kubernetes deployment strategy notes

cert-manager/README.md

@@ -0,0 +1 @@
+no AI here - just a quick google search.  Once cert-manager was installed via helm, adding a cluster-issuer and requesting certs came from my personal notes having used cert-manager for years.

cert-manager/certificate.yaml

@@ -0,0 +1,19 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  annotations:
+  name: letsencrypt
+  namespace: cert-manager
+spec:
+  commonName: '*.k8s.lab.cudanet.org'
+  dnsNames:
+  - '*.k8s.lab.cudanet.org'
+  duration: 2160h0m0s
+  issuerRef:
+    kind: ClusterIssuer
+    name: letsencrypt
+  renewBefore: 360h0m0s
+  secretName: letsencrypt
+  usages:
+  - server auth
+  - client auth

cert-manager/cloudflare-secret.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+data:
+  api-key: OWVjMTdmYzA0MjJlN2VlZmQxNDdmMmU2ZGE5MmQxMjY2OGZiNQ==
+kind: Secret
+metadata:
+  annotations:
+  name: cloudflare-api-key-secret
+  namespace: cert-manager
+type: Opaque
+---
+apiVersion: v1
+data:
+  api-token: NEpmdEMxRm5acGN4U2t2OWFWNk1QWEQ4SEN4eVlIblAyWDhCcTNxZg==
+kind: Secret
+metadata:
+  annotations:
+  name: cloudflare-api-token-secret
+  namespace: cert-manager
+type: Opaque

cert-manager/clusterissuer.yaml

@@ -0,0 +1,22 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  annotations:
+  name: letsencrypt
+spec:
+  acme:
+    email: ryancuda@protonmail.com
+    privateKeySecretRef:
+      name: acme-key
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+    - dns01:
+        cloudflare:
+          apiKeySecretRef:
+            key: api-key
+            name: cloudflare-api-key-secret
+          email: ryancuda@protonmail.com
+        cnameStrategy: Follow
+      selector:
+        dnsZones:
+        - lab.cudanet.org

cert-manager/install

@@ -0,0 +1,11 @@
+# 1. Add the official Jetstack Helm repository
+helm repo add jetstack https://charts.jetstack.io
+
+# 2. Update your local Helm chart repository cache
+helm repo update
+
+# 3. Install cert-manager and automatically create its Custom Resource Definitions (CRDs)
+helm install cert-manager jetstack/cert-manager \
+  --namespace cert-manager \
+  --create-namespace \
+  --set crds.enabled=true