terraform-aws-eks-cert-manager

Terraform module for deploying Kubernetes cert-manager, cert-manager is a native Kubernetes certificate management controller. It can help with issuing certificates from a variety of sources, such as Let’s Encrypt, HashiCorp Vault, Venafi, a simple signing key pair, or self signed.

Usage

module "cert_manager" {
  source = "git::https://github.com/DNXLabs/terraform-aws-eks-cert-manager.git"

  enabled = true

  cluster_name                     = module.eks_cluster.cluster_id
  cluster_identity_oidc_issuer     = module.eks_cluster.cluster_oidc_issuer_url
  cluster_identity_oidc_issuer_arn = module.eks_cluster.oidc_provider_arn

  dns01 = [
    {
      name           = "letsencrypt-staging"
      namespace      = "default"
      kind           = "ClusterIssuer"
      dns_zone       = "example.com"
      region         = "us-east-1" # data.aws_region.current.name
      secret_key_ref = "letsencrypt-staging"
      acme_server    = "https://acme-staging-v02.api.letsencrypt.org/directory"
      acme_email     = "your@email.com"
    },
    {
      name           = "letsencrypt-prod"
      namespace      = "default"
      kind           = "ClusterIssuer"
      dns_zone       = "example.com"
      region         = "us-east-1" # data.aws_region.current.name
      secret_key_ref = "letsencrypt-prod"
      acme_server    = "https://acme-v02.api.letsencrypt.org/directory"
      acme_email     = "your@email.com"
    }
  ]

  # In case you want to use HTTP01 challenge method uncomment this section
  # and comment dns01 variable
  # http01 = [
  #   {
  #     name           = "letsencrypt-staging"
  #     kind           = "ClusterIssuer"
  #     ingress_class  = "nginx"
  #     secret_key_ref = "letsencrypt-staging"
  #     acme_server    = "https://acme-staging-v02.api.letsencrypt.org/directory"
  #     acme_email     = "your@email.com"
  #   },
  #   {
  #     name           = "letsencrypt-prod"
  #     kind           = "ClusterIssuer"
  #     ingress_class  = "nginx"
  #     secret_key_ref = "letsencrypt-prod"
  #     acme_server    = "https://acme-v02.api.letsencrypt.org/directory"
  #     acme_email     = "your@email.com"
  #   }
  # ]

  # In case you want to create certificates uncomment this block
  # certificates = [
  #   {
  #     name           = "example-com"
  #     namespace      = "default"
  #     kind           = "ClusterIssuer"
  #     secret_name    = "example-com-tls"
  #     issuer_ref     = "letsencrypt-prod"
  #     dns_name       = "*.example.com"
  #   }
  # ]
}

ingress.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
    kubernetes.io/tls-acme: "true"
    cert-manager.io/cluster-issuer: letsencrypt-prod # This should match the ClusterIssuer created
    # cert-manager.io/issuer: letsencrypt-prod # In case you choose Issuer instead of ClusterIssuer
  labels:
    app: app
spec:
  rules:
  - host: app.example.com
    http:
      paths:
        - path: /*
          backend:
            serviceName: service
            servicePort: 80
  tls:
    - hosts:
        # - "*.example.com" # Example of wildcard
        - app.example.com
      secretName: app-example-com-prod-tls

Detached Wildcard Certificate

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-com
  namespace: default
spec:
  secretName: example-com-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - '*.example.com'

Decoding the Secret

You can check for any existing resources with the following command:

kubectl get Issuers,ClusterIssuers,Certificates,CertificateRequests,Orders,Challenges --all-namespaces

To view the contents of the Secret we just created, you can run the following command:

kubectl get secret example-com-tls -o jsonpath='{.data}'

Now you can decode the tls.key or tls.crt data:

echo 'MWYyZDFlMmU2N2Rm' | base64 -d

Requirements

Providers

Inputs

list(object({
    name        = string
    namespace   = string
    secret_name = string
    issuer_ref  = string
    kind        = string
    dns_name    = string
  }))

list(object({
    name           = string
    namespace      = string
    kind           = string
    dns_zone       = string
    region         = string
    secret_key_ref = string
    acme_server    = string
    acme_email     = string
  }))

list(object({
    name           = string
    kind           = string
    ingress_class  = string
    secret_key_ref = string
    acme_server    = string
    acme_email     = string
  }))

Outputs

No output.

Authors

Module managed by DNX Solutions.

License

Apache 2 Licensed. See LICENSE for full details.