +35,8 @@ spec:
     labels:
       app.kubernetes.io/name: *app
   dependsOn:
-    - name: nginx-certificates
+    - name: certificates
+    - name: external-secrets-stores
   path: ./kubernetes/main/apps/network/nginx/internal
   prune: false
   sourceRef:

diff --git a/kubernetes/storage/apps/cert-manager/cert-manager/issuers/issuers.yaml b/kubernetes/storage/apps/cert-manager/cert-manager/issuers/issuers.yaml
@@ -18,8 +18,7 @@ spec:
               name: cloudflare-secret
               key: CLOUDFLARE_API_KEY
         selector:
-          dnsZones:
-            - turbo.ac
+          dnsZones: ["turbo.ac"]
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/clusterissuer_v1.json
 apiVersion: cert-manager.io/v1
@@ -40,5 +39,4 @@ spec:
               name: cloudflare-secret
               key: CLOUDFLARE_API_KEY
         selector:
-          dnsZones:
-            - turbo.ac
+          dnsZones: ["turbo.ac"]
diff --git a/...work/nginx/certificates/certificates.yaml → ...anager/certificates/app/certificates.yaml b/...work/nginx/certificates/certificates.yaml → ...anager/certificates/app/certificates.yaml
diff --git a/...ork/nginx/certificates/kustomization.yaml → ...nager/certificates/app/kustomization.yaml b/...ork/nginx/certificates/kustomization.yaml → ...nager/certificates/app/kustomization.yaml
diff --git a/...etwork/nginx/certificates/pushsecret.yaml → ...-manager/certificates/app/pushsecret.yaml b/...etwork/nginx/certificates/pushsecret.yaml → ...-manager/certificates/app/pushsecret.yaml
diff --git a/kubernetes/storage/apps/cert-manager/certificates/import/clusterexternalsecret.yaml b/kubernetes/storage/apps/cert-manager/certificates/import/clusterexternalsecret.yaml
@@ -0,0 +1,40 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/clusterexternalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterExternalSecret
+metadata:
+  name: turbo-ac-tls
+spec:
+  externalSecretName: turbo-ac-tls
+  namespaceSelector:
+    matchExpressions:
+      - key: kubernetes.io/metadata.name
+        operator: In
+        values: ["cert-manager", "network"]
+  refreshTime: 1m
+  externalSecretSpec:
+    secretStoreRef:
+      kind: ClusterSecretStore
+      name: onepassword-connect
+    target:
+      name: turbo-ac-tls
+      creationPolicy: Orphan
+      template:
+        engineVersion: v2
+        type: kubernetes.io/tls
+        metadata:
+          annotations:
+            cert-manager.io/alt-names: '*.turbo.ac,turbo.ac'
+            cert-manager.io/certificate-name: turbo-ac
+            cert-manager.io/common-name: turbo.ac
+            cert-manager.io/ip-sans: ""
+            cert-manager.io/issuer-group: ""
+            cert-manager.io/issuer-kind: ClusterIssuer
+            cert-manager.io/issuer-name: letsencrypt-production
+            cert-manager.io/uri-sans: ""
+          labels:
+            controller.cert-manager.io/fao: "true"
+    dataFrom:
+      - extract:
+          key: turbo-ac-tls
+          decodingStrategy: Auto
diff --git a/kubernetes/storage/apps/cert-manager/certificates/import/kustomization.yaml b/kubernetes/storage/apps/cert-manager/certificates/import/kustomization.yaml
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./clusterexternalsecret.yaml
diff --git a/kubernetes/storage/apps/cert-manager/certificates/ks.yaml b/kubernetes/storage/apps/cert-manager/certificates/ks.yaml
@@ -0,0 +1,48 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app certificates-import
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets-stores
+  path: ./kubernetes/storage/apps/cert-manager/certificates/import
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app certificates
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: certificates-import
+    - name: cert-manager-issuers
+    - name: external-secrets-stores
+  path: ./kubernetes/storage/apps/cert-manager/certificates/app
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
diff --git a/kubernetes/storage/apps/cert-manager/kustomization.yaml b/kubernetes/storage/apps/cert-manager/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
   - ./namespace.yaml
   # Flux-Kustomizations
   - ./cert-manager/ks.yaml
+  - ./certificates/ks.yaml
diff --git a/kubernetes/storage/apps/network/nginx/ks.yaml b/kubernetes/storage/apps/network/nginx/ks.yaml
@@ -2,29 +2,6 @@
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
-metadata:
-  name: &app nginx-certificates
-  namespace: flux-system
-spec:
-  targetNamespace: network
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager-issuers
-  path: ./kubernetes/storage/apps/network/nginx/certificates
-  prune: false
-  sourceRef:
-    kind: GitRepository
-    name: home-kubernetes
-  wait: true
-  interval: 30m
-  retryInterval: 1m
-  timeout: 5m
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
 metadata:
   name: &app nginx-internal
   namespace: flux-system
@@ -34,7 +11,7 @@ spec:
     labels:
       app.kubernetes.io/name: *app
   dependsOn:
-    - name: nginx-certificates
+    - name: certificates
   path: ./kubernetes/storage/apps/network/nginx/internal
   prune: false
   sourceRef: