Initial commit

cert-manager/README.md

@@ -0,0 +1,26 @@
+# cert-manager
+
+`cert-manager` is used to obtain TLS certificates from Let's Encrypt.
+
+Added manifest with:
+
+```
+curl -L https://github.com/jetstack/cert-manager/releases/download/v1.6.1/cert-manager.yaml -O
+```
+
+To update certificate issuer
+
+```
+kubectl apply -f namespace.yml -f cert-manager.yaml
+kubectl apply -f issuer.yml
+ kubectl -n cert-manager create secret generic tsig-secret \
+    --from-literal=TSIG_SECRET=<secret>
+```
+
+Workaround for webhook timeout issue https://github.com/jetstack/cert-manager/issues/2602
+It's not very clear why this is happening, deserves further investigation - presumably Calico related somehow:
+
+```
+kubectl delete mutatingwebhookconfiguration.admissionregistration.k8s.io cert-manager-webhook
+kubectl delete validatingwebhookconfigurations.admissionregistration.k8s.io cert-manager-webhook
+```

cert-manager/issuer.yml

@@ -0,0 +1,19 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: default
+spec:
+  acme:
+    email: info@k-space.ee
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: example-issuer-account-key
+    solvers:
+    - dns01:
+        rfc2136:
+          nameserver: 193.40.103.2
+          tsigKeyName: acme.
+          tsigAlgorithm: HMACSHA512
+          tsigSecretSecretRef:
+            name: tsig-secret
+            key: TSIG_SECRET