Last active
March 20, 2023 09:09
-
-
Save TylerWanner/c06dd59cd78b9f6b61252b3a19bddf55 to your computer and use it in GitHub Desktop.
Cert-Manager CRDs for Linkerd Identity
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
terraform { | |
backend "local" { | |
path = "../states/cm_crds.tfstate" | |
} | |
} | |
data "terraform_remote_state" "cluster" { | |
backend = "local" | |
config = { | |
path = "../states/cluster.tfstate" | |
} | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
resource "tls_private_key" "root" { | |
algorithm = "ECDSA" | |
ecdsa_curve = "P256" | |
} | |
resource "tls_self_signed_cert" "root" { | |
key_algorithm = tls_private_key.root.algorithm | |
private_key_pem = tls_private_key.root.private_key_pem | |
validity_period_hours = 87600 | |
early_renewal_hours = 2190 | |
is_ca_certificate = true | |
allowed_uses = [ | |
"cert_signing", | |
"key_encipherment", | |
] | |
subject { | |
common_name = "identity.linkerd.cluster.local" | |
} | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
resource "kubernetes_manifest" "issuer" { | |
manifest = yamldecode(file("l5d_issuer.yaml")) | |
} | |
resource "kubernetes_manifest" "certificate" { | |
manifest = yamldecode(file("l5d_id_certificate.yaml")) | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
apiVersion: cert-manager.io/v1 | |
kind: Certificate | |
metadata: | |
name: linkerd-identity-issuer | |
namespace: linkerd | |
spec: | |
secretName: linkerd-identity-issuer | |
duration: 48h0m0s | |
renewBefore: 25h0m0s | |
issuerRef: | |
name: linkerd-trust-anchor | |
kind: Issuer | |
commonName: identity.linkerd.cluster.local | |
dnsNames: | |
- identity.linkerd.cluster.local | |
isCA: true | |
privateKey: | |
algorithm: ECDSA | |
usages: | |
- cert sign | |
- crl sign | |
- server auth | |
- client auth |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
apiVersion: cert-manager.io/v1 | |
kind: Issuer | |
metadata: | |
name: linkerd-trust-anchor | |
namespace: linkerd | |
spec: | |
ca: | |
secretName: linkerd-trust-anchor |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
provider null {} | |
provider tls {} | |
provider google {} | |
data "google_client_config" "default" {} | |
provider kubernetes { | |
host = "https://${data.terraform_remote_state.cluster.outputs.cluster_endpoint}" | |
token = data.google_client_config.default.access_token | |
cluster_ca_certificate = base64decode(data.terraform_remote_state.cluster.outputs.cacert) | |
experiments { | |
manifest_resource = true | |
} | |
} | |
output cert { | |
value = tls_self_signed_cert.root.cert_pem | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
resource "kubernetes_namespace" "linkerd" { | |
metadata { | |
name = "linkerd" | |
annotations = { | |
"linkerd.io/inject" = "disabled" | |
} | |
labels = { | |
"config.linkerd.io/admission-webhooks" = "disabled" | |
} | |
} | |
} | |
resource "kubernetes_secret" "linkerd" { | |
metadata { | |
name = "linkerd-trust-anchor" | |
namespace = kubernetes_namespace.linkerd.metadata[0].name | |
} | |
data = { | |
"tls.crt" = tls_self_signed_cert.root.cert_pem | |
"tls.key" = tls_private_key.root.private_key_pem | |
} | |
type = "kubernetes.io/tls" | |
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
terraform { | |
required_providers { | |
google = { | |
source = "hashicorp/google" | |
version = "3.85.0" | |
} | |
helm = { | |
source = "hashicorp/helm" | |
version = "2.3.0" | |
} | |
kubernetes = { | |
source = "hashicorp/kubernetes" | |
version = "2.5.0" | |
} | |
tls = { | |
source = "hashicorp/tls" | |
version = "> 3" | |
} | |
} | |
required_version = ">= 1" | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment