feat: Add cert-manager installation with ClusterIssuers and TLS certificates for telecom platform

- Add cert-manager namespace with certificates component labels and telecom-platform integration
- Add cert-manager ServiceAccount with RBAC ClusterRole for secrets, ingresses, certificates, issuers, ACME challenges
- Add ClusterRoleBinding associating cert-manager ServiceAccount with ClusterRole
- Add cert-manager Deployment with v1.12.0 controller image, metrics port 9402, default issuer telecom-platform-ca
- Add cert-manager Service expos

deployments/cert-manager/cert-manager-install.yaml

@@ -0,0 +1,263 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  labels:
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+  labels:
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: cert-manager
+  labels:
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  - events
+  verbs:
+  - create
+  - update
+  - patch
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses/status
+  verbs:
+  - update
+  - patch
+- apiGroups:
+  - cert-manager.io
+  resources:
+  - certificates
+  - certificaterequests
+  - issuers
+  - clusterissuers
+  verbs:
+  - create
+  - update
+  - patch
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - cert-manager.io
+  resources:
+  - certificates/status
+  - certificaterequests/status
+  - issuers/status
+  - clusterissuers/status
+  verbs:
+  - update
+  - patch
+- apiGroups:
+  - acme.cert-manager.io
+  resources:
+  - challenges
+  - orders
+  verbs:
+  - create
+  - update
+  - patch
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - acme.cert-manager.io
+  resources:
+  - challenges/status
+  - orders/status
+  verbs:
+  - update
+  - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cert-manager
+  labels:
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cert-manager
+subjects:
+- kind: ServiceAccount
+  name: cert-manager
+  namespace: cert-manager
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+  labels:
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: cert-manager
+      app.kubernetes.io/component: certificates
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: cert-manager
+        app.kubernetes.io/component: certificates
+    spec:
+      serviceAccountName: cert-manager
+      containers:
+      - name: cert-manager
+        image: quay.io/jetstack/cert-manager-controller:v1.12.0
+        ports:
+        - containerPort: 9402
+          name: metrics
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: SERVICE_ACCOUNT_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.serviceAccountName
+        args:
+        - --v=2
+        - --cluster-resource-namespace=$(POD_NAMESPACE)
+        - --leader-election-namespace=$(POD_NAMESPACE)
+        - --default-issuer-name=telecom-platform-ca
+        - --default-issuer-kind=ClusterIssuer
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+          limits:
+            cpu: 100m
+            memory: 128Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+  labels:
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  ports:
+  - port: 9402
+    name: metrics
+    targetPort: 9402
+  selector:
+    app.kubernetes.io/name: cert-manager
+    app.kubernetes.io/component: certificates
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: telecom-platform-ca
+  labels:
+    app.kubernetes.io/name: telecom-platform-ca
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  ca:
+    secretName: telecom-platform-ca-secret
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+  labels:
+    app.kubernetes.io/name: letsencrypt-staging
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    solvers:
+    - http01:
+        ingress:
+          class: istio
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  labels:
+    app.kubernetes.io/name: letsencrypt-prod
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: [email protected]
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+    - http01:
+        ingress:
+          class: istio

deployments/cert-manager/certificates.yaml

@@ -0,0 +1,123 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: telecom-platform-tls
+  namespace: telecom-platform
+  labels:
+    app.kubernetes.io/name: telecom-platform-tls
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  secretName: telecom-platform-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - api.telecom.local
+  - dashboard.telecom.local
+  - grafana.telecom.local
+  - prometheus.telecom.local
+  - kibana.telecom.local
+  - vault.telecom.local
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: telecom-platform-api-tls
+  namespace: telecom-platform
+  labels:
+    app.kubernetes.io/name: telecom-platform-api-tls
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  secretName: telecom-platform-api-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - api.telecom.local
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: telecom-platform-dashboard-tls
+  namespace: telecom-platform
+  labels:
+    app.kubernetes.io/name: telecom-platform-dashboard-tls
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  secretName: telecom-platform-dashboard-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - dashboard.telecom.local
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: telecom-platform-grafana-tls
+  namespace: telecom-platform
+  labels:
+    app.kubernetes.io/name: telecom-platform-grafana-tls
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  secretName: telecom-platform-grafana-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - grafana.telecom.local
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: telecom-platform-prometheus-tls
+  namespace: telecom-platform
+  labels:
+    app.kubernetes.io/name: telecom-platform-prometheus-tls
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  secretName: telecom-platform-prometheus-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - prometheus.telecom.local
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: telecom-platform-kibana-tls
+  namespace: telecom-platform
+  labels:
+    app.kubernetes.io/name: telecom-platform-kibana-tls
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  secretName: telecom-platform-kibana-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - kibana.telecom.local
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: telecom-platform-vault-tls
+  namespace: vault
+  labels:
+    app.kubernetes.io/name: telecom-platform-vault-tls
+    app.kubernetes.io/component: certificates
+    app.kubernetes.io/part-of: telecom-platform
+spec:
+  secretName: telecom-platform-vault-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+  - vault.telecom.local