mrwho
0194a6fc0e
Replace manual TLS secret creation with cert-manager Certificate resources and automatic secret provisioning, enabling dynamic certificate issuance from Let's Encrypt while improving infrastructure reliability and reducing operational overhead.
46 lines
1.8 KiB
YAML
46 lines
1.8 KiB
YAML
---
|
|
- name: Helm | Add Jetstack chart repository
|
|
ansible.builtin.command: helm repo add jetstack https://jetstack.io
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _helm_repo_add
|
|
changed_when: "'already exists' not in _helm_repo_add.stdout"
|
|
failed_when: _helm_repo_add.rc != 0 and 'already exists' not in _helm_repo_add.stdout
|
|
|
|
- name: Helm | Update chart repositories
|
|
ansible.builtin.command: helm repo update
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
changed_when: false
|
|
|
|
- name: Helm | Install or upgrade cert-manager CRDs
|
|
ansible.builtin.command: >
|
|
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/{{ cert_manager_crds_version }}/cert-manager.crds.yaml
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _cert_manager_crds
|
|
changed_when: false
|
|
failed_when: _cert_manager_crds.rc != 0
|
|
|
|
- name: Helm | Install or upgrade cert-manager
|
|
ansible.builtin.command: >
|
|
helm repo update && helm upgrade --install cert-manager jetstack/cert-manager
|
|
--namespace {{ cert_manager_namespace }}
|
|
--create-namespace
|
|
{% if cert_manager_chart_version is defined and cert_manager_chart_version | length > 0 %}
|
|
--version {{ cert_manager_chart_version }}
|
|
{% endif %}
|
|
{% if cert_manager_args is defined and cert_manager_args | length > 0 %}
|
|
--set args[0]={{ cert_manager_args[0] }}
|
|
{% endif %}
|
|
--timeout 10m0s
|
|
--wait
|
|
environment:
|
|
KUBECONFIG: "{{ cert_manager_kubeconfig }}"
|
|
PATH: "/usr/local/bin:/usr/bin:/bin"
|
|
register: _helm_install
|
|
changed_when: "'STATUS: deployed' in _helm_install.stdout or 'has been upgraded' in _helm_install.stdout"
|