integrated cluster issuer to appsec chart

Author: mkol5222

CHANGELOG.md

@@ -0,0 +1 @@
+* appsec 0.1.1 - 2024-03-07: integration of Lets encrypt cluster issuer

README.md

@@ -25,18 +25,12 @@ newgrp microk8s
 # setup user profile
 . <(curl -s https://raw.githubusercontent.com/mkol5222/appsec-chart/main/setup-user.sh)
 
-# ready to deploy certificate issuer with HTTP-01 solver - FOCUS ON EMAIL ADDRESS!!!
-#
-#
-#
-MY_EMAIL_ADDRESS="[email protected]" # REPLACE
-helm install letsencrypt https://github.com/mkol5222/appsec-chart/releases/download/certs-0.1.0/certs-0.1.0.tgz --set letsencrypt.email=$MY_EMAIL_ADDRESS
-
 
 # ready to deploy AppSec WAF - FOCUS ON INPUTS AND DNS RECORD!!!
 #
 #
 #
+MY_EMAIL_ADDRESS="[email protected]" # REPLACE
 APPSEC_TOKEN=cp-abc123... # REPLACE WITH REAL TOKEN from Infinity Portal
 APPSEC_HOSTNAME=appsec1492.klaud.online # REPLACE
 
@@ -47,7 +41,7 @@ echo "Make sure DNS recort for $APPSEC_HOSTNAME points to $VMPUBLICIP"
 sudo resolvectl flush-caches 
 dig +short $APPSEC_HOSTNAME
 
-helm install appsec https://github.com/mkol5222/appsec-chart/releases/download/appsec-0.1.0/appsec-0.1.0.tgz --set cptoken=$APPSEC_TOKEN --set hostname=$APPSEC_HOSTNAME
+helm install appsec https://github.com/mkol5222/appsec-chart/releases/download/appsec-0.1.1/appsec-0.1.1.tgz --set cptoken=$APPSEC_TOKEN --set hostname=$APPSEC_HOSTNAME --set letsencrypt.email=$MY_EMAIL_ADDRESS
 
 # monitor appsec and http-01 solver
 k get po --watch

charts/appsec/Chart.yaml

@@ -2,5 +2,5 @@ apiVersion: v2
 name: appsec
 description: Simple deployment of CloudGuard WAF with HTTPS and certs
 type: application
-version: 0.1.0
+version: 0.1.1
 appVersion: "1.0.1"

charts/appsec/templates/issuer.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+ name: lets-encrypt
+spec:
+ acme:
+   email: {{ .Values.letsencrypt.email }}
+   server: https://acme-v02.api.letsencrypt.org/directory
+   privateKeySecretRef:
+     # Secret resource that will be used to store the account's private key.
+     name: {{ default "lets-encrypt-priviate-key" .Values.letsencrypt.secret }}
+   # Add a single challenge solver, HTTP01 using nginx
+   solvers:
+   - http01:
+       ingress:
+         class: public

charts/appsec/values.yaml

@@ -1,4 +1,12 @@
 
 # hostname to publish to
 hostname: "web1492.klaud.online"
-cptoken:
+cptoken:
+
+# Lets encrypt cluster issuer
+
+letsencrypt:
+  # Lets encrypt certificate issuer user
+  email: "[email protected]"
+  # secret used to store Lets encrypt account's private key
+  secret: lets-encrypt-priviate-key