59 lines
2 KiB
Django/Jinja
59 lines
2 KiB
Django/Jinja
{#
|
|
Managed by Ansible (roles/k3s_cert_manager) — do not edit on the node.
|
|
|
|
A HelmChart CR, same pattern as roles/k3s_metallb and roles/k3s_monitoring:
|
|
k3s's bundled helm-controller reconciles it, the same mechanism it uses to
|
|
install its own Traefik.
|
|
-#}
|
|
apiVersion: helm.cattle.io/v1
|
|
kind: HelmChart
|
|
metadata:
|
|
name: cert-manager
|
|
namespace: kube-system
|
|
spec:
|
|
chart: cert-manager
|
|
repo: {{ k3s_cert_manager_chart_repo }}
|
|
version: "{{ k3s_cert_manager_chart_version }}"
|
|
targetNamespace: {{ k3s_cert_manager_namespace }}
|
|
createNamespace: true
|
|
valuesContent: |-
|
|
# The chart installs its own CRDs. Without this they'd have to be applied
|
|
# separately before the chart, which the helm-controller gives no ordering
|
|
# hook for — and the ClusterIssuer this role also renders would then never
|
|
# become appliable.
|
|
crds:
|
|
enabled: true
|
|
|
|
# Sized for a Raspberry Pi 4, same reasoning as k3s_monitoring_values and
|
|
# k3s_postgres_resources. cert-manager is idle almost all of the time —
|
|
# it wakes to renew a certificate every 60 days — so these are set for
|
|
# "doesn't get OOM-killed during a renewal", not for throughput.
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 128Mi
|
|
webhook:
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 128Mi
|
|
cainjector:
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 96Mi
|
|
limits:
|
|
memory: 192Mi
|
|
|
|
# DNS-01 self-check queries the authoritative nameservers directly rather
|
|
# than going through the cluster's resolver. Without this, CoreDNS
|
|
# forwards to whatever the LAN's DNS is, and a split-horizon setup —
|
|
# where the internal view of the zone doesn't carry the _acme-challenge
|
|
# TXT record the public view does — makes cert-manager wait for a record
|
|
# it will never see, until the order times out.
|
|
dns01RecursiveNameservers: "1.1.1.1:53,9.9.9.9:53"
|
|
dns01RecursiveNameserversOnly: true
|