init rig

rig/ctrl/addons/cert-manager.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# cert-manager plus a self-signed cluster issuer.
+#
+# In a regulated estate almost everything is TLS, so the interesting question
+# during onboarding is "does this service present a cert my client trusts" — not
+# "can I reach a public ACME server". A local CA answers that offline, which is
+# also what makes the air-gapped profile usable.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+source ./lib/config.sh
+load_config
+
+K="kubectl --context ${KUBECONTEXT}"
+
+if $K get deployment -n cert-manager cert-manager >/dev/null 2>&1; then
+    echo "  already installed"
+else
+    $K apply -f "https://github.com/cert-manager/cert-manager/releases/download/${CERT_MANAGER_VERSION}/cert-manager.yaml"
+fi
+
+echo "  waiting for cert-manager..."
+$K wait --namespace cert-manager \
+    --for=condition=ready pod --selector=app.kubernetes.io/instance=cert-manager \
+    --timeout=240s
+
+# A self-signed root, then a CA issuer chained off it. Workloads reference
+# ClusterIssuer/local-ca and get a cert from a CA you can actually distribute.
+echo "  creating local CA issuer"
+$K apply -f - <<'YAML' >/dev/null
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-root
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: local-ca
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: rig-local-ca
+  secretName: local-ca-key-pair
+  duration: 87600h
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned-root
+    kind: ClusterIssuer
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: local-ca
+spec:
+  ca:
+    secretName: local-ca-key-pair
+YAML
+
+echo "  export the CA for your browser/client with:"
+echo "    kubectl --context ${KUBECONTEXT} -n cert-manager get secret local-ca-key-pair -o jsonpath='{.data.tls\\.crt}' | base64 -d"