terraform-hcloud-kubernetes/cert_manager.tf at main · hcloud-k8s/terraform-hcloud-kubernetes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
locals {
  cert_manager_namespace = var.cert_manager_enabled ? {
    apiVersion = "v1"
    kind       = "Namespace"
    metadata = {
      name = data.helm_template.cert_manager[0].namespace
    }
  } : null

  cert_manager_values = {
    replicaCount = local.control_plane_sum > 1 ? 2 : 1
    podDisruptionBudget = {
      enabled        = true
      minAvailable   = null
      maxUnavailable = 1
    }
    topologySpreadConstraints = [
      {
        topologyKey       = "kubernetes.io/hostname"
        maxSkew           = 1
        whenUnsatisfiable = "DoNotSchedule"
        labelSelector = {
          matchLabels = {
            "app.kubernetes.io/instance"  = "cert-manager"
            "app.kubernetes.io/component" = "controller"
          }
        }
        matchLabelKeys = ["pod-template-hash"]
      },
      {
        topologyKey       = "topology.kubernetes.io/zone"
        maxSkew           = 1
        whenUnsatisfiable = "ScheduleAnyway"
        labelSelector = {
          matchLabels = {
            "app.kubernetes.io/instance"  = "cert-manager"
            "app.kubernetes.io/component" = "controller"
          }
        }
        matchLabelKeys = ["pod-template-hash"]
      }
    ],
    nodeSelector = { "node-role.kubernetes.io/control-plane" : "" }
    tolerations = [
      {
        key      = "node-role.kubernetes.io/control-plane"
        effect   = "NoSchedule"
        operator = "Exists"
      }
    ]
  }
}

data "helm_template" "cert_manager" {
  count = var.cert_manager_enabled ? 1 : 0

  name      = "cert-manager"
  namespace = "cert-manager"

  repository   = var.cert_manager_helm_repository
  chart        = var.cert_manager_helm_chart
  version      = var.cert_manager_helm_version
  kube_version = var.kubernetes_version

  values = [
    yamlencode(
      merge(
        {
          crds            = { enabled = true }
          startupapicheck = { enabled = false }
          config = {
            enableGatewayAPI = true
            featureGates = {
              # Disable the use of Exact PathType in Ingress resources, to work around a bug in ingress-nginx
              # https://github.com/kubernetes/ingress-nginx/issues/11176
              ACMEHTTP01IngressPathTypeExact = !var.ingress_nginx_enabled
            }
          }
        },
        local.cert_manager_values,
        {
          webhook = merge(
            local.cert_manager_values,
            {
              topologySpreadConstraints = [
                for constraint in local.cert_manager_values.topologySpreadConstraints :
                merge(
                  constraint,
                  {
                    labelSelector = {
                      matchLabels = {
                        "app.kubernetes.io/instance"  = "cert-manager"
                        "app.kubernetes.io/component" = "webhook"
                      }
                    }
                  }
                )
              ]
            }
          )
          cainjector = merge(
            local.cert_manager_values,
            {
              topologySpreadConstraints = [
                for constraint in local.cert_manager_values.topologySpreadConstraints :
                merge(
                  constraint,
                  {
                    labelSelector = {
                      matchLabels = {
                        "app.kubernetes.io/instance"  = "cert-manager"
                        "app.kubernetes.io/component" = "cainjector"
                      }
                    }
                  }
                )
              ]
            }
          )
        }
      )
    ),
    yamlencode(var.cert_manager_helm_values)
  ]
}

locals {
  cert_manager_manifest = var.cert_manager_enabled ? {
    name     = "cert-manager"
    contents = <<-EOF
      ${yamlencode(local.cert_manager_namespace)}
      ---
      ${data.helm_template.cert_manager[0].manifest}
    EOF
  } : null
}