WIP: create dedicated app for cert-manager

bootstrap/helm/bootstrap/templates/issuer.yaml

@@ -1,5 +1,4 @@
-{{ if index $.Values "cert-manager" "enabled" }}
-{{   if empty .Values.acmeServer }}
+{{- if empty .Values.acmeServer }}
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
@@ -13,7 +12,7 @@ metadata:
   name: letsencrypt-staging
 spec:
   selfSigned: {}
-{{   else }}
+{{- else }}
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
@@ -25,14 +24,14 @@ spec:
     # certificates, and issues related to your account.
     email: {{ .Values.ownerEmail }}
     server: {{ .Values.acmeServer }}
-    {{ if .Values.acmeEAB.kid }}
+    {{- if .Values.acmeEAB.kid }}
     externalAccountBinding:
       keyID: {{ .Values.acmeEAB.kid }}
       keySecretRef:
         name: acme-eab-secret
         key: eab-secret
       keyAlgorithm: HS256
-    {{ end }}
+    {{- end }}
     privateKeySecretRef:
       # Secret resource that will be used to store the account's private key.
       name: cert-manager-key
@@ -60,5 +59,4 @@ spec:
     - http01:
         ingress:
           class: nginx
-{{   end }}
-{{ end }}
+{{- end }}

bootstrap/helm/bootstrap/values.yaml.tpl

@@ -4,6 +4,7 @@
 {{ if eq .Provider "google" }}
   {{ $_ := set $providerArgs "provider" "gcp" }}
 {{ end }}
+{{ $certManager := chartInstalled "cert-manager" "cert-manager" }}
 
 external-dns:
   {{ if $pluraldns }}
@@ -146,50 +147,39 @@ snapshot-controller:
 {{- end}}
 {{ end }}
 
-{{ if $pluraldns }}
+
 dnsSolver:
+  {{- if $pluraldns }}
   webhook:
     groupName: acme.plural.sh
     solverName: plural-solver
     config:
       cluster: {{ $providerArgs.cluster }}
       provider: {{ $providerArgs.provider }}
-{{ end }}
-
-{{ if eq .Provider "aws" }}
-cert-manager:
-  serviceAccount:
-    create: true
-    name: certmanager
-    annotations:
-      eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Project }}:role/{{ .Cluster }}-certmanager"
-
-{{ if not $pluraldns }}
-dnsSolver:
+  {{- else if eq .Provider "aws" }}
   route53:
     region: {{ .Region }}
-{{ end }}
-{{ end }}
-
-{{ if and (not $pluraldns) (eq .Provider "azure") }}
-dnsSolver:
+  {{- else if $isGcp }}
+  cloudDNS:
+    project: {{ .Project }}
+  {{- else if eq .Provider "azure" }}
   azureDNS:
     subscriptionID: {{ .Context.SubscriptionId }}
     resourceGroupName: {{ .Project }}
     hostedZoneName: {{ .Network.Subdomain }}
     # Azure Cloud Environment, default to AzurePublicCloud
     environment: AzurePublicCloud
-{{ end }}
+  {{- end }}
 
-{{ if $isGcp }}
 cert-manager:
+  {{- if $certManager }}
+  enabled: false
+  {{- end }}
   serviceAccount:
+    {{- if $isGcp }}
     create: false
-    name: certmanager
-
-{{ if not $pluraldns }}
-dnsSolver:
-  cloudDNS:
-    project: {{ .Project }}
-{{ end }}
-{{ end }}
+    {{- end }}
+    {{- if eq .Provider "aws" }}
+    annotations:
+      eks.amazonaws.com/role-arn: "arn:aws:iam::{{ .Project }}:role/{{ .Cluster }}-certmanager"
+    {{- end }}

cert-manager/Pluralfile

@@ -0,0 +1,6 @@
+REPO cert-manager
+ATTRIBUTES Plural repository.yaml
+
+TF terraform/*
+HELM helm/*
+RECIPE plural/recipes/*

cert-manager/helm/cert-manager/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

cert-manager/helm/cert-manager/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: cert-manager
+  repository: https://charts.jetstack.io
+  version: v1.12.4
+digest: sha256:a50e8a0a20bdc42f2fc82da344210c49ac5b1d0c11b44d954f41671a332c2e17
+generated: "2023-09-05T16:02:34.692637+02:00"

cert-manager/helm/cert-manager/Chart.yaml

@@ -0,0 +1,11 @@
+apiVersion: v2
+name: cert-manager
+description: helm chart for cert-manager
+type: application
+version: 0.1.2
+appVersion: v1.12.4
+dependencies:
+- name: cert-manager
+  version: v1.12.4
+  repository: https://charts.jetstack.io
+  condition: cert-manager.enabled

cert-manager/helm/cert-manager/README.md

@@ -0,0 +1 @@
+A helm chart for cert-manager