commitdev · bmonkman · Apr 21, 2020 · Apr 20, 2020 · Apr 20, 2020 · Apr 20, 2020
diff --git a/kubernetes/terraform/environments/development/main.tf b/kubernetes/terraform/environments/development/main.tf
@@ -20,4 +20,7 @@ module "kubernetes" {
 
   external_dns_zone = "<% index .Params `stagingHost` %>"
   external_dns_owner_id = "<% GenerateUUID %>" # randomly generated ID
+
+  # Registration email for LetsEncrypt
+  cert_manager_acme_registration_email = "devops@<% index .Params `stagingHost` %>"
 }
diff --git a/kubernetes/terraform/environments/production/main.tf b/kubernetes/terraform/environments/production/main.tf
@@ -20,4 +20,7 @@ module "kubernetes" {
 
   external_dns_zone = "<% index .Params `productionHost` %>"
   external_dns_owner_id = "<% GenerateUUID %>" # randomly generated ID
+
+  # Registration email for LetsEncrypt
+  cert_manager_acme_registration_email = "devops@<% index .Params `productionHost` %>"
 }
diff --git a/kubernetes/terraform/environments/staging/main.tf b/kubernetes/terraform/environments/staging/main.tf
@@ -24,4 +24,7 @@ module "kubernetes" {
 
   external_dns_zone = "<% index .Params `stagingHost` %>"
   external_dns_owner_id = "<% GenerateUUID %>" # randomly generated ID
+
+  # Registration email for LetsEncrypt
+  cert_manager_acme_registration_email = "devops@<% index .Params `stagingHost` %>"
 }
diff --git a/kubernetes/terraform/modules/kubernetes/cert_manager.tf b/kubernetes/terraform/modules/kubernetes/cert_manager.tf
@@ -1,6 +1,8 @@
 locals {
-  cert_manager_namespace  = "kube-system"
-  cert_manager_version    = "0.14.2"
+  cert_manager_namespace   = "kube-system"
+  cert_manager_version     = "0.14.2"
+  cluster_issuer_name      = var.cert_manager_use_production_acme_environment ? "clusterissuer-letsencrypt-production" : "clusterissuer-letsencrypt-production"
+  cert_manager_acme_server = var.cert_manager_use_production_acme_environment ? "https://acme-v02.api.letsencrypt.org/directory" : "https://acme-staging-v02.api.letsencrypt.org/directory"
 }
 
 # Reference an existing route53 zone
@@ -24,6 +26,32 @@ resource "null_resource" "cert_manager" {
   }
 }
 
+
+# Cert-manager issuer manifest
+data "template_file" "cert_manager_issuer" {
+  template = "${file("${path.module}/files/cert_manager_issuer.yaml.tpl")}"
+  vars = {
+    name                    = local.cluster_issuer_name
+    environment             = var.environment
+    acme_registration_email = var.cert_manager_acme_registration_email
+    acme_server             = local.cert_manager_acme_server
+    region                  = var.region
+    hosted_zone_id          = data.aws_route53_zone.public.zone_id
+  }
+}
+
+# Manually kubectl apply the cert-manager issuer, as the kubernetes terraform provider
+# does not have support for custom resources.
+resource "null_resource" "cert_manager_issuer" {
+  triggers = {
+    manifest_sha1 = "${sha1("${data.template_file.cert_manager_issuer.rendered}")}"
+  }
+  provisioner "local-exec" {
+    command = "kubectl apply -f - <<EOF\n${data.template_file.cert_manager_issuer.rendered}\nEOF"
+  }
+  depends_on = [null_resource.cert_manager]
+}
+
 data "helm_repository" "jetstack" {
   name = "jetstack"
   url  = "https://charts.jetstack.io"

diff --git a/kubernetes/terraform/modules/kubernetes/files/cert_manager_issuer.yaml.tpl b/kubernetes/terraform/modules/kubernetes/files/cert_manager_issuer.yaml.tpl
@@ -0,0 +1,38 @@
+apiVersion: cert-manager.io/v1alpha2
+kind: ClusterIssuer
+metadata:
+  name: "${name}"
+spec:
+  acme:
+    server: "${acme_server}"
+    # Email address used for ACME registration
+    email: "${acme_registration_email}"
+    # Name of a secret used to store the ACME account private key
+    privateKeySecretRef:
+      name: clusterissuer-letsencrypt-${environment}-secret
+    # Enable the HTTP-01 challenge provider
+    solvers:
+      - http01:
+          ingress:
+            class: nginx
+
+---
+
+apiVersion: cert-manager.io/v1alpha2
+kind: ClusterIssuer
+metadata:
+  name: "${name}-dns"
+spec:
+  acme:
+    server: "${acme_server}"
+    # Email address used for ACME registration
+    email: "${acme_registration_email}"
+    # Name of a secret used to store the ACME account private key
+    privateKeySecretRef:
+      name: clusterissuer-letsencrypt-${environment}-secret
+    # Enable the DNS-01 challenge provider
+    solvers:
+      - dns01:
+          route53:
+            region: ${region}
+            hostedZoneID: ${hosted_zone_id}
diff --git a/kubernetes/terraform/modules/kubernetes/variables.tf b/kubernetes/terraform/modules/kubernetes/variables.tf
@@ -17,3 +17,13 @@ variable "external_dns_zone" {
 variable "external_dns_owner_id" {
   description = "Unique id of the TXT record that external-dns will use to store state (can just be a uuid)"
 }
+
+variable "cert_manager_use_production_acme_environment" {
+  description = "ACME (LetsEncrypt) Environment - only production creates valid certificates but it has lower rate limits than staging"
+  type        = bool
+  default     = true
+}
+
+variable "cert_manager_acme_registration_email" {
+  description = "Email to associate with ACME account when registering with LetsEncrypt"
+}