bind, cert-manager: Cleanups

cert-manager/README.md

@@ -1,18 +1,33 @@
 # cert-manager
 
 `cert-manager` is used to obtain TLS certificates from Let's Encrypt.
+It uses DNS-01 challenge in conjunction with Bind primary
+at `ns1.k-space.ee`.
+Refer to the [Bind primary Ansible playbook](https://git.k-space.ee/k-space/ansible/src/branch/main/authoritative-nameserver.yaml) and
+[Bind namespace on Kubernetes cluster](https://git.k-space.ee/k-space/kube/src/branch/master/bind)
+for more details
 
-Added manifest with:
+# For user
+
+Use `Certificate` CRD of cert-manager, refer to
+[official documentation](https://cert-manager.io/docs/usage/certificate/).
+
+To find usage examples in this repository use
+`grep -r -A10 "^kind: Certificate" .`
+
+# For administrator
+
+Deployed with:
 
 ```
 curl -L https://github.com/jetstack/cert-manager/releases/download/v1.15.1/cert-manager.yaml -O
-```
-
-To update certificate issuer
-
-```
 kubectl apply -f cert-manager.yaml
-kubectl apply -f issuer.yml
+```
+
+To update the issuer configuration or TSIG secret:
+
+```
+kubectl apply -f default-issuer.yml
  kubectl -n cert-manager create secret generic tsig-secret \
     --from-literal=TSIG_SECRET=<secret>
 ```

cert-manager/default-issuer.yaml

@@ -0,0 +1,21 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: default
+  namespace: cert-manager
+spec:
+  acme:
+    email: info@k-space.ee
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: example-issuer-account-key
+    solvers:
+      - dns01:
+          rfc2136:
+            nameserver: 193.40.103.2
+            tsigKeyName: readwrite.
+            tsigAlgorithm: HMACSHA512
+            tsigSecretSecretRef:
+              name: tsig-secret
+              key: TSIG_SECRET

cert-manager/issuer.yml

@@ -1,19 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: default
-spec:
-  acme:
-    email: info@k-space.ee
-    server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: example-issuer-account-key
-    solvers:
-    - dns01:
-        rfc2136:
-          nameserver: 193.40.103.2
-          tsigKeyName: acme.
-          tsigAlgorithm: HMACSHA512
-          tsigSecretSecretRef:
-            name: tsig-secret
-            key: TSIG_SECRET