67 lines
2.1 KiB
YAML
67 lines
2.1 KiB
YAML
- name: Install cert-manager
|
|
shell: kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.4/cert-manager.yaml
|
|
|
|
- name: Wait for cert-manager pods to be ready
|
|
shell: kubectl wait --for=condition=ready --timeout=300s pod -l app.kubernetes.io/instance=cert-manager -n cert-manager
|
|
|
|
- name: Wait for webhook endpoint to be ready
|
|
shell: |
|
|
for i in {1..30}; do
|
|
if kubectl get endpoints cert-manager-webhook -n cert-manager -o jsonpath='{.subsets[*].addresses[*].ip}' | grep -q .; then
|
|
echo "Webhook endpoint is ready"
|
|
exit 0
|
|
fi
|
|
echo "Waiting for webhook endpoint... attempt $i/30"
|
|
sleep 2
|
|
done
|
|
exit 1
|
|
|
|
- name: Test webhook connectivity
|
|
shell: kubectl run test-webhook --image=curlimages/curl:latest --rm -i --restart=Never -- curl -k https://cert-manager-webhook.cert-manager.svc:443/healthz
|
|
register: webhook_test
|
|
ignore_errors: yes
|
|
|
|
- name: Display webhook test result
|
|
debug:
|
|
var: webhook_test
|
|
|
|
- name: ClusterIssuer
|
|
copy:
|
|
dest: /root/cluster-issuer-prod.yaml
|
|
content: |
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-prod
|
|
spec:
|
|
acme:
|
|
- name: ClusterIssuer
|
|
copy:
|
|
dest: /root/cluster-issuer-prod.yaml
|
|
content: |
|
|
apiVersion: cert-manager.io/v1
|
|
kind: ClusterIssuer
|
|
metadata:
|
|
name: letsencrypt-prod
|
|
spec:
|
|
acme:
|
|
email: admin@betelgeusebytes.io
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
privateKeySecretRef:
|
|
name: letsencrypt-prod-key
|
|
solvers:
|
|
- http01:
|
|
ingress:
|
|
class: nginx
|
|
|
|
- name: Temporarily disable cert-manager webhook
|
|
shell: |
|
|
kubectl delete validatingwebhookconfiguration cert-manager-webhook || true
|
|
ignore_errors: yes
|
|
|
|
- name: Apply ClusterIssuer
|
|
command: kubectl apply -f /root/cluster-issuer-prod.yaml
|
|
|
|
- name: Reinstall cert-manager to restore webhook
|
|
shell: kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.4/cert-manager.yaml
|