30 lines
1.3 KiB
Django/Jinja
30 lines
1.3 KiB
Django/Jinja
{#
|
|
Managed by Ansible (roles/k3s_cert_manager) — do not edit on the node.
|
|
|
|
Plain manifest, not a HelmChart — same pattern as
|
|
roles/k3s_metallb/templates/metallb-config.yaml.j2 and
|
|
roles/k3s_postgres/templates/postgres-cluster.yaml.j2: this references a
|
|
CRD (cert-manager.io) that only exists once the chart alongside it has
|
|
installed, and k3s's deploy controller retries rather than giving up.
|
|
|
|
ClusterIssuer rather than Issuer so it's usable from every namespace —
|
|
an app's Ingress just annotates itself with
|
|
`cert-manager.io/cluster-issuer: {{ k3s_cert_manager_issuer_name }}` and
|
|
needs no ACME account or DNS credentials of its own.
|
|
-#}
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: {{ k3s_cert_manager_issuer_name }}
|
|
spec:
|
|
acme:
|
|
server: {{ k3s_cert_manager_acme_server }}
|
|
email: {{ k3s_cert_manager_acme_email }}
|
|
# Where cert-manager keeps the ACME *account* key it generates on first
|
|
# registration — not any certificate's key. In the cert-manager namespace
|
|
# because a ClusterIssuer's secrets always resolve there, regardless of
|
|
# which namespace the Certificate using it lives in.
|
|
privateKeySecretRef:
|
|
name: {{ k3s_cert_manager_acme_key_secret }}
|
|
solvers:
|
|
{{ [k3s_cert_manager_solver] | to_nice_yaml(indent=2) | indent(6, first=true) }}
|