From c0c75d1bbb39685e560e12815dfa0af9f49b153c Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Sun, 2 Aug 2026 17:47:39 +1000 Subject: [PATCH] Add Let's Encrypt RFC2136/TSIG ClusterIssuers (#327) Publicly-trusted wildcard certs via Let's Encrypt DNS-01, solved over RFC2136/TSIG against our own BIND. A one-time CNAME self-delegates `_acme-challenge.unkin.net` into the `acme.unkin.net` zone served by bind-external; cert-manager writes the challenge TXT there. No GCP/clouddns and no Vault secret involved. The existing `vault-issuer` (internal PKI) is untouched. - Add ClusterIssuers `letsencrypt` (prod) and `letsencrypt-staging`, both using a dns01 rfc2136 solver: nameserver `198.18.199.53:53`, key `certmanager`, HMACSHA256, `tsigSecretSecretRef` -> reflected Secret `certmanager-tsig` key `secret`. - Whitelist `cert-manager.io ClusterIssuer` in the platform AppProject. Depends on #329 (bind-external: the acme.unkin.net zone, the certmanager TSIG key reflected into cert-manager, and the 198.18.199.53 nameserver) and on the one-time Google Cloud DNS delegation + NAT of the public IP :53 to 198.18.199.53. Earlier clouddns/Vault commits on this branch are reverted. --------- Co-authored-by: Ben Vincent Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/327 Co-authored-by: Ben Vincent Co-committed-by: Ben Vincent --- .../clusterissuer_letsencrypt-staging.yaml | 20 +++++++++++++++++++ .../clusterissuer_letsencrypt.yaml | 20 +++++++++++++++++++ apps/base/cert-manager/kustomization.yaml | 2 ++ argocd/projects/platform.yaml | 2 ++ 4 files changed, 44 insertions(+) create mode 100644 apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml create mode 100644 apps/base/cert-manager/clusterissuer_letsencrypt.yaml diff --git a/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml b/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml new file mode 100644 index 0000000..03e7600 --- /dev/null +++ b/apps/base/cert-manager/clusterissuer_letsencrypt-staging.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + email: admin@unkin.net + privateKeySecretRef: + name: letsencrypt-staging-account-key + solvers: + - dns01: + rfc2136: + nameserver: "198.18.199.53:53" + tsigKeyName: certmanager + tsigAlgorithm: HMACSHA256 + tsigSecretSecretRef: + name: certmanager-tsig + key: secret diff --git a/apps/base/cert-manager/clusterissuer_letsencrypt.yaml b/apps/base/cert-manager/clusterissuer_letsencrypt.yaml new file mode 100644 index 0000000..b2950c7 --- /dev/null +++ b/apps/base/cert-manager/clusterissuer_letsencrypt.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + email: admin@unkin.net + privateKeySecretRef: + name: letsencrypt-account-key + solvers: + - dns01: + rfc2136: + nameserver: "198.18.199.53:53" + tsigKeyName: certmanager + tsigAlgorithm: HMACSHA256 + tsigSecretSecretRef: + name: certmanager-tsig + key: secret diff --git a/apps/base/cert-manager/kustomization.yaml b/apps/base/cert-manager/kustomization.yaml index f1fcada..33e1bc4 100644 --- a/apps/base/cert-manager/kustomization.yaml +++ b/apps/base/cert-manager/kustomization.yaml @@ -8,3 +8,5 @@ resources: - clusterrole.yaml - clusterrolebinding.yaml - vmservicescrape.yaml + - clusterissuer_letsencrypt.yaml + - clusterissuer_letsencrypt-staging.yaml diff --git a/argocd/projects/platform.yaml b/argocd/projects/platform.yaml index 1eabece..da8742d 100644 --- a/argocd/projects/platform.yaml +++ b/argocd/projects/platform.yaml @@ -84,6 +84,8 @@ spec: kind: Certificate - group: 'cert-manager.io' kind: Issuer + - group: 'cert-manager.io' + kind: ClusterIssuer - group: 'gateway.networking.k8s.io' kind: GatewayClass - group: 'networking.k8s.io'