✨ new cluster deployment

cluster/apps/networking/cert-manager/helm-release.yaml

@@ -17,11 +17,10 @@ spec:
       interval: 15m
   install:
     createNamespace: true
-    crds: CreateReplace
     remediation:
       retries: 3
   values:
-    installCRDs: false
+    installCRDs: true
     webhook:
       enabled: true
     extraArgs:

cluster/apps/networking/cert-manager/issuers/helm-release.yaml

@@ -3,7 +3,7 @@ apiVersion: helm.toolkit.fluxcd.io/v2beta1
 kind: HelmRelease
 metadata:
   name: cert-manager-issuers
-  namespace: cert-manager
+  namespace: default
 spec:
   interval: 15m
   chart:

cluster/apps/networking/cert-manager/kustomization.yaml

@@ -2,8 +2,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespace.yaml
   - secret.sops.yaml
   - helm-release.yaml
+  - rbac.yaml
   - webhook-ovh
+  - issuers
+  - certificates
   - prometheus-rule.yaml

cluster/apps/networking/cert-manager/namespace.yaml

@@ -1,8 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cert-manager
-  labels:
-    kustomize.toolkit.fluxcd.io/prune: disabled
-    goldilocks.fairwinds.com/enabled: "true"

cluster/apps/networking/cert-manager/rbac.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cert-manager:ovh-dns-challenge
+  namespace: default
+rules:
+  - apiGroups: ["${SECRET_DOMAIN}"]
+    resources: ["ovh"]
+    verbs: ["get", "watch", "list", "create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cert-manager:ovh-dns-challenge
+  namespace: default
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cert-manager:ovh-dns-challenge
+subjects:
+  - apiGroup: ""
+    kind: ServiceAccount
+    name: cert-manager
+    namespace: default