Add cert-manager with Cloudflare DNS-01 ClusterIssuers

2026-09-03 05:03:10 +01:00
parent e6a42a39a8
commit 4affbaf973
7 changed files with 255 additions and 2 deletions
@@ -0,0 +1,23 @@
+# Let's Encrypt's real, publicly-trusted production environment. Switch an
+# Ingress to this one only after confirming the same hostname worked
+# against letsencrypt-staging (see clusterissuer-staging.yaml) — production
+# has much stricter rate limits, and a repeated mistake here can lock you
+# out of requesting real certificates for that hostname for a while.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: certs@ahmza.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token
@@ -0,0 +1,26 @@
+# Let's Encrypt's staging environment: unlimited (well, generous) request
+# limits, but its certificates are not trusted by browsers. Use this one
+# first to prove the whole DNS-01/Cloudflare flow actually works, without
+# risking Let's Encrypt's much stricter production rate limits on a typo.
+#
+# sync-wave "1" defers this until cert-manager's own chart resources
+# (wave "0" by default, including its CRDs) are synced and healthy — same
+# reasoning as apps/metallb/templates/*.
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: certs@ahmza.com
+    privateKeySecretRef:
+      name: letsencrypt-staging-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key: api-token