Feature request: add dns01 into template

[dc232]

was wondering if template could be upgrades to support dns1 configs such as

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email:  __cloudflareemail__
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - selector:
        dnsNames:
        - '*.vinsonjewellers.com'
        - vinsonjewellers.com
      dns01:
        cloudflare:
          email: __cloudflareemail__
          apiKeySecretRef:
            name: cloudflare-api-key-secret
            key: API

[bohdantverdyi]

Hey, at least you can add your additional cluster issuer.

Also you can add your own yaml for cluster issuer in module.

Variable called: cluster_issuer_yaml . Just give your own yaml of cluster issuer to this variable, and module will replace default http issuer with your yaml.

Make sure that name of new cluster issuer is not same as in module, in case when you are adding second cluster issuer.

resource "kubectl_manifest" "cloudflare_cluster_issuer" {

  validate_schema = false

  yaml_body = <<EOF
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
  namespace: cert-manager
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email:  __cloudflareemail__
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - selector:
        dnsNames:
        - '*.vinsonjewellers.com'
        - vinsonjewellers.com
      dns01:
        cloudflare:
          email: __cloudflareemail__
          apiKeySecretRef:
            name: cloudflare-api-key-secret
            key: API
EOF
  depends_on = [module.cert_manager]
}

Anyway good idea to implement support of dns01 issuer in this module :)

[timothyclarke]

In terms of a "second" cluster issuer. It's typically less confusing (and easier to debug) if you keep to 1 cluster issuer but have multiple solvers eg

    solvers:
    - dns01:
        route53:
          region: __CLUSTER_REGION__
          ambient: true
      selector:
        dnsZones:
        - internal.example.com
    - dns01:
        cloudflare:
          email: __cloudflareemail__
          apiKeySecretRef:
            name: cloudflare-api-key-secret
            key: API
      selector:
        dnsZones:
        - public.example.com
    - http01:
        ingress:
          class: nginx

Aka internal.example.com is on route53, public.example.com is on cloudflare and everything else uses a http01 solver.

[bohdantverdyi]

@timothyclarke Looks really good, let me check locally how it works in real life )

[bohdantverdyi]

@timothyclarke Thanks for PR.

@dc232 Feature has been added.