-
Notifications
You must be signed in to change notification settings - Fork 5
/
main.tf
87 lines (75 loc) · 3.11 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
data "azurerm_subscription" "subscription" {
subscription_id = var.subscription_id
}
resource "azurerm_user_assigned_identity" "cert_manager" {
name = "${var.names.product_group}-${var.names.subscription_type}-certmgr${local.delimiter}${var.name_identifier}"
location = var.location
resource_group_name = var.resource_group_name
tags = var.tags
}
resource "azurerm_role_definition" "cert_manager" {
for_each = var.domains
name = "${var.names.product_group}-${var.names.subscription_type}-certmgr${local.delimiter}${var.name_identifier}-${each.key}"
description = "Allow cert manager to use TXT entries for verification"
scope = data.azurerm_subscription.subscription.id
permissions {
actions = ["Microsoft.Network/dnszones/TXT/read",
"Microsoft.Network/dnszones/TXT/write",
"Microsoft.Network/dnszones/TXT/delete"]
not_actions = []
}
assignable_scopes = [data.azurerm_subscription.subscription.id]
}
resource "azurerm_role_assignment" "cert_manager" {
for_each = var.domains
scope = each.value
role_definition_id = azurerm_role_definition.cert_manager[each.key].role_definition_resource_id
principal_id = azurerm_user_assigned_identity.cert_manager.principal_id
}
module "identity" {
source = "github.com/Azure-Terraform/terraform-azurerm-kubernetes-aad-pod-identity.git///identity?ref=v1.1.0"
identity_name = azurerm_user_assigned_identity.cert_manager.name
identity_client_id = azurerm_user_assigned_identity.cert_manager.client_id
identity_resource_id = azurerm_user_assigned_identity.cert_manager.id
}
resource "helm_release" "cert_manager" {
name = var.helm_release_name
namespace = var.kubernetes_namespace
create_namespace = var.create_kubernetes_namespace
repository = "https://charts.jetstack.io"
chart = "cert-manager"
version = var.cert_manager_version
values = [
yamlencode({
installCRDs = "${var.install_crds}"
podLabels = {
aadpodidbinding = "${azurerm_user_assigned_identity.cert_manager.name}"
}
podDnsPolicy = "None"
podDnsConfig = {
nameservers = ["8.8.8.8","8.8.4.4"]
}
extraArgs = ["--enable-certificate-owner-ref=true"]
}),
var.additional_yaml_config
]
}
resource "helm_release" issuer {
depends_on = [helm_release.cert_manager]
for_each = var.issuers
name = "cert-manager-issuer-${each.key}"
namespace = each.value.namespace
chart = "${path.module}/charts/letsencrypt-acme"
values = [
yamlencode({
kind = (each.value.cluster_issuer ? "ClusterIssuer" : "Issuer")
name = "letsencrypt-acme-${each.key}"
email = each.value.email_address
server = lookup(local.le_endpoint, each.value.letsencrypt_endpoint, each.value.letsencrypt_endpoint)
secretName = "cert-manager-issuer-${each.key}"
subscriptionID = var.subscription_id
resourceGroup = var.resource_group_name
dnsZone = each.value.domain
})
]
}