last

charts/cluster-issuer/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: cluster-issuer
+description: Let's Encrypt ClusterIssuer (staging + prod) für cert-manager
+type: application
+version: 0.1.0

charts/cluster-issuer/templates/clusterissuer.yaml

@@ -0,0 +1,19 @@
+{{- range $name, $server := dict
+      "letsencrypt-staging" "https://acme-staging-v02.api.letsencrypt.org/directory"
+      "letsencrypt-prod"    "https://acme-v02.api.letsencrypt.org/directory" }}
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: {{ $name }}
+spec:
+  acme:
+    server: {{ $server }}
+    email: {{ required "email ist Pflicht" $.Values.email | quote }}
+    privateKeySecretRef:
+      name: {{ $name }}-account-key
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: {{ $.Values.ingressClass | quote }}
+{{- end }}

charts/cluster-issuer/values.yaml

@@ -0,0 +1,2 @@
+email: ""
+ingressClass: traefik

main.tf

@@ -56,6 +56,47 @@ variable "longhorn_basic_auth" {
   sensitive = true
 }
 
+# --- TLS: cert-manager + Let's Encrypt -------------------------------------
+
+# Version des cert-manager-Helm-Charts (jetstack/cert-manager), bewusst gepinnt
+variable "cert_manager_chart_version" {
+  type = string
+}
+
+# Kontakt-E-Mail für Let's Encrypt (Ablauf-Warnungen)
+variable "acme_email" {
+  type = string
+}
+
+resource "helm_release" "cert_manager" {
+  name             = "cert-manager"
+  repository       = "https://charts.jetstack.io"
+  chart            = "cert-manager"
+  version          = var.cert_manager_chart_version
+  namespace        = "cert-manager"
+  create_namespace = true
+  timeout          = 600
+  atomic           = true
+
+  values = [yamlencode({
+    crds = { enabled = true }
+  })]
+}
+
+# Eigener kleiner Chart, damit Terraform beim Plan die cert-manager-CRDs noch nicht kennen muss
+resource "helm_release" "cluster_issuer" {
+  name      = "cluster-issuer"
+  chart     = "${path.module}/charts/cluster-issuer"
+  namespace = "cert-manager"
+
+  set {
+    name  = "email"
+    value = var.acme_email
+  }
+
+  depends_on = [helm_release.cert_manager]
+}
+
 # Kein hostPort mehr -> der Talos-Standard (PSA "baseline") reicht
 resource "kubernetes_namespace" "traefik" {
   metadata {
@@ -70,11 +111,13 @@ resource "helm_release" "traefik" {
   chart      = "traefik"
   version    = var.traefik_chart_version
   namespace  = kubernetes_namespace.traefik.metadata[0].name
+  timeout    = 600
+  atomic     = true
 
   values = [yamlencode({
     deployment = { replicas = 2 }
 
-    # Je ein Pod pro Node
+    # Möglichst je ein Pod pro Node (weich: bei nur einem Worker laufen beide dort)
     topologySpreadConstraints = [{
       maxSkew           = 1
       topologyKey       = "kubernetes.io/hostname"

terraform.tfvars

@@ -3,3 +3,5 @@ traefik_chart_version = "42.3.0"
 traefik_lb_ip         = "172.25.64.200"      # gemeinsame Ingress-IP für alle Hostnamen
 longhorn_host         = "longhorn.boday-it.ch"
 # longhorn_basic_auth kommt als TF_VAR_longhorn_basic_auth aus dem Forgejo-Secret
+cert_manager_chart_version = "v1.21.0"
+acme_email                 = "info@boday-it.ch"