Add letsencrypt

06-cert-manager/README.md

@@ -8,11 +8,27 @@ Install cert-manager - check for latest version.
 kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.3/cert-manager.yaml
 ```
 
-After cert manager is installed, create the Let's Encrypt issuer:
+After cert manager is installed, create API tokens (not keys, but tokens) on cloudflare (User Profile > API Tokens > API Tokens) with permissions:
+
+Permissions:
+
+* Zone - DNS - Edit
+* Zone - Zone - Read
+
+Zone Resources:
+
+* Include - All Zones
+
+Configure a the API token as a secret in Kubernetes and replace the <APITOKEN> in the below command with the token from cloudflare.
+
+```bash
+kubectl create secret generic cloudflare-api-token-secret --namespace=cert-manager --type=Opaque --from-literal=api-token=<APIKEY>
+```
+
+Create the Let's Encrypt ClusterIssuer:
 
 ```yaml
 
 # Be sure to edit the file and set the production URL if not a test cluster
 kubectl apply -f lets-encrypt-issuer.yaml
 ```
-

06-cert-manager/lets-encrypt-issuer.yaml

@@ -1,14 +1,13 @@
 apiVersion: cert-manager.io/v1
-kind: Issuer
+kind: ClusterIssuer
 metadata:
   name: letsencrypt
-  namespace: default
 spec:
   acme:
     # The ACME server URL
     # production is https://acme-v02.api.letsencrypt.org/directory
     # stagiong is https://acme-staging-v02.api.letsencrypt.org/directory
-    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    server: https://acme-v02.api.letsencrypt.org/directory
     # Email address used for ACME registration
     email: himself@stevenpolley.net
     # Name of a secret used to store the ACME account private key
@@ -18,6 +17,8 @@ spec:
     solvers:
     # An empty 'selector' means that this solver matches all domains
     - selector: {}
-      http01:
-        ingress:
-          ingressClassName: nginx
+      dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token-secret
+            key: api-token